Information Assurance
Midterm Exam
Course Introduction
Information Assurance is a multidisciplinary course focused on the protection and management of information assets to ensure their confidentiality, integrity, availability, authenticity, and non-repudiation. Students will explore the principles, standards, policies, and practices used to assess and mitigate risks associated with information systems. Topics include security models, risk management, threat and vulnerability analysis, compliance with legal and ethical requirements, incident response, and strategies for developing and maintaining secure information infrastructures in both organizational and global contexts. This course prepares students to critically evaluate and implement assurance processes and technologies in real-world environments.
Recommended Textbook Management of Information Security 3rd Edition by Michael E. Whitman
Available Study Resources on Quizplus
12 Chapters
1438 Verified Questions
1438 Flashcards
Source URL: https://quizplus.com/study-set/2354 Page 2
Chapter 1: Introduction to the Management of Information Security
Available Study Resources on Quizplus for this Chatper
139 Verified Questions
139 Flashcards
Source URL: https://quizplus.com/quiz/46799
Sample Questions
Q1) Which of the following is a project not a managed process?
A) monitoring external and internal environment during incident response
B) installation of a new firewall system
C) ongoing risk assessments of routine operations
D) continuous vulnerability assessment and vulnerability repair
Answer: B
Q2) All managers are expected to play a leadership role.
A)True
B)False
Answer: False
Q3) A manager is responsible for coordinating the completion of tasks.
A)True
B)False
Answer: True
Q4) ____________________ security encompasses the protection of an organization's communications media,technology,and content.
Answer: Communications
Q5) ____________________ are the operations conducted within InfoSec,which are specifically managed as separate entities.
Answer: Programs
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: Planning for Security
Available Study Resources on Quizplus for this Chatper
123 Verified Questions
123 Flashcards
Source URL: https://quizplus.com/quiz/46800
Sample Questions
Q1) The CISO is also known as the chief security officer,director of information \(\text {\underline{security } }\) or information security manager._________________________
A)True
B)False
Answer: True
Q2) Another significant benefit of information security governance is ____________________ for safeguarding information during critical business activities,such as mergers and acquisitions,business process recovery,and regulatory response.
Answer: accountability
Q3) Controls or ____________________ are used to protect information from attacks by threats; the terms are also often used interchangeably.
Answer: safeguards
Q4) In ____________________ testing,security personnel simulate or perform specific and controlled attacks to compromise or disrupt their own systems by exploiting documented vulnerabilities.
Answer: penetration
To view all questions and flashcards with answers, click on the resource link above. Page 4
Chapter 3: Planning for Contingencies
Available Study Resources on Quizplus for this Chatper
114 Verified Questions
114 Flashcards
Source URL: https://quizplus.com/quiz/46801
Sample Questions
Q1) To perform parallel testing,the operations of the business must be halted.
A)True
B)False
Answer: False
Q2) When dealing with an incident,the last action the IR team takes is to ____.
A) create the incident damage assessment
B) conduct an after-action review
C) restore data from backups
D) restore services and processes in use
Answer: B
Q3) Which of the following is a definite indicator of an actual incident?
A) Unusual system crashes
B) Reported attack
C) Presence of new accounts
D) Use of dormant accounts
Answer: D
Q4) The overall process of preparing for unexpected events is called
Answer: contingency planning
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Information Security Policy
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46802
Sample Questions
Q1) A(n)<u>issue-specific</u> security policy sets the strategic direction,scope,and tone for all of an organization's security efforts._________________________
A)True
B)False
Q2) To be effective,policy must be uniformly applied to all employees,including executives.
A)True
B)False
Q3) For most corporate documents,a score of ____ is preferred on the Flesch Reading Ease scale.
A) 9 to 10
B) 15 to 20
C) 60 to 70
D) 90 to 100
Q4) A risk assessment is performed during the ____ phase of the SecSDLC.
A) implementation
B) analysis
C) design
D) investigation
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Developing the Security Program
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46803
Sample Questions
Q1) Which of the following would be responsible for configuring firewalls and IDSs,implementing security software,and diagnosing and troubleshooting problems?
A) A security technician
B) A security analyst
C) A security consultant
D) The security manager
Q2) In the <u>on-the-job</u> method of training,a trainer works with each trainee on an individual basis._________________________
A)True
B)False
Q3) The information security budgets of very large organizations grow faster than their IT budgets.
A)True
B)False
Q4) The aim of a security ____________________ program is to keep information security at the forefront of users' minds on a daily basis.
Q5) Two methods for customizing training for users are by functional background and by ____________________.
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Security Management Models
Available Study Resources on Quizplus for this Chatper
120 Verified Questions
120 Flashcards
Source URL: https://quizplus.com/quiz/46804
Sample Questions
Q1) ISO/IEC 17799 is designed to promote certification of information security management system.
A)True
B)False
Q2) Storage of classified documents must be accessible only to authorized individuals,which usually requires which of the following?
A) Safes
B) Locking file cabinets
C) Other protective devices for hard copies
D) All of these
Q3) ISO 27002 is an international standard for computer security certification,considered to be the successor to both TCSEC and ITSEC.
A)True
B)False
Q4) One of the key elements of the Clark-Wilson model is the <u>unconstrained data item </u>which is a data item with protected integrity._________________________
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Security Management Practices
Available Study Resources on Quizplus for this Chatper
114 Verified Questions
114 Flashcards
Source URL: https://quizplus.com/quiz/46805
Sample Questions
Q1) List the four factors critical to the success of an information security performance program,according to NIST SP 800-55.
Q2) One of the factors critical to the success of an information security performance program is practical information security ____________________ and procedures.
Q3) It is seldom advisable to broadcast complex and nuanced metrics-based reports to large groups,unless ____.
A) the group is well educated and capable of understanding such complex reports
B) the reports also contain addendums providing detailed analyses of the findings
C) the key points are well established and embedded in a more complete context such as a newsletter or press release
D) None of these
Q4) Which of the following would NOT be a valuable performance measure?
A) Percent of the organization's IT budget devoted to InfoSec
B) Percent of IT personnel that have received security training
C) Percent of media that has been sanitized
D) Percent of vulnerabilities that have been remediated with organizationally specified time frames
To view all questions and flashcards with answers, click on the resource link above.
Chapter 8: Risk Management: Identifying and Assessing Risk
Available Study Resources on Quizplus for this Chatper
78 Verified Questions
78 Flashcards
Source URL: https://quizplus.com/quiz/46806
Sample Questions
Q1) The amount of danger posed by a threat is sometimes difficult to assess.It may be simply the <u>impact</u> of a threat attacking the organization,or it may reflect the amount of damage that the threat could create or the frequency with which an attack can occur._________________________
A)True
B)False
Q2) Organizations should have a data classification scheme categorizing information assets based on their sensitivity and security needs; for example: confidential,internal and public.
A)True
B)False
Q3) People are divided into insiders (employees)and outsiders (nonemployees).<u>Outsiders</u> come in two categories: either they hold trusted roles and have correspondingly greater authority and accountability,or they are regular staff without any special privileges._________________________
A)True
B)False
Q4) The standard IT system components include: people,data,networks,hardware,software,and ____________________.
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 9: Risk Management: Controlling Risk
Available Study Resources on Quizplus for this Chatper
105 Verified Questions
105 Flashcards
Source URL: https://quizplus.com/quiz/46807
Sample Questions
Q1) Once a control strategy has been selected and implemented,controls should be ____ on an ongoing basis to determine their effectiveness and to estimate the remaining risk.
A) budgeted
B) updated
C) monitored and measured
D) evaluated and funded
Q2) ____ is the money saved by avoiding,via the implementation of a control,the financial ramifications of an incident.
A) Cost - Benefit Analysis
B) Cost avoidance
C) Economic feasibility
D) Financial acceptance
Q3) The goal of information security is to bring </>residual</u> risk in line with an organization's risk appetite._________________________
A)True
B)False
Q4) The element of remaining risk after vulnerabilities have been controlled is referred to as ____________________ risk.
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 10: Protection Mechanisms
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46808
Sample Questions
Q1) Any firewall device must have its own set of configuration rules that controls its actions.
A)True
B)False
Q2) The transformation of individual components such as characters or bits of an unencrypted message into encrypted components is known as ____.
A) key
B) cryptosystem
C) cipher
D) steganography
Q3) When evaluating biometric technologies,the false reject rate is also known as a Type<u> II </u> error or a false negative._________________________
A)True
B)False
Q4) Firewalls are designed,implemented,configured and operated by people,yet are resistant to human error.
A)True
B)False
Q5) What should you look for when selecting a firewall for your network?
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 11: Personnel and Security
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46809
Sample Questions
Q1) The ____________________ prohibits employers from obtaining a credit report without the candidate's written consent.
Q2) Which of the following policies requires that every employee be able to perform the work of at least one other staff member?
A) Task rotation
B) Job rotation
C) Two-man control
D) Separation of duties
Q3) It is the responsibility of a security manager to achieve objectives identified by the CISO and resolve issues identified by the ____________________.
Q4) The CISSP certification recognizes mastery of an internationally identified _________________________ in information security.
Q5) By utilizing a(n)<u>human</u> RAID system of requiring employees to know at least one part of another person's job,an organization can survive the loss of any single employee._________________________
A)True
B)False
Q6) The GIAC ____________________ is the pinnacle of the GIAC certification program.
13
To view all questions and flashcards with answers, click on the resource link above.
Chapter 12: Law and Ethics
Available Study Resources on Quizplus for this Chatper
113 Verified Questions
113 Flashcards
Source URL: https://quizplus.com/quiz/46810
Sample Questions
Q1) By enacting the ____ in 1996,Congress sought to protect intellectual property and competitive advantage.
A) DMCA
B) EEA
C) HIPAA
D) FOIA
Q2) The first method of deterring ignorance within an organization is disciplinary action.
A)True
B)False
Q3) In digital forensics,all investigations follow the same basic methodology,including acquiring or seizing the evidence without<u> disclosure</u> or damage._________________________
A)True
B)False
Q4) Briefly describe five different types of laws.
Q5) _________________________ refers to the ability of law to reach across boundaries to bring accused individuals into its court systems.
Q6) ____________________ law encompasses family law,commercial law,and labor law.
Page 14
To view all questions and flashcards with answers, click on the resource link above.