BCS CISMP-V9 BCS Foundation Certificate in Information Security Management Principles V9.0 Exam Practice Test

Answer : D

Regular rotation of staff monitoring critical CCTV systems is recommended primarily to address the limitations of the human attention span. Research suggests that the average human attention span during intense monitoring tasks is approximately 20 minutes. After this period, vigilance and alertness can significantly decrease, leading to a potential lapse in monitoring effectiveness. Rotating staff helps to ensure that individuals are always at their most attentive when observing the CCTV feeds, which is crucial for maintaining security and safety standards. This practice also helps to mitigate risks associated with fatigue and the potential for missing critical events or details.

Answer : A

Loading bays are areas of a facility where goods are loaded and unloaded, which can be busy and potentially hazardous. They are considered vulnerable points for security breaches due to the high volume of goods movement and external access. Using them as staff entrances increases the risk of unauthorized access and potential security incidents. By restricting access to loading bays and directing staff to use dedicated entrances, an organization can better control entry points, monitor traffic, and maintain security protocols.This principle is part of the Physical and Environmental Security Controls domain, which emphasizes the importance of securing physical access to protect information assets1.

Answer : B

Syslog is a standard for message logging and allows devices to send event notification messages across IP networks to event message collectors - also known as Syslog servers or SIEM (Security Information and Event Management) systems. Native support for syslog is commonly found in various network devices and Unix/Linux-based systems.

Enterprise Wireless Access Points,Linux Web Server Appliances, andEnterprise Stateful Firewallstypically have built-in capabilities to generate and send syslog messages to a SIEM system for monitoring and analysis.

Windows Desktop Systems, on the other hand, do not natively support syslog because Windows uses its own event logging system known as Windows Event Log.While it is possible to configure Windows systems to send logs to a SIEM appliance, this usually requires additional software or agents to translate Windows Event Log messages into syslog format before they can be sent1.

Answer : C

When an organization opts for public cloud services, it relinquishes direct control over many aspects of security and privacy. While the cloud service provider maintains the physical servers, the organization loses the ability to physically access these servers. This is a significant shift from traditional on-premises data centers where the organization would have complete control over and access to the physical infrastructure. In the context of the public cloud, the organization must rely on the cloud provider's security measures and protocols to protect its data.However, it's important to note that while physical access is lost, cloud providers typically offer robust security features and compliance certifications that can compensate for this loss12.

Answer : A

In the context of a cloud service provision, particularly Infrastructure as a Service (IaaS), the focus is typically on providing the physical or virtual infrastructure to the customer. The responsibility for user security education generally falls within the domain of the customer, as it pertains to their internal operations and how their employees or users interact with the IaaS. The IaaS provider's responsibilities are more aligned with ensuring the security of the infrastructure itself, rather than the education of users on security practices.

Intellectual Property Rights (B), End-of-service , and Liability (D) are all common considerations in cloud service contracts. Intellectual Property Rights would cover the ownership of data and software used within the service. End-of-service terms would outline the process and responsibilities when the service term ends, including data retrieval or transfer. Liability clauses would define the extent to which the provider is responsible for damages or losses incurred due to service issues.

Answer : D

Developers should undergo Awareness Training to understand the security of the code they have written and how it can improve security defense while being attacked. This type of training educates developers on the importance of security considerations throughout the software development lifecycle (SDLC). It covers best practices for secure coding, common vulnerabilities and how to avoid them, and the impact of code security on the overall security posture of an application. By being aware of security principles and the potential threats, developers can write more secure code, which is crucial for defending against attacks.

Answer : A

The delivery of online security training material offers several advantages over printed media. One of the key benefits is the ease of updating content. When updates are required, online materials can be edited quickly and efficiently, with changes being immediately available to all users.This contrasts with printed materials, which would require a new physical version to be produced and distributed, a process that is both time-consuming and resource-intensive1.

Furthermore, online training materials can be accessed from anywhere at any time, providing flexibility and convenience for learners.They also allow for interactive elements, such as quizzes and simulations, which can enhance the learning experience1.Additionally, online materials can be tracked for usage and completion, enabling organizations to monitor compliance with training requirements2.

While option C mentions a 'discoverable record,' this refers to the legal concept that materials may be used as evidence in litigation. However, this is not an advantage of online over printed media, as both can be discoverable. Option B's claim that online materials are intrinsically more accurate is not necessarily true, as accuracy depends on the content's quality, not the delivery method. Option D is incorrect because while online materials are protected by copyright laws, this is not an exclusive benefit over printed materials, which are also protected.