Information Assurance
Chapter Exam Questions
Course Introduction
Information Assurance is a comprehensive course that explores the principles, methodologies, and best practices for protecting and managing information assets in organizations. Students learn how to assess risks, develop strategies for data integrity, confidentiality, and availability, and implement security policies and controls to mitigate threats. The course covers topics such as risk management, legal and ethical considerations, security technologies, and the development of incident response plans, preparing students to effectively safeguard information in dynamic digital environments.
Recommended Textbook
Principles of Information Security 5th Edition by Michael E. Whitman
Available Study Resources on Quizplus
12 Chapters
696 Verified Questions
696 Flashcards
Source URL: https://quizplus.com/study-set/2374
Chapter 1: Introduction to the Management of Information Security
Available Study Resources on Quizplus for this Chatper
63 Verified Questions
63 Flashcards
Source URL: https://quizplus.com/quiz/47110
Sample Questions
Q1) What do audit logs that track user activity on an information system provide?
A) identification
B) authorization
C) accountability
D) authentication Answer: C
Q2) When voltage levels <U>lag</U>(experience a momentary increase),the extra voltage can severely damage or destroy equipment._________________________
A)True
B)False Answer: False
Q3) Corruption of information can occur only while information is being stored.
A)True
B)False Answer: False
Q4) The first step in solving problems is to gather facts and make assumptions. A)True
B)False Answer: False
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: Compliance: Law and Ethics
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/47111
Sample Questions
Q1) The act of attempting to prevent an unwanted action by threatening punishment orretaliation on the instigator if the act takes place is known as ___________.
Answer: deterrence
Q2) Which law requires mandatory periodic training in computer security awareness and accepted computer security practice for all employees who are involved with the management,use,or operation of each federal computer system?
A) The Telecommunications Deregulation and Competition Act
B) National Information Infrastructure Protection Act
C) Computer Fraud and Abuse Act
D) The Computer Security Act
Answer: D
Q3) To protect intellectual property and competitive advantage,Congress passed the <U>Entrepreneur</U> Espionage Act (EEA)in 1996. ___________
A)True
B)False
Answer: False
To view all questions and flashcards with answers, click on the resource link above. Page 4
Chapter 3: Governance and Strategic Planning for Security
Available Study Resources on Quizplus for this Chatper
52 Verified Questions
52 Flashcards
Source URL: https://quizplus.com/quiz/47112
Sample Questions
Q1) A project manager who understands project management,personnel management,and InfoSec technical requirements is needed to fill the role of a(n)____________.
A) champion
B) end user
C) team leader
D) policy developer
Answer: C
Q2) Which of the following is a key advantage of the bottom-up approach to security implementation?
A) strong upper-management support
B) a clear planning and implementation process
C) utilizes the technical expertise of the individual administrators
D) coordinated planning from upper management
Answer: C
Q3) Because it sets out general business intentions,a mission statement does not need to be concise.
A)True
B)False
Answer: False
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Information Security Policy
Available Study Resources on Quizplus for this Chatper
56 Verified Questions
56 Flashcards
Source URL: https://quizplus.com/quiz/47113
Sample Questions
Q1) A risk assessment is performed during which phase of the SecSDLC?
A) implementation
B) analysis
C) design
D) investigation
Q2) A detailed outline of the scope of the policy development project is created during which phase of the SecSDLC?
A) design
B) analysis
C) implementation
D) investigation
Q3) Non mandatory recommendations that the employee may use as a reference incomplying with a policy.are known as<U> regulations</U>.____________
A)True
B)False
Q4) What is the final component of the design and implementation of effective policies?Describe this component.
Q5) List the advantages and disadvantages of using a modular approach for creating and managing the ISSP.
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Developing the Security Program
Available Study Resources on Quizplus for this Chatper
55 Verified Questions
55 Flashcards
Source URL: https://quizplus.com/quiz/47114
Sample Questions
Q1) Which of the following is NOT a step in the process of implementing training?
A) administer the program
B) hire expert consultants
C) motivate management and employees
D) identify target audiences
Q2) The first step in the work breakdown structure (WBS)approach encompasses activities,but not deliverables.
A)True
B)False
Q3) What is the Chief Information Security Office primarily responsible for?
Q4) Which of the following is true about a company's InfoSec awareness Web site?
A) it should contain large images to maintain interest
B) appearance doesn't matter if the information is there
C) it should be placed on the Internet for public use
D) it should be tested with multiple browsers
Q5) What are the four areas into which it is recommended to separate the functions of security?
Q6) The project planner should describe the skills or personnel needed for a task,often referred to as a(n)____________________,needed to accomplish a task.
Page 7
To view all questions and flashcards with answers, click on the resource link above.
Chapter 6: Risk Management: Identifying and Assessing Risk
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47115
Sample Questions
Q1) Assigns a risk-rating ranked value to each uncontrolled asset-vulnerability pair.
A)risk management
B)risk analysis
C)classification categories
D)risk identification
E)field change order
F)threat assessment
G)risk appetite
H)qualitative assessment
I)residual risk
J)ranked vulnerability risk worksheet
Q2) The probability that a specific vulnerability within an organization will be the targetof an attack is known as <U>risk</U>.____________
A)True
B)False
Q3) What does it mean to 'know the enemy' with respect to risk management?
Q4) Assessing risks includes determining the ____________________ that vulnerable systems will be attacked by specific threats.
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Risk Management: Controlling Risk
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47116
Sample Questions
Q1) Discuss three alternatives to feasibility analysis.
Q2) An examination of how well a particular solution fits within theorganization's strategic planning objectives and goals.
A)defense risk control strategy
B)mitigation risk control strategy
C)acceptance risk control strategy
D)termination risk control strategy
E)risk appetite
F)cost-benefit analysis
G)cost avoidance
H)asset valuation
I)organizational feasibility
J)single loss expectancy
Q3) A <U>benchmark </U>is derived by comparing measured actual performance against established standards for the measured category.____________
A)True
B)False
Q4) Explain two practical guidelines to follow in risk control strategy selection.
Q5) What are the four phases of the Microsoft risk management strategy?
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: Security Management Models
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47117
Sample Questions
Q1) A person'ssecurity clearance is a personnel security structure in which each user of an information asset isassigned an authorization level that identifies the level of<U> classified</U> information he or she iscleared to access.____________
A)True
B)False
Q2) Under lattice-based access controls,the column of attributes associated with a particular object (such as a printer)is referred to as which of the following?
A) access control list
B) capabilities table
C) access matrix
D) sensitivity level
Q3) Which of the following is NOT a change control principle of the Clark-Wilson model?
A) No changes by unauthorized subjects
B) No unauthorized changes by authorized subjects
C) No changes by authorized subjects without external validation
D) The maintenance of internal and external consistency
Q4) Access controls are build on three key principles.List and briefly define them.
To view all questions and flashcards with answers, click on the resource link above.
10
Chapter 9: Security Management Practices
Available Study Resources on Quizplus for this Chatper
59 Verified Questions
59 Flashcards
Source URL: https://quizplus.com/quiz/47118
Sample Questions
Q1) A common approach to a Risk ManagementFramework (RMF)for InfoSec practice.
A)accreditation
B)baseline
C)benchmarking
D)certification
E)due diligence
F)best security practices
G)recommended business practices
H)standard of due care
I)performance measurements
J)NIST SP 800-37
Q2) One question you should ask when choosing among recommended practices is "Can your organization afford to implement the recommended practice?"
A)True
B)False
Q3) Describe the three tier approach of the RMF as defined by NIST SP 800-37.
Q4) A goal of 100 percent employee InfoSec training as an objective for the training program is an example of a performance __________.
Q5) Compare and contrast accreditation and certification.
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 10: Planning for Contingencies
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47119
Sample Questions
Q1) The first component of the analysis phase of a digital forensic investigation is ___________,which allows the investigator to quickly and easily search for a specific type of file.
Q2) Which of the following is a definite indicator of an actual incident?
A) Unusual system crashes
B) Reported attack
C) Presence of new accounts
D) Use of dormant accounts
Q3) Patch and <U> proceed</U> is anorganizational CP philosophy that focuses on the defense ofinformation assets and preventing reoccurrence rather than the attacker's identification andprosecution.____________
A)True
B)False
Q4) Which of the following is usually conducted via leased lines or secure Internet connections whereby the receiving server archives the data as it is received?.
A) Database shadowing
B) Timesharing
C) Traditional backups
D) Electronic vaulting
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 11: Personnel and Security
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47120
Sample Questions
Q1) Ideally,a candidate for the CISO position should have experience in what other InfoSec position?
A) Security officer
B) Security consultant
C) Security technician
D) Security manager
Q2) The CompTIA ____________________ certification tests an individual's security knowledge mastery and requires two years on-the-job networking experience,with emphasis on security.
Q3) ISACA offers the CGEIT certification that is targeted at upper-level executives such as CISOs andCIOs,directors,and consultants with knowledge and experience in IT<U> operations</U>.____________
A)True B)False
Q4) Briefly describe at least five types of background checks.
Q5) Describe the certifications developed by SANS.How are they different from InfoSec certifications like CISSP and SSCP?
Q6) Briefly describe the classifications of InfoSec positions as defined by Schwartz et al.
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Protection Mechanisms
Available Study Resources on Quizplus for this Chatper
61 Verified Questions
61 Flashcards
Source URL: https://quizplus.com/quiz/47121
Sample Questions
Q1) A(n)____________________ is any device that prevents a specific type of information from moving between an untrusted network and a trusted network.
Q2) An integrated system of software,encryption methodologies,protocols,legal agreements,and third-party services that enables users to communicate securelythrough the use of digital certificates.
A)VPN
B)transport mode
C)SSL
D)PKI
E)digital certificate
F)asymmetric encryption
G)Vernam cipher
H)transposition cipher
I)content filter
J)footprinting
Q3) Secure Shell (SSH)provides security for remote access connections over public networks by creating a secure and persistent connection..
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above.
Page 14