Deck 10: Implementing Information Security

Question 1

Each for-profit organization determines its capital budget and the rules for managing capital spending and expenses the same way.

Answer 1

False

Question 2

The networks layer of the bull's-eye is the outermost ring of the bull's eye.

Answer 2

False

Question 3

The WBS can be prepared with a simple desktop PC word processing program.

Answer 3

False

Question 4

Weak management support,with overly delegated responsibility and no champion,sentences the project to almost-certain failure.

Question 5

Planning for the implementation phase of a security project requires the creation of a detailed project plan.

Question 6

All organizations should designate a champion from the general management community of interest to supervise the implementation of an information security project plan.

Question 7

Planners need to estimate the effort required to complete each task,subtask,or action step.

Question 8

The size of the organization and the normal conduct of business may preclude a single large training program on new security procedures or technologies.

Question 9

The project plan as a whole must describe how to acquire and implement the needed security controls and create a setting in which those controls achieve the desired outcomes.

Question 10

The budgets of public organizations are usually the product of legislation or public meetings.

Question 11

The first step in the WBS approach encompasses activities,but not deliverables.

Question 12

The bull's-eye model can be used to evaluate the sequence of steps taken to integrate parts of the information security blueprint into a project plan.

Question 13

DMZ is the primary way to secure an organization's networks.

Question 14

Every organization needs to develop an information security department or program of its own.

Question 15

Unfreezing in the Lewin change model involves thawing hard-and-fast habits and established procedures.

Question 16

Each organization has to determine its own project management methodology for IT and information security projects.

Question 17

When an estimate is flawed,as when the number of effort-hours required is underestimated,the plan should be corrected and downstream tasks updated to reflect the change.

Question 18

In general,the design phase is accomplished by changing the configuration and operation of the organization's information systems to make them more secure.

Question 19

The need for qualified,trained,and available personnel constrains the project plan.

Question 20

The primary drawback to the direct changeover approach is that if the new system fails or needs modification,users may be without services while the system's bugs are worked out.

Question 21

The date for sending the final RFP to vendors is considered a(n)____,because it signals that all RFP preparation work is complete.

A)intermediate step
B)resource
C)milestone
D)deliverable

Question 22

The task of creating a project plan is often assigned to either a project manager or the project leader._________________________

Question 23

If the task is to write firewall specifications for the preparation of a(n)____,the planner would note that the deliverable is a specification document suitable for distribution to vendors.

A)WBS
B)CBA
C)SDLC
D)RFP

Question 24

A task or subtask becomes an action step when it can be completed by one individual or skill set and when it includes a single deliverable._________________________

Question 25

The RFP determines the impact that a specific technology or approach can have on the organization's information assets and what it may cost._________________________

Question 26

Most information security projects require a trained project CEO._________________________

Question 27

The parallel implementation works well when an isolated group can serve as the "guinea pig," which prevents any problems with the new system from dramatically interfering with the performance of the organization as a whole._________________________

Question 28

The security systems implementation life cycle is a process for collecting information about an organization's objectives,its technical architecture,and its information security environment._________________________

Question 29

The tasks or action steps that come before the specific task at hand are called successors._________________________

Question 30

A direct changeover is also known as going "fast turnkey." _________________________

Question 31

In the early stages of planning,the project planner should attempt to specify completion dates only for major employees within the project._________________________

Question 32

An ideal organization fosters resilience to change._________________________

Question 33

The ____ involves collecting information about an organization's objectives,its technical architecture,and its information security environment.

A)SISC
B)SecSDLC
C)DLC
D)SIDLC

Question 34

Corrective action decisions are usually expressed in terms of trade-offs._________________________

Question 35

A proven method for prioritizing a program of complex change is the bull's-eye method._________________________

Question 36

The optimal time frame for training is usually one to three weeks before the new policies and technologies come online._________________________

Question 37

A cybernetic loop ensures that progress is measured periodically._________________________

Question 38

____ is a simple planning tool.

A)RFP
B)WBS
C)ISO 17799
D)SDLC

Question 39

Tasks or action steps that come after the task at hand are called ____.

A)predecessors
B)successors
C)children
D)parents

Question 40

The primary drawback to the direct changeover approach is that if the new system fails or needs modification,users may be without services while the system's bugs are worked out._________________________

Question 41

A(n)____________________ is a completed document or program module that can either serve as the beginning point for a later task or become an element in the finished project.

Question 42

A(n)____________________ is a specific point in the project plan when a task that has a noticeable impact on the progress of the project plan is complete.

Question 43

In the ____ process,measured results are compared to expected results.

A)negative feedback loop
B)wrap-up
C)direct changeover
D)turnover

Question 44

The ____ methodology has been used by many organizations,requires that issues be addressed from the general to the specific,and that the focus be on systematic solutions instead of individual problems.

A)parallel
B)direct changeover
C)bull's-eye
D)wrap-up

Question 45

The ____ layer of the bull's-eye model receives attention last.

A)Policies
B)Networks
C)Systems
D)Applications

Question 46

The goal of the ____ is to resolve any pending issues,critique the overall effort of the project,and draw conclusions about how to improve the process for the future.

A)direct changeover
B)wrap-up
C)phased implementation
D)pilot implementation

Question 47

The ____ layer of the bull's-eye model includes computers used as servers,desktop computers,and systems used for process control and manufacturing systems.

A)Policies
B)Networks
C)Systems
D)Applications

Question 48

Public organizations often have "____" to spend all their remaining funds before the end of the fiscal year.

A)end-of-fiscal-year spending-sprees
B)end-of-year spend-a-thons
C)end-of-fiscal spending-sprees
D)end-of-fiscal-year spend-a-thons

Question 49

A ____ is usually the best approach to security project implementation.

A)direct changeover
B)phased implementation
C)pilot implementation
D)parallel operation

Question 50

Technology ____ guides how frequently technical systems are updated,and how technical updates are approved and funded.

A)wrap-up
B)governance
C)turnover
D)changeover

Question 51

During the implementation phase,the organization translates its blueprint for information security into a concrete project ____________________.

Question 52

Management should coordinate the organization's information security vision and objectives with the communities of ____________________ involved in the execution of the plan.

Question 53

Some cases of ____ are simple,such as requiring employees to use a new password beginning on an announced date.

A)phased implementation
B)direct changeover
C)pilot implementation
D)wrap-up

Question 54

A(n)____,typically prepared in the analysis phase of the SecSDLC,must be reviewed and verified prior to the development of the project plan.

A)RFP
B)WBS
C)SDLC
D)CBA

Question 55

The Lewin change model consists of ____.

A)unfreezing
B)moving
C)refreezing
D)All of the above

Question 56

Project managers can reduce resistance to change by involving employees in the project plan.In systems development,this is referred to as ____.

A)DMZ
B)SDLC
C)WBS
D)JAD

Question 57

____________________ is a phenomenon in which the project manager spends more time documenting project tasks,collecting performance measurements,recording project task information,and updating project completion forecasts than in accomplishing meaningful project work.

Question 58

By managing the ____,the organization can reduce unintended consequences by having a process to resolve potential conflict and disruption that uncoordinated change can introduce.

A)changeover
B)wrap-up
C)process of change
D)governance

Question 59

The ____ level of the bull's-eye model establishes the ground rules for the use of all systems and describes what is appropriate and what is inappropriate,it enables all other information security components to function correctly.

A)Policies
B)Networks
C)Systems
D)Applications

Question 60

In a ____ implementation,the entire security system is put in place in a single office,department,or division,and issues that arise are dealt with before expanding to the rest of the organization.

A)loop
B)direct
C)parallel
D)pilot

Question 61

What are the major steps in executing the project plan?

Question 62

Project ____________________ describes the amount of time and effort-hours needed to deliver the planned features and quality level of the project deliverables.

Question 63

The project planner should describe the skill set or person,often called a(n)____________________,needed to accomplish a task.

Question 64

Once a project is underway,it is managed to completion using a process known as a negative ____________________ loop.

Question 65

What major project tasks does the WBS document?

Question 66

A(n)____________________ implementation is the most common conversion strategy and involves a measured rollout of the planned system with a part of the whole being brought out and disseminated across an organization before the next piece is implemented.

Question 67

The tasks or action steps that come before the specific task at hand are called ____________________.

Question 68

Technology ____________________ is a complex process that organizations use to manage the affects and costs of technology implementation,innovation,and obsolescence.

Question 69

ERP stands for enterprise ____________________ planning.

Question 70

One of the oldest models of change is the ____________________ change model.

Question 71

A direct ____________________ involves stopping the old method and beginning the new.

Question 72

What can the organization do by managing the process of change?

Question 73

The ____________________ operations strategy involves running the new methods alongside the old methods.

Question 74

Tasks or action steps that come after the task at hand are called ____________________.

Question 75

Medium- and large-sized organizations deal with the impact of technical change on the operation of the organization through a(n)____________________ control process.

Question 76

Regardless of where in the budget information security items are located,monetary ____________________ determine what can (and cannot)be accomplished.

Question 77

The level of resistance to ____________________ impacts the ease with which an organization is able to implement the procedural and managerial changes.

Question 78

JAD stands for ____________________ application development.