1. Which of the following is NOT a resource that operations security identifies the controls for? A. Software B. Hardware C. Media D. All of the above are resources. Answer: D Reference: Introduction Difficulty: moderate
2. A control that makes certain no one person has excessive privileges is: A. Separation of duties B. Principle of least privilege C. Need-to-know D. Individual privilege Answer: A Reference: Operations Security Principles Difficulty: moderate
3. A minimum set of access rights needed to perform a specific job description is: A. Separation of duties B. Need-to-know C. Privileged-controls D. Separation-of-privilege Answer: B Reference: Operations Security Principles Difficulty: moderate
4. Which of the following is NOT a key element of a system of internal and security controls? A. Employ competent people B. Have adequate separation of job duties C. Execute internal and external transactions D. Maintain adequate documents and records Answer: C Reference: Operations Security Principles Difficulty: moderate
5. Which of the following is a fundamental reason why separation of duties is important? A. People are an integral part of operations process B. People have shortcomings C. Both A and B D. None of the above Answer: C Reference: Operations Security Principles Difficulty: moderate
6. People engage in fraud, theft, or malicious activities for all of the following reasons except: A. Some financial crises motivates them B. They can justify their actions C. Internal controls are not in place D. All of the above are reasons Answer: D Reference: Operations Security Principles Difficulty: moderate
7. Operations security process controls include all of the following except: A. Personnel security B. Resource protection C. User recovery controls D. Privileged entity controls Answer: C Reference