Golden Gate University IT Security Policies to Help Mitigate Risk Lab 9 Quiz

identify risks and vulnerabilities.

help mitigate identified risks.

document the security measures the organization is currently following.

eliminate all risks.

their children’s education records.

their children’s medical records.

the type of education their children receive.

the medical treatment their children receive.

Student Education Records Act (SERA)

Family Educational Rights and Privacy Act (FERPA)

Intellectual Property Act (IPA)

Gramm-Leach-Bliley Act (GLBA)

categories based on value.

departments.

work groups.

the seven IT domains.

Other schools

The student’s parents

Other parents

Everyone

Personally Identifiable Information (PII)

directory information

educational information

academic information

The environment has no bearing on risk.

Any given risk has the same significance, regardless of environment.

Some environments produce highly significant risks.

Every environment carries the same set of risks.

Some risks are unique to different environments.

Every environment carries the same set of risks.

The environment does not have any bearing on risks.

Every risk is of equal importance.

enroll in high school.

graduate from high school.

reach the age of 18 or attend a school beyond the high school level.

reach the age of 21.

all schools, regardless of level or funding source.

all schools that receive funds under an applicable program of the U.S. Department of Education.

only higher education institutions such as colleges and universities.

only elementary, middle, and high schools.

Each one develops its own security policies independently.

All hospitals, schools, and financial institutions have the same security policies.

The government legislates precise security policies.

The government legislates special acts to provide guidance and countermeasures.

written permission

oral consent given in person only

oral consent given either in person or over the telephone

enrollment verification

educational institutions, but not for-profit businesses.

for-profit businesses, but not educational institutions.

a limited number of environments.

a wide variety of environments.

FERPA considers each with different levels of protection.

FERPA considers all three types of information with the same level of protection.

FERPA is not concerned with disclosure in any of the types of information.

FERPA is only concerned with the protection of Personally Identifiable Information (PII).

personally identifiable.

unimportant.

correct but unflattering.

inaccurate or misleading.

document policies

develop procedures

ensure compliance

make future purchases

electronic information, written information, and physical information.

student information, faculty information, and institution information.

educational information, Personally Identifiable Information (PII), and directory information.

disciplinary information, attendance information, and grades.

Purchasing additional equipment

Complying with regulations

Writing security policies

Developing recovery procedures

contains a breach of security notification requirement for all schools

contains a breach of security notification requirement for elementary, middle, and high schools

contains a breach of security notification requirement for higher education institutions

does not contain a breach of security notification requirement

parents’ right to inspect and review the student’s education records maintained by the school.

information assurance or security of student records.

parents’ right to request that a school correct records which they believe to be inaccurate or misleading.

written permission from the parent or eligible student in order to release any information from a student’s education record.