Course Introduction
Information Assurance Test Preparation
Information Assurance is the practice of managing risks related to the use, processing, storage, and transmission of information. This course introduces students to core concepts such as confidentiality, integrity, and availability, and explores strategies for protecting data against threats and vulnerabilities. Topics include risk assessment, security policies, legal and ethical considerations, incident response, and the implementation of security controls in organizational settings. Through real-world case studies and practical exercises, students learn to design and evaluate information assurance solutions that protect critical assets in both public and private sectors.
Recommended Textbook
Management of Information Security 3rd Edition by Michael E. Whitman
Available Study Resources on Quizplus
12 Chapters
1438 Verified Questions
1438 Flashcards
Source URL: https://quizplus.com/study-set/2354
Page 2
Chapter 1: Introduction to the Management of Information Security
Available Study Resources on Quizplus for this Chatper
139 Verified Questions
139 Flashcards
Source URL: https://quizplus.com/quiz/46799
Sample Questions
Q1) The process of achieving objectives using a given set of resources is called \(\text {\underline{ management } }\)
A)True
B)False
Answer: True
Q2) The management of human resources must address many complicating factors; which of the following is NOT among them?
A) All workers operate at approximately the same level of efficiency
B) Not all workers begin the project with the same degree of skill
C) Skill mixtures among the actual project workers seldom match the needs of the project plan.
D) Some tasks may require skills that are not available from resources on hand
Answer: A
Q3) ____________________ are discrete sequences of activities with starting points and defined completion points.
Answer: Projects
Q4) The term ____________________ refers to the end result of a planning process.
Answer: goal
3
To view all questions and flashcards with answers, click on the resource link above.
Chapter 2: Planning for Security
Available Study Resources on Quizplus for this Chatper
123 Verified Questions
123 Flashcards
Source URL: https://quizplus.com/quiz/46800
Sample Questions
Q1) The impetus to begin a SDLC-based project may be either event-driven or \(\text {\underline{personnel-driven } }\)
A)True
B)False
Answer: False
Q2) Which of the following is NOT a significant benefit of information security governance?
A) Optimization of the allocation of limited security resources
B) A level of assurance that critical decisions are not based on faulty information
C) Increased predictability and reduced uncertainty of business operations by lowering information security-related risks to definable and acceptable levels
D) All of these are benefits of information security governance
Answer: D
Q3) A technique or mechanism that is used to compromise a system is called a(n)____________________.
Answer: exploit
To view all questions and flashcards with answers, click on the resource link above.
4
Chapter 3: Planning for Contingencies
Available Study Resources on Quizplus for this Chatper
114 Verified Questions
114 Flashcards
Source URL: https://quizplus.com/quiz/46801
Sample Questions
Q1) A(n)\(\text {\underline{hierarchical } }\) roster requires that a contact person call each and every person on the roster._________________________
A)True
B)False
Answer: False
Q2) The \(\text {\underline{ IR Plan } }\) is the component of contingency planning that focuses on restoring operations at the primary site._________________________
A)True
B)False
Answer: False
Q3) Classifying an incident is the responsibility of the IR team.
A)True
B)False
Answer: True
Q4) The bulk batch-transfer of data to an off-site facility is known as ____________________.
Answer: electronic vaulting
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Information Security Policy
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46802
Sample Questions
Q1) To ensure ____,an organization must demonstrate that it is continuously attempting to meet the requirements of the market in which it operates.
A) policy administration
B) due diligence
C) adequate security measures
D) certification and accreditation
Q2) A(n)<u>enterprise information</u> security policy is a type of information security policy that provides detailed,targeted guidance to instruct all members of the organization in the use of technology-based systems._________________________
A)True
B)False
Q3) The<u> Prohibited Usage of Equipment</u> section of the ISSP specifies the penalties and repercussions of violating the usage and systems management policies._________________________
A)True
B)False
Q4) List the significant guidelines used in the formulation of effective information security policy.
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Developing the Security Program
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46803
Sample Questions
Q1) A ____ program keeps information security at the forefront of users' minds on a daily basis.
A) security accountability
B) security education
C) security training
D) security awareness
Q2) Distance learning/Web seminars can be low- or no-cost.
A)True
B)False
Q3) In ____________________ training,prepackaged software provides training at the trainee's workstation.
Q4) Which of the following methods of training results in the lowest cost for the organization?
A) Distance learning/Web seminars
B) Formal class
C) One-on-one training
D) Self-study (noncomputerized)
Q5) Keys to a good security ____________________ series include varying the content and keeping posters updated.
Page 7
Q6) List the steps of the seven-step methodology for implementing training.
To view all questions and flashcards with answers, click on the resource link above.
Chapter 6: Security Management Models
Available Study Resources on Quizplus for this Chatper
120 Verified Questions
120 Flashcards
Source URL: https://quizplus.com/quiz/46804
Sample Questions
Q1) TCSEC is also known as the "Orange Book" and is considered the cornerstone of the DoD Rainbow Series that defines the criteria for assessing the access controls in a computer system.
A)True
B)False
Q2) ____ is an international standard framework that is based on the security model Information Technology-Code of Practice for Information Security Management.
A) ISO/IEC 17799
B) NIST SP 800-12
C) RFC 2196
D) NIST SP 800-26
Q3) Separation of duties is the principle by which members of the organization can access the minimum amount of information for the minimum amount of time necessary to perform their required duties.
A)True
B)False
Q4) One discretionary model is ____________________-based access controls,in which access is granted based on a set of mandates specified by the central authority.
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Security Management Practices
Available Study Resources on Quizplus for this Chatper
114 Verified Questions
114 Flashcards
Source URL: https://quizplus.com/quiz/46805
Sample Questions
Q1) It is seldom advisable to broadcast complex and nuanced metrics-based reports to large groups,unless ____.
A) the group is well educated and capable of understanding such complex reports
B) the reports also contain addendums providing detailed analyses of the findings
C) the key points are well established and embedded in a more complete context such as a newsletter or press release
D) None of these
Q2) Organizations that adopt minimum levels of security to establish a future legal defense may need to verify that they have done what any ____________________ organization would do in similar circumstances.
Q3) When choosing from among recommended practices,an organization should ask if it<u> resembles</u> the target organization of the recommended practice._________________________
A)True
B)False
Q4) "Good security now is better than perfect security never."
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above.
9
Chapter 8: Risk Management: Identifying and Assessing Risk
Available Study Resources on Quizplus for this Chatper
78 Verified Questions
78 Flashcards
Source URL: https://quizplus.com/quiz/46806
Sample Questions
Q1) Classification categories must be ____ (all inventoried assets fit into a category)and ____ (each asset is found in only one category).
A) self-regulating, conscriptive
B) mutually inclusive, mutually exclusive
C) comprehensive, mutually exclusive
D) mutually exclusive, classification
Q2) The last stage in the risk identification process is to document the organization's ____________________.
Q3) Risk Analysis is the process of discovering and assessing the risks to an organization's operations and determining how those risks can be controlled or mitigated.
A)True
B)False
Q4) Assessing risks includes assigning a value to each information asset.
A)True
B)False
Q5) A(n)____________________ number uniquely identifies a specific device.
To view all questions and flashcards with answers, click on the resource link above. Page 10
Q6) Assessing risks includes determining the ____________________ that vulnerable systems will be attacked by specific threats.
Chapter 9: Risk Management: Controlling Risk
Available Study Resources on Quizplus for this Chatper
105 Verified Questions
105 Flashcards
Source URL: https://quizplus.com/quiz/46807
Sample Questions
Q1) Risks can be avoided by countering the threats that an asset faces.
A)True
B)False
Q2) Risk appetite (also known as risk <u>tolerance</u>)is the quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility._________________________
A)True
B)False
Q3) When the attacker's potential gain is greater than the costs of<u> attack</u>,you should apply protections to increase the attacker's cost or reduce the attacker's gain,by using technical or managerial controls._________________________
A)True
B)False
Q4) One of the most common methods of obtaining user acceptance and support is via user ____________________ .
Q5) ____________________ is a control approach that attempts to shift the risk to other agencies who will manage or insure the assets.
Q6) Discuss at least four alternatives to feasibility.
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 10: Protection Mechanisms
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46808
Sample Questions
Q1) ____________________ Ticket Granting Service (TGS)provides tickets to clients who request services.
Q2) The<u> Vernam</u> cipher rearranges values within a block to create the ciphertext._________________________
A)True
B)False
Q3) ____ is an encryption cryptosystem that has been adapted to add security to e-mail.
A) IP Security
B) Pretty Good Privacy
C) Secure Hypertext Transfer Protocol
D) Secure Electronic Transactions
Q4) A ____ is an example of the "something you are" authentication mechanism.
A) fingerprint
B) password
C) smart card
D) signature pattern recognition
Q5) What should you look for when selecting a firewall for your network?
Q6) "Something you are" and "something you ____________________" are considered to be biometric.
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 11: Personnel and Security
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46809
Sample Questions
Q1) Configuring firewalls and IDSs,implementing security software,and diagnosing and troubleshooting problems are some of the responsibilities of a ____.
A) security manager
B) CISO
C) security technician
D) security officer
Q2) A security technician usually reports to a ____ who in turn reports to a(n)____.
A) security engineer; security manager
B) support staff member; analyst
C) CISO, CEO
D) security manager, CISO
Q3) When the employer and employee relationship ends,many organizations conduct a(n)____________________ interview to remind the employee of any contractual obligations such as nondisclosure agreements.
Q4) Automatic résumé scanning software can be set up to search for strings of characters that represent professional certifications.
A)True
B)False
Q5) Briefly describe at least five types of background checks.
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Law and Ethics
Available Study Resources on Quizplus for this Chatper
113 Verified Questions
113 Flashcards
Source URL: https://quizplus.com/quiz/46810
Sample Questions
Q1) Founded in 1989,____ has a membership of over 156,000 security professionals,auditors,system administrators,and network administrators.
A) (ISC)²
B) ISACA
C) ISSA
D) SANS
Q2) ____ law embodies a wide variety of laws pertaining to relationships between and among individuals and organizations.
A) Civil
B) Criminal
C) Ethical
D) Tort
Q3) The ____ defines and formalizes laws to counter threats from computer-related acts and offenses.
A) National Information Infrastructure Protection Act of 1996
B) Economic Espionage Act of 1996
C) Fraud and Related Activity in Connection with Computers Act
D) Computer Security Act of 1987
Q4) Briefly describe five different types of laws.
To view all questions and flashcards with answers, click on the resource link above. Page 14