1. What is wrong with this policy compliance clause? Show how you could fix it. People who violate this policy are subject to sanctions.

2. The three effects of security controls are prevention, detection, and recovery. Briefly explain how these effects are related to the known good state.

3. Briefly explain why separation of duties between general user roles and privileged user roles is needed.

4. The privacy laws of the United States are different from the privacy law of the European Union, but many U.S. companies employ citizens of the European Union in EU countries (and in the United States). Explain what has been done to ensure that the privacy of EU citizens working for U.S. companies is observed.

5. List the four characteristics of a reference monitor.

6. Briefly explain the idea of a mantrap. 

7. Explain what media disposition means.

8. Explain the term hot site. 

9. Distinguish between an access control list and a capabilities list.

10. Explain how a user's public key is protected in an asymmetric cryptosystem.

11. List the important security characteristics of a good firewall. 

12. What is often another term for a bastion host? 

13. For intrusion detection, briefly explain what Type 1 and Type 2 errors are. 

14. A packet-filtering router is not capable of understanding the context/data of a particular service. Evaluate the types of security devices available and conclude what would be the best choice to perform this function. 

15. Explain how a worm propagates itself.