CISSP-ISSMP Question #82: Real Exam Question with Answer & Explanation

Question

Which of the following administrative policy controls is usually associated with government classifications of materials and the clearances of individuals to access those materials?

Options

• ASeparation of Duties
• BDue Care
• CAcceptable Use
• DNeed to Know

Explanation

It is the concept of need to know, which is generally associated with government classifications of materials and the clearances of individuals to access those materials. It is similar to the least privilege principle. Answer option C is incorrect. An acceptable or appropriate user policy details the conditions that a user must agree to in order to use an account on an information system. Answer option B is incorrect. Due Care policy identifies the level of confidentiality of information on a computer. It specifies how the information is to be handled. The objective of this policy is to protect confidential records, the unauthorized disclosure of which creates a strong potential for liability. Answer option A is incorrect. Separation of duties (SoD) is the concept of having more than one person required to complete a task. It is alternatively called segregation of duties or, in the political realm, separation of powers. Segregation of duties helps reduce the potential damage from the actions of one person. IS or end-user department should be organized in a way to achieve adequate separation of duties. According to ISACA's Segregation of Duties Control matrix, some duties should not be combined into one position. This matrix is not an industry standard, just a general guideline suggesting which positions should be separated and which require compensating controls when combined.

No community discussion yet for this question.