ISP ISP Personnel Security & Insider Threats 2

Question 1

The 'need-to-know' principle in personnel security means:

Accepted Answer

Access to specific information is granted only when operationally necessary for assigned duties

Answer

Need-to-know limits access to information to only what is required for a person to perform their specific job functions.

Question 2

Which process is used to verify that employees only retain access rights appropriate to their current role?

Accepted Answer

Access recertification or entitlement review

Answer

Access recertification (entitlement review) is the formal process of confirming that each user's permissions still match their job requirements.

Question 3

When an employee is terminated, which security action should be taken IMMEDIATELY?

Accepted Answer

Revoking all logical and physical access simultaneously upon departure

Answer

Simultaneous revocation of all access upon termination prevents a departing employee from exfiltrating data or entering the facility.

Question 4

Social engineering targeting employees is BEST countered by:

Accepted Answer

Ongoing security awareness training and clear reporting procedures

Answer

Awareness training equips employees to recognize social engineering tactics and empowers them to report suspicious contacts.

Question 5

What does 'two-person integrity' (TPI) primarily protect against in a personnel security context?

Accepted Answer

A single insider acting alone to commit theft or sabotage of critical assets

Answer

TPI requires two authorized individuals to be present during access to sensitive areas or materials, preventing unilateral insider action.

(ISP) Industrial Security Professional Certification Practice Test