Ethical and Legal Issues in Information Security
Exam Answer Key
Course Introduction
This course examines the critical ethical and legal considerations in the field of information security. Students will explore topics such as privacy rights, intellectual property, cybercrime, compliance requirements, and professional codes of conduct. Emphasis is placed on understanding the evolving legal frameworks that govern data protection and cybersecurity in both national and international contexts. Through case studies and current events, learners will analyze real-world scenarios to develop the skills needed to recognize, assess, and address complex ethical dilemmas and legal challenges facing information security professionals today.
Recommended Textbook Principles of Information Security 6th Edition by Michael E. Whitman
Available Study Resources on Quizplus
12 Chapters
1148 Verified Questions
1148 Flashcards
Source URL: https://quizplus.com/study-set/2123
Page 2
Chapter 1: Introduction to Information Security
Available Study Resources on Quizplus for this Chatper
87 Verified Questions
87 Flashcards
Source URL: https://quizplus.com/quiz/42300
Sample Questions
Q1) Describe the multiple types of security systems present in many organizations. Answer: A successful organization should have the following multiple layers of security in place to protect its operations, including physical, personnel, operations, communications, networks, and information: Physical security, to protect physical items, objects, or areas from unauthorized access and misuse Personnel security, to protect the individual or group of individuals who are authorized to access the organization and its operations Operations security, to protect the details of a particular operation or series of activities Communications security, to protect communications media, technology, and content Network security, to protect networking components, connections, and contents Information security, to protect the confidentiality, integrity, and availability of information assets, whether in storage, processing, or transmission. It is achieved via the application of policy, education, training and awareness, and technology.
Q2) The investigation phase of the SDLC involves specification of the objectives, constraints, andscope of the project.
A)True
B)False
Answer: True
To view all questions and flashcards with answers, click on the resource link above.
Page 3
Chapter 2: The Need for Security
Available Study Resources on Quizplus for this Chatper
91 Verified Questions
91 Flashcards
Source URL: https://quizplus.com/quiz/42301
Sample Questions
Q1) Microsoft acknowledged that if you type a res:// URL (a Microsoft-devised type of URL) longer than ____________________ characters in Internet Explorer 4.0, the browser will crash.
A) 64
B) 128
C) 256
D) 512
Answer: C
Q2) The process of maintaining the confidentiality, integrity, and availability of data managed by a DBMS is known as __________ security.
A) database
B) data
C) information
D) residual
Answer: A
Q3) Attacks conducted by scripts are usually unpredictable.
A)True
B)False
Answer: False
To view all questions and flashcards with answers, click on the resource link above.
Page 4
Chapter 3: Legal, Ethical, and Professional Issues in Information Security
Available Study Resources on Quizplus for this Chatper
83 Verified Questions
83 Flashcards
Source URL: https://quizplus.com/quiz/42302
Sample Questions
Q1) __________ is the legal obligation of an entity that extends beyond criminal or contract law.
Answer: Liability
Q2) The Computer __________ and Abuse Act of 1986 is the cornerstone of many computer-related federal laws and enforcement efforts.
A) Violence
B) Fraud
C) Theft
D) Usage
Answer: B
Q3) __________ are rules that mandate or prohibit certain behavior and are enforced by the government.
Answer: Laws
Q4) The low overall degree of tolerance for __________ system use may be a function of the easy association between the common crimes of breaking and entering, trespassing, theft, and destruction of property to their computer-related counterparts.
Answer: illicit
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Planning for Security
Available Study Resources on Quizplus for this Chatper
109 Verified Questions
109 Flashcards
Source URL: https://quizplus.com/quiz/42303
Sample Questions
Q1) A(n)<u> alarming </u>event is an event with negative consequences that could threaten the organization's information assets or operations.__________________
A)True
B)False
Q2) A disaster recovery plan shows the organization's intended efforts to restore operations at the original site in the aftermath of a disaster.
A)True
B)False
Q3) Redundancy can be implemented at a number of points throughout the security architecture, such as in ________.
A) firewalls
B) proxy servers
C) access controls
D) All of the above
Q4) A standard is a written instruction provided by management that informs employees and others in the workplace about proper behavior.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Risk Management
Available Study Resources on Quizplus for this Chatper
108 Verified Questions
108 Flashcards
Source URL: https://quizplus.com/quiz/42304
Sample Questions
Q1) Baselining is the comparison of past security activities and events against the organization's current performance.
A)True
B)False
Q2) The _________ control strategy attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards.
A) termination
B) defense
C) transference
D) mitigation
Q3) Residual risk is the risk that has not been removed, shifted, or planned for after vulnerabilities have been completely resolved.
A)True
B)False
Q4) Operational feasibility is an assessment of whether the organization can acquire the technology necessary to implement and support the proposed control.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Security Technology: Access Controls, Firewalls, and VPNS
Available Study Resources on Quizplus for this Chatper
106 Verified Questions
106 Flashcards
Source URL: https://quizplus.com/quiz/42305
Sample Questions
Q1) As organizations implement cloud-based IT solutions, bring your own device (BYOD) options for employees, and other emerging network solutions, the network perimeter may be ____________________ for them.
Q2) An extranet is a segment of the DMZ where no authentication and authorization controls are put into place.
A)True
B)False
Q3) It is important that e-mail traffic reach your e-mail server and only your e-mail server.
A)True
B)False
Q4) <u>Traceroute</u>, formally known as an ICMP Echo request, is used by internal systems administrators to ensure that clients and servers can communicate.
A)True
B)False
Q5) SESAME uses ____________________ key encryption to distribute secret keys.
To view all questions and flashcards with answers, click on the resource link above. Page 8
Q6) The ____________________ packet-filtering firewall can react to an emergent event and update or create rules to deal with that event.
Chapter 7: Security Technology: Intrusion
Detection and Prevention Systems, and Other Security Tools
Available Study Resources on Quizplus for this Chatper
107 Verified Questions
107 Flashcards
Source URL: https://quizplus.com/quiz/42306
Sample Questions
Q1) Most network behavior analysis system sensors can be deployed in __________ mode only, using the same connection methods as network-based IDPSs.
A) passive
B) active
C) reactive
D) dynamic
Q2) A padded cell is a hardened <u>honeynet</u>. _________________________
A)True
B)False
Q3) In the process of protocol <u>application </u>verification, the NIDPSs look for invalid data packets. _________________________
A)True
B)False
Q4) Passive scanners are advantageous in that they require vulnerability analysts to get approval prior to testing.
A)True
B)False
Q5) List and describe the four advantages of HIDPSs.
Q6) HIDPSs are also known as system ____________________ verifiers.
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: Cryptography
Available Study Resources on Quizplus for this Chatper
109 Verified Questions
109 Flashcards
Source URL: https://quizplus.com/quiz/42307
Sample Questions
Q1) At the World Championships in Athletics in Helsinki in August 2005, a virus called Cabir infected dozens of __________, the first time this occurred in a public setting.
A) iPad tablets
B) Bluetooth mobile phones
C) WiFi routers
D) laptop Macintosh computers
Q2) The process of hiding messages within the digital encoding of a picture or graphic is called ____________________.
Q3) To <u>encipher</u> means to decrypt, decode, or convert ciphertext into the equivalent plaintext. _________________________
A)True
B)False
Q4) DES uses a(n) ___________-bit block size.
A) 32
B) 64
C) 128
D) 256
Q5) Describe symmetric and asymmetric encryption.
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 9: Physical Security
Available Study Resources on Quizplus for this Chatper
77 Verified Questions
77 Flashcards
Source URL: https://quizplus.com/quiz/42308
Sample Questions
Q1) Explain how a mantrap works.
Q2) _________________________ locks can be integrated into alarm systems and combined with other building management systems.
Q3) In the __________ approach, the sensor detects an unusually rapid increase in the area temperature within a relatively short period of time.
A) fixed temperature
B) permanent temperature
C) fixed rate
D) rate-of-rise
Q4) A <u>gaseous</u> system is designed to apply a liquid, usually water, to all areas in which a fire has been detected. _________________________
A)True
B)False
Q5) Standby power supply (SPS) UPSs provide power conditioning.
A)True
B)False
Q6) List and describe the "Seven Major Sources of Physical Loss."
Q7) A(n) _________________________ is typically carried concealed.
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 10: Implementing Information Security
Available Study Resources on Quizplus for this Chatper
78 Verified Questions
78 Flashcards
Source URL: https://quizplus.com/quiz/42309
Sample Questions
Q1) Planning for the implementation phase requires the creation of a detailed r<u>equest for proposal</u>, which is often assigned either to a project manager or the project champion. _________________________
A)True
B)False
Q2) Effective planning for information security involves:
A) collecting information about an organization's objectives.
B) collecting information about an organization's information security environment.
C) collecting information about an organization's technical architecture.
D) All of the above
Q3) Technology _____________________ is a complex process that organizations use to manage the impact and costs of technology implementation, innovation, and obsolescence.
Q4) The <u>parallel operations</u> strategy works well when an isolated group can serve as a test area, which prevents any problems with the new system dramatically interfering with the performance of the organization as a whole.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 11: Security and Personnel
Available Study Resources on Quizplus for this Chatper
77 Verified Questions
77 Flashcards
Source URL: https://quizplus.com/quiz/42310
Sample Questions
Q1) The process of ensuring that no unnecessary access to data exists and that employees are able to perform only the minimum operations necessary on a set of data is referred to as the principle of ____________________.
Q2) The ISSEP allows CISSP certificate holders to demonstrate expert knowledge of all of the following except __________.
A) systems security engineering
B) technical management
C) international laws
D) certification and accreditation/risk management framework
Q3) ISSEP stands for Information Systems Security <u>Experienced</u> Professional.
A)True
B)False
Q4) The CISSP concentrations are available for CISSPs to demonstrate knowledge that is already a part of the CISSP CBK.
A)True
B)False
Q5) ISACA offers the CGEIT as well as the CISA and ____________________ certifications.
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Information Security Maintenance
Available Study Resources on Quizplus for this Chatper
116 Verified Questions
116 Flashcards
Source URL: https://quizplus.com/quiz/42311
Sample Questions
Q1) The NIST SP 800-100 Information Security Handbook provides<u> technical</u> guidance for the establishment and implementation of an information security program.
A)True
B)False
Q2) Policy needs to be reviewed and refreshed from time to time to ensure that it's providing a current foundation for the information security program.
A)True
B)False
Q3) The process of collecting detailed information about devices in a network is often referred to as ____________________.
Q4) Common vulnerability assessment processes include:
A) Internet VA
B) wireless VA
C) intranet VA
D) All of these
Q5) Threats cannot be removed without requiring a repair of the vulnerability.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 14