Information Systems Security Exam Solutions
Course Introduction
Information Systems Security explores the principles, practices, and technologies essential for protecting digital information and information systems from unauthorized access, misuse, and threats. The course covers security concepts, risk management, security policies, access control mechanisms, cryptography, network and application security, and incident response. Students will analyze real-world security breaches, examine legal and ethical considerations, and learn how to develop strategies that safeguard organizational assets in a rapidly evolving digital landscape. Emphasis is placed on both technical and managerial aspects of information security, preparing students to address current and emerging security challenges.
Recommended Textbook Principles of Information Security 5th Edition by Michael E. Whitman
Available Study Resources on Quizplus
12 Chapters
696 Verified Questions
696 Flashcards
Source URL: https://quizplus.com/study-set/2374
Page 2
Chapter 1: Introduction to the Management of Information Security
Available Study Resources on Quizplus for this Chatper
63 Verified Questions
63 Flashcards
Source URL: https://quizplus.com/quiz/47110
Sample Questions
Q1) The term <U>phreaker</U> is now commonly associated with an individual who cracks or removes software protection that is designed to prevent unauthorized duplication._________________________
A)True
B)False
Answer: False
Q2) One form of online vandalism is ____________________operations,which interfere with or disrupt systems to protest the operations,policies,or actions of an organization or government agency.
A) hacktivist
B) phreak
C) hackcyber
D) cyberhack
Answer: A
Q3) The<U> macro</U> virus infects the key operating system files located in a computer's start up sector._________________________
A)True
B)False
Answer: False
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: Compliance: Law and Ethics
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/47111
Sample Questions
Q1) A key difference between policy and law is that ignorance of policy is a viable defense.What steps must be taken to assure that an organization has a reasonable expectation that policy violations can be appropriately penalized without fear of legal retribution?
Answer: Policies must be: Distributed to all individuals who are expected to comply with them Read by all employees Understood by all employees,with multilingual translations and translations for visually impaired or low-literacy employees Acknowledged by the employee,usually by means of a signed consent form Uniformly enforced,with no special treatment for any group (e.g.,executives)
Q2) <U>Deterrence</U> is the best method for preventing an illegal or unethical activity.____________
A)True
B)False
Answer: True
Q3) Ethics carry the sanction of a governing authority.
A)True
B)False
Answer: False
To view all questions and flashcards with answers, click on the resource link above.
Chapter 3: Governance and Strategic Planning for Security
Available Study Resources on Quizplus for this Chatper
52 Verified Questions
52 Flashcards
Source URL: https://quizplus.com/quiz/47112
Sample Questions
Q1) What is the role of planning in InfoSec management?What are the factors that affect planning?
Answer: Planning usually involves many interrelated groups and organizational processes.The groups involved in planning represent the three communities of interest; they may be internal or external to the organization and can include employees,management,stockholders,and other outside stakeholder.Among the factors that affect planning are the physical environment,the political and legal environment,the competitive environment,and the technological environment.
Q2) The ______________________ phase is the last phase of SecSDLC,but perhaps the most important.
Answer: maintenance and change
Q3) Which model of SecSDLC does the work product from each phase fall into the next phase to serve as its starting point?
A) modular continuous
B) elementary cyclical
C) time-boxed circular
D) traditional waterfall
Answer: D
To view all questions and flashcards with answers, click on the resource link above.
5
Chapter 4: Information Security Policy
Available Study Resources on Quizplus for this Chatper
56 Verified Questions
56 Flashcards
Source URL: https://quizplus.com/quiz/47113
Sample Questions
Q1) The 'Authorized Uses' section of an ISSP specifies what the identified technology cannot be used for.
A)True
B)False
Q2) Which of the following is NOT an aspect of access regulated by ACLs?
A) what authorized users can access
B) where the system is located
C) how authorized users can access the system
D) when authorized users can access the system
Q3) Information securitypolicies are designed to provide structure in the workplace and explain the <U> will</U> of the organization'smanagement.____________
A)True
B)False
Q4) A risk assessment is performed during which phase of the SecSDLC?
A) implementation
B) analysis
C) design
D) investigation
Q5) What are configuration rules?Provide examples.
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Developing the Security Program
Available Study Resources on Quizplus for this Chatper
55 Verified Questions
55 Flashcards
Source URL: https://quizplus.com/quiz/47114
Sample Questions
Q1) The three methods for selecting or developing advanced technical training are by job category,by job function,and by ____________________.
Q2) A(n)____________________ is a specific point in the project plan when a task that has a noticeable impact on plan's the progress is complete.
Q3) What is the security education,training,and awareness program? Describe how the program aims to enhance security.
Q4) __________ is a simple project management planning tool.
A) RFP
B) WBS
C) ISO 17799
D) SDLC
Q5) Which function needed to implement the information security program includes researching,creating,maintaining,and promoting information security plans?
A) compliance
B) policy
C) planning
D) systems security administration
Q6) What is the Chief Information Security Office primarily responsible for?
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Risk Management: Identifying and Assessing Risk
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47115
Sample Questions
Q1) For the purposes of relative risk assessment how is risk calculated?
Q2) Once an information asset is identified,categorized,and classified,what must also be assigned to it?
A) Asset tag
B) Relative value
C) Location ID
D) Threat risk
Q3) Some threats can manifest in multiple ways,yielding multiple<U> exploits</U> for an asset-threat pair. ____________
A)True
B)False
Q4) Briefly describe any three standard categories of information asset and their respective risk management components.
Q5) The InfoSec community often takes on the leadership role in addressing risk.
A)True
B)False
Q6) List the stages in the risk identification process in order of occurrence.
Q7) What are the included tasks in the identification of risks?
Q8) Why is threat identification so important in the process of risk management? Page 8
To view all questions and flashcards with answers, click on the resource link above.
Page 9
Chapter 7: Risk Management: Controlling Risk
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47116
Sample Questions
Q1) Unlike other risk management frameworks,FAIR relies on the qualitative assessment of many risk components using scales with value ranges.
A)True
B)False
Q2) What should each information asset-threat pair have at a minimum that clearly identifies any residual risk that remains after the proposed strategy has been executed?
A) probability calculation
B) documented control strategy
C) risk acceptance plan
D) mitigation plan
Q3) Once an organization has estimated the worth of various assets,what three questions must be asked to calculate the potential loss from the successful exploitation of a vulnerability?
Q4) What are the four phases of the Microsoft risk management strategy?
Q5) The ____________________ risk control strategy attempts to shift the risk to other assets,processes,or organizations.
Q6) Explain two practical guidelines to follow in risk control strategy selection.
Q7) Discuss three alternatives to feasibility analysis.
Page 10
To view all questions and flashcards with answers, click on the resource link above.
Chapter 8: Security Management Models
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47117
Sample Questions
Q1) Which control category discourages an incipient incident?
A) preventative B) deterrent C) remitting D) compensating
Q2) Which of the following is NOT one of the three levels in the U.S.military data classification scheme for National Security Information?
A) confidential
B) secret C) top secret D) for official use only
Q3) What is the data classification for information deemed to be National Security Information for the U.S.military as specified in 2009 in Executive Order 13526?
Q4) What are the two primary access modes of the Bell-LaPadula model and what do they restrict?
Q5) What are the five principles that are focused on the governance and management of IT as specified by COBIT 5?
Q6) Under what circumstances should access controls be centralized vs.decentralized?
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 9: Security Management Practices
Available Study Resources on Quizplus for this Chatper
59 Verified Questions
59 Flashcards
Source URL: https://quizplus.com/quiz/47118
Sample Questions
Q1) A legal standard that requires an organization and its employees to actas a reasonable and prudent individual or organization would under similar circumstances.
A)accreditation
B)baseline
C)benchmarking
D)certification
E)due diligence
F)best security practices
G)recommended business practices
H)standard of due care
I)performance measurements
J)NIST SP 800-37
Q2) Which of the following is Tier 3 (indicating environment of operation)of the tiered risk management approach?
A) Mission/business process
B) Information system
C) Accounting/logistics
D) Organization
Q3) Describe the three tier approach of the RMF as defined by NIST SP 800-37.
To view all questions and flashcards with answers, click on the resource link above.
Page 12
Chapter 10: Planning for Contingencies
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47119
Sample Questions
Q1) The first component of the analysis phase of a digital forensic investigation is ___________,which allows the investigator to quickly and easily search for a specific type of file.
Q2) Describe the methodology an organization should follow in an investigation.
Q3) In which contingency plan testing strategy do individuals participate in a role-playing exercise inwhich the CP team is presented with a scenario of an actual incident or disaster and expected to react as if it had occurred?
A) Desk check
B) Simulation
C) Structured walk-through
D) Parallel testing
Q4) A(n) <U>wrap-up</U> review is a detailedexamination and discussion of the events that occurred duringan incident or disaster,from first detection to final recovery.____________
A)True
B)False
Q5) If operations at the primary site cannot be quickly restored,the ____________________ occurs concurrently with the DR plan,enabling the business to continue at an alternate site.
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 11: Personnel and Security
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47120
Sample Questions
Q1) List the six key principles that should shape the career of a CISO.
Q2) A technically qualified individual who may configure firewalls and IDPSs,implement security software,diagnose and troubleshoot problems,and coordinate with systemsand network administrators to ensure that security technical controls are properly implemented is known as asecurity <U>architect</U>.____________
A)True
B)False
Q3) A conspiracy or cooperation between two or more individuals or groups to commitillegal or unethical actions is known as<U> racketeering</U>.____________
A)True
B)False
Q4) InfoSec is a profession with little personnel turnover - most InfoSec professionals stay in their positions for a very long time.
A)True
B)False
Q5) It is the responsibility of a _______________________ to develop appropriate InfoSec policies,standards,guidelines,and procedures.
To view all questions and flashcards with answers, click on the resource link above.
14
Chapter 12: Protection Mechanisms
Available Study Resources on Quizplus for this Chatper
61 Verified Questions
61 Flashcards
Source URL: https://quizplus.com/quiz/47121
Sample Questions
Q1) Technical controls alone,when properly configured,can secure an IT environment.
A)True
B)False
Q2) The KDC component of Kerberos knows the secret keys of all clients and servers on the network.
A)True
B)False
Q3) The "something a person has" authentication mechanism takes advantage of something inherent in the user that is evaluated using biometrics.
A)True
B)False
Q4) What is the next phase of the preattack data gathering process after an attacker has collected all of an organization's Internet addresses?
A) Footprinting
B) Content filtering
C) Deciphering
D) Fingerprinting
Q5) What is a packet sniffer and how can it be used for good or nefarious purposes?
Q6) List the most common firewall implementation architectures.
Page 15
To view all questions and flashcards with answers, click on the resource link above.