Course Introduction
Enterprise Security Test Questions
Enterprise Security explores the principles, practices, and technologies used to protect the information assets and infrastructure of organizations. The course covers risk management, security policies and frameworks, threat identification, and the implementation of security controls tailored for large-scale and complex environments. Students learn about access control, network and application security, incident response, compliance, and the evolving landscape of cyber threats. Emphasis is placed on real-world case studies, best practices, and the coordination of physical and digital security measures to effectively safeguard enterprise operations and data.
Recommended Textbook Management of Information Security 3rd Edition by Michael E. Whitman
Available Study Resources on Quizplus
12 Chapters
1438 Verified Questions
1438 Flashcards
Source URL: https://quizplus.com/study-set/2354
Page 2
Chapter 1: Introduction to the Management of Information Security
Available Study Resources on Quizplus for this Chatper
139 Verified Questions
139 Flashcards
Source URL: https://quizplus.com/quiz/46799
Sample Questions
Q1) \(\text {\underline{ Leadership} }\) generally addresses the direction and motivation of the human resource._________________________
A)True
B)False
Answer: True
Q2) \(\text {\underline{Democratic } }\)
leaders tend to make decisions only when they are needed to avoid bringing the process to a complete halt._________________________
A)True
B)False
Answer: False
Q3) In the PERT technique,the difference in time between the critical path and any other path is called ____________________.
Answer: slack time
Q4) The ____________________ community articulates and communicates organizational policy and objectives.
Answer: general business
Page 3
To view all questions and flashcards with answers, click on the resource link above.
Chapter 2: Planning for Security
Available Study Resources on Quizplus for this Chatper
123 Verified Questions
123 Flashcards
Source URL: https://quizplus.com/quiz/46800
Sample Questions
Q1) Which of the following is true about mission statements?
A) They should be ambitious
B) They express what the organization is
C) They express the aspirations of the organization
D) They are not meant to be probable
Answer: B
Q2) Which of the following is an nformation security governance responsibility of the CISO?
A) Communicate policies and the program
B) Set security policy, procedures, programs and training for the organization
C) Brief the board, customers and the public
D) Implement policy, report security vulnerabilities and breaches
Answer: B
Q3) In order to build programs suited to their needs,organizations should conduct an annual information security evaluation,the results of which the CISO should review with staff and then report to the board of directors.
A)True
B)False
Answer: False
To view all questions and flashcards with answers, click on the resource link above.
Page 4
Chapter 3: Planning for Contingencies
Available Study Resources on Quizplus for this Chatper
114 Verified Questions
114 Flashcards
Source URL: https://quizplus.com/quiz/46801
Sample Questions
Q1) The BC Plan is most properly managed by the ____.
A) CEO
B) CIO
C) CISO
D) IT community of interest
Answer: A
Q2) A(n)____ shows the estimated cost of the best,worst,and most likely outcomes of an attack.
A) attack profile
B) attack message
C) attack scenario end case
D) attack success scenario
Answer: C
Q3) A(n)____________________ is an agency that provides,in the case of DR/BC planning,physical facilities for a fee.
Answer: service bureau
Q4) The immediate determination of the scope of the breach of confidentiality,integrity,and availability of information and information assets is called
Answer: incident damage assessment
Page 5
To view all questions and flashcards with answers, click on the resource link above.
Chapter 4: Information Security Policy
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46802
Sample Questions
Q1) The ____ section of the ISSP should specify users' and systems administrators' responsibilities.
A) Authorized Access and Usage of Equipment
B) Systems Management
C) Prohibited Usage of Equipment
D) Violations of Policy
Q2) List and briefly describe the major components of the ISSP.
Q3) During the ____ phase of the SecSDLC,the information security policy is monitored,maintained,and modified as needed.
A) implementation
B) maintenance
C) analysis
D) investigation
Q4) List the significant guidelines used in the formulation of effective information security policy.
Q5) For policies to be effective,they must be properly formally agreed to by act or ____________________.
Q6) The ____________________ information security program policy is the highest level of policy.
Page 6
To view all questions and flashcards with answers, click on the resource link above.
Chapter 5: Developing the Security Program
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46803
Sample Questions
Q1) Organizations with complex IT infrastructures are likely to require more information security support than those with less complex infrastructures.
A)True B)False
Q2) The<u> distance learning</u> method of training is in use when a single trainer works with multiple trainees in a formal setting._________________________ A)True B)False
Q3) The organization's size and available resources also <u>indirectly</u> affect the size and structure of the information security program._________________________ A)True
B)False
Q4) In ____________________ training,prepackaged software provides training at the trainee's workstation.
Q5) Training for managers would be more detailed than that for security staff. A)True B)False
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Security Management Models
Available Study Resources on Quizplus for this Chatper
120 Verified Questions
120 Flashcards
Source URL: https://quizplus.com/quiz/46804
Sample Questions
Q1) Within the TCB is a conceptual object known as the ____________________,which is the piece of the system that manages access controls-in other words,it mediates all access to objects by subjects.
Q2) Under lattice-based access controls,the row of attributes associated with a particular subject (such as a user)is referred to as a(n)____.
A) access control list
B) capabilities table
C) access control matrix
D) sensitivity level
Q3) Bell-LaPadula security rules prevent information from being moved from a level of higher security to a level of lower security.
A)True
B)False
Q4) Controls that discourage an incipient incident are called ____.
A) preventative
B) deterrent
C) corrective
D) compensating
Q5) ____________________ controls restore operating conditions back to normal.
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Security Management Practices
Available Study Resources on Quizplus for this Chatper
114 Verified Questions
114 Flashcards
Source URL: https://quizplus.com/quiz/46805
Sample Questions
Q1) Security efforts that seek to provide a superior level of performance in the protection of information are called ____.
A) recommended business practices
B) best practices
C) best security practices
D) All of these are correct
Q2) Best security practices (BSPs)balance the need for information access with the need for adequate protection while simultaneously demonstrating social responsibility.
A)True
B)False
Q3) In information security,two categories of benchmarks are used: standards of due care and due diligence and <u>recommended practices</u>._________________________
A)True
B)False
Q4) The process of implementing a performance measures program recommended by NIST involves six phases.List them.
To view all questions and flashcards with answers, click on the resource link above.
9
Chapter 8: Risk Management: Identifying and Assessing Risk
Available Study Resources on Quizplus for this Chatper
78 Verified Questions
78 Flashcards
Source URL: https://quizplus.com/quiz/46806
Sample Questions
Q1) The process of evaluating potential weaknesses in each information asset is known as ____________________ identification.
Q2) Assessing risks includes determining the ____________________ that vulnerable systems will be attacked by specific threats.
Q3) People are divided into insiders (employees)and outsiders (nonemployees).<u>Outsiders</u> come in two categories: either they hold trusted roles and have correspondingly greater authority and accountability,or they are regular staff without any special privileges._________________________
A)True
B)False
Q4) The ____ is an effective attribute for tracking network devices and servers,but rarely applies to software.
A) name
B) asset type
C) MAC address
D) IP address
Q5) Briefly describe any three standard IT system components and their respective risk management components.
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 9: Risk Management: Controlling Risk
Available Study Resources on Quizplus for this Chatper
105 Verified Questions
105 Flashcards
Source URL: https://quizplus.com/quiz/46807
Sample Questions
Q1) The Annualized Loss Expectancy in the CBA formula is determined as ____.
A) ALE * ARO
B) SLE * ARO
C) ACS - SLE(post)
D) AV * EF
Q2) Economic feasibility is a standard that is commonly used when evaluating a project that implements information security safeguards.
A)True
B)False
Q3) The final choice of a risk control strategy may call for a balanced mixture of controls that provides the greatest value for as many asset-threat pairs as possible.
A)True
B)False
Q4) Organizations can establish a competitive business model,method,or technique allowing it to provide a product or service that is superior in some way creating competitive <u>disadvantage</u>._________________________
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above.
Chapter 10: Protection Mechanisms
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46808
Sample Questions
Q1) The second router in an application-level firewall is often called a(n)<u>proxy</u> server,because it relays internal services for external service requests.._________________________
A)True
B)False
Q2) The<u> trace</u> function in a trap and trace scanning tool entices individuals who are illegally perusing the internal sections of a network,in order to determine who they are._________________________
A)True
B)False
Q3) The firewall architecture that consists of one or more internal bastion hosts located behind a packet filtering router is the ____.
A) screened-subnet firewall
B) dual-homed host firewall
C) proxy firewall
D) screened-host firewall
Q4) The second generation of firewalls are known as proxy servers or ____________________ firewalls.
Q5) Bastion host is also referred to as a(n)____________________ host.
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 11: Personnel and Security
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46809
Sample Questions
Q1) The CompTIA ____________________ certification tests an individual's security knowledge mastery and requires two years on-the-job networking experience,with emphasis on security.
Q2) (ISC)²'s SSCP is considered to be the most prestigious certification for information security managers and CISOs.
A)True
B)False
Q3) Enforcing tight badge security measures is a social engineering strategy that secures the ____.
A) office
B) Dumpster
C) building entrance
D) phone closet
Q4) The ____ certification program is an option for individuals who wish to take the CISSP or SSCP exams before obtaining the requisite experience for certification.
A) TICSA
B) SCP
C) MCSE
D) (ISC)² Associate
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Law and Ethics
Available Study Resources on Quizplus for this Chatper
113 Verified Questions
113 Flashcards
Source URL: https://quizplus.com/quiz/46810
Sample Questions
Q1) ____ is the study of the rightness or wrongness of intentions and motives as opposed to the rightness or wrongness of the consequences and is also known as dutyor obligation-based ethics.
A) Applied ethics
B) Descriptive ethics
C) Normative ethics
D) Deontological ethics
Q2) Laws and policies and their associated penalties only deter if three conditions are present.Which of the following is NOT one of them?
A) Fear of penalty
B) Probability of being caught
C) Probability of penalty being administered
D) Probability of prosecution
Q3) Which law categorizes crimes based on a defendant's authority to access a protected computer system and criminal intent?
A) USA Patriot Act of 2001
B) Computer Fraud and Abuse Act of 2001
C) National Information Infrastructure Protection Act of 1996
D) Computer Security Act of 1987
To view all questions and flashcards with answers, click on the resource link above.
Page 14