CHAPTER 1 1. Corruption of information can occur only while information is being stored. a. True *b. False
2. The authorization process takes place before the authentication process. a. True *b. False
3. A worm may be able to deposit copies of itself onto all Web servers that the infected system can reach, so that users who subsequently visit those sites become infected. *a. True b. False
4. DoS attacks cannot be launched against routers. a. True *b. False
5. The first step in solving problems is to gather facts and make assumptions. a. True *b. False
6. A device (or a software program on a computer) that can monitor data traveling on a network is known as a socket sniffer. __________ a. True *b. False
7. One form of e-mail attack that is also a DoS attack is called a mail spoof, in which an attacker overwhelms the receiver with excessive quantities of e-mail. __________ a. True *b. False
8. When voltage levels lag (experience a momentary increase), the extra voltage can severely damage or destroy equipment. __________ a. True *b. False
9. "Shoulder spying" is used in public or semi-public settings when individuals gather information they are not authorized to have by looking over another individual’s shoulder or viewing the information from a distance. __________ a. True *b. False
10. The term phreaker is now commonly associated with an individual who cracks or removes software protection that is designed to prevent unauthorized duplication. __________ a. True *b. False
11. The application of computing and network resources to try every possible combination of options of a password is called a dictionary attack. __________ a. True *b. False
12. The macro virus infects the key operating system files located in a computer’s start-up sector. __________ a. True *b. False
13. The malicious code attack includes the execution of viruses, worms, Trojan horses, and active Web scripts with the intent to destroy or steal information. __________ *a. True b. False
14. A(n) polymorphic threat is one that over time changes the way it appears to antivirus software programs, making it undetectable by techniques that look for pre-configured signatures. __________ *a. True b. False
15. Communications security involves the protection of which of the following? a. radio handsets b. people, physical assets c. the IT department *d. media, technology, and content
16. The protection of voice and data components, connections, and content is known as
__________ security. *a. network b. national c. cyber d. operational
17. The protection of confidentiality, integrity, and availability of data regardless of its
location is known as __________ security. *a. information b. network c. cyber d. operational
18. A model of InfoSec that offers a comprehensive view of security for data while being
stored, processed, or transmitted is the __________ security model. *a. CNSS b. USMC c. USNA d. NPC
19. Which of the following is a C.I.A. triad characteristic that addresses the threat from
corruption, damage, destruction, or other disruption of its authentic state? *a. integrity b. availability c. authentication d. accountability
20. According to the C.I.A. triad, which of the following is the most desirable characteristic for
privacy? *a. confidentiality
b. availability c. integrity d. accountability
21. Which of the following is recognition that data used by an organization should only be used
for the purposes stated by the information owner at the time it was collected? a. accountability b. availability *c. privacy d. confidentiality
22. Which of the following is a C.I.A. triad characteristic that ensures only those with sufficient
privileges and a demonstrated need may access certain information? a. integrity b. availability c. authentication *d. confidentiality
23. The use of cryptographic certificates to establish Secure Sockets Layer (SSL) connections is
an example of which process? a. accountability b. authorization c. identification *d. authentication
24. A process that defines what the user is permitted to do is known as __________. a. identification *b. authorization c. accountability d. authentication
25. What do audit logs that track user activity on an information system provide? a. identification b. authorization *c. accountability d. authentication
26. Any event or circumstance that has the potential to adversely affect operations and assets is
known as a(n) __________. *a. threat b. attack c. exploit d. vulnerability
27. An intentional or unintentional act that can damage or otherwise compromise information
and the systems that support it is known as a(n) __________. a. threat *b. attack c. exploit d. vulnerability
28. A technique used to compromise a system is known as a(n) __________. a. threat b. attack *c. exploit d. vulnerability
29. A potential weakness in an asset or its defensive control system(s) is known as a(n)
__________. a. threat b. attack c. exploit *d. vulnerability
30. The unauthorized duplication, installation, or distribution of copyrighted computer software,
which is a violation of intellectual property, is called __________. *a. software piracy b. copyright infringement c. trademark violation d. data hijacking
31. Technology services are usually arranged with an agreement defining minimum service
levels known as a(n) __________. a. SSL *b. SLA
c. MSL d. MIN
32. A short-term interruption in electrical power availability is known as a __________. *a. fault b. brownout c. blackout d. lag
33. Acts of __________ can lead to unauthorized real or virtual actions that enable information
gatherers to enter premises or systems they have not been authorized to access. a. bypass b. theft *c. trespass d. security
34. An information security professional with authorization to attempt to gain system access in
an effort to identify and recommend resolutions for vulnerabilities in those systems is known as a(n) __________. *a. penetration tester b. expert hacker c. phreaker d. cracker
35. A hacker who intentionally removes or bypasses software copyright protection designed to
prevent unauthorized duplication or use is known as a(n) __________. a. penetration tester b. expert hacker c. phreaker *d. cracker
36. __________ is the collection and analysis of information about an organization’s business
competitors, often through illegal or unethical means, to gain an unfair edge over them. a. Dumpster diving b. Packet sniffing c. Competitive advantage *d. Industrial espionage
37. The hash values for a wide variety of passwords can be stored in a database known as a(n)
__________, which can be indexed and quickly searched using the hash value, allowing the corresponding plaintext password to be determined. *a. rainbow table b. unicorn table c. rainbow matrix d. poison box
38. Which of the following is NOT an approach to password cracking? *a. ransomware b. brute force c. dictionary attacks d. social engineering attacks
39. Force majeure includes all of the following EXCEPT: *a. armed robbery b. acts of war c. civil disorder d. forces of nature
40. Human error or failure often can be prevented with training and awareness programs,
policy, and __________. a. outsourcing *b. technical controls c. hugs d. ISO 27000
41. “4-1-9” fraud is an example of a __________ attack. *a. social engineering b. virus c. worm d. spam
42. “4-1-9” is one form of a(n) __________ fraud. *a. advance fee b. privilege escalation c. check kiting d. "Spanish Prisoner"
43. Blackmail threat of informational disclosure is an example of which threat category? a. espionage or trespass *b. information extortion c. sabotage or vandalism d. compromises of intellectual property
44. An attack that uses phishing techniques along with specialized forms of malware to encrypt
the victim's data files is known as __________. a. crypto locking *b. ransomware c. jailbreaking d. spam
45. One form of online vandalism is __________, in which individuals interfere with or disrupt
systems to protest the operations, policies, or actions of an organization or government agency. *a. hacktivism b. phreaking c. red teaming d. cyberhacking
46. __________ are malware programs that hide their true nature and reveal their designed
behavior only when activated. a. Viruses b. Worms c. Spam *d. Trojan horses
47. As frustrating as viruses and worms are, perhaps more time and money is spent on resolving
virus __________. a. false alarms b. polymorphisms *c. hoaxes d. urban legends
48. Which of the following is a feature left behind by system designers or maintenance staff that
allows quick access to a system at a later time by bypassing access controls?
a. brute force b. DoS *c. back door d. hoax
49. A __________ is an attack in which a coordinated stream of requests is launched against a
target from many locations at the same time. a. denial of service *b. distributed denial of service c. virus d. spam
50. Which type of attack involves sending a large number of connection or information requests
to a target? a. malicious code *b. denial of service (DoS) c. brute force d. spear fishing
51. In the __________ attack, an attacker monitors (or sniffs) packets from the network,
modifies them, and inserts them back into the network. a. zombie-in-the-middle b. sniff-in-the-middle c. server-in-the-middle *d. man-in-the-middle
52. Which statement defines the differences between a computer virus and a computer worm? a. Worms and viruses are the same. b. Worms can make copies all by themselves on one kind of computer but viruses
can make copies all by themselves on any kind of computer. c. Worms can copy themselves to computers and viruses can copy themselves to smartphones. *d. Worms can make copies all by themselves but viruses need to attach to an existing program on the host computer to replicate. 53. Which of the following is not among the "deadly sins of software security"? *a. extortion sins b. implementation sins c. Web application sins
d. networking sins
54. Which of the 12 categories of threats best describes a situation where the adversary removes
data from a victim's computer? *a. theft b. espionage or trespass c. sabotage or vandalism d. information extortion
55. Which of the following is the principle of management that develops, creates, and
implements strategies for the accomplishment of objectives? a. leading b. controlling c. organizing *d. planning
56. Which of the following is the principle of management dedicated to the structuring of
resources to support the accomplishment of objectives? *a. organization b. planning c. controlling d. leading
57. __________ is the set of responsibilities and practices exercised by the board and
executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately, and verifying that the enterprise’s resources are used responsibly. *a. Governance b. Controlling c. Leading d. Strategy
58. Which of the following is the first step in the problem-solving process? a. Analyze and compare the possible solutions. b. Develop possible solutions. *c. Recognize and define the problem. d. Select, implement, and evaluate a solution.
59. Which of the following is NOT a step in the problem-solving process? a. Select, implement, and evaluate a solution. b. Analyze and compare possible solutions. *c. Build support among management for the candidate solution. d. Gather facts and make assumptions.
60. Which of the following is NOT a primary function of information security management? a. planning b. protection c. projects *d. performance
61. Which of the following functions of information security management seeks to dictate
certain behavior within the organization through a set of organizational guidelines? a. planning *b. policy c. programs d. people
62. Which function of InfoSec management encompasses security personnel as well as aspects
of the SETA program? a. protection *b. people c. projects d. policy
63. A(n) __________ is a potential weakness in an asset or its defensive control(s). Correct Answer(s): a. vulnerability
64. A(n) __________ is an act against an asset that could result in a loss. Correct Answer(s): a. attack
65. Duplication of software-based intellectual property is more commonly known as software
__________.
Correct Answer(s): a. piracy
66. A(n) __________ hacks the public telephone network to make free calls or disrupt services. Correct Answer(s): a. phreaker
67. A momentary low voltage is called a(n) __________. Correct Answer(s): a. sag
68. Some information gathering techniques are quite legal—for example, using a Web browser
to perform market research. These legal techniques are called, collectively, __________. Correct Answer(s): a. competitive intelligence
69. Attempting to reverse-calculate a password or bypass encryption is called __________. Correct Answer(s): a. cracking
70. ESD is the acronym for __________. Correct Answer(s): a. electrostatic discharge
71. A virus or worm can have a payload that installs a(n) __________ door or trap-door
component in a system, which allows the attacker to access the system at will with special privileges. Correct Answer(s): a. back
72. __________ is unsolicited commercial e-mail. Correct Answer(s): a. Spam
73. A ___________ overflow is an application error that occurs when the system can’t handle
the amount of data that is sent.
Correct Answer(s): a. buffer
74. The three levels of planning are strategic planning, tactical planning, and __________
planning. Correct Answer(s): a. operational
75. The set of organizational guidelines that dictates certain behavior within the organization is
called __________. Correct Answer(s): a. policy
76. Explain the differences between a leader and a manager. Correct Answer:
The distinctions between a leader and a manager arise in the execution of organizational tasks. A leader provides purpose, direction, and motivation to those that follow. By comparison, a manager administers the resources of the organization. He or she creates budgets, authorizes expenditures, and hires employees. 77. List and explain the critical characteristics of information as defined by the C.I.A. triad. Correct Answer:
Confidentiality of information ensures that only those with sufficient privileges and a demonstrated need may access certain information. When unauthorized individuals or systems can view information, confidentiality is breached.
Integrity is the quality or state of being whole, complete, and uncorrupted. The integrity of information is threatened when it is exposed to corruption, damage, destruction, or other disruption of its authentic state.
Availability is the characteristic of information that enables user access to information without interference or obstruction and in a usable format.
78. List and explain the four principles of management under the contemporary or popular management theory. Briefly define each. Correct Answer:
Popular management theory categorizes the principles of management into planning, organizing, leading, and controlling (POLC). The process that develops, creates, and implements strategies for the accomplishment of objectives is called planning.
The management function dedicated to the structuring of resources to support the accomplishment of objectives is called organization.
Leadership includes supervising employee behavior, performance, attendance, and attitude. Leadership generally addresses the direction and motivation of the human resource.
Monitoring progress toward completion, and making necessary adjustments to achieve desired objectives, requires the exercise of control.
79. List the steps that can be used as a basic blueprint for solving organizational problems. Correct Answer:
1. Recognize and define the problem.2. Gather facts and make assumptions. 3. Develop possible solutions. 4. Analyze and compare possible solutions. 5. Select, implement, and evaluate a solution.
80. What are the three distinct groups of decision makers or communities of interest on an information security team? Correct Answer:
Managers and professionals in the field of information securityManagers and professionals in the field of IT Managers and professionals from the rest of the organization
81. List the specialized areas of security. Correct Answer:
Physical securityOperations security Communications security Network security
82. List the measures that are commonly used to protect the confidentiality of information. Correct Answer:
Information classificationSecure document (and data) storage Application of general security policies Education of information custodians and end users Cryptography (encryption)
83. What is authentication?
Provide some examples.
Correct Answer:
Authentication is the process by which a control establishes whether a user (or system) has the identity it claims to have. Examples include the use of cryptographic certificates to establish Secure Sockets Layer (SSL) connections as well as the use of cryptographic hardware devices— for example, hardware tokens such as RSA’s SecurID. Individual users may disclose a personal identification number (PIN) or a password to authenticate their identities to a computer system. 84. Discuss the planning element of information security. Correct Answer:
Planning in InfoSec management is an extension of the basic planning model. Included in the InfoSec planning model are activities necessary to support the design, creation, and implementation of InfoSec strategies within the IT planning environment. The business strategy is translated into the IT strategy. Both the business strategy and the IT strategy are then used to develop the InfoSec strategy. For example, the CIO uses the IT objectives gleaned from the business unit plans to create the organization’s IT strategy. 85. There are 12 general categories of threat to an organization's people, information, and systems. List at least six of the general categories of threat and identify at least one example of those listed. Correct Answer:
Compromises to intellectual propertySoftware attacks Deviations in quality of service Espionage or trespass Forces of nature Human error or failure Information extortion Sabotage or vandalism Theft
Technical hardware failures or errors Technical software failures or errors Technological obsolescence
CHAPTER 2 1. Ethics carry the sanction of a governing authority. a. True *b. False
2. The Secret Service is charged with the detection and arrest of any person who commits a U.S. federal offense relating to computer fraud, as well as false identification crimes. *a. True b. False
3. Deterrence is the best method for preventing an illegal or unethical activity. ____________ *a. True b. False
4. ISACA is a professional association with a focus on authorization, control, and security. ___________ a. True *b. False
5. Information ambiguation occurs when pieces of nonprivate data are combined to create information that violates privacy. _________________________ a. True *b. False
6. The Gramm-Leach-Bliley (GLB) Act, also known as the Financial Services Modernization Act of 1999, contains a number of provisions that affect banks, securities firms, and insurance companies. ___________ *a. True b. False
7. To protect intellectual property and competitive advantage, Congress passed the Entrepreneur Espionage Act (EEA) in 1996. ___________ a. True *b. False
8. A(n) compromise law specifies a requirement for organizations to notify affected parties when they have experienced a specified type of loss of information. ____________ a. True *b. False
9. It is the responsibility of InfoSec professionals to understand state laws and bills. ____________ a. True *b. False
10. Due diligence requires that an organization make a valid and ongoing effort to protect others. ____________ *a. True b. False
11. InfraGard began as a cooperative effort between the FBI’s Cleveland field office and local intelligence professionals. ___________ a. True *b. False
12. Which of the following ethical frameworks is the study of the choices that have been made
by individuals in the past? a. Applied ethics *b. Descriptive ethics c. Normative ethics d. Deontological ethics
13. Which of the following is the study of the rightness or wrongness of intentions and motives
as opposed to the rightness or wrongness of the consequences (also known as duty- or obligationbased ethics)? a. Applied ethics b. Meta-ethics c. Normative ethics *d. Deontological ethics
14. Which ethical standard is based on the notion that life in community yields a positive
outcome for the individual, requiring each individual to contribute to that community?
a. utilitarian b. virtue c. fairness or justice *d. common good
15. There are three general categories of unethical behavior that organizations and society
should seek to eliminate. Which of the following is NOT one of them? a. ignorance *b. malice c. accident d. intent
16. Which of the following is the best method for preventing an illegal or unethical activity?
Examples include laws, policies, and technical controls. a. remediation *b. deterrence c. persecution d. rehabilitation
17. Which of the following is NOT a requirement for laws and policies to deter illegal or
unethical activity? a. fear of penalty b. probability of being penalized c. probability of being caught *d. fear of humiliation
18. Which of the following organizations put forth a code of ethics designed primarily for
InfoSec professionals who have earned their certifications? The code includes the canon: Provide diligent and competent service to principals. *a. (ISC)2 b. ACM c. SANS d. ISACA
19. Which subset of civil law regulates the relationships among individuals and among
individuals and organizations? a. tort
b. criminal *c. private d. public
20. Which of the following is NOT used to categorize some types of law? a. constitutional b. regulatory c. statutory *d. international
21. Which law addresses privacy and security concerns associated with the electronic
transmission of PHI? a. USA PATRIOT Act of 2001 b. American Recovery and Reinvestment Act *c. Health Information Technology for Economic and Clinical Health Act d. National Information Infrastructure Protection Act of 1996
22. The penalties for offenses related to the National Information Infrastructure Protection Act
of 1996 depend on whether the offense is judged to have been committed for several reasons. Which of the following is NOT one of those reasons? a. For purposes of commercial advantage b. For private financial gain *c. For political advantage d. In furtherance of a criminal act
23. Which law requires mandatory periodic training in computer security awareness and
accepted computer security practice for all employees who are involved with the management, use, or operation of a federal computer system? a. The Telecommunications Deregulation and Competition Act b. National Information Infrastructure Protection Act c. Computer Fraud and Abuse Act *d. The Computer Security Act
24. Which act is a collection of statutes that regulates the interception of wire, electronic, and
oral communications? *a. The Electronic Communications Privacy Act of 1986 b. The Telecommunications Deregulation and Competition Act of 1996 c. National Information Infrastructure Protection Act of 1996 d. Federal Privacy Act of 1974
25. Which act requires organizations that retain health care information to use InfoSec
mechanisms to protect this information, as well as policies and procedures to maintain them? a. ECPA b. Sarbanes-Oxley *c. HIPAA d. Gramm-Leach-Bliley
26. Which law extends protection to intellectual property, which includes words published in
electronic formats? a. Freedom of Information Act *b. U.S. Copyright Law c. Security and Freedom through Encryption Act d. Sarbanes-Oxley Act
27. A more recently created area of law related to information security specifies a requirement
for organizations to notify affected parties when they have experienced a specified type of information loss. This is commonly known as a __________ law. a. notification *b. breach c. spill d. compromise
28. Which of the following is the result of a U.S. led international effort to reduce the impact of
copyright, trademark, and privacy infringement, especially via the removal of technological copyright protection measures? a. U.S. Copyright Law b. PCI DSS c. European Council Cybercrime Convention *d. DMCA
29. This collaborative support group began as a cooperative effort between the FBI’s Cleveland
field office and local technology professionals with a focus of protecting critical national infrastructure. *a. InfraGard b. Homeland Security c. CyberWatch d. CyberGard
30. Another key U.S. federal agency is _________, which is responsible for coordinating,
directing, and performing highly specialized activities to protect U.S. information systems and produce foreign intelligence information. a. InfraGard b. Homeland Security *c. the National Security Agency d. the Federal Bureau of Investigation
31. Which of the following is compensation for a wrong committed by an individual or
organization? a. liability *b. restitution c. due diligence d. jurisdiction
32. Any court can impose its authority over an individual or organization if it can establish
which of the following? a. jurisprudence *b. jurisdiction c. liability d. sovereignty
33. Investigations involving the preservation, identification, extraction, documentation, and
interpretation of computer media for evidentiary and root cause analysis are known as _________. *a. digital forensics b. criminal investigation c. crime scene investigation d. e-discovery
34. Also known as “items of potential evidentiary value,” any information that could potentially
support the organization’s legal or policy-based case against a suspect is known as _________. *a. evidentiary material b. digital forensics c. evidence d. e-discovery
35. The coherent application of methodical investigatory techniques to collect, preserve, and
present evidence of crimes in a court or court-like setting is known as _________. a. evidentiary material *b. forensics c. crime scene investigation d. data imaging
36. Permission to search for evidentiary material at a specified location and/or to seize items to
return to the investigator’s lab for examination is known as a(n) _________. a. subpoena b. forensic clue *c. search warrant d. affidavit
37. Sworn testimony that certain facts are in the possession of the investigating officer and that
they warrant the examination of specific items located at a specific place is known as a(n) _________. a. subpoena b. forensic finding c. search warrant *d. affidavit
38. A process focused on the identification and location of potential evidence related to a
specific legal action after it was collected through digital forensics is known as _________. *a. e-discovery b. forensics c. indexing d. root cause analysis
39. Digital forensics can be used for two key purposes: ________ or _________. a. e-discovery; to perform root cause analysis *b. to investigate allegations of digital malfeasance; to perform root cause analysis c. to solicit testimony; to perform root cause analysis d. to investigate allegations of digital malfeasance; to solicit testimony
40. In digital forensics, all investigations follow the same basic methodology once permission to
search and seize is received, beginning with _________. *a. identifying relevant items of evidentiary value
b. acquiring (seizing) the evidence without alteration or damage c. analyzing the data without risking modification or unauthorized access d. investigating allegations of digital malfeasance
41. _________ devices often pose special challenges to investigators because they can be
configured to use advanced encryption and they can be wiped by the user even when the user is not present. *a. Portable b. Desktop computer c. Expansion d. Satellite transceiver
42. The most complex part of an investigation is usually __________. *a. analysis for potential EM b. protecting potential EM c. requesting potential EM d. preventing the destruction of potential EM
43. When an incident violates civil or criminal law, it is the organization’s responsibility to
notify the proper authorities; selecting the appropriate law enforcement agency depends on __________. *a. the type of crime committed b. how many perpetrators were involved c. the network provider the hacker used d. what kind of computer the hacker used
44. Ethics are based on ___________________, which are the relatively fixed moral attitudes or
customs of a societal group. Correct Answer(s): a. cultural mores
45. The branch of philosophy that considers nature, criteria, sources, logic, and the validity
of moral judgment is known as ___________. Correct Answer(s): a. ethics
46. The act of attempting to prevent an unwanted action by threatening punishment
or retaliation on the instigator if the act takes place is known as ___________.
Correct Answer(s): a. deterrence
47. ___________________ is a subset of civil law that allows individuals to seek redress in the
event of personal, physical, or financial injury. Correct Answer(s): a. Tort law
48. Information ____________ occurs when pieces of nonprivate data are combined to
create information that violates privacy. Correct Answer(s): a. aggregation
49. An organization increases its liability if it refuses to take the measures a prudent
organization should; this is known as the standard of _____________. Correct Answer(s): a. due care
50. Investigations involving the preservation, identification, extraction, documentation, and
interpretation of computer media for evidentiary and root cause analysis are known as _________. Correct Answer(s): a. digital forensics
51. _________ devices often pose special challenges to investigators because they can be
configured to use advanced encryption and they can be wiped by the user even when the user is not present. Correct Answer(s): a. Portable
52. A process focused on the identification and location of potential evidence related to a
specific legal action after it was collected through digital forensics is known as _________. Correct Answer(s): a. e-discovery b. ediscovery
53. Sworn testimony that certain facts are in the possession of the investigating officer and that
they warrant the examination of specific items located at a specific place is known as a(n) _________. Correct Answer(s): a. affidavit
54. [f] 1. One of the first attempts to protect federal computer systems by establishing minimum acceptable security practices. [d] 2. Focuses on enhancing the security of the critical infrastructure in the United States. [c] 3. An approach that applies moral codes to actions drawn from realistic situations. [g] 4. A collection of statutes that regulates the interception of wire, electronic, and oral communications. [h] 5. Regulates the structure and administration of government agencies and their relationships with citizens, employees, and other governments. [b] 6. The study of what makes actions right or wrong, also known as moral theory. [a] 7. Addresses violations harmful to society and is actively enforced and prosecuted by the state. [e] 8. Defines socially acceptable behaviors. a. criminal law b. normative ethics c. applied ethics d. Cybersecurity Act e. ethics f. Computer Security Act (CSA) g. Electronic Communications Privacy Act (ECPA) h. public law 55. Describe the foundations and frameworks of ethics. Correct Answer:
Normative ethics—The study of what makes actions right or wrong, also known as moral theory—that is, how should people act?Meta-ethics—The study of the meaning of ethical judgments and properties—that is, what is right? Descriptive ethics—The study of the choices that have been made by individuals in the past—that is, what do others think is right? Applied ethics—An approach that applies moral codes to actions drawn from realistic situations; it seeks to define how we might use ethics in practice. Deontological ethics—The study of the rightness or wrongness of intentions and motives as opposed to the rightness or wrongness of the consequences; also known as duty-based or obligation-based ethics. This approach seeks to define a person’s ethical duty.
56. Discuss the three general categories of unethical behavior that organizations should try to control. Correct Answer:
Ignorance:Ignorance of the law is no excuse, but ignorance of policies and procedures is. The first method of deterrence is education. Organizations must design, publish, and disseminate organizational policies and relevant laws, and employees must explicitly agree to abide by them. Reminders, training, and awareness programs support retention, and one hopes, compliance.
Accident: Individuals with authorization and privileges to manage information within the organization have the greatest opportunity to cause harm or damage by accident. The careful placement of controls can help prevent accidental modification to systems and data.
Intent: Criminal or unethical intent refers to the state of mind of the individual committing the infraction. A legal defense can be built upon whether the accused acted out of ignorance, by accident, or with the intent to cause harm or damage. Deterring those with criminal intent is best done by means of litigation, prosecution, and technical controls. Intent is only one of several factors to consider when determining whether a computer-related crime has occurred.
57. Laws and policies and their associated penalties only deter if three conditions are present. What are these conditions? Correct Answer:
Fear of penalty—Threats of informal reprimand or verbal warnings may not have the same impact as the threat of imprisonment or forfeiture of pay.Probability of being caught—There must be a strong possibility that perpetrators of illegal or unethical acts will be caught. Probability of penalty being administered—The organization must be willing and able to impose the penalty.
58. Briefly describe five different types of laws. Correct Answer:
1. Civil law embodies a wide variety of laws pertaining to relationships between and among individuals and organizations.2. Criminal law addresses violations harmful to society and is actively enforced and prosecuted by the state. 3. Tort law is a subset of civil law that allows individuals to seek recourse against others in the event of personal, physical, or financial injury. 4. Private law regulates the relationships among individuals and among individuals and organizations, and encompasses family law, commercial law, and labor law.
5. Public law regulates the structure and administration of government agencies and their relationships with citizens, employees, and other governments. Public law includes criminal, administrative, and constitutional law.
59. The penalty for violating the National Information Infrastructure Protection Act of 1996 depends on the value of the information obtained and whether the offense is judged to have been committed for one of three reasons. What are those reasons? Correct Answer:
For purposes of commercial advantageFor private financial gain In furtherance of a criminal act
60. The Computer Security Act charges the National Bureau of Standards, in cooperation with the National Security Agency (NSA), with the development of five standards and guidelines establishing minimum acceptable security practices. What are three of these principles? Correct Answer:
Standards, guidelines, and associated methods and techniques for computer systems Uniform standards and guidelines for most federal computer systems Technical, management, physical, and administrative standards and guidelines for the costeffective security and privacy of sensitive information in federal computer systems Guidelines for use by operators of federal computer systems that contain sensitive information in training their employees in security awareness and accepted security practice Validation procedures for, and evaluation of the effectiveness of, standards and guidelines through research and liaison with other government and private agencies
61. Describe the Freedom of Information Act. apply to federal vs. state agencies?
How does its application
Correct Answer:
All federal agencies are required under the Freedom of Information Act (FOIA) to disclose records requested in writing by any person. However, agencies may withhold information pursuant to nine exemptions and three exclusions contained in the statute. FOIA applies only to federal agencies and does not create a right of access to records held by Congress, the courts, or by state or local government agencies. Each state has its own public access laws that should be consulted for access to state and local records. 62. What is a key difference between law and ethics? Correct Answer:
The key difference between law and ethics is that law carries the sanction of a governing authority and ethics do not. 63. A key difference between policy and law is that ignorance of policy is a viable defense. What steps must be taken to assure that an organization has a reasonable expectation that policy violations can be appropriately penalized without fear of legal retribution? Correct Answer:
Policies must be: o Effectively written o Distributed to all individuals who are expected to comply with them o Read by all employees o Understood by all employees, with multilingual translations and translations for visually impaired or low-literacy employees o Acknowledged by the employee, usually by means of a signed consent form o Uniformly enforced, with no special treatment for any group (e.g., executives)
CHAPTER 3 1. Because it sets out general business intentions, a mission statement does not need to be concise. a. True *b. False
2. A clearly directed strategy flows from top to bottom rather than from bottom to top. *a. True b. False
3. A maintenance model is intended to focus ongoing maintenance efforts so as to keep systems usable and secure. *a. True b. False
4. A top-down approach to information security usually begins with a systems administrator’s attempt to improve the security of systems. a. True *b. False
5. Today’s InfoSec systems need constant monitoring, testing, modifying, updating, and repairing. *a. True b. False
6. Values statements should be ambitious; after all, they are meant to express the aspirations of an organization. ____________ a. True *b. False
7. A person or organization that has a vested interest in a particular aspect of the planning or operation of an organization is a(n) investiture. ____________ a. True *b. False
8. The ISO 27014:2013 standard promotes five governance processes, which should be adopted by the organization’s executive management and its consultant. ____________ a. True *b. False
9. Enterprise risk management is a valuable approach that can better align security functions with the business mission while offering opportunities to lower costs. ____________ *a. True b. False
10. According to the CGTF, the organization should treat InfoSec as an integral part of the system life cycle. ____________ *a. True b. False
11. Which of the following explicitly declares the business of the organization and its intended
areas of operations? a. vision statement b. values statement *c. mission statement d. business statement
12. Which type of planning is the primary tool in determining the long-term direction taken by
an organization? *a. strategic b. tactical c. operational d. managerial
13. Which of the following is true about planning? *a. Strategic plans are used to create tactical plans. b. Tactical plans are used to create strategic plans. c. Operational plans are used to create tactical plans. d. Operational plans are used to create strategic plans.
14. Which level of planning breaks down each applicable strategic goal into a series of
incremental objectives?
a. strategic b. operational c. organizational *d. tactical
15. Which type of planning is used to organize the ongoing, day-to-day performance of tasks? a. strategic b. tactical c. organizational *d. operational
16. The basic outcomes of InfoSec governance should include all but which of the following? a. Value delivery by optimizing InfoSec investments in support of organizational
objectives b. Performance measurement by measuring, monitoring, and reporting information security governance metrics to ensure that organizational objectives are achieved *c. Time management by aligning resources with personnel schedules and organizational objectives d. Resource management by utilizing information security knowledge and infrastructure efficiently and effectively 17. Internal and external stakeholders, such as customers, suppliers, or employees who interact
with information in support of their organization’s planning and operations, are known as ____________. a. data owners b. data custodians *c. data users d. data generators
18. The National Association of Corporate Directors (NACD) recommends four essential
practices for boards of directors. Which of the following is NOT one of these recommended practices? *a. Hold regular meetings with the CIO to discuss tactical InfoSec planning. b. Assign InfoSec to a key committee and ensure adequate support for that committee. c. Ensure the effectiveness of the corporation’s InfoSec policy through review and
approval. d. Identify InfoSec leaders, hold them accountable, and ensure support for them. 19. Which of the following should be included in an InfoSec governance program?
a. An InfoSec maintenance methodology *b. An InfoSec risk management methodology c. An InfoSec project management assessment d. All of these are components of the InfoSec governance program.
20. According to the Corporate Governance Task Force (CGTF), which phase in the IDEAL
model and framework lays the groundwork for a successful improvement effort? *a. initiating b. establishing c. acting d. learning
21. According to the Corporate Governance Task Force (CGTF), during which phase of the
IDEAL model and framework does the organization plan the specifics of how it will reach its destination? a. initiating *b. establishing c. acting d. learning
22. Which of the following is an information security governance responsibility of the chief
information security officer? a. Develop policies and the program. *b. Set security policy, procedures, programs, and training. c. Brief the board, customers, and the public. d. Implement incident response programs to detect security vulnerabilities and breaches.
23. ISO 27014:2013 is the ISO 27000 series standard for ____________. *a. governance of information security b. information security management c. risk management d. policy management
24. Which of the following is a key advantage of the bottom-up approach to security
implementation? a. strong upper-management support b. a clear planning and implementation process *c. utilizing the technical expertise of the individual administrators
d. coordinated planning from upper management
25. A high-level executive such as a CIO or VP-IT, who will provide political support and
influence for a specific project, is known as a(n) _________. a. sponsor *b. champion c. overseer d. auditor
26. In which SDLC model does the work product from each phase transition into the next phase
to serve as its starting point while allowing movement back to a previous phase should the project require it? a. spiral b. evolutionary prototyping c. agile *d. waterfall
27. Individuals who control, and are therefore responsible for, the security and use of a
particular set of information are known as ____________. *a. data owners b. data custodians c. data users d. data generators
28. What is the first phase of the SecSDLC? a. analysis *b. investigation c. logical design d. physical design
29. The individual responsible for the assessment, management, and implementation of
information-protection activities in the organization is known as a(n) ____________. *a. chief information security officer b. security technician c. security manager d. chief technology officer
30. In which phase of the SecSDLC does the risk management task occur?
*b. False
8. The false accept rate is the rate at which fraudulent users or nonusers are allowed access to systems or areas as a result of a failure in the biometric device. __________ *a. True b. False
9. Boundary controls regulate the admission of users into trusted areas of the organization. __________ a. True *b. False
10. A password should be difficult to guess.
__________
*a. True b. False
11. A bollard host is a device placed between an external, untrusted network and an internal, trusted network. __________ a. True *b. False
12. Intense packet inspection is a firewall function that involves examining multiple protocol headers and even content of network traffic, all the way through the TCP/IP layers and including encrypted, compressed, or encoded data. __________ a. True *b. False
13. A packet filtering firewall is a networking device that examines the header information of data packets that come into a network and determines whether to drop them (deny) or forward them to the next network connection (allow), based on its configuration rules. __________ *a. True b. False
14. A validity table is a tabular record of the state and context of each packet in a conversation between an internal and external user or system. __________
a. True *b. False
15. The action level is a predefined assessment level of an IDPS that triggers a predetermined response when surpassed. __________ a. True *b. False
16. In an IDPS, a sensor is a piece of software that resides on a system and reports back to a management server. __________ *a. True b. False
17. In wireless networking, the waveprint is the geographic area in which there is sufficient signal strength to make a network connection. __________ a. True *b. False
18. A wireless access point is a device used to connect wireless networking users and their devices to the rest of the organization’s network(s). __________ *a. True b. False
19. In e-commerce situations, some cryptographic tools can be used for misrepresentation in order to assure that parties to the transaction are authentic, and that they cannot later deny having participated in a transaction. __________ a. True *b. False
20. A semialphabetic substitution cipher is one that incorporates two or more alphabets in the encryption process. __________ a. True *b. False
21. Which of the following access control processes confirms the identity of the entity seeking
access to a logical or physical area? a. identification
*b. authentication c. authorization d. accountability
22. Which of the following is NOT among the three types of authentication mechanisms? a. something a person knows b. something a person has *c. something a person says d. something a person can produce
23. Which of the following characteristics currently used for authentication purposes is the
LEAST unique? a. fingerprints b. iris c. retina *d. face geometry
24. The rate at which authentic users are denied or prevented access to authorized areas as a
result of a failure in the biometric device is known as the __________. a. reset error ratio *b. false reject rate c. crossover error rate d. false accept rate
25. Which of the following is a commonly used criterion for comparing and evaluating
biometric technologies? a. false accept rate *b. crossover error rate c. false reject rate d. valid accept rate
26. Which of the following biometric authentication systems is considered to be truly unique,
suitable for use, and currently cost-effective? a. gait recognition b. signature recognition c. voice pattern recognition *d. fingerprint recognition
27. Which of the following biometric authentication systems is the most accepted by users? a. keystroke pattern recognition b. fingerprint recognition *c. signature recognition d. retina pattern recognition
28. Which type of firewall keeps track of each network connection established between internal
and external systems? a. packet filtering *b. stateful packet inspection c. application layer d. cache server
29. The combination of a system's TCP/IP address and a service port is known as a
__________. a. portlet b. NAT c. packet *d. socket
30. Which type of device exists to intercept requests for information from external users and
provide the requested information by retrieving it from an internal server? a. dynamic packet filtering firewall *b. proxy server c. intrusion detection system d. application layer firewall
31. The intermediate area between trusted and untrusted networks is referred to as which of the
following? a. unfiltered area b. semi-trusted area *c. demilitarized zone d. proxy zone
32. Which type of device can react to network traffic and create or modify configuration rules to
adapt? *a. dynamic packet filtering firewall b. proxy server