Computer Security Fundamentals
Solved Exam Questions
Course Introduction
Computer Security Fundamentals introduces the basic principles, concepts, and practices of securing computer systems and networks. The course covers essential topics such as threats and vulnerabilities, security policies, authentication and access control, cryptography, malware, and network security mechanisms. Students will learn how to identify security risks, implement protective measures, and understand the ethical and legal considerations involved in computer security. Through theoretical lessons and practical exercises, this course prepares students to recognize vulnerabilities and apply foundational defenses to safeguard information assets.
Recommended Textbook Management of Information Security 3rd Edition by Michael E. Whitman
Available Study Resources on Quizplus
12 Chapters
1438 Verified Questions
1438 Flashcards
Source URL: https://quizplus.com/study-set/2354
Page 2
Chapter 1: Introduction to the Management of Information Security
Available Study Resources on Quizplus for this Chatper
139 Verified Questions
139 Flashcards
Source URL: https://quizplus.com/quiz/46799
Sample Questions
Q1) When you review technological feasibility,you address the organization's financial ability to purchase the technology needed to implement a candidate solution
A)True
B)False
Answer: False
Q2) Which of the following is a project not a managed process?
A) monitoring external and internal environment during incident response
B) installation of a new firewall system
C) ongoing risk assessments of routine operations
D) continuous vulnerability assessment and vulnerability repair
Answer: B
Q3) The term ____________________ refers to the end result of a planning process. Answer: goal
Q4) The most popular of networking dependency diagramming techniques is the \(\text {\underline{ Program Evaluation and Review Technique (PERT)} }\) ,similar to the Critical Path Method._________________________
A)True
B)False
Answer: True
Page 3
To view all questions and flashcards with answers, click on the resource link above.
Chapter 2: Planning for Security
Available Study Resources on Quizplus for this Chatper
123 Verified Questions
123 Flashcards
Source URL: https://quizplus.com/quiz/46800
Sample Questions
Q1) At the end of each phase of the security systems development life cycle (SecSDLC),a ____ takes place.
A) brainstorming session
B) structured discussion
C) structured review
D) planning session
Answer: C
Q2) The long-term direction taken by the organization is based on ____ planning.
A) strategic
B) tactical
C) operational
D) managerial
Answer: A
Q3) When an unauthorized individual gains access to information that an organization is trying to protect,the act is categorized as a(n)____.
A) deliberate act of espionage or trespass
B) act of human error or failure
C) deliberate act of information extortion
D) deliberate act of theft
Answer: A
To view all questions and flashcards with answers, click on the resource link above. Page 4
Chapter 3: Planning for Contingencies
Available Study Resources on Quizplus for this Chatper
114 Verified Questions
114 Flashcards
Source URL: https://quizplus.com/quiz/46801
Sample Questions
Q1) A document that contains contact information on the individuals to be notified in the event of an actual incident is called a(n)____.
A) notification table
B) alert roster
C) notification list
D) response list
Answer: B
Q2) The \(\text {\underline{CP } }\)
team manages and executes the incident response plan by detecting,evaluating,and responding to incidents._________________________
A)True
B)False
Answer: False
Q3) ____________________ is a set of procedures that commence when an incident is detected.
Answer: Incident response
IR
To view all questions and flashcards with answers, click on the resource link above.
5
Chapter 4: Information Security Policy
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46802
Sample Questions
Q1) A ____ is a more detailed statement identifying a measurement of behavior and specifies what must be done to comply with a policy.
A) procedure
B) standard
C) guideline
D) practice
Q2) It is during the<u> design</u> phase of the SecSDLC that the policy development team must provide for policy distribution._________________________
A)True
B)False
Q3) The information security policy is written during the ____ phase of the SecSDLC.
A) investigation
B) maintenance
C) implementation
D) design
Q4) In an organization,a(n)____________________ security policy provides detailed,targeted guidance to instruct all the members in the use of technology-based systems.
Q5) The ____________________ phase is the last phase of the SecSDLC.
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Developing the Security Program
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46803
Sample Questions
Q1) In large organizations the information security department is often located within the ____________________ department.
Q2) The security education,training,and awareness (SETA)program is designed to reduce the incidence of external security attacks.
A)True
B)False
Q3) Security awareness and <u>security training</u> are designed to modify any employee behavior that endangers the security of the organization's information._________________________
A)True
B)False
Q4) Training for ____ may require the use of consultants or outside training organizations.
A) general users
B) managers
C) IT staff
D) All of these
Q5) In the ____________________ method of training,a single trainer works with multiple trainees in a formal setting.
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Security Management Models
Available Study Resources on Quizplus for this Chatper
120 Verified Questions
120 Flashcards
Source URL: https://quizplus.com/quiz/46804
Sample Questions
Q1) The principle by which members of the organization can access the minimum amount of information for the minimum amount of time necessary to perform their required duties is known as ____.
A) need-to-know
B) eyes only
C) least privilege
D) separation of duties
Q2) ISO/IEC 27001 provieds implementation details using a(n)____________________ cycle.
Q3) Within the TCB is a conceptual object known as the ____________________,which is the piece of the system that manages access controls-in other words,it mediates all access to objects by subjects.
Q4) COBIT is an IT ____________________ framework and supporting toolset that allows managers to bridge the gap between control requirements,technical issues,and business risks.
Q5) In rule-based access controls,access is granted based on a set of rules which may be specified by the central authority.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Security Management Practices
Available Study Resources on Quizplus for this Chatper
114 Verified Questions
114 Flashcards
Source URL: https://quizplus.com/quiz/46805
Sample Questions
Q1) In the NIST performance measures implementation process,the comparison of observed measurements with target values is known as a ____ analysis.
A) shortfall
B) gap
C) corrective
D) failure
Q2) In information security,two categories of benchmarks are used: standards of due care and due diligence and ____ practices.
A) security
B) recommended
C) measures
D) metrics
Q3) The last phase in the NIST performance measures implementation process is to apply ____________________ actions; close the gap by implementing the recommended corrective actions in the security program or in the security controls.
Q4) A problem with benchmarking is that recommended practices are a(n)____________________; that is,knowing what happened a few years ago does not necessarily tell you what to do next.
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: Risk Management: Identifying and Assessing Risk
Available Study Resources on Quizplus for this Chatper
78 Verified Questions
78 Flashcards
Source URL: https://quizplus.com/quiz/46806
Sample Questions
Q1) For the purposes of relative risk assessment how is risk calculated?
Q2) List the stages in the risk identification process in order of occurrence.
Q3) A press release is likely to fall under the ____ data classification scheme.
A) public
B) classified
C) sensitive
D) for official use only
Q4) Which of the following activities is part of the risk identification process?
A) Determining the likelihood that vulnerable systems will be attacked by specific threats
B) Calculating the risks to which assets are exposed in their current setting
C) Assigning a value to each information asset
D) Assessing the relative risk facing the organization's information assets
Q5) The ____ uniquely identifies a specific device.
A) manufacturer's model number
B) manufacturer name
C) IP address
D) serial number
To view all questions and flashcards with answers, click on the resource link above. Page 10
Q6) The standard IT system components include: people,data,networks,hardware,software,and
Chapter 9: Risk Management: Controlling Risk
Available Study Resources on Quizplus for this Chatper
105 Verified Questions
105 Flashcards
Source URL: https://quizplus.com/quiz/46807
Sample Questions
Q1) Unlike other risk management frameworks,FAIR relies on the qualitative assessment of many risk components using scales with value ranges,for example very high to very low.
A)True
B)False
Q2) Risk appetite is also known as risk ____________________.
Q3) Step-by-step rules to regain normalcy is covered by which of the following plans in the mitigation control approach?
A) Incident response plan
B) Business continuity plan
C) Disaster recovery plan
D) Damage control plan
Q4) The Annualized Loss Expectancy in the CBA formula is determined as ____.
A) ALE * ARO
B) SLE * ARO
C) ACS - SLE(post)
D) AV * EF
Q5) What is a cost/benefit analysis and how is it calculated?
Q6) Discuss at least four alternatives to feasibility.
Page 11
To view all questions and flashcards with answers, click on the resource link above.
Chapter 10: Protection Mechanisms
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46808
Sample Questions
Q1) The data encryption standard is a popular<u> symmetric</u> encryption cryptosystem._________________________
A)True
B)False
Q2) ____ is an encryption cryptosystem that has been adapted to add security to e-mail.
A) IP Security
B) Pretty Good Privacy
C) Secure Hypertext Transfer Protocol
D) Secure Electronic Transactions
Q3) A firewall uses its ____ to decide whether or not to allow packets into the network.
A) configuration rules
B) access control list
C) rule base
D) network connections
Q4) Symmetric encryptions are more efficient in their use of CPU resources than asymmetric encryptions.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 11: Personnel and Security
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46809
Sample Questions
Q1) The <u>CISO</u> is typically considered the top information security officer in an organization._________________________
A)True
B)False
Q2) In an effort to push the information security discipline forward,<u>middle</u> management should learn more about personnel and information security budgetary needs._________________________
A)True
B)False
Q3) Which of the following policies requires that two individuals review and approve each other's work before the task is considered complete?
A) Task rotation
B) Two-person control
C) Separation of duties
D) Job rotation
Q4) Similar to the case of other professions,overspecialization in information security can be an advantage.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Law and Ethics
Available Study Resources on Quizplus for this Chatper
113 Verified Questions
113 Flashcards
Source URL: https://quizplus.com/quiz/46810
Sample Questions
Q1) The ____ is a professional organization that was established in 1947 as the world's first educational and scientific computing society.
A) SANS
B) ACM
C) (ISC)²
D) CSI
Q2) The Normative ethics framework is the study of what makes actions right or wrong; also known as <u>deontological</u> theory._________________________
A)True
B)False
Q3) Financial compensation for committing a wrongful act is referred to as ____________________.
Q4) The structure and administration of government agencies and their relationships with citizens,employees,and other governments is regulated by ____________________ law.
Q5) ____________________ law encompasses family law,commercial law,and labor law.
Q6) ____________________ law addresses violations harmful to the society and is actively enforced and prosecuted by the state.
Page 14
To view all questions and flashcards with answers, click on the resource link above.