Ethical and Legal Issues in Information Security
Exam Preparation Guide
Course Introduction
This course explores the fundamental ethical and legal challenges associated with information security in todays digital landscape. Students examine the frameworks governing data privacy, intellectual property, cybercrime, and digital rights management, as well as professional codes of conduct relevant to security practitioners. Case studies and real-world scenarios are used to illustrate issues such as responsible disclosure, regulatory compliance, ethical hacking, and the impact of global laws on security operations. Emphasis is placed on developing critical thinking skills to identify and address ethical dilemmas and legal constraints in security policy making, system implementation, and incident response.
Recommended Textbook Principles of Information Security 4th Edition by Michael E. Whitman
Available Study Resources on Quizplus 12 Chapters
Source URL: https://quizplus.com/study-set/2244
2
Chapter 1: Introduction to Information Security
Available Study Resources on Quizplus for this Chatper
78 Verified Questions
78 Flashcards
Source URL: https://quizplus.com/quiz/44634
Sample Questions
Q1) The Analysis phase of the SecSDLC begins with a directive from upper management._________________________
A)True
B)False
Answer: False
Q2) The most successful kind of top-down approach involves a formal development strategy referred to as a ____.
A)systems design
B)development life project
C)systems development life cycle
D)systems schema
Answer: C
Q3) A champion is a project manager,who may be a departmental line manager or staff unit manager,and understands project management,personnel management,and information security technical requirements.
A)True
B)False
Answer: False
To view all questions and flashcards with answers, click on the resource link above.
3
Chapter 2: The Need for Security
Available Study Resources on Quizplus for this Chatper
78 Verified Questions
78 Flashcards
Source URL: https://quizplus.com/quiz/44635
Sample Questions
Q1) A ____ is an attack in which a coordinated stream of requests is launched against a target from many locations at the same time.
A)denial-of-service
B)distributed denial-of-service
C)virus
D)spam
Answer: B
Q2) Cyberterrorists hack systems to conduct terrorist activities via network or Internet pathways._________________________
A)True
B)False
Answer: True
Q3) One form of e-mail attack that is also a DoS is called a mail spoof,in which an attacker routes large quantities of e-mail to the target._________________________
A)True
B)False
Answer: False
To view all questions and flashcards with answers, click on the resource link above. Page 4
Chapter 3: Legal, Ethical, and Professional Issues in Information Security
Available Study Resources on Quizplus for this Chatper
78 Verified Questions
78 Flashcards
Source URL: https://quizplus.com/quiz/44636
Sample Questions
Q1) The United States has implemented a version of the DMCA law called the Database Right,in order to comply with Directive 95/46/EC.
A)True
B)False
Answer: False
Q2) Every state has implemented uniform laws and regulations placed on organizational use of computer technology.
A)True
B)False
Answer: False
Q3) ____ defines stiffer penalties for prosecution of terrorist crimes.
A)USA Patriot Act
B)Sarbanes-Oxley Act
C)Gramm-Leach-Bliley Act
D)Economic Espionage Act
Answer: A
Q4) ____________________ are the fixed moral attitudes or customs of a particular group.
Answer: Cultural mores
Page 5
To view all questions and flashcards with answers, click on the resource link above.
Available
Study
Chapter 4: Risk Management
Resources on Quizplus for this Chatper
108 Verified Questions
108 Flashcards
Source URL: https://quizplus.com/quiz/44637
Sample Questions
Q1) Internal benchmarking can provide the foundation for baselining.
A)True
B)False
Q2) Organizations should communicate with system users throughout the development of the security program,letting them know that change are coming.
A)True
B)False
Q3) A(n)____________________ is a "value or profile of a performance metric against which changes in the performance metric can be usefully compared."
Q4) Of the three types of mitigation plans,the _________________________ plan is the most strategic and long term.
Q5) In the U.S.military classification scheme,____ data is any information or material the unauthorized disclosure of which reasonably could be expected to cause damage to the national security.
A)confidential
B)secret
C)top secret
D)sensitive
To view all questions and flashcards with answers, click on the resource link above.
Page 6
Chapter 5: Planning for Security
Available Study Resources on Quizplus for this Chatper
108 Verified Questions
108 Flashcards
Source URL: https://quizplus.com/quiz/44638
Sample Questions
Q1) A(n)____________________ is a detailed examination of the events that occurred from first detection to final recovery.
Q2) Incident ____________________ is the process of examining a potential incident,or incident candidate,and determining whether or not the candidate constitutes an actual incident.
Q3) Informational controls guide the development of education,training,and awareness programs for users,administrators,and management.
A)True
B)False
Q4) Information security safeguards provide two levels of control: managerial and remedial.
A)True
B)False
Q5) Security training provides detailed information and hands-on instruction to employees to prepare them to perform their duties securely.
A)True
B)False
Q6) Compare electronic vaulting and remote journaling.
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Security Technology: Firewalls and Vpns
Available Study Resources on Quizplus for this Chatper
108 Verified Questions
108 Flashcards
Source URL: https://quizplus.com/quiz/44639
Sample Questions
Q1) The application firewall is also known as a(n)____________________ server.
Q2) The Secure European System for Applications in a(n)____________________ Environment is the result of a European research and development project partly funded by the European Commission.
Q3) A Web server is often exposed to higher levels of risk when placed in the DMZ than when it is placed in the untrusted network.
A)True
B)False
Q4) In Kerberos,a(n)____________________ is an identification card for a particular client that verifies to the server that the client is requesting services and that the client is a valid member of the Kerberos system and therefore authorized to receive services.
Q5) A content filter is technically a firewall.
A)True
B)False
Q6) A(n)____________________ filter is a software filter - technically not a firewall - that allows administrators to restrict access to content from within a network.
Q7) A trusted VPN is also known as a(n)____________________ VPN.
Page 8
To view all questions and flashcards with answers, click on the resource link above.
Chapter 7: Security Technology: Intrusion
Detection and Prevention Systems, and Other Security Tools
Available Study Resources on Quizplus for this Chatper
108 Verified Questions
108 Flashcards
Source URL: https://quizplus.com/quiz/44640
Sample Questions
Q1) To determine whether an attack has occurred or is underway,NIDPSs compare measured activity to known ____ in their knowledge base.
A)fingernails
B)fingerprints
C)signatures
D)footprints
Q2) A(n)____ is a network tool that collects copies of packets from the network and analyzes them.
A)packet scanner
B)packet sniffer
C)honey pot
D)honey packet
Q3) ____________________ is the process of attracting attention to a system by placing tantalizing bits of information in key locations.
Q4) A(n)____ IDPS is focused on protecting network information assets.
A)network-based
B)host-based
C)application-based
D)server-based
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: Cryptography
Available Study Resources on Quizplus for this Chatper
108 Verified Questions
108 Flashcards
Source URL: https://quizplus.com/quiz/44641
Sample Questions
Q1) A(n)____________________ authority operates under the trusted collaboration of the certificate authority and can be delegated day-to-day certification functions,such as verifying registration information about new registrants,generating end-user keys,revoking certificates,and validating that users possess a valid certificate.
Q2) Nonrepudiation means that customers or partners can be held accountable for transactions,such as online purchases,which they cannot later deny.
A)True B)False
Q3) Popular cryptosystems use a hybrid combination of symmetric and asymmetric algorithms.
A)True B)False
Q4) The application header protocol provides secrecy for the content of a network communication.
A)True B)False
Q5) ____________________ is the process of making and using codes to secure the transmission of information.
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 9: Physical Security
Available Study Resources on Quizplus for this Chatper
78 Verified Questions
78 Flashcards
Source URL: https://quizplus.com/quiz/44642
Sample Questions
Q1) A name badge is typically worn concealed.
A)True
B)False
Q2) A wet-pipe system is usually considered appropriate in computer rooms. A)True B)False
Q3) Class ____ fires are extinguished by agents that remove oxygen from the fire.
A)A
B)B
C)C
D)D
Q4) Vibration sensors fall into the motion sensor category. A)True B)False
Q5) Guards can evaluate each situation as it arises and make reasoned responses._________________________
A)True B)False
Q6) A(n)____________________ is a small enclosure that has separate entry and exit points.
Page 11
To view all questions and flashcards with answers, click on the resource link above.
Chapter 10: Implementing Information Security
Available Study Resources on Quizplus for this Chatper
78 Verified Questions
78 Flashcards
Source URL: https://quizplus.com/quiz/44643
Sample Questions
Q1) Medium- and large-sized organizations deal with the impact of technical change on the operation of the organization through a(n)____________________ control process.
Q2) A cybernetic loop ensures that progress is measured periodically._________________________
A)True
B)False
Q3) The primary drawback to the direct changeover approach is that if the new system fails or needs modification,users may be without services while the system's bugs are worked out.
A)True
B)False
Q4) The security systems implementation life cycle is a process for collecting information about an organization's objectives,its technical architecture,and its information security environment._________________________
A)True
B)False
Q5) One of the oldest models of change is the ____________________ change model.
Q6) What major project tasks does the WBS document?
Page 12
To view all questions and flashcards with answers, click on the resource link above.
Chapter 11: Security and Personnel
Available Study Resources on Quizplus for this Chatper
78 Verified Questions
78 Flashcards
Source URL: https://quizplus.com/quiz/44644
Sample Questions
Q1) The certification requires both the successful completion of the examination and an endorsement by a qualified third party,typically another CISSP-certified professional,the candidate's employer,or a licensed,certified,or commissioned professional.
Q2) Separation of ____________________ is used to reduce the chance of an individual violating information security and breaching the confidentiality,integrity,or availability of information.
Q3) Many information security professionals enter the field from traditional ____ assignments.
A)HR
B)BA
C)IT
D)All of the above
Q4) Sometimes onsite contracted employees are self-employed or are employees of an organization hired for a specific,one-time purpose.These people are typically referred to as ____________________.
Q5) Each CISSP concentration exam consists of 25 to 50 questions.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Information Security Maintenance
Available Study Resources on Quizplus for this Chatper
103 Verified Questions
103 Flashcards
Source URL: https://quizplus.com/quiz/44645
Sample Questions
Q1) The ____________________ process step is identical to the one followed in Internet vulnerability analysis.
Q2) Court decisions generally do not impact agency policy.
A)True
B)False
Q3) Major planning components should be reviewed on a periodic basis to ensure that they are current,accurate,and appropriate.
A)True
B)False
Q4) In some instances,risk is acknowledged as being part of an organization's business process.
A)True
B)False
Q5) Threats cannot be removed without requiring a repair of the vulnerability.
A)True
B)False
Q6) The Analysis step of Internet vulnerability assessment is when a knowledgeable and experienced vulnerability analyst screens the test results for the ____________________ vulnerabilities logged during scanning.
Page 14
To view all questions and flashcards with answers, click on the resource link above.