1. Time Based 2. What is the significance of obtaining a Non-Disclosure Agreement from third parties? To ensure the confidentiality of company data that they may have access to 3. Which two major cities have conducted full-scale simulations of bioterror and nuke attacks? New york and DC 4. What kind of facilities are specified in the physical security perimeter control? All information processing facilities 5. Which of the following best represents the principle of “economy of mechanism?” run only the services and applications necessary to perform the desired function 6. What is the primary goal of establishing incident management responsibilities and procedures? Ensuring an effective response to security investigations. 7. An organization has implemented a Windows environment with Active Directory. They have set up groups with limited access for each department, such as Human Resources and Accounting. Additional access rights needed for certain tasks within each department are assigned to specialized groups, such as Accounting_Payroll and Human Resources_Benefits. User accounts are added to the groups that have the appropriate access rights to meet their assigned responsibilities. What type of access control model is this organization using? Role Based Access Control 8. Why is it important to temper good intentions with knowledge with regard to employee awareness training? Clear and specific policies protect both the organization and the employees. 9. In addition to high-level policy, what is needed for explaining how to meet policy objectives? Specific operating procedures 10. From a security perspective, which of the following should be the most important prerequisite to posting new data on an existing publicly accessible website? Performing data classification 11. Which of the following are ways to measure voluntary conformance with a security awareness program?