Which of the following governance bodies directs and coordinates implementations of the information security program?

• A.Chief Information Security Officer
• B.Information Security Steering Committee
• C.Business Unit Manager
• D.Senior Management

Correct Answer: A

Explanation/Reference:
Explanation: Chief Information Security Officer directs and coordinates implementations of the information security program. The governance roles and responsibilities are mentioned below in the table:

Comment: *

Name: *

Email: *

Verification: *

Which of the following security objectives are defined for information and information systems by the FISMA? Each correct answer represents a part of the solution. Choose all that apply.

• A.Authenticity
• B.Availability
• C.Integrity
• D.Confidentiality

Comment: *

Name: *

Email: *

Verification: *

Which of the following test methods has the objective to test the IT system from the viewpoint of a threat-source and to identify potential failures in the IT system protection schemes?

• A.Security Test and Evaluation (ST&E)
• B.Penetration testing
• C.Automated vulnerability scanning tool
• D.On-site interviews

Comment: *

Name: *

Email: *

Verification: *

Which of the following NIST documents provides a guideline for identifying an information system as a National Security System?

• A.NIST SP 800-37
• B.NIST SP 800-59
• C.NIST SP 800-53
• D.NIST SP 800-60
• E.NIST SP 800-53A

Comment: *

Name: *

Email: *

Verification: *

Which of the following security architectures defines how to integrate widely disparate applications for a world that is Web-based and uses multiple implementation platforms?

• A.Sherwood Applied Business Security Architecture
• B.Enterprise architecture
• C.Service-oriented architecture
• D.Service-oriented modeling and architecture

Correct Answer: C

Explanation/Reference:
Explanation: In computing, a service-oriented architecture (SOA) is a flexible set of design principles used during the phases of systems development and integration. A deployed SOA-based architecture will provide a loosely-integrated suite of services that can be used within multiple business domains. SOA also generally provides a way for consumers of services, such as web-based applications, to be aware of available SOA-based services. For example, several disparate departments within a company may develop and deploy SOA services in different implementation languages; their respective clients will benefit from a well understood, well defined interface to access them. XML is commonly used for interfacing with SOA services, though this is not required. SOA defines how to integrate widely disparate applications for a world that is Web-based and uses multiple implementation platforms. Rather than defining an API, SOA defines the interface in terms of protocols and functionality. An endpoint is the entry point for such an SOA implementation.

(Layer interaction in Service-oriented architecture) AnswerA is incorrect. SABSA (Sherwood Applied Business Security Architecture) is a framework and methodology for Enterprise Security Architecture and Service Management. SABSA is a model and a methodology for developing risk-driven enterprise information security architectures and for delivering security infrastructure solutions that support critical business initiatives. The primary characteristic of the SABSA model is that everything must be derived from an analysis of the business requirements for security, especially those in which security has an enabling function through which new business opportunities can be developed and exploited. AnswerD is incorrect. The service-oriented modeling and architecture (SOMA) includes an analysis and design method that extends traditional object-oriented and component-based analysis and design methods to include concerns relevant to and supporting SOA. AnswerB is incorrect. Enterprise architecture describes the terminology, the composition of subsystems, and their relationships with the external environment, and the guiding principles for the design and evolution of an enterprise.

Comment: *

Name: *

Email: *

Verification: *