Enterprise Security Exam
Bank
Course Introduction
Enterprise Security explores the principles, technologies, and strategies essential for protecting an organizations information assets in complex business environments. The course covers topics such as risk assessment, security policies, access control, cryptography, network defense, incident response, compliance, and security governance. Students learn to evaluate potential threats and vulnerabilities, implement effective security architectures, and align security initiatives with organizational objectives. By examining real-world case studies and current industry standards, the course prepares students to design and manage robust enterprise security solutions that address both technical and managerial challenges.
Recommended Textbook
Principles of Information Security 5th Edition by Michael E. Whitman
Available Study Resources on Quizplus
12 Chapters
696 Verified Questions
696 Flashcards
Source URL: https://quizplus.com/study-set/2374
Page 2
Chapter 1: Introduction to the Management of Information Security
Available Study Resources on Quizplus for this Chatper
63 Verified Questions
63 Flashcards
Source URL: https://quizplus.com/quiz/47110
Sample Questions
Q1) ____________________are malware programs that hide their true nature,and reveal their designed behavior only when activated.
A) Viruses
B) Worms
C) Spam
D) Trojan horses
Answer: D
Q2) Which of the following is the principle of management dedicated to the structuring of resources to support the accomplishment of objectives?
A) organization
B) planning
C) controlling
D) leading
Answer: A
Q3) The first step in solving problems is to gather facts and make assumptions.
A)True
B)False
Answer: False
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: Compliance: Law and Ethics
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/47111
Sample Questions
Q1) Due <U>diligence</U> requires that an organization make a valid and ongoing effort to protect others.____________
A)True
B)False
Answer: True
Q2) The penalty for violating the National Information Infrastructure Protection Act of 1996 depends on the value of the information obtained and whether the offense is judged to have been committed for one of three reasons.What are those reasons?
Answer: For purposes of commercial advantage For private financial gain In furtherance of a criminal act
Q3) Which act is a collection of statutes that regulates the interception of wire,electronic,and oral communications?
A) The Electronic Communications Privacy Act of 1986
B) The Telecommunications Deregulation and Competition Act of 1996
C) National Information Infrastructure Protection Act of 1996
D) Federal Privacy Act of 1974
Answer: A
To view all questions and flashcards with answers, click on the resource link above. Page 4
Chapter 3: Governance and Strategic Planning for Security
Available Study Resources on Quizplus for this Chatper
52 Verified Questions
52 Flashcards
Source URL: https://quizplus.com/quiz/47112
Sample Questions
Q1) The individual responsible for the assessment,management,and implementation of information-protection activities in the organization is known as a(n)____________.
A) chief information security officer
B) security technician
C) security manager
D) chief technology officer
Answer: A
Q2) According to the Corporate Governance Task Force (CGTF),which phase in the IDEAL model and framework lays the groundwork for a successful improvement effort?
A) Initiating
B) Establishing
C) Acting
D) Learning
Answer: A
Q3) In ____________________
testing,security personnel simulate or perform specific and controlled attacks to compromise or disrupt their own systems by exploiting documented vulnerabilities.
Answer: penetration
To view all questions and flashcards with answers, click on the resource link above.
5
Chapter 4: Information Security Policy
Available Study Resources on Quizplus for this Chatper
56 Verified Questions
56 Flashcards
Source URL: https://quizplus.com/quiz/47113
Sample Questions
Q1) The responsibilities of both the users and the systems administrators with regard to specific systems administration duties should be specified in the ____________________ section of the ISSP.
Q2) Examples of actions that illustrate compliance with policies are known as <U>laws</U>.
A)True
B)False
Q3) List the major components of the ISSP.
Q4) Which policy is the highest level of policy and is usually created first?
A) SysSP
B) USSP
C) ISSP
D) EISP
Q5) Since most policies are drafted by a single person and then reviewed by a higher-level manager,employee input should not be considered since it makes the process too complex.
A)True
B)False
Q6) What should an effective ISSP accomplish?
Q7) What is a SysSP and what is one likely to include?
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Developing the Security Program
Available Study Resources on Quizplus for this Chatper
55 Verified Questions
55 Flashcards
Source URL: https://quizplus.com/quiz/47114
Sample Questions
Q1) The security education,training,and awareness (SETA)program is designed to reduce the occurence of external security attacks.
A)True
B)False
Q2) What is the purpose of a security awareness program?What advantage does an awareness program have for the InfoSec program?
Q3) Threats from insiders are more likely in a small organization than in a large one.
A)True
B)False
Q4) Which of the following functions needed to implement the information security program evaluates patches used to close software vulnerabilities and acceptance testing of new systems to assure compliance with policy and effectiveness?
A) Systems testing
B) Risk assessment
C) Incident response
D) Systems security administration
Q5) List the steps of the seven-step methodology for implementing training.
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Risk Management: Identifying and Assessing Risk
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47115
Sample Questions
Q1) List the stages in the risk identification process in order of occurrence.
Q2) Which of the following distinctly identifies an asset and can be vital in later analysis of threats directed to specific models of certain devices or software components?
A) Name
B) MAC address
C) Serial number
D) Manufacturer's model or part number
Q3) The <U>secretarial </U> community often takes on the leadership role in addressing risk.____________
A)True
B)False
Q4) What should the prioritized list of assets and their vulnerabilities and the prioritized list of threats facing the organization be combined to create?
A) Risk exposure report
B) Threats-vulnerabilities-assets worksheet
C) Costs-risks-prevention database
D) Threat assessment catalog
Q5) What are the included tasks in the identification of risks?
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Risk Management: Controlling Risk
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47116
Sample Questions
Q1) Unlike other risk management frameworks,FAIR relies on the qualitative assessment of many risk components using scales with value ranges.
A)True
B)False
Q2) To keep up with the competition organizations must design and create a ____________ environment in which business processes and procedures can function and evolve effectively.
Q3) The risk control strategy that indicates the organization is willing to accept the current level of risk.As a result,the organization makes a conscious decision to do nothing to protect an information asset from risk and to accept the outcome from any resulting exploitation is known as the <U>termination </U>risk control strategy.
A)True
B)False
Q4) Due care and due diligence occur when an organization adopts a certain minimum level of security-that is,what any<U> prudent</U> organization would do in similar circumstances.____________
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above.
9
Chapter 8: Security Management Models
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47117
Sample Questions
Q1) Ratings of the security level for a specified collection of information (or user)within a mandatory access control scheme.
A)blueprint
B)DAC
C)content-dependent access controls
D)rule-based access controls
E)separation of duties
F)sensitivity levels
G)storage channels
H)task-based controls
I)timing channels
J)TCB
Q2) Which of the following is NOT a change control principle of the Clark-Wilson model?
A) No changes by unauthorized subjects
B) No unauthorized changes by authorized subjects
C) No changes by authorized subjects without external validation
D) The maintenance of internal and external consistency
Q3) Access controls are build on three key principles.List and briefly define them.
Q4) Under what circumstances should access controls be centralized vs.decentralized?
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 9: Security Management Practices
Available Study Resources on Quizplus for this Chatper
59 Verified Questions
59 Flashcards
Source URL: https://quizplus.com/quiz/47118
Sample Questions
Q1) The biggest barrier to<U>baselining </U>in InfoSec is the fact that many organizations do notshare warnings with other organizations.____________
A)True
B)False
Q2) The Authorize step of the NIST six-step approach to the risk management framework involves all but which of the following tasks?
A) Prepare the plan of action and develop milestones
B) Assemble the security authorization package
C) Determine if the cost/benefit ratio is acceptable
D) Determine the risk to organizational operations
Q3) Which of the following InfoSec measurement specifications makes it possible to define success in the security program?
A) Development approach
B) Establishing targets
C) Prioritization and selection
D) Measurements templates
Q4) The process of implementing a performance measures program recommended by NIST involves six phases.List and describe them.
To view all questions and flashcards with answers, click on the resource link above.
Chapter 10: Planning for Contingencies
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47119
Sample Questions
Q1) Which of the following is the process of examining a possible incident and determining whether it constitutes an actual incident?
A) Incident classification
B) Incident identification
C) Incident registration
D) Incident verification
Q2) What are the major components of contingency planning?
Q3) There are six key elements that the CP team must build into the DR Plan.What are three of them?
Q4) Which of the following has the main goal of restoring normal modes of operation with minimal cost and disruption to normal business activities after an adverse event?
A) Risk management
B) Contingency planning
C) Business response
D) Disaster readiness
Q5) The bulk batch-transfer of data to an off-site facility is known as
Q6) Describe the methodology an organization should follow in an investigation.
Q7) List four of the eight key components of a typical IR policy.
Page 12
To view all questions and flashcards with answers, click on the resource link above.
Chapter 11: Personnel and Security
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47120
Sample Questions
Q1) Most hiring organizations are aware of the precise value of information security certifications because these programs have been in existence for a long time.
A)True
B)False
Q2) Which of the following is NOT a CISSP concentration?
A) ISSAP
B) ISSTP
C) ISSMP
D) ISSEP
Q3) computer forensics certification from ISFCE
A)definers
B)builders
C)security manager
D)security technician
E)systems programmer
F)ethics officer
G)CISSP
H)SSCP
I)SANS
J)CCE
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Protection Mechanisms
Available Study Resources on Quizplus for this Chatper
61 Verified Questions
61 Flashcards
Source URL: https://quizplus.com/quiz/47121
Sample Questions
Q1) List the most common firewall implementation architectures.
Q2) ____________is a technology in which multiple real,routable external IP addresses are converted to special ranges of internal IP addresses,usually on a one-to-one basis.
Q3) Which of the following provides an identification card of sorts to clients who request services in a Kerberos system?
A) Ticket Granting Service
B) Authentication Server
C) Authentication Client
D) Key Distribution Center
Q4) The intermediate area between trusted and untrusted networks is referred to as which of the following?
A) Unfiltered area
B) Semi-trusted area
C) Demilitarized zone
D) Proxy zone
Q5) What should you look for when selecting a firewall for your network?
Q6) What is a packet sniffer and how can it be used for good or nefarious purposes?
Q7) Briefly describe how biometric technologies are generally evaluated.
Q8) What are NAT and PAT?Describe these technologies.
To view all questions and flashcards with answers, click on the resource link above. Page 14