Security Risk Management Final Exam

Course Introduction

Security Risk Management explores the principles and practices involved in identifying, assessing, and mitigating risks to organizational assets, information, and operations. This course examines the frameworks and methodologies used to analyze vulnerabilities and threats, as well as strategies for implementing effective risk controls and response plans. Students will learn about risk assessment tools, legal and regulatory considerations, and the role of security policies in both the public and private sectors. Emphasis is placed on real-world case studies and contemporary challenges, equipping students with the skills to make informed decisions that protect people, property, and information in diverse environments.

Recommended Textbook

Principles of Information Security 6th Edition by Michael E. Whitman Available Study Resources on Quizplus

Verified Questions

Flashcards

Source URL: https://quizplus.com/study-set/2123 Page 2

Chapter 1: Introduction to Information Security

Available Study Resources on Quizplus for this Chatper

87 Verified Questions

87 Flashcards

Source URL: https://quizplus.com/quiz/42300

Sample Questions

Q1) Hardware is often the most valuable asset possessed by an organization, and it is the main target of intentional attacks.

A)True

B)False

Answer: False

Q2) The ____ is the individual primarily responsible for the assessment, management, and implementation of information security in the organization.

A) ISO

B) CIO

C) CISO

D) CTO

Answer: C

Q3) Hardware is the physical technology that houses and executes the software, stores and transports the data, and provides interfaces for the entry and removal of information from the system. _________________________

A)True

B)False

Answer: True

To view all questions and flashcards with answers, click on the resource link above. Page 3

Chapter 2: The Need for Security

Available Study Resources on Quizplus for this Chatper

91 Verified Questions

91 Flashcards

Source URL: https://quizplus.com/quiz/42301

Sample Questions

Q1) Cyberterrorists hack systems to conduct terrorist activities via network or Internet pathways. _________________________

A)True

B)False

Answer: True

Q2) One form of online vandalism is ____________________ operations, which interfere with or disrupt systems to protest the operations, policies, or actions of an organization or government agency.

A) hacktivist

B) phreak

C) hackcyber

D) cyberhack

Answer: A

Q3) Organizations can use dictionaries to regulate password selection during the reset process and thus guard against easy-to-guess passwords.

A)True

B)False

Answer: True

To view all questions and flashcards with answers, click on the resource link above.

Chapter 3: Legal, Ethical, and Professional Issues in Information Security

Available Study Resources on Quizplus for this Chatper

83 Verified Questions

83 Flashcards

Source URL: https://quizplus.com/quiz/42302

Sample Questions

Q1) Laws, policies, and their associated penalties only provide deterrence if, among other things, potential offenders fear the probability of a penalty being applied.

A)True

B)False

Answer: True

Q2) Criminal laws address activities and conduct harmful to society and is categorized as private or public.

A)True

B)False

Answer: True

Q3) The code of ethics put forth by (ISC)2 focuses on four mandatory canons: "Protect society, the commonwealth, and the infrastructure; act honorably, honestly, justly, responsibly, and legally; provide diligent and competent service to principals; and advance and protect the profession." _________________________

A)True

B)False

Answer: True

To view all questions and flashcards with answers, click on the resource link above. Page 5

Chapter 4: Planning for Security

Available Study Resources on Quizplus for this Chatper

109 Verified Questions

109 Flashcards

Source URL: https://quizplus.com/quiz/42303

Sample Questions

Q1) NIST Special Publication 800-18 Rev. 1, The Guide for Developing Security Plans for Federal Information Systems, includes templates for major application security plans, and provides detailed methods for assessing, designing, and implementing controls and plans for applications of varying size.

A)True

B)False

Q2) Each policy should contain procedures and a timetable for periodic review.

A)True

B)False

Q3) A service bureau is an agency that provides a service for a fee.

A)True

B)False

Q4) Incident ____________________ is the set of activities taken to plan for, detect, and correct the impact of an incident on information assets.

Q5) A(n) ____________________ is a scripted description of an incident-usually just enough information so that each individual knows what portion of the IRP to implement, and not enough to slow down the notification process.

To view all questions and flashcards with answers, click on the resource link above. Page 6

Chapter 5: Risk Management

Available Study Resources on Quizplus for this Chatper

108 Verified Questions

108 Flashcards

Source URL: https://quizplus.com/quiz/42304

Sample Questions

Q1) A(n) qualitative assessment is based on characteristics that do not use numerical measures. _________________________

A)True

B)False

Q2) Likelihood is the probability that a specific vulnerability within an organization will be the target of an attack. _________________________

A)True

B)False

Q3) A _________ assigns a status level to employees to designate the maximum level of classified data they may access.

A) security clearance scheme

B) data recovery scheme

C) risk management scheme

D) data classification scheme

Q4) The value of information to the organization's competition should influence the asset's valuation.

A)True

B)False

Q5) Behavioral feasibility is also known as ____________________.

To view all questions and flashcards with answers, click on the resource link above. Page 7

Chapter 6: Security Technology: Access Controls, Firewalls, and VPNS

Available Study Resources on Quizplus for this Chatper

106 Verified Questions

106 Flashcards

Source URL: https://quizplus.com/quiz/42305

Sample Questions

Q1) __________ filtering requires that the firewall's filtering rules for allowing and denying packets are developed and installed with the firewall.

A) Dynamic

B) Static

C) Stateful

D) Stateless

Q2) The application layer proxy firewall is capable of functioning both as a firewall and an application layer proxy server.

A)True

B)False

Q3) Access control is achieved by means of a combination of policies, programs, and technologies. _________________________

A)True

B)False

Q4) Firewalls operate by examining a data packet and performing a comparison with some predetermined logical rules. _________________________

A)True

B)False

Page 8

To view all questions and flashcards with answers, click on the resource link above.

Chapter 7: Security Technology: Intrusion Detection and

Prevention Systems, and Other Security Tools

Available Study Resources on Quizplus for this Chatper

107 Verified Questions

107 Flashcards

Source URL: https://quizplus.com/quiz/42306

Sample Questions

Q1) A(n) __________ is a software program or hardware appliance that can intercept, copy, and interpret network traffic.

A) packet scanner

B) packet sniffer

C) honeypot

D) honey packet

Q2) __________ benchmark and monitor the status of key system files and detect when an intruder creates, modifies, or deletes monitored files.

A) NIDPSs

B) HIDPSs

C) AppIDPSs

D) SIDPSs

Q3) Most network behavior analysis system sensors can be deployed in __________ mode only, using the same connection methods as network-based IDPSs.

A) passive

B) active

C) reactive

D) dynamic

Q4) A signature-based IDPS is sometimes called a(n) ____________________-based IDPS.

To view all questions and flashcards with answers, click on the resource link above. Page 9

Chapter 8: Cryptography

Available Study Resources on Quizplus for this Chatper

109 Verified Questions

109 Flashcards

Source URL: https://quizplus.com/quiz/42307

Sample Questions

Q1) __________ is the entire range of values that can possibly be used to construct an individual key.

A) Code

B) Keyspace

C) An algorithm

D) A cryptogram

Q2) To encipher means to decrypt, decode, or convert ciphertext into the equivalent plaintext. _________________________

A)True

B)False

Q3) __________ is an integrated system of software, encryption methodologies, protocols, legal agreements, and third-party services that enables users to communicate securely.

A) MAC

B) PKI

C) DES

D) AES

Q4) Netscape developed the ____________________ Layer protocol to use public-key encryption to secure a channel over the Internet, thus enabling secure communications.

Page 10

To view all questions and flashcards with answers, click on the resource link above.

Chapter 9: Physical Security

Available Study Resources on Quizplus for this Chatper

77 Verified Questions

77 Flashcards

Source URL: https://quizplus.com/quiz/42308

Sample Questions

Q1) A wet-pipe system is usually considered appropriate in computer rooms.

A)True

B)False

Q2) In the __________ UPS, the internal components of the standby models are replaced with a pair of inverters and converters.

A) line-interactive

B) ferroresonant

C) true online

D) offline

Q3) Standby power supply (SPS) UPSs provide power conditioning.

A)True

B)False

Q4) Some sprinkler systems, called _________________________ systems, keep all individual sprinkler heads open; as soon as the system is activated, water is immediately applied to all areas.

Q5) Keycard readers based on smart cards are often used to secure computer rooms, communications closets, and other restricted areas.

A)True

B)False

To view all questions and flashcards with answers, click on the resource link above. Page 11

Chapter 10: Implementing Information Security

Available Study Resources on Quizplus for this Chatper

78 Verified Questions

78 Flashcards

Source URL: https://quizplus.com/quiz/42309

Sample Questions

Q1) Tasks or action steps that come after the task at hand are called __________.

A) predecessors

B) successors

C) children

D) parents

Q2) Planners need to estimate the effort required to complete each task, subtask, or action step in the project plan.

A)True

B)False

Q3) The size of the organization and the normal conduct of business may preclude a large training program on new security procedures or technologies.

A)True

B)False

Q4) The optimal time frame for training is usually one to three weeks before the new policies and technologies come online. _________________________

A)True

B)False

Q5) What minimum attributes for project tasks does the WBS document

To view all questions and flashcards with answers, click on the resource link above. Page 12

Chapter 11: Security and Personnel

Available Study Resources on Quizplus for this Chatper

77 Verified Questions

77 Flashcards

Source URL: https://quizplus.com/quiz/42310

Sample Questions

Q1) CompTIA offers a vendor-specific certification program called the Security+ certification.

A)True

B)False

Q2) The CISSP-ISSEP concentration focuses on the knowledge areas that are part of enterprise security management.

A)True

B)False

Q3) __________ is a cornerstone in the protection of information assets and in the prevention of financial loss.

A) Fire suppression

B) Business separation

C) Separation of duties

D) Collusion

Q4) ISSEP stands for Information Systems Security Experienced Professional.

A)True

B)False

Q5) Describe the concept of separation of duties.

To view all questions and flashcards with answers, click on the resource link above. Page 13

Chapter 12: Information Security Maintenance

Available Study Resources on Quizplus for this Chatper

116 Verified Questions

116 Flashcards

Source URL: https://quizplus.com/quiz/42311

Sample Questions

Q1) Documentation procedures are not required for configuration and change management processes.

A)True

B)False

Q2) Almost all aspects of a company's environment are ____________________, meaning threats that were originally assessed in the early stages of the project's systems development life cycle have probably changed and new priorities have emerged.

Q3) An effective information security governance program requires constant change. _________________________

A)True

B)False

Q4) The basic function of the external monitoring process is to monitor activity, report results, and escalate warnings. _________________________

A)True

B)False

Q5) __________ is the coherent application of methodical investigatory techniques to present evidence of crimes in a court or similar setting.

To view all questions and flashcards with answers, click on the resource link above. Page 14