Explanation/Reference:
Explanation:
Although society has evolved to be extremely dependent upon technology in the workplace, people are still the key ingredient to a successful company. But in security circles, people are often the weakest link.
Either accidentally through mistakes or lack of training, or intentionally through fraud and malicious intent, personnel causes more serious and hard-to-detect security issues than hacker attacks, outside espionage, or equipment failure. Although the future actions of individuals cannot be predicted, it is possible to minimize the risks by implementing preventive measures. These include hiring the most qualified individuals, performing background checks, using detailed job descriptions, providing necessary training, enforcing strict access controls, and terminating individuals in a way that protects all parties involved.
Incorrect Answers:
B: Software generally does what it is configured to do. It is not considered the weakest link in a security system.
C: It is easy to configure secure communications where they are required. Communications are not considered the weakest link in a security system.
D: Hardware generally does what it is configured to do. It is not considered the weakest link in a security system.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 126

IM clients find ways to tunnel through firewalls, creating risk. Most IM services come through well- publicized ports (5190 for AOL Instant Messenger, 1863 for MSN and 5050 for Yahoo), but IM clients also can exploit any open port on the firewall, including those used by other applications (such as Port 80 for Web and HTTP traffic). Some clients also can connect via peer-to-peer connections or establish connections on randomly negotiated ports.

Making the determination to decide what level of classification the information
requires is the main responsibility of the data owner.
The data owner within classification is a person from Management who has been entrusted with a
data set that belong to the company. It could be for example the Chief Financial Officer (CFO) who
has been entrusted with all financial date or it could be the Human Resource Director who has
been entrusted with all Human Resource data. The information owner will decide what
classification will be applied to the data based on Confidentiality, Integrity, Availability, Criticality,
and Sensitivity of the data.
The Custodian is the technical person who will implement the proper classification on objects in
accordance with the Data Owner. The custodian DOES NOT decide what classification to apply, it
is the Data Owner who will dictate to the Custodian what is the classification to apply.
NOTE:
The term Data Owner is also used within Discretionary Access Control (DAC). Within DAC it
means the person who has created an object. For example, if I create a file on my system then I
am the owner of the file and I can decide who else could get access to the file. It is left to my
discretion. Within DAC access is granted based solely on the Identity of the subject, this is why
sometimes DAC is referred to as Identity Based Access Control.
The other choices were not the best answer
Running regular backups is the responsibility of custodian.
Audit the data users is the responsibility of the auditors
Periodically check the validity and accuracy of the data is not one of the data owner responsibility
Reference(s) used for this question:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of
Computer Security, John Wiley & Sons, 2001, Page 14, Chapter 1: Security Management
Practices.