Chapter 6 Assessment Questions 1. In terms of business continuity, a hostage situation could be considered a disaster.
True

2. _____ is choosing not to engage in an activity that carries some element of risk.
Risk avoidance

3. _____ is carrying on despite the risks involved in a given activity.
Risk acceptance

4. _____ is the process of assigning risk to someone else.
Risk transference

5. _____ combines attempts to minimize the probability and impact of risk.
Risk mitigation

6. The three main threat categories are information confidentiality, _____, and availability.
Integrity

7. Even non-sensitive data should be kept under some level of access control.
True

8. Any system or data resource that, if it were lost, stolen, damaged, altered, or publicly divulged, would cause a significant negative impact to the organization should be considered _____.
Sensitive

9. Which of the following is an access control system in which rights are assigned by the owner of the resource?
Discretionary access control

10. Which of the following is an access control system in which rights are assigned based on a user's role rather than his or her identity?
Role-based access control

11. Which of the following is an access control system in which rights are assigned by a central authority?
Mandatory access control

12. The principle of separation of responsibility requires a minimum of how many conditions to be met before access is granted?
2
13. Least user access implements what access control requirement?
Users should commonly log into workstations under limited user accounts, unless they are performing administrative functions.

14. The three basic levels of need for information are existence of information, view partial information, and _____.
View full