Developing Cybersecurity Programs and Policies, 3rd Edition Omar Santos Test Bank

Type:

Test Bank

Resource:

Developing Cybersecurity Programs and Policies

Edition:

3rd Edition

Author(s):

Omar Santos

Developing Cybersecurity Programs and Policies (Santos) Chapter 1 Understanding Cybersecurity Policy and Governance 1) Which of the following elements ensures a policy is enforceable?

A) Compliance can be measured.

B) Appropriate sanctions are applied when the policy is violated.

C) Appropriate administrative, technical, and physical controls are put in place to support the policy.

D) All of the above Answer: D 2) FERPA protects which of the following?

A) Medical records B) Educational records C) Personally identifiable information D) Financial records Answer: B 3) Which of the following is an example of an information asset?

A) Business plans B) Employee records C) Company reputation D) All of the above Answer: D 4) Policy implementation and enforcement are part of which of the following phases of the cybersecurity policy life cycle?

A) Develop B) Review C) Adopt D) Publish Answer: C 5) Which of the following is the correct order of the policy life cycle?

A) Review, develop, adopt, publish B) Develop, publish, adopt, review C) Publish, develop, review, adopt D) Review, adopt, develop, publish Answer: B 6) Endorsed is one of the seven policy characteristics. Which of the following statements best describes endorsed?

A) The policy is supported by management.

B) The policy is accepted by the organization’s employees.

C) The policy is mandatory; compliance is measured; and appropriate sanctions are applied.

D) The policy is regulated by the government.

Answer: A 1 .

7) Which of the following is the outcome of policy review?

A) Retirement or renewal B) Retirement or reauthorization C) Renewal or reauthorization D) None of the above Answer: B 8) How often should policies be reviewed?

A) Monthly B) Twice a year C) Annually D) Never Answer: C 9) Which of the following statements is not true?

A) Policies should require only what is possible.

B) Policies that are no longer applicable should be retired.

C) All guiding principles and corporate cultures are good.

D) Guiding principles set the tone for a corporate culture.

Answer: C 10) Which of the following is not one of the tasks of the policy development phase?

A) Approve B) Write C) Communicate D) Authorize Answer: C 11) The United States Department of Homeland Security defines how many critical infrastructure sectors?

A) 16 B) 14 C) 20 D) 17 Answer: A 12) Which of the following is the seminal tool used to protect both our critical infrastructure and our individual liberties?

A) Information security B) Society C) Physical security D) Policy Answer: D

2 .

13) Which of the following can be defined as the shared attitudes, goals, and practices that characterize a company, corporation, or institution?

A) Regulations B) Corporate culture C) Cybersecurity policy D) Guiding principles Answer: B 14) Which of the following is a collection of articles and amendments that provide a framework for the American government and define citizens’ rights?

A) The Constitution B) The Torah C) Data Protection Act D) Consumer Credit Act Answer: A 15) Which layer in the defense-in-depth strategy includes firewalls, IDS/IPS devices, segmentation, and VLANs? A) Physical security B) Network security C) Perimeter security D) Application security Answer: C 16) Which of the following is another term for statutory law?

A) Legislation B) Regulation C) Policy D) Governance Answer: A 17) Which of the following federal legislations, also known as the Financial Modernization Act of 1999, was created to reform and modernize the banking industry by eliminating existing barriers between banking and commerce?

A) HITECH B) HIPAA C) FERPA D) GLBA Answer: D 18) Which major regulation entity within the European Union (EU) was created to maintain a single standard for data protection among all member states in the EU? A) Directive on Security of Network and Information Systems (the NIS Directive) B) EU General Data Protection Regulation (GDPR) C) European Union Agency for Network and Information Security (ENISA) D) The Consumer Credit Regulations 2010 Answer: B 3 .

19) Which key task in the policy development phase requires the authors to consult with internal and external experts, including legal counsel, human resources, compliance, cybersecurity and technology professionals, auditors, and regulators?

A) Writing B) Authorizing C) Vetting D) Planning Answer: C 20) Which key task in the policy adoption phase is the busiest and most challenging task of all?

A) Implementation B) Enforcement C) Monitoring D) Education Answer: A

4 .

Developing Cybersecurity Programs and Policies (Santos) Chapter 2 Cybersecurity Policy Organization, Format, and Styles 1) Which of the following is not an example of a standard?

A) Passwords must include at least one special character.

B) Passwords must not include repeating characters.

C) Pass phrases make good passwords.

D) Passwords must not include the user’s name.

Answer: C 2) Which of the following version numbers is an example of a major policy revision?

A) 3.5 B) 4.0 C) 4.1 D) 5.1 Answer: B 3) Which of the following version numbers would indicate a minor revision?

A) IV B) 2.0 C) 2.1 D) 3.0 Answer: C 4) Where is the policy introduction located in a consolidated policy document?

A) In a separate document B) Before the version control table C) At the beginning of the document D) After the version control table Answer: D 5) What is the purpose of the administrative notations section of a policy?

A) To refer the reader to additional information B) To explain terms, abbreviations, and acronyms used in the policy C) To provide the policy version number D) To provide information about policy exceptions Answer: A 6) What is the purpose of the policy definition section?

A) To provide information about policy exceptions B) To refer the reader to additional information C) To explain terms, abbreviations, and acronyms used in the policy D) To provide the policy version number Answer: C

1 .

7) Which of the following statements about standards and guidelines is true?

A) Standards are mandatory, whereas guidelines are not.

B) Guidelines are mandatory, whereas standards are not.

C) Both standards and guidelines are mandatory.

D) Neither standards nor guidelines are mandatory.

Answer: A 8) Which of the following procedure formats is best suited when there is a decision-making process associated with a task?

A) Simple Step B) Flowchart C) Hierarchical D) Graphic Answer: B 9) Which of the following best describes a baseline?

A) Specifications for implementation of a policy B) Instructions on how a policy is carried out C) Application of a standard to a specific category or grouping D) Teaching tools that help people conform to a policy Answer: C 10) Which of the following best describes a procedure?

A) Application of a standard to a specific category or grouping B) Instructions on how a policy is carried out C) Teaching tools that help people conform to a policy D) Specifications for implementation of a policy Answer: B 11) Which of the following statements about policies and standards is true?

A) Policies are mandatory, whereas standards are not.

B) Standards are mandatory, whereas policies are not.

C) Both policies and standards are mandatory.

D) Neither policies nor standards are mandatory.

Answer: C 12) Which of the following is the topmost object in the policy hierarchy?

A) Standards B) Baselines C) Procedures D) Guiding Principles Answer: D

2 .

13) Which of the following is one of the ten plain language techniques for policy writing?

A) Use passive voice.

B) Include redundant pairs or modifiers.

C) Use long sentences.

D) Limit a paragraph to one subject.

Answer: D 14) Which of the following is not one of the plain language techniques for policy writing?

A) Use active voice.

B) Write short sentences.

C) Use “shall” instead of “must.”

D) Avoid double negatives.

Answer: C 15) What is the purpose of the policy exceptions section of a policy document?

A) To acknowledge exclusions B) To track changes C) To convey intent D) To identify the topic Answer: A 16) Which of the following refers to the relationship between a policy and its supporting documents?

A) Policy format B) Policy hierarchy C) Policy audience D) Policy objectives Answer: B 17) Which of the following identifies a policy by name and provides the reader with an overview of the policy topic or category?

A) Policy heading B) Policy goal C) Policy objective D) Policy statement Answer: A 18) Which of the following is best thought of as a high-level directive or strategic roadmap?

A) Policy objective B) Policy heading C) Policy statement D) Policy goal Answer: C

3 .

19) A(n) __________ or waiver process is required for exceptions identified after a policy has been authorized.

A) administrative notation B) policy statement C) policy definition D) exemption Answer: D 20) Where are the policy definitions located in a consolidated policy document?

A) At the beginning of the document B) At the end of the document C) Just after the policy heading D) In a separate document Answer: B

4 .

Developing Cybersecurity Programs and Policies (Santos) Chapter 3 Cybersecurity Framework 1) Which of the following is a network of the national standards institutes of more than 160 countries?

A) ISO B) NIST C) FIPS D) IEC Answer: A 2) Which of the following is the official publication series for NIST standards and guidelines?

A) ITL bulletins B) FIPS C) Special Publication 800 series D) NIST Internal or Interagency reports Answer: B 3) Which of the following key information security principles traces actions to their source?

A) Accountability B) Assurance C) Authorization D) Accounting Answer: A 4) Which of the following key information security principles grants users and systems a predetermined level of access to information resources?

A) Assurance B) Authentication C) Authorization D) Accountability Answer: C 5) Which of the following is a behavioral control that can be used to safeguard against the loss of integrity?

A) Rotation of duties B) Log analysis C) Code testing D) Digital signatures Answer: A 6) Which of the following is a monitoring control that safeguards against the loss of integrity?

A) File integrity monitoring B) Separation of duties C) Encryption D) Digital signatures Answer: A 1 .

7) Which of the following are the three elements of the CIA triad?

A) Authentication, integrity, confidentiality B) Availability, integrity, confidentiality C) Access, integrity, confidentiality D) Authorization, integrity, confidentiality Answer: B 8) Which of the following refers to a computer used in a DDoS attack?

A) Botnet B) Victim C) Bot D) Handler Answer: C 9) Which of the following statements best describes NIST? A) A regulatory government organization that enforces standards B) A coalition of over 160 countries that creates standards C) A nonregulatory federal agency that develops and promotes standards D) A nongovernment organization that develops and promotes standards Answer: C 10) Which of the following best describes the accounting key information security principle?

A) The logging of access and usage of information resources B) The configuring of the Security log to record events C) The process of tracing actions to their source D) The process of identifying users who seek access to secure information Answer: A 11) Which of the following best describes the accountability key information security principle?

A) The logging of access and usage of information resources B) The configuring of the Security log to record events C) The process of tracing actions to their source D) The process of identifying users who seek access to secure information Answer: C 12) Which of the following can achieve authentication in information security?

A) Intrusion detection systems B) Log files C) Auditing D) Tokens Answer: D

2 .

13) Which of the following refers to the requirement that private or confidential information not be disclosed to unauthorized individuals?

A) Availability B) Confidentiality C) Integrity D) Control Answer: B 14) Which of the following is an example of a security mechanism designed to preserve confidentiality?

A) Controlled traffic routing B) Logical and physical access controls C) Database views D) All of the above Answer: D 15) CVSS is short for which of the following?

A) Confidential Vulnerability Secure System B) Common Vulnerability Secure System C) Common Vulnerability Scoring System D) Confidential Vulnerability Scoring System Answer: C 16) Which of the following is not one of the “Five A’s” of information security?

A) Availability B) Assurance C) Authorization D) Authentication Answer: A 17) Which of the following is a collective term given to guidance on topics related to information systems security, predominantly regarding the planning, implementing, managing, and auditing of overall information security practices?

A) Service level agreements B) Security framework C) “Five A’s” of information security D) CIA security model Answer: B 18) The ISO 27002 standard has its origins in which of the following countries?

A) France B) United States C) Germany D) Great Britain Answer: D

3 .

19) Which of the following NIST publications focuses on cybersecurity practices and guidelines?

A) Special Publication 1800 series B) FIPS C) ITL bulletins D) NIST Internal or Interagency reports Answer: A 20) Which of the following refers to those responsible for implementing, maintaining, and monitoring safeguards and systems?

A) Network engineers B) System administrators C) Webmasters D) All of the above Answer: D

4 .

Developing Cybersecurity Programs and Policies (Santos) Chapter 4 Governance and Risk Management 1) Which of the following is a characteristic of the silo-based approach to cybersecurity?

A) Compliance is discretionary.

B) Security is the responsibility of the IT department.

C) Little or no organizational accountability exists.

D) All of the above Answer: D 2) At which of the following states of the CMM scale are there no documented policies and processes?

A) Ad hoc B) Defined process C) Optimized D) Nonexistent Answer: A 3) Which of the following best describes residual risk?

A) The likelihood of occurrence of a threat B) The level of risk before security measures are applied C) The level of risk after security measures are applied D) The impact of risk if a threat is realized Answer: C 4) Which of the following statements best describes risk transfer?

A) It shifts a portion of the risk responsibility or liability to other organizations.

B) It shifts the entire risk responsibility to other organizations.

C) It takes steps to eliminate or modify the risk.

D) None of the above Answer: A 5) Which of the following is the objective of risk assessment?

A) Identify the inherent risk B) Determine the impact of a threat C) Calculate the likelihood of a threat occurrence D) All of the above Answer: D 6) Which of the following risk assessment methodologies was originally developed by CERT? A) FAIR B) OCTAVE C) RMF D) CMM Answer: B

1 .

7) Which of the following risks relates to negative public opinion?

A) Operational risk B) Strategic risk C) Financial risk D) Reputational risk Answer: D 8) Which of the following statements best describes strategic risk?

A) Risk that relates to monetary loss B) Risk that relates to adverse business decisions C) Risk that relates to loss resulting from inadequate or failed processes or systems D) Risk that relates to violations of laws, rules, regulations, or policy Answer: B 9) Which of the following is the magnitude of harm?

A) Risk B) Threat C) Impact D) Vulnerability Answer: C 10) The two approaches to cybersecurity are silo-based and __________.

A) integrated B) operational C) environmental D) strategic Answer: A 11) Which of the following refers to directives that codify organizational requirements?

A) Guidelines B) Standards C) Policies D) Baselines Answer: C 12) Which of the following is the leading membership organization for Boards and Directors in the U.S.?

A) ISO B) NIST C) CERT D) NACD Answer: D

2 .

13) Which of the following is a systematic, evidence-based evaluation of how well an organization conforms to such established criteria as Board-approved policies, regulatory requirements, and internationally recognized standards, such as the ISO 27000 series?

A) Audit report B) Cybersecurity audit C) CMM D) CISA Answer: B 14) In the NIST Cybersecurity Framework, which governance subcategory references legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations?

A) ID.GV-1 B) ID.GV-2 C) ID.GV-3 D) ID.GV-4 Answer: C 15) Which of the following refers to how much of the undesirable outcome a risk taker is willing to accept in exchange for the potential benefit?

A) Risk tolerance B) Risk mitigation C) Risk management D) Risk acceptance Answer: A 16) Which of the following refers to the level of risk before security measures are applied?

A) Residual risk B) Vulnerability C) Inherent risk D) Impact Answer: C 17) Which of the following is the final step in the NIST Risk Assessment methodology?

A) Communicate the results.

B) Prepare for the assessment.

C) Conduct the assessment.

D) Maintain the assessment.

Answer: D 18) Which of the following refers to the process of managing, directing, controlling, and influencing organizational decisions, actions, and behaviors?

A) Governance B) Risk sharing C) Risk management D) CMM Answer: A 3 .

19) OCTAVE is short for which of the following?

A) Operationally Critical Threat, Assessment, and Vulnerability Evaluation B) Operationally Critical Threat, Asset, and Vulnerability Evaluation C) Optimized Critical Threat, Assessment, and Vulnerability Evaluation D) Optimized Critical Threat, Asset, and Vulnerability Evaluation Answer: B 20) Which of the following provides a model for understanding, analyzing, and quantifying information risk in quantitative financial and business terms?

A) RMF B) NIST C) FAIR D) OCTAVE Answer: C

4 .

Developing Cybersecurity Programs and Policies (Santos) Chapter 5 Asset Management and Data Loss Prevention 1) Which of the following statements best describes the Biba security model?

A) No read up, no write up B) No write up, no write down C) No read up, no write down D) No read down, no write up Answer: D 2) Which of the following best described the Bell-Lapadula security model?

A) No read up, no write up B) No write up, no write down C) No read up, no write down D) No read down, no write up Answer: C 3) A Social Security number would be classified in which of the following levels under the private sector classification system?

A) Internal use B) Protected C) Confidential D) Public Answer: B 4) Which of the following would most likely be classified as confidential information under the private sector classification system?

A) Laboratory research B) Social Security number C) List of upcoming trade shows D) Nonsensitive client or vendor information Answer: A 5) Which of the following is not one of the classification levels for national security information?

A) Secret B) Protected C) Confidential D) Unclassified Answer: B 6) Which of the following is not one of the classification levels for private sector information?

A) Protected B) Secret C) Internal use D) Public Answer: B 1 .

7) Which of the following statements describes reclassification?

A) The process of changing the classification level to a lower level B) The process of removing a classification C) The process of assigning a classification D) The process of upgrading a classification Answer: D 8) Which if the following statements best describes declassification?

A) The process of upgrading a classification B) The process of assigning a new classification C) The process of downgrading sensitivity levels D) The process of removing a classification Answer: C 9) Which of the following is a hardware identification number that uniquely identifies a device?

A) IP domain name B) MAC address C) IPv4 address D) IPv6 address Answer: B 10) A MAC address uses which of the following formats?

A) Hexadecimal B) Binary C) Decimal D) Unicode Answer: A 11) Which of the following refers to the unauthorized or unintentional modification or destruction of information?

A) Loss of availability B) Loss of confidentiality C) Loss of control D) Loss of integrity Answer: D 12) Which of the following is not one of the responsibilities of a data owner?

A) Assigning the economic or business value to the asset B) Implementing security controls for the asset C) Defining the level of protection required for the asset D) Deciding who should have access to the asset Answer: B

2 .

13) The objective of an __________ is to differentiate data types to enable organizations to safeguard CIA based on content.

A) asset classification policy B) information ownership policy statement C) information classification system D) inventory information systems Answer: C 14) Which of the following means the loss of CIA could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals?

A) High potential impact B) Moderate potential impact C) Low potential impact D) No potential impact Answer: C 15) Which of the following classification levels for national security information refers to any information or material the unauthorized disclosure of which reasonably could be expected to cause serious damage to the national security?

A) Secret B) Confidential C) Protected D) Top secret Answer: A 16) Which of the following informs custodians and users how to treat the information they use and the systems they interact with?

A) Processing standards B) Handling standards C) Organizational standards D) Classification standards Answer: B 17) Which of the following refers to visible and tangible pieces of equipment and media, such as computer equipment and storage media?

A) Operating system software B) Software assets C) Productivity software D) Hardware assets Answer: D

3 .

18) Which of the following refers to programs or code that provide the interface between the hardware, the users, and the data?

A) Software assets B) Hardware assets C) Infrastructure equipment D) Printers Answer: A 19) Which of the following is designed to implement the business rules of the organization and is often custom-developed?

A) Productivity software B) Operating system software C) Application software D) Software assets Answer: C 20) Which data type protected by DLP includes patent applications, product design documents, the source code of software, research information, and customer data?

A) Personally Identifiable Information (PII) B) Intellectual Property (IP) C) Nonpublic Information (NPI) D) None of the above Answer: B

4 .

Developing Cybersecurity Programs and Policies (Santos) Chapter 6 Human Resources Security 1) Why shouldn’t information about specific systems be included in a job description?

A) To make sure candidates know all systems B) To protect against social engineering and other attacks C) To get as many candidates as possible D) To get more knowledgeable candidates Answer: B 2) During what step of the employee life cycle are employees added to the organization’s benefit system?

A) Recruitment B) Onboarding C) User provisioning D) Orientation Answer: B 3) Which of the following is part of the user provisioning phase of the employee life cycle?

A) The employee is added to the organization’s payroll.

B) The employee is provided with a username or smart card.

C) A background check is conducted for the employee.

D) The employee expectations of privacy are determined.

Answer: B 4) Which of the following steps of the employee life cycle is considered the most dangerous?

A) Termination B) Onboarding C) Recruitment D) User provisioning Answer: A 5) Which of the following best describes the purpose of security awareness?

A) To teach skills that would allow a person to perform a certain function B) To focus attention on security C) To integrate all the security skills and competencies into a common body of knowledge D) To involve management in the process Answer: B 6) Which stage of the employee life cycle includes all the processes leading up to and including the hiring of a new employee?

A) Onboarding B) Career development C) Recruitment D) Orientation Answer: C 1 .

7) Which of the following best describes the purpose of security training?

A) To teach skills that would allow a person to perform a certain function B) To focus attention on security C) To integrate all the security skills and competencies into a common body of knowledge D) To involve management in the process Answer: A 8) Which of the following statements about security awareness is not true?

A) The purpose of security awareness is to focus attention on security.

B) Awareness is training.

C) Security awareness programs are designed to remind users of appropriate behaviors.

D) A poster reminding users not to write their password down is an example of an awareness program.

Answer: B 9) During what stage of the employee life cycle are user accounts disabled?

A) Career development B) Termination C) User provisioning D) Onboarding Answer: B 10) Which of the following sections of the Acceptable Use Agreement dictates how information must be stored, transmitted, and communicated?

A) Introduction B) Data classification C) Applicable policy statements D) Handling standards Answer: D 11) Which of the following specifies that schools must have written permission to release any information from a student’s education record?

A) FACTA B) FCRA C) FERPA D) DPPA Answer: C 12) SETA is short for which of the following?

A) Security Education, Training, and Awareness B) Social Education, Training, and Application C) Security Education, Training, and Application D) Social Education, Training, and Awareness Answer: A

2 .

13) Which stage of the employee life cycle includes the process for transitioning employees out of an organization?

A) Termination B) Off-boarding C) User provisioning D) Onboarding Answer: B 14) Which type of employee background check includes verification of all relevant licenses, certifications, or credentials?

A) Educational B) License/certification C) Employment D) Criminal history Answer: B 15) Which phase in obtaining a U.S. government security clearance includes a comprehensive background check?

A) Application phase B) Adjudication phase C) Investigative phase D) Granting (or denial) of clearance at a specific level Answer: C 16) An employee should learn about which of the following during orientation?

A) The company B) The job C) Their co-workers D) All of the above Answer: D 17) A confidentiality agreement for employees, contractors, and outsourcers is also known as which of the following?

A) Non-disclosure agreement B) Acceptable use agreement C) Handling standards D) Internet access security Answer: A 18) Which component of an acceptable use agreement defines (and includes examples of) the classification schema adopted by the organization?

A) Introduction B) Data classifications C) Applicable policy statements D) Handling standards Answer: B 3 .

19) In which stage of the employee life cycle does the employee settle into the job, integrate with the corporate culture, and establish his or her role within the organization?

A) Onboarding B) Career development C) User provisioning D) Orientation Answer: D 20) Which of the following NIST publications is known as The NIST Handbook?

A) SP 800-12 B) SP 800-16 C) SP 800-50 D) SP 800-100 Answer: A

4 .

Developing Cybersecurity Programs and Policies (Santos) Chapter 7 Physical and Environmental Security 1) Which of the following does not destroy the data on a hard drive?

A) Disk wiping B) Data destruction C) Formatting D) Degaussing Answer: C 2) Which of the following can permanently remove data from a drive?

A) Deleting and formatting B) Deleting and disk wiping C) Formatting and degaussing D) Disk wiping and degaussing Answer: D 3) Which of the following statements best describes hidden files?

A) Temporary storage of web documents, such as HTML pages and downloads B) Files that the operating system by design does not display C) A temporary holding area for files being created D) Files that authorized users can view and access Answer: B 4) Which of the following statements about formatting is not true?

A) System recovery software can be used to restore data from a formatted disk.

B) Formatting permanently deletes the files on a disk.

C) Formatting erases the operating system address tables.

D) All of the above Answer: B 5) Which of the following statements best describes metadata?

A) Information about websites visited B) Files that the operating system by design does not display C) Details about a file that describes or identifies it D) Temporary storage area for web documents Answer: C 6) Which of the following statements best describes a cookie?

A) File with information about websites visited B) File that the operating system by design does not display C) Details about a file that describe or identify it D) Temporary storage area for web documents Answer: A

1 .

7) Which of the following is a temporary storage for web documents such as HTML pages and downloads?

A) Data cache B) Metadata C) Web cache D) Cookies Answer: C 8) Which of the following is an example of a browser-based data?

A) Cookies B) Form history C) Search bar history D) All of the above Answer: D 9) Layered defense for securing facilities is both physical and __________.

A) alarmed B) psychological C) monitored D) structural Answer: B 10) Class C fire extinguishers are best suited for which of the following fires?

A) Computer equipment fires B) Fires in document storage areas C) Fires with liquids and gases D) Fires involving metals Answer: A 11) Class A fire extinguishers are best suited for which of the following fires?

A) Computer equipment fires B) Fires in document storage areas C) Fires with liquids and gases D) Fires involving metals Answer: B 12) The design of a secure site starts with the __________ of the site.

A) scope B) dimensions C) storage needs D) location Answer: D

2 .

13) Which of the following is the first line of defense for fires?

A) Fire detection controls B) Fire prevention controls C) Fire containment controls D) Fire suppression controls Answer: B 14) Which of the following is an example of a fire prevention control?

A) Fire containment equipment B) Fire extinguishers C) Fire suppressors D) Adhering to building and construction codes Answer: D 15) Fences used in perimeter security should be at least how many feet in height?

A) 6 B) 7 C) 8 D) 9 Answer: C 16) BYOD stands for which of the following?

A) Build your own device B) Bring your own device C) Bring your own documentation D) Build your own documentation Answer: B 17) Which of the following refers to a prolonged increase in voltage (minutes or hours)?

A) Power surge B) Power spike C) Sag D) Fault Answer: A 18) Which of the following refers to a prolonged period of power loss (hours or days)?

A) Fault B) Brownout C) Sag D) Blackout Answer: D

3 .

19) Which of the following is defined by NIST as “the result of actions taken to ensure that media cannot be reused as originally intended and that information is virtually impossible to recover or prohibitively expensive.”

A) Data destruction B) Degaussing C) Disk wiping D) Chain of custody Answer: A 20) Which of the following refers to a technique that uses the encryption of target data by enabling sanitization of the target data’s encryption key?

A) Degaussing B) Shoulder surfing C) Cryptographic erase D) Layered defense Answer: C

4 .

Developing Cybersecurity Programs and Policies (Santos) Chapter 8 Communications and Operations Security 1) Which of the following best describes the difference between a virus and a worm?

A) A virus is malicious software that requires a host file to spread itself, whereas a worm is malicious software that does not require a host file to spread itself.

B) A worm is malicious software that requires a host file to spread itself, whereas a virus is malicious software that does not require a host file to spread itself.

C) A virus is malicious software that attaches itself to executable files, whereas a worm is malicious software that attaches itself to an image file.

D) There is no difference between a virus and a worm.

Answer: A 2) Which of the following is an example of a malware prevention control?

A) Real-time firewall detection of suspicious file downloads B) Review and analysis of log files C) User awareness to recognize and report suspicious activity D) Not allowing users to have administrative rights to their workstations Answer: D 3) Which of the following statements best describes a Trojan?

A) Malicious software that hides into the lower levels of the operating system and opens a backdoor B) Malicious software that records every key stroke and mouse movement C) Malicious software that disguises itself as a legitimate program D) Malicious software that takes the computer data hostage to extort money Answer: C 4) Which of the following statements about Trojans is true?

A) Trojans reproduce by infecting other files.

B) Trojans need user interaction to spread.

C) Trojans self-replicate.

D) Trojans are legitimate programs that enhance user experience.

Answer: B 5) Which of the following statements best describes data replication?

A) The process of copying data to another drive weekly B) The process of copying data to a second location that is available for immediate use C) The process of copying and storing data that could be restored to its original location D) The process of copying data to the cloud Answer: B

1 .

6) Which of the following statements about data backup is not true?

A) Backups can be stored in the cloud.

B) Backups can be conducted once a week.

C) Backups do not have to be restored as long as they are stored in the cloud.

D) Backups can be stored to a tape.

Answer: C 7) Which of the following statements about antivirus software is not true?

A) Antivirus software is 100 percent effective against malware intrusions.

B) Antivirus software uses signature-based recognition and behavior-based recognition to detect malware.

C) Antivirus software can detect various types of malware.

D) Antivirus software can detect, contain, or eliminate malware.

Answer: A 8) Which of the following malware takes advantage of a security vulnerability on the same day that the vulnerability becomes known to the public?

A) Ransomware B) Screen scraper C) Bot D) Zero-day exploit Answer: D 9) Which of the following is a snippet of code designed to automate tasks and often used by attackers to carry out denial-of-service attacks?

A) Ransomware B) Screen scraper C) Zero-day exploit D) Bot Answer: D 10) Which of the following is an example of ransomware that takes a computer or its data hostage in an effort to extort money from victims?

A) SpyEye B) WannaCry C) Sapphire D) Slammer Answer: B 11) Which of the following was a worm that infected Microsoft SQL Server 2000 and Microsoft SQL Desktop Engine?

A) Zeus B) SpyEye C) Slammer D) Nyetya Answer: C 2 .

12) Which of the following is an SMB exploit affecting various Windows operating systems from XP to Windows 7 and various versions of Windows Server 2003 and 2008?

A) EternalBlue B) SpyEye C) Slammer D) Zeus Answer: A 13) Which of the following best describes the log analysis technique called trend analysis?

A) Compares log data to known bad activity B) Compares log data to known good activity C) Identifies activity over time that in isolation might appear normal D) Ties individual entries together based on related information Answer: C 14) Which of the following log analysis techniques compares the log entries against a set of known bad activity?

A) Trend analysis B) Signature analysis C) Correlation analysis D) Sequencing analysis Answer: B 15) Which common standard operating procedure (SOP) format should be used for long procedures requiring many decisions?

A) Hierarchical B) Simple step C) Graphical D) Flowchart Answer: D 16) Which of the following refers to an internal procedure by which authorized changes are made to software, hardware, network access privileges, or business processes?

A) Change control B) NIST framework C) Standard operating procedure D) Patch management Answer: A 17) Which of the following is the standard protocol for sending email messages?

A) IPsec B) SSL C) SMTP D) FTP Answer: C

3 .

18) Which of the following is a word, phrase, or image that is programmatically configured to connect to another document, bookmark, or location?

A) Hyperlink B) Log C) Relay D) Metadata Answer: A 19) Which of the following describes the process or methodology used to assess the adequacy of a service provider?

A) Sequencing B) Due care C) Trend analysis D) Due diligence Answer: D 20) Which federal regulation requires financial institutions to protect their customers’ information against security threats?

A) HIPAA B) GLBA C) PCI DSS D) FISMA Answer: B

4 .

Developing Cybersecurity Programs and Policies (Santos) Chapter 9 Access Control Management 1) Which of the following refers to security features that govern how users and processes communicate and interact with systems and resources?

A) Security posture B) Access controls C) Secure authentication D) Identity management Answer: B 2) Which common attribute of all access controls is used to identify unique records in a set, such as a username?

A) Identification scheme B) Authentication method C) Authorization model D) None of the above Answer: A 3) Using a smartcard and a one-time passcode is an example of which of the following authentication methods?

A) Single-factor authentication B) Multifactor authentication C) Multilayer authentication D) Cognitive password authentication Answer: C 4) Which of the following is not an example of authentication by knowledge?

A) Cognitive password B) PIN C) One-time passcode D) Password Answer: C 5) Which of the following is a type of access control that is defined by a policy and cannot be changed by the information owner?

A) Mandatory access control B) Discretionary access control C) Role-based access control D) Rule-based access control Answer: A

1 .

6) Which of the following is an access control that is based on a specific job role or function?

A) Mandatory access control B) Discretionary access control C) Role-based access control D) Rule-based access control Answer: C 7) Providing your mother’s maiden name as verification is an example of which of the following?

A) Multilayer authentication B) One-time passcode C) Multifactor authentication D) Cognitive password Answer: D 8) Which of the following is an example of authentication by characteristic?

A) Smartcard B) Fingerprint scan C) One-time passcode D) Cognitive password Answer: B 9) Which of the following statements best describes object capability?

A) Mandatory access controls embedded in object and subject properties B) Used to determine access based on a combination of specific criteria C) Used programmatically and based on a combination of an unforgettable reference and an operational message D) The process of assigning authenticated subjects permission to carry out a specific task Answer: C 10) Which of the following network types is a segment of the internal network that requires a high degree of protection?

A) Enclave network B) Trusted network C) DMZ D) Guest network Answer: A 11) The Internet is an example of which of the following network types?

A) Guest network B) Untrusted network C) Enclave network D) DMZ Answer: B

2 .

12) Which of the following best describes a firewall?

A) Passive device that analyzes network traffic to detect unauthorized access B) Active device that sits inline with traffic and can respond to intrusions by disabling the connection, dropping the packet, or deleting the malicious content C) A software or hardware device that can filter incoming or outgoing traffic based on specific rules D) A device that monitors the characteristics of a single host and the events occurring on that host Answer: C 13) Which of the following best describes an intrusion prevention system?

A) Passive device that analyzes network traffic to detect unauthorized access B) Active device that sits inline with traffic flow and can respond to intrusions by disabling the connection, dropping the packet, or deleting the malicious content C) A software or hardware device that can filter incoming or outgoing traffic based on specific rules D) A device that monitors the characteristics of a single host and the events occurring on that host Answer: B 14) Which of the following is the most dangerous and unwanted IDS/IPS decision state?

A) False positive B) False negative C) True positive D) True negative Answer: B 15) Which of the following provides a secure tunnel for transmitting data through an insecure network such as the Internet?

A) Remote access portal B) DMZ C) Network access control system D) Virtual private network Answer: D 16) Which of the following provides access to one or more applications through a single centralized interface?

A) Remote access portal B) Virtual private network C) DMZ D) Network access control system Answer: A

3 .

17) Which of the following statements best describes an administrative account control called dual control?

A) Two individuals complete the same task simultaneously.

B) No one individual can control a process from start to finish.

C) Two individuals must both complete their half of a specific task.

D) Two individuals complete different tasks at the same time.

Answer: C 18) Which of the following is an example of a multifactor authentication?

A) A password and a PIN B) A cognitive password and a PIN C) A fingerprint scan and a retina scan D) A smartcard and a retina scan Answer: D 19) Which of the following statements best describes segregation of duties?

A) Two individuals complete the same task simultaneously.

B) No one individual can control a process from start to finish.

C) Two individuals must both complete their half of a specific task.

D) Two individuals complete different tasks at the same time.

Answer: B 20) Using a palm scan for authentication is an example of which of the following?

A) Authentication by knowledge B) Authentication by ownership C) Authentication by characteristic D) Authentication by possession Answer: C

4 .

Developing Cybersecurity Programs and Policies (Santos) Chapter 10 Information Systems Acquisition, Development, and Maintenance 1) Which of the following is used to associate a public key with an identity?

A) Encryption B) Digital hash C) Digital certificate D) Digital signature Answer: C 2) Which of the following statements about asymmetric key cryptography is true?

A) Asymmetric key cryptography uses one shared key.

B) Asymmetric key cryptography is also called private key cryptography.

C) Asymmetric key cryptography uses two keys called public keys.

D) Asymmetric key cryptography is also called public key cryptography.

Answer: D 3) Which of the following issues and maintains digital certificates?

A) Registration authority B) Certification authority C) Public key infrastructure D) Client nodes Answer: B 4) Which of the following tasks is part of the disposal phase of the SDLC? A) Authorization B) Conducting risk assessment C) Archiving information and sanitization of media D) Adding hardware and software Answer: C 5) Identification of compliance requirements is done during which of the following phases of the SDLC? A) Initiation B) Development/acquisition C) Implementation/assessment D) Operations/maintenance Answer: A 6) Which of the following is the most common web application security flaw?

A) Failure to validate output B) Failure to validate input C) Dynamic data validation D) Static data validation Answer: B

1 .

7) Symmetric key cryptography uses which of the following?

A) One public key B) One shared key C) Two public keys D) One public and one private key Answer: B 8) Which of the following is one of the most popular symmetric algorithms of recent years?

A) AES B) RSA C) DES D) IPsec Answer: A 9) Which of the following statements about symmetric key cryptography is not true?

A) Symmetric key cryptography uses one shared key.

B) Symmetric algorithms can provide confidentiality.

C) Symmetric algorithms can provide nonrepudiation and authenticity.

D) Symmetric key cryptography uses a single secret key.

Answer: C 10) Which of the following is a component of PKI? A) Certification authority B) Registration authority C) Client nodes D) All of the above Answer: D 11) Which of the following is the process of creating a numeric value that represents the original text?

A) Encryption B) Decryption C) Hashing D) Key management Answer: C 12) Which of the following provides confidentiality?

A) Encryption B) Decryption C) Hashing D) Key management Answer: A

2 .

13) Public key cryptography uses which of the following?

A) A shared key B) A public key C) A private key D) Both a public and a private key Answer: D 14) Which of the following provides a standardized process for all phases of any system development or acquisition effort?

A) COTS B) SDLC C) NIST D) CIA Answer: B 15) In which phase of the SDLC are systems and products in place and operating, enhancements and/or modifications to the system are being developed and tested, and hardware and software components are added or replaced?

A) Initiation B) Development/acquisition C) Operations/maintenance D) Implementation/assessment Answer: C 16) Which of the following is a hybrid of a beta and a final release version of a software product?

A) Release candidate B) Alpha phase C) General availability D) Go live Answer: A 17) Which of the following is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted?

A) NIST B) GLBA C) MITRE D) OWASP Answer: D 18) Which of the following components of PKI performs the administrative functions, including verifying the identity of users and organizations requesting a digital certificate?

A) Certification authority B) Registration authority C) Client nodes D) Digital certificate Answer: B 3 .

19) Which of the following is not a best practice for cryptographic key management?

A) Keys should be transmitted and stored by secure means.

B) Keys should be properly destroyed when their lifetime ends.

C) Keys should be presented in clear text.

D) Key values should be random, and the full spectrum of the keyspace should be used.

Answer: C 20) Which of the following is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization?

A) ISO B) SAMM C) OWASP D) SDLC Answer: B

4 .

Developing Cybersecurity Programs and Policies (Santos) Chapter 11 Cybersecurity Incident Response 1) Which of the following statements is not true?

A) Employees should report all actual incidents.

B) Employees should report all suspected incidents.

C) Employees should assign a severity level when reporting incidents.

D) Employees should not be reprimanded if they report a perceived incident that ends up being a false positive.

Answer: C 2) Which of the following is an example of a Severity Level 2 incident?

A) Malware detected on multiple systems B) User’s excessive use of bandwidth or resources C) Compromise or suspected compromise of any company website or web presence D) Compromise or suspected compromise of protected customer information Answer: A 3) Which of the following is an example of a Severity Level 1 incident?

A) Inappropriate access to legally protected or proprietary information B) Malware detected on multiple systems C) User access to content or sites restricted by policy D) Any act that is in direct violation of local, state, or federal law or regulation Answer: D 4) Which of the following is an example of a Severity Level 3 incident?

A) Malware detected on multiple systems B) User’s excessive use of bandwidth or resources C) Compromise or suspected compromise of any company website or web presence D) Compromise or suspected compromise of protected customer information Answer: B 5) Who must be notified of Severity Level 3 incidents?

A) Chief Executive Officer B) Chief Operating Officer C) Chief Information Security Officer D) Legal counsel Answer: C 6) Which of the following regulations address the protection of personally identifiable information?

A) HITECH B) FISMA C) GLBA D) All of the above Answer: D 1 .

7) Within what time frame does the HITECH Act require covered entities to notify affected individuals of a data breach of personal healthcare information?

A) 30 days B) 40 days C) 60 days D) 1 week Answer: C 8) Which of the following states does not have security breach law?

A) California B) Massachusetts C) Texas D) None of the above Answer: D 9) Which of the following best describes the preparation phase of the NIST incident response process?

A) Follows a predefined process while documenting each step the analyst takes B) Includes deploying the necessary tools and resources to successfully investigate and resolve cybersecurity incidents C) Includes how to use collected incident data and evidence retention D) Includes choosing a containment strategy to effectively contain and eradicate the attack, as well as to successfully recover from it Answer: B 10) A denial-of-service attack is considered which of the following?

A) Severity Level 1 incident B) Severity Level 2 incident C) Severity Level 3 incident D) Internal incident Answer: A 11) Which of the following is an example of an intentional unauthorized access or use?

A) Clicking a link in an e-mail that happens to contain malware B) Installing a keylogger on a system in an attempt to collect usernames and passwords C) Flooding a system with ping requests in an attempt to take it down D) Viewing medical records to satisfy one’s curiosity Answer: B 12) Which of the following is an example of a denial-of-service attack?

A) Clicking a link in an e-mail that happens to contain malware B) Installing a keylogger on a system in an attempt to collect usernames and passwords C) Flooding a system with ping requests in an attempt to take it down D) Viewing medical records to satisfy one’s curiosity Answer: C 13) Which of the following best describes the post-incident activity phase of the NIST incident 2 .

response process?

A) Follows a predefined process while documenting each step the analyst takes B) Includes deploying the necessary tools and resources to successfully investigate and resolve cybersecurity incidents C) Includes how to use collected incident data and evidence retention D) Includes choosing a containment strategy to effectively contain and eradicate the attack, as well as to successfully recover from it Answer: C 14) Which of the following best describes the detection and analysis phase of the NIST incident response process?

A) Follows a predefined process while documenting each step the analyst takes B) Includes deploying the necessary tools and resources to successfully investigate and resolve cybersecurity incidents C) Includes how to use collected incident data and evidence retention D) Includes choosing a containment strategy to effectively contain and eradicate the attack, as well as to successfully recover from it Answer: A 15) Which of the following are the steps in a digital forensic analysis according to NIST Special Publication 800-87?

A) Collection, acquisition, security, reporting B) Collection, examination, analysis, reporting C) Collection, security, analysis, reporting D) Collection, analysis, reporting, testifying Answer: B 16) Which method of evidence preservation involves using a mesh of conducting material that prevents devices from communicating via Wi-Fi or cellular signals?

A) Forensic image file B) Chain of custody C) Encryption D) Faraday cage Answer: D 17) Which of the following is the final step for an incident response tabletop exercise?

A) Execution B) Preparation C) Report D) Analysis Answer: C

3 .

18) During the investigation and resolution of a security incident, you may also need to communicate with outside parties regarding the incident, such as which of the following?

A) CSIRT B) FS-ISAC C) PSIRT D) CERT Answer: B 19) CVSS is short for which of the following?

A) Common Vulnerability Security System B) Computer Vulnerability Scoring System C) Computer Vulnerability Security System D) Common Vulnerability Scoring System Answer: D 20) Which key incident management personnel represents the central point of contact for all incidents?

A) Incident response coordinators B) Designated incident handlers C) Incident response team members D) External advisors Answer: A

4 .

Developing Cybersecurity Programs and Policies (Santos) Chapter 12 Business Continuity Management 1) Which of the following testing exercises are discussion-based only and don’t involve deploying equipment or other resources?

A) Functional exercises B) Full-scale testing C) Tabletop exercises D) Plan audits Answer: C 2) Which of the following best describes a warm site?

A) A backup facility that has power and HVAC but no equipment B) A self-contained unit that has hardware, software, and peripherals C) A fully operational location that is ready for immediate move in and contains all data D) An operational location that contains all equipment but data must be restored Answer: D 3) Which of the following best describes a mobile site?

A) A backup facility that has power and HVAC but no equipment B) A self-contained unit that has hardware, software, and peripherals C) A fully operational location that is ready for immediate move in and contains all data D) An operational location that contains all equipment, but data must be restored Answer: B 4) Which of the following is the total length of time an essential business function can be unavailable without causing significant harm to the organization?

A) Maximum tolerable downtime B) Maximum tolerable uptime C) Recovery time objective D) Recovery point objective Answer: A 5) Which of the following represents the acceptable data loss?

A) Maximum tolerable downtime B) Maximum tolerable uptime C) Recovery time objective D) Recovery point objective Answer: D 6) Which of the following business continuity plans focus on the initial response to a disaster and includes plan activation, notification, evacuation, and communication?

A) Response plans B) Contingency plans C) Recovery plans D) Resumption plans Answer: A 1 .

7) Which of the following business continuity plans focus on the immediate and near-term alternative workplace and business processes?

A) Response plans B) Contingency plans C) Recovery plans D) Resumption plans Answer: B 8) Which of the following is the official notification that the organization is no longer operating in emergency or disaster mode?

A) Validation B) Activation C) Deactivation D) Resumption Answer: C 9) Which of the following statements best describes functional exercises?

A) Testing conducted at the enterprise level with a full simulation of a disaster, suspending all normal operations B) Scenario-driven exercises that are limited in scope to simulate a failure of a critical business function C) Discussion-based exercises that do not involve deploying equipment or other resources D) Systematic walkthrough of the procedures to determine disaster readiness Answer: B 10) Which of the following best describes full-scale testing?

A) Testing conducted at the enterprise level with a full simulation of a disaster, suspending all normal operations B) Scenario-driven exercises that are limited in scope to simulate a failure of a critical business function C) Discussion-based exercises that do not involve deploying equipment or other resources D) Systematic walkthrough of the procedures to determine disaster readiness Answer: A 11) Which of the following is an example of willful damage?

A) Cybercrime B) User or operator error C) Hazardous chemical exposure D) Public health emergency Answer: A

2 .

12) Which of the following business continuity plans guides the organization back to normalcy?

A) Response plans B) Contingency plans C) Recovery plans D) Resumption plans Answer: D 13) Which of the following describes evacuations and shelter-in-place procedures for a threat or incident?

A) Occupant emergency plan (OEP) B) Business continuity threat assessment (BCTA) C) Business continuity risk assessment (BCRA) D) Continuity of operations plan (COOP) Answer: A 14) Which of the following is an example of an operational issue that can lead to an emergency or disaster?

A) Biological accident B) Air contaminants C) Degradation of power D) Sabotage Answer: C 15) A __________ organization is one that has the ability to quickly adapt and recover from known or unknown changes to the environment.

A) dependent B) resistant C) tolerable D) resilient Answer: D 16) Which of the following refers to the maximum amount of time a system resource can be unavailable before there is an unacceptable impact on other system resources or business processes?

A) Maximum tolerable downtime B) Maximum tolerable uptime C) Recovery time objective D) Recovery point objective Answer: C 17) Which of the following individuals or groups is vested by the Board of Directors with the authority to make decisions related to disaster preparation, response, and recovery?

A) Chief Operating Officer B) IT department C) Department managers D) Business Continuity Team Answer: D 3 .

18) Which of the following refers to a location that is fully operational and ready to move into in the event of an emergency or disaster?

A) Hot site B) Warm site C) Cold site D) Mobile site Answer: A 19) Which of the following locations is fully redundant with real-time replication from the production site?

A) Reciprocal site B) Mirrored site C) Mobile site D) Cold site Answer: B 20) Following a disaster, which of the following recovery phases encompasses systems that provide a general operating environment, including environmental and physical controls?

A) Communications recovery B) Facilities recovery C) Infrastructure recovery D) Network recovery Answer: C

4 .

Developing Cybersecurity Programs and Policies (Santos) Chapter 13 Regulatory Compliance for Financial Institutions 1) Which of the following agencies regulates financial institutions not covered by other agencies?

A) Federal Trade Commission (FTC) B) Commodity Futures Trading Commission (CFTC) C) National Credit Union Administration (NCUA) D) Federal Deposit Insurance Corporation (FDIC) Answer: A 2) Which of the following agencies regulates state-chartered banks?

A) Federal Trade Commission (FTC) B) Commodity Futures Trading Commission (CFTC) C) National Credit Union Administration (NCUA) D) Federal Deposit Insurance Corporation (FDIC) Answer: D 3) The Federal Reserve Board is responsible for regulating which of the following?

A) Bank holding companies and member banks of the Federal Reserve System B) National banks, federal saving associations, and federal branches of foreign banks C) Federally charted credit unions D) State-chartered banks Answer: A 4) Which of the following statements best describes operational risk?

A) The risk arising from adverse business decisions B) The risk arising from negative public opinion C) The risk arising from problems with service or product delivery D) The risk of loss resulting from inadequate or failed internal processes, people, or systems Answer: D 5) Which of the following statements best describes reputational risk?

A) The risk arising from adverse business decisions B) The risk arising from negative public opinion C) The risk arising from problems with service or product delivery D) The risk of loss resulting from inadequate or failed internal processes, people, or systems Answer: B 6) Which of the following best describes an assessment?

A) Evidenced-based examination that compares current practices against a specific internal or external criteria B) A focused privileged inspection to determine condition, locate weakness or vulnerabilities, and identity corrective actions C) Testing controls by performing vulnerability assessment tests that simulate real attacks D) Configuring the System and Security logs on each system to record and audit activities Answer: B 1 .

7) Which of the following testing methodologies measures how well controls and safeguards work by subjecting the system to an attack?

A) Assessment B) Audit C) Assurance D) All of the above Answer: C 8) Which of the following is an evidence-based examination that compares current practices against internal or external criteria?

A) Appraisal B) Audit C) Assurance D) Assessment Answer: B 9) What is the FTC implementation of the GBLA? A) Interagency guidelines B) Guidelines for Safeguarding Member Information C) Safeguards Act D) Banks Holding Company Act Answer: C 10) What is the term used to describe names, addresses, and phone numbers when linked to bank and credit card account information?

A) Private information B) Nonpublic personal information C) Nonpublic private information D) Personal information Answer: B 11) Which of the following threats must financial institutions address?

A) Denial of service B) Unauthorized access C) Malware D) All of the above Answer: D 12) Which of the following is not considered NPPI? A) Social Security number B) Customer account number C) Credit card account number D) Credit history Answer: B

2 .

13) According to the Interagency Guidelines, who must approve the bank’s written information security program?

A) Chief Executive Officer B) Chief Security Officer C) Board of Directors D) Information owner Answer: C 14) Which of the following, also known as social engineering, is a methodology by which an individual impersonates someone else to extract sensitive information from them?

A) Pretexting B) System infiltration C) Corporate identity theft D) Denial of service Answer: A 15) Which of the following gives federal financial regulators statutory authority to regulate and examine the services a technology service provider (TSP) performs for FDIC-insured financial institutions?

A) FDIC B) FFIEC C) NIST D) BSCA Answer: D 16) Which of the following statements best describes strategic risk?

A) The risk arising from adverse business decisions B) The risk arising from negative public opinion C) The risk arising from problems with service or product delivery D) The risk of loss resulting from inadequate or failed internal processes, people, or systems Answer: A 17) Which of the following is used by regulatory agencies to uniformly assess financial institutions based on a rating scale of 1 to 5, with 1 representing the best rating and least degree of concern, and 5 representing the worst rating and highest degree of concern?

A) NY DFS B) URSIT C) BSCA D) GLBA Answer: B

3 .

18) Which of the following is an interagency body empowered to prescribe uniform principles, standards, and report forms for the federal examination of financial institutions?

A) NCUA B) FRB C) FDIC D) FFIEC Answer: D 19) Which key part of the NY DFS Cybersecurity Regulation covers training and monitoring?

A) Section 500.06 B) Section 500.12 C) Section 500.14 D) Section 500.17 Answer: C 20) Which of the following refers to the risk arising from problems with service or product delivery?

A) Operational risk B) Transactional risk C) Strategic risk D) Compliance risk Answer: B

4 .

Developing Cybersecurity Programs and Policies (Santos) Chapter 14 Regulatory Compliance for the Health-Care Sector 1) Which of the following statements best describes a health-care provider?

A) A person or organization that provides patient or medical services B) An entity that provides payment for medical services C) An entity that processes nonstandard health information it receives from another entity D) A person or entity that creates, receives, maintains, transmits, accesses, or has the potential to access ePHI Answer: A 2) Which of the following statements best describes a health-care clearinghouse?

A) A person or organization that provides patient or medical services B) An entity that provides payment for medical services C) An entity that processes nonstandard health information it receives from another entity D) A person or entity that creates, receives, maintains, transmits, accesses, or has the potential to access ePHI Answer: C 3) Which of the following best describes HIPAA administrative safeguards?

A) Retention, availability, and update requirements related to supporting documentation B) The use of technical security measures to protect ePHI data C) Standards for business associate contracts and other arrangements D) Documented policies and procedures for managing day-to-day operations and access to ePHI Answer: D 4) Which of the following is the goal of an Audit Controls standard?

A) Implementing technical controls that protect ePHI from improper alteration or destruction B) Restricting access to ePHI only to users and processes that have been specifically authorized C) Implementing hardware, software, and procedural mechanisms that record and examine activity in information systems that contain ePHI D) Verifying that a person or process seeking to access ePHI is the one claimed Answer: C 5) Which of the following is the goal of an Integrity Controls standard?

A) Implementing technical controls that protect ePHI from improper alteration or destruction B) Restricting access to ePHI only to users and processes that have been specifically authorized C) Implementing hardware, software, and procedural mechanisms that record and examine activity in information systems that contain ePHI D) Verification that a person or process seeking to access ePHI is the one claimed Answer: A

6) Which of the following statements best describes the HIPAA breach notification rules?

A) Covered entities are required to notify individuals for any ePHI breach within 90 days after the discovery of the breach.

B) Covered entities are required to notify individuals for breach of unsecured ePHI within 60 1 .

days after the discovery of the breach.

C) Covered entities are required to notify individuals for any ePHI breach within 30 days after the discovery of the breach.

D) Covered entities are required to notify individuals for breach of unsecured ePHI within 30 days after the discovery of the breach.

Answer: B 7) Who should be notified of ePHI breaches?

A) Department of Justice B) Local law enforcement C) Department of Health and Human Services D) State Attorney Answer: C 8) Security awareness and training and workforce security standards are examples of which of the following?

A) Administrative safeguards B) Physical safeguards C) Technical safeguards D) Organizational requirements Answer: A 9) Under the HITECH Act criminal violations can be brought against which of the following?

A) Covered entities B) Employees C) Covered entities and employees D) Anyone who wrongly discloses PHI Answer: D 10) Which of the following is an example of a HIPAA physical safeguard standard?

A) Workforce Security B) Workstation Use C) Audit Controls D) Security Incident Response Answer: B 11) Which of the following is an example of a HIPAA administrative safeguard standard?

A) Workforce Security B) Workstation Use C) Audit Controls D) Workstation Security Answer: A 12) Which of the following is an example of a HIPAA technical safeguard standard?

A) Workforce Security B) Workstation Use C) Audit Controls 2 .

D) Workstation Security Answer: C 13) Which of the following is a change made to HIPAA by the Omnibus Rule?

A) Expanded the definition of “business associates” B) Increased penalties for violations to up to $1.5 million C) Granting authority to state Attorneys General to enforce HIPAA rules and pursue criminal and civil cases D) All of the above Answer: D 14) Which of the following are the two required implementation specifications of the access control standard under HIPAA? A) Unique user identification and establishing emergency access procedures B) Implementing automatic logoff procedures and encrypting/decrypting information at rest C) Unique user identification and implementing automatic logoff procedures D) Encrypting/decrypting information at rest and establishing emergency access procedures Answer: A 15) Which of the following is not one of the three risk management activities in the security management process?

A) Protections B) Analysis C) Measures D) Plan Answer: B 16) According to HIPAA, which of the following refers to anyone who does work at or for an organization?

A) Staff B) Personnel C) Employee D) Workforce Answer: D 17) Which of the following backup types backs up anything that has changed since the last backup of any type?

A) Differential B) Cumulative incremental C) Incremental D) Full Answer: C 18) Which of the following was given the authority to bring criminal action against covered entities that wrongly disclose ePHI? A) Department of Justice B) Local law enforcement 3 .

C) Department of Health and Human Services D) State Attorney Answer: A 19) Covered entities (CEs) include which of the following?

A) Health-care providers B) Health plans C) Health-care clearinghouses D) All of the above Answer: D 20) ePHI refers to which of the following?

A) Electronic private health information B) Electronic protected health information C) Encrypted private health information D) Encrypted protected health information Answer: B

4 .

Developing Cybersecurity Programs and Policies (Santos) Chapter 15 PCI Compliance for Merchants 1) Which of the following is considered cardholder data?

A) Service code B) Full magnetic stripe data C) Security code D) PIN Answer: A 2) Which of the following is considered sensitive authentication data?

A) Expiration date B) Primary account number C) Full magnetic stripe data D) Cardholder name Answer: C 3) PCI compliance validation is composed of four merchant levels. Which of the following levels requires conducting an annual onsite evaluation?

A) Level 1 B) Level 2 C) Level 3 D) Level 4 Answer: A 4) Which of the following statements best describes a data security compliance assessment?

A) A self-assessment questionnaire B) An annual onsite evaluation of compliance with PCI DSS C) A compliance requirement conducted by the merchant bank D) A compliance report submitted by the internal security assessor Answer: B 5) Which of the following requirements is part of the “Build and maintain a secure network and systems” PCI DSS core principle?

A) Protect stored card data.

B) Restrict physical access to cardholder data.

C) Do not use vendor-supplied defaults for system passwords and security parameters.

D) Track and monitor all access to network resources and cardholder data.

Answer: C 6) Which of the following requirements is part of the “Protect cardholder data” PCI DSS core principle?

A) Maintain a policy that addresses cybersecurity for all personnel.

B) Develop and maintain secure systems and architecture.

C) Restrict physical access to cardholder data.

D) Protect stored card data.

Answer: D 1 .

7) Which of the following requirements is part of the “Maintain a vulnerability management program” PCI DSS core principle?

A) Install and maintain a firewall configuration to protect cardholder data.

B) Develop and maintain secure systems and architecture.

C) Protect all systems against malware and regularly update antivirus software.

D) Encrypt transmission of cardholder data across open, public networks.

Answer: C 8) Which of the following requirements is part of the “Implement strong access control measures” PCI DSS core principle?

A) Restrict access to cardholder data by business need-to know.

B) Develop and maintain secure systems and applications.

C) Protect all systems against malware and regularly update antivirus software.

D) Encrypt transmission of cardholder data across open, public networks.

Answer: A 9) According to the Federal Trade Commission, consumers reported how much in losses due to fraud each year during the last few years?

A) More than $90 million B) More than $125 million C) More than $550 million D) More than $900 million Answer: D 10) The Fair Credit Billing Act (FCBA) states that the maximum liability for unauthorized credit card use is how much?

A) $25 B) $50 C) $75 D) $100 Answer: B 11) According to the PCI Security Standards Council (PCI SSC), which of the following refers to any entity that accepts American Express, Discover, JCB, MasterCard, or Visa as payment for goods and/or services?

A) Acquirer B) Service provider C) Merchant D) Approved Scanning Vendor (ASV) Answer: C 12) Which of the following refers to a document that Qualified Security Assessors (QSAs) use to validate organizations that must be PCI DSS-compliant?

A) DESV B) FCBA C) EFTA 2 .

D) QSA Answer: A 13) Which of the following PCI compliance validation levels includes requirements that are set by the merchant bank?

A) Level 1 B) Level 2 C) Level 3 D) Level 4 Answer: D 14) Which of the following is not an example of cardholder data?

A) Primary account number B) PIN number C) Service code D) Expiration date Answer: B 15) Which of the following is not considered sensitive authentication data?

A) Full magnetic stripe data B) CAV2 code C) Expiration date D) CVC2 code Answer: C 16) Which of the following refers to organizations that have been qualified by the PCI Security Standards Council to have their employees assess compliance to the PCI DSS standard?

A) Qualified Security Assessors (QSAs) B) Internal Security Assessors (ISAs) C) Approved Scanning Vendors (ASVs) D) All of the above Answer: A 17) Which of the following refers to organizations that validate adherence to certain PCI DSS requirements by performing vulnerability scans of Internet-facing environments of merchants and service providers?

A) Qualified Security Assessors (QSAs) B) Internal Security Assessors (ISAs) C) Approved Scanning Vendors (ASVs) D) None of the above Answer: C 18) Which category of the PCI DSS self-assessment questionnaire (SAQ) is applicable only to ecommerce channels who outsource all payment processing to PCI DSS validated third-party providers?

A) SAQ A B) SAQ A-EP 3 .

C) SAQ B D) SAQ P2PE Answer: B 19) Which of the following fines can be applied to all organizations under PCI regulation?

A) DCRS for compromised international-issued cards B) PCI noncompliance C) ADCR for compromised domestic-issued cards D) All of the above Answer: D 20) Which of the following merchant level categories includes any merchant—regardless of acceptance channel—processing one million to six million Visa transactions per year?

A) Level 1 B) Level 2 C) Level 3 D) Level 4 Answer: B

4 .

Developing Cybersecurity Programs and Policies (Santos) Chapter 16 NIST Cybersecurity Framework 1) NIST’s Cybersecurity Framework is divided into three parts, including all but which of the following?

A) The Framework Tiers B) The Framework Core C) The Framework Outcomes D) The Framework Profiles Answer: C 2) Which part of the NIST Cybersecurity Framework is designed to help organizations view and understand the characteristics of their approach to managing cybersecurity risk?

A) The Framework Tiers B) The Framework Core C) The Framework Outcomes D) The Framework Profiles Answer: A 3) Which of the following statements about the NIST Cybersecurity Framework is true?

A) It was created in the U.S. and is used exclusively within the U.S. B) It was created in the U.S. and is also used outside of the U.S. C) It was created outside of the U.S. and is used worldwide.

D) None of the above Answer: B 4) Which function defined in the NIST Cybersecurity Framework Core includes the categories and subcategories that define what processes and assets need protection?

A) Detect B) Identify C) Protect D) Respond Answer: B 5) Which function defined in the NIST Cybersecurity Framework Core provides guidance on how to recover normal operations after a cybersecurity incident?

A) Respond B) Detect C) Identify D) Recover Answer: D

1 .

6) In the NIST Cybersecurity Framework Tiers, which of the following Framework Implementation Tiers is labeled Tier 2?

A) Adaptive B) Repeatable C) Risk-Informed D) Partial Answer: C 7) Which of the following is not one of the three levels NIST defines within an organization that should coordinate the framework implementation and a common flow of information?

A) Management B) Implementation/Operations C) Executive D) Business/Process Answer: A 8) Which of the following is the first step in NIST’s recommended steps to establish or improve a cybersecurity program?

A) Create a current profile B) Prioritize and scope C) Create a target profile D) Conduct a risk assessment Answer: B 9) Which of the following is the last step in NIST’s recommended steps to establish or improve a cybersecurity program?

A) Implement the action plan B) Orient your strategy C) Determine, analyze, and prioritize any gaps D) Create a target profile Answer: A 10) The NIST Cybersecurity Framework (CSF) Reference Tool can run in which of the following operating systems?

A) Microsoft Windows and Linux B) Apple Mac OS-X and Linux C) Microsoft Windows and Apple Mac OS-X D) Microsoft Windows, Apple Mac OS-X, and Linux Answer: C 11) The NIST CSF Reference Tool provides a way for you to browse the Framework Core by which of the following?

A) Categories B) Functions C) Informative references D) All of the above Answer: D 2 .

12) Which part of the NIST Cybersecurity Framework provide guidance to allow organizations to analyze cybersecurity risk and to enhance their processes to manage such risk?

A) The Framework Tiers B) The Framework Core C) The Framework Outcomes D) The Framework Profiles Answer: A 13) Which of the following is not a supported export file format for current viewed data in the NIST CSF Reference Tool?

A) XML files B) Adobe PDF files C) Tab-separated text files D) Comma-separated text files Answer: B 14) The NIST Cybersecurity Framework was developed by which of the following?

A) U.S. government B) Corporations C) Individuals D) All of the above Answer: D 15) Which of the following statements about the NIST Cybersecurity Framework is not true?

A) One of the main goals is to address and manage cybersecurity risk in a cost-effective way to protect critical infrastructure.

B) It is aimed to replace an existing risk management process and cybersecurity program in an organization.

C) An organization that doesn’t have an existing cybersecurity program can use the NIST Cybersecurity Framework as a reference to develop such a program.

D) The NIST Cybersecurity Framework is developed with a common taxonomy.

Answer: B 16) Which part of the NIST Cybersecurity Framework is designed to help an organization align its cybersecurity undertakings with business requirements, risk tolerances, and resources?

A) The Framework Tiers B) The Framework Core C) The Framework Profiles D) The Framework Outcomes Answer: C 17) Which category in the Identify function of the NIST Cybersecurity Framework Core addresses the need for an organization’s mission, objectives, stakeholders, and activities to be comprehended and prioritized?

A) Business Environment B) Governance 3 .

C) Risk Assessment D) Asset Management Answer: A 18) Which category in the Protect function of the NIST Cybersecurity Framework Core provides guidance around data management practices in order to protect the confidentiality, integrity, and availability of such data?

A) Awareness and Training B) Protective Technology C) Maintenance D) Data Security Answer: D 19) In the NIST Cybersecurity Framework Tiers, which of the following Framework Implementation Tiers is labeled Tier 4?

A) Risk-Informed B) Partial C) Adaptive D) Repeatable Answer: C 20) NIST created a(n) __________ that allows you to start reviewing and documenting each of the framework’s functions, categories, subcategories, and informative references.

A) spreadsheet B) database C) presentation D) XML file Answer: A

4 .