Information Assurance Question
Bank
Course Introduction
Information Assurance is an interdisciplinary course focusing on the principles and practices for protecting information systems from unauthorized access, use, disclosure, disruption, modification, or destruction. The course covers key areas such as risk management, security policies, authentication methods, cryptography, and incident response. Students learn how to assess threats and vulnerabilities, apply controls to mitigate risks, and ensure confidentiality, integrity, and availability of information. Emphasis is placed on legal, ethical, and regulatory considerations, as well as the development and implementation of comprehensive assurance strategies in both organizational and technical contexts.
Recommended Textbook
Computer Security Principles and Practice 2nd Edition by William Stallings
Available Study Resources on Quizplus
24 Chapters
1078 Verified Questions
1078 Flashcards
Source URL: https://quizplus.com/study-set/3971
Page 2
Chapter 1: Computer Systems Overview
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79799
Sample Questions
Q1) Threats are attacks carried out.
A)True
B)False
Answer: False
Q2) Contingency planning is a functional area that primarily requires computer security technical measures.
A)True
B)False
Answer: False
Q3) A __________ is data appended to,or a cryptographic transformation of,a data unit that allows a recipient of the data unit to prove the source and integrity of the data unit and protect against forgery.
Answer: digital signature
Q4) A threat action in which sensitive data are directly released to an unauthorized entity is __________.
A)corruption
B)intrusion
C)disruption
D)exposure
Answer: D
Page 3
To view all questions and flashcards with answers, click on the resource link above.
Chapter 2: Cryptographic Tools
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79788
Sample Questions
Q1) The purpose of a __________ is to produce a "fingerprint" of a file,message,or other block of data.
A)secret key
B)digital signature
C)keystream
D)hash function
Answer: D
Q2) Public-key algorithms are based on simple operations on bit patterns.
A)True
B)False
Answer: False
Q3) __________ is a block cipher in which the plaintext and ciphertext are integers between 0 and n-1 for some n.
A)DSS
B)RSA
C)AES
D)SHA
Answer: B
Q4) Public-key encryption was first publicly proposed by __________ in 1976. Answer: Diffie and Hellman
To view all questions and flashcards with answers, click on the resource link above. Page 4
Chapter 3: User Authentication
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/79782
Sample Questions
Q1) A good technique for choosing a password is to use the first letter of each word of a phrase.
A)True
B)False
Answer: True
Q2) A __________ strategy is one in which the system periodically runs its own password cracker to find guessable passwords.
A)user education
B)reactive password checking
C)proactive password checking
D)computer-generated password
Answer: B
Q3) A __________ is a password guessing program.
A)password hash
B)password biometric
C)password cracker
D)password salt
Answer: C
Q4) The __________ is the pattern formed by veins beneath the retinal surface. Answer: retinal pattern
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Access Control
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79781
Sample Questions
Q1) The basic elements of access control are: subject,__________,and access right.
Q2) __________ access control controls access based on the identity of the requestor and on access rules stating what requestors are or are not allowed to do.
Q3) The final permission bit is the _________ bit.
A)superuser
B)kernel
C)set user
D)sticky
Q4) _________ is the granting of a right or permission to a system entity to access a system resource.
A)Authorization
B)Authentication
C)Control
D)Monitoring
Q5) A user program executes in a kernel mode in which certain areas of memory are protected from the user's use and certain instructions may not be executed.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Database Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79780
Sample Questions
Q1) __________ is an organization that receives the encrypted data from a data owner and makes them available for distribution to clients.
A)User
B)Client
C)Data owner
D)Server
Q2) To create a relationship between two tables,the attributes that define the primary key in one table must appear as attributes in another table,where they are referred to as a foreign key.
A)True
B)False
Q3) With __________ the records in the database are clustered into a number of mutually exclusive groups and the user may only query the statistical properties of each group as a whole.
A)compromise
B)inference
C)partitioning
D)query restriction
Q4) The __________ is a human entity that presents requests (queries)to the system.
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Malicious Software
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/79779
Sample Questions
Q1) __________ are used to send large volumes of unwanted e-mail.
A)Rootkits
B)Spammer programs
C)Downloaders
D)Auto-rooter
Q2) A _________ is a set of programs installed on a system to maintain covert access to that system with administrator (root)privileges while hiding evidence of its presence.
Q3) Countermeasures for malware are generally known as _________ mechanisms because they were first developed to specifically target virus infections.
Q4) Developed by IBM and refined by Symantec,the __________ provides a malware detection system that will automatically capture,analyze,add detection and shielding,or remove new malware and pass information about it to client systems so the malware can be detected before it is allowed to run elsewhere.
Q5) A __________ uses multiple methods of infection or propagation to maximize the speed of contagion and the severity of the attack.
Q6) Sometimes referred to as the "infection vector",the __________ is the means by which a virus spreads or propagates.
To view all questions and flashcards with answers, click on the resource link above.
Page 8
Chapter 7: Denial-Of-Service Attacks
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79778
Sample Questions
Q1) The ICMP echo response packets generated in response to a ping flood using randomly spoofed source addresses is known as _______ traffic.
Q2) DoS attacks cause damage or destruction of IT infrastructures.
A)True
B)False
Q3) The best defense against broadcast amplification attacks is to block the use of _______ broadcasts.
Q4) Slowloris is a form of ICMP flooding.
A)True
B)False
Q5) A ______ is a graphical puzzle used to attempt to identify legitimate human initiated interactions.
Q6) TCP uses the _______ to establish a connection.
A)zombie
B)SYN cookie
C)directed broadcast
D)three-way handshake
Q7) The standard protocol used for call setup in VoIP is the ________ Protocol.
Q8) Requests and _______ are the two different types of SIP messages.
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: Intrusion Detection
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79777
Sample Questions
Q1) _________ anomaly detection focuses on characterizing the past behavior of individual users or related groups of users and then detecting significant deviations.
Q2) The _________ is the predefined formally documented statement that defines what activities are allowed to take place on an organization's network or on particular hosts to support the organization's requirements.
Q3) To be of practical use an IDS should detect a substantial percentage of intrusions while keeping the false alarm rate at an acceptable level.
A)True
B)False
Q4) Running a packet sniffer on a workstation to capture usernames and passwords is an example of intrusion.
A)True
B)False
Q5) Intrusion detection is based on the assumption that the behavior of the intruder differs from that of a legitimate user in ways that can be quantified.
A)True
B)False
Q6) The three classes of intruders are masquerader,clandestine user and _________.
Q7) An IDS comprises three logical components: analyzers,user interface and _____.
Page 10
To view all questions and flashcards with answers, click on the resource link above.
Chapter 9: Firewalls and Intrusion Prevention Systems
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79776
Sample Questions
Q1) __________ are attacks that attempt to give ordinary users root access.
A)Privilege-escalation exploits
B)Directory transversals
C)File system access
D)Modification of system resources
Q2) A _________ consists of a set of computers that interconnect by means of a relatively unsecure network and makes use of encryption and special protocols to provide security.
A)proxy
B)UTM
C)VPN
D)stateful inspection firewall
Q3) _________ control controls how particular services are used.
A)Service
B)Behavior
C)User
D)Direction
Q4) __________ protocols operate in networking devices,such as a router or firewall,and will encrypt and compress all traffic going into the WAN and decrypt and uncompress traffic coming from the WAN.
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 10: Buffer Overflow
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79798
Sample Questions
Q1) A stack buffer overflow attack is also referred to as ______.
A)stack smashing
B)stack framing
C)buffer overrunning
D)heap overflowing
Q2) The attacker can specify the return address used to enter code as a location somewhere in the run of NOPs,which is called a NOP ______.
Q3) The _________ aims to provide useful information to people who perform penetration testing,IDS signature development,and exploit research.
A)Metasploit Project
B)Manhattan Project
C)Levy Project
D)RAD Project
Q4) To exploit any type of buffer overflow the attacker needs to understand how that buffer will be stored in the processes memory.
A)True
B)False
Q5) ______ defenses aim to harden programs to resist attacks in new programs.
Q6) _______ defenses aim to detect and abort attacking existing programs.
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 11: Software Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79797
Sample Questions
Q1) _________ are a collection of string values inherited by each process from its parent that can affect the way a running process behaves.
A)Deadlocks
B)Privileges
C)Environment variables
D)Race conditions
Q2) To prevent XSS attacks any user supplied input should be examined and any dangerous code removed or escaped to block its execution.
A)True
B)False
Q3) Defensive programming requires a changed mindset to traditional programming practices.
A)True
B)False
Q4) Program _______ refers to any source of data that originates outside the program and whose value is not explicitly known by the programmer when the code was written.
Q5) The major advantage of ________ is its simplicity and its freedom from assumptions about the expected input to any program,service,or function.
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Operating System Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79796
Sample Questions
Q1) ______ are resources that should be used as part of the system security planning process.
A)Texts
B)Online resources
C)Specific system hardening guides
D)All of the above
Q2) The range of logging data acquired should be determined _______.
A)during security testing
B)as a final step
C)after monitoring average data flow volume
D)during the system planning stage
Q3) The following steps should be used to secure an operating system:
A)test the security of the basic operating system
B)remove unnecessary services
C)install and patch the operating system
D)all of the above
Q4) ______ virtualization systems are more common in clients,where they run along side other applications on the host OS,and are used to support applications for alternate operating system versions or types.
Q5) System security begins with the installation of the ________.
Page 14
To view all questions and flashcards with answers, click on the resource link above.
Chapter 13: Trusted Computing and Multilevel Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79795
Sample Questions
Q1) Security classes are referred to as __________.
A)security clearances
B)security classifications
C)security levels
D)security properties
Q2) One of the most influential computer security models is the Bell-LaPadula model.
A)True
B)False
Q3) The ________ control the manner by which a subject may access an object.
A)security classes
B)security classifications
C)security clearances
D)security properties
Q4) The _______ access mode allows the subject both read and write access to the object.
A)read
B)append
C)write
D)execute
To view all questions and flashcards with answers, click on the resource link above. Page 15
Chapter 14: It Security Management and Risk Assessment
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79794
Sample Questions
Q1) The results of the risk analysis should be documented in a _________.
A)journal
B)consequence
C)risk register
D)none of the above
Q2) The intent of the ________ is to provide a clear overview of how an organization's IT infrastructure supports its overall business objectives.
A)risk register
B)corporate security policy
C)vulnerability source
D)threat assessment
Q3) The level of risk the organization views as acceptable is the organization's __________.
Q4) _________ is sharing responsibility for the risk with a third party.
Q5) A major advantage of the informal approach is that the individuals performing the analysis require no additional skills.
A)True
B)False
Q6) A(n)_________ is anything that has value to the organization.
To view all questions and flashcards with answers, click on the resource link above. Page 16
Q7) Not proceeding with the activity or system that creates the risk is _________.
Chapter 15: It Security Controls, plans, and Procedures
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79793
Sample Questions
Q1) Appropriate security awareness training for all personnel in an organization,along with specific training relating to particular systems and controls,is an essential component in implementing controls.
A)True
B)False
Q2) Once in place controls cannot be adjusted,regardless of the results of risk assessment of systems in the organization.
A)True
B)False
Q3) The follow-up stage of the management process includes _________.
A)maintenance of security controls
B)security compliance checking
C)incident handling
D)all of the above
Q4) An IT security plan should include details of _________.
A)risks
B)recommended controls
C)responsible personnel
D)all of the above
Q5) Contingency planning falls into the _________ class of security controls.
To view all questions and flashcards with answers, click on the resource link above. Page 17
Chapter 16: Physical and Infrastructure Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79792
Sample Questions
Q1) The CHUID is a PIV card data object.
A)True
B)False
Q2) The direct flame is the only threat from fire.
A)True
B)False
Q3) Tornados,tropical cyclones,earthquakes,blizzards,lightning,and floods are all types of ________ disasters.
Q4) ________ includes data processing and storage equipment,transmission and networking facilities,and offline storage media.
A)Supporting facilities
B)Physical facilities
C)Information system hardware
D)Infrastructure facilities
Q5) Eavesdropping and wiretapping fall into the ________ category.
A)theft
B)vandalism
C)misuse
D)unauthorized physical access
Q6) The most essential element of recovery from physical security breaches is ____.
To view all questions and flashcards with answers, click on the resource link above. Page 18
Chapter 17: Human Resources Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79791
Sample Questions
Q1) The education and experience learning level provides the foundation for subsequent training by providing a universal baseline of key security terms and concepts.
A)True
B)False
Q2) A _______ is a characteristic of a piece of technology that can be exploited to perpetrate a security incident.
Q3) To emphasize the importance of security awareness,an organization should have a security awareness policy document that is provided to all employees.
A)True
B)False
Q4) In general,a ________ program seeks to inform and focus an employee's attention on issues related to security within the organization.
Q5) A(n)________ is any file or object found on a system that might be involved in probing or attacking systems and networks or that is being used to defeat security measures.
Q6) The group of users,sites,networks,or organizations served by the CSIRT is a _______.
To view all questions and flashcards with answers, click on the resource link above. Page 19
Chapter 18: Security Auditing
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79790
Sample Questions
Q1) The ________ is a module on a centralized system that collects audit trail records from other systems and creates a combined audit trail.
A)audit dispatcher
B)audit analyzer
C)audit trail collector
D)audit provider
Q2) With _________ the linking to shared library routines is deferred until load time so that if changes are made any program that references the library is unaffected.
A)statically linked shared libraries
B)dynamically linked shared libraries
C)system linked shared libraries
D)all of the above
Q3) Applications,especially applications with a certain level of privilege, present security problems that may not be captured by system-level or user-level auditing data.
A)True
B)False
Q4) The audit _______ are a permanent store of security-related events on a system.
Q5) SIEM software has two general configuration approaches: agentless and ______.
To view all questions and flashcards with answers, click on the resource link above. Page 20
Chapter 19: Legal and Ethical Aspects
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79789
Sample Questions
Q1) Personal effects,moveable property and goods,such as cars,bank accounts,wages,securities,a small business,furniture,insurance policies,jewelry,patents,and pets are all examples of _________.
A)intellectual property
B)real property
C)personal property
D)cyber property
Q2) ________ ensures that a user may make multiple uses of resources or services without others being able to link these uses together.
A)Anonymity
B)Pseudonymity
C)Unobservability
D)Unlinkability
Q3) The three main types of intellectual property for which legal protection is available are: copyrights,patents,and _______.
Q4) Privacy is broken down into four major areas: anonymity,unlinkability,unobservability,and _________.
Q5) The invasion of the rights secured by patents,copyrights,and trademarks is ________.
To view all questions and flashcards with answers, click on the resource link above. Page 21
Chapter 20: Symmetric Encryption and Message
Confidentiality
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79787
Sample Questions
Q1) With _________ encryption the encryption process is carried out at the two end systems.
Q2) For stream-oriented transmission over noisy channel you would typically use _______ mode.
A)ECB
B)CTR
C)OFB
D)CBC
Q3) One disadvantage of the link encryption approach is that the message must be decrypted each time it enters a frame switch.
A)True
B)False
Q4) "The input to the encryption algorithm is the XOR of the next 64 bits of plaintext and the preceding 64 bits of ciphertext" is a description of the ________ mode of operation.
Q5) The ciphertext-only attack is the easiest to defend against. A)True B)False
Page 22
Q6) The three most important symmetric block ciphers are: 3DES,AES,and _____.
Q7) _________ is the process of attempting to discover the plaintext or key.
To view all questions and flashcards with answers, click on the resource link above.
Chapter 21: Public-Key Cryptography and Message
Authentication
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79786
Sample Questions
Q1) If speed is a concern,it is fully acceptable to use _________ rather than SHA as the embedded hash function for HMAC.
Q2) ___________ was the first published public-key algorithm.
A)NIST
B)Diffie-Hellman
C)RC4
D)RSA
Q3) The appeal of HMAC is that its designers have been able to prove an exact relationship between the strength of the embedded hash function and the strength of HMAC.
A)True
B)False
Q4) The National Institute of Standards and Technology has published Federal Information Processing Standard FIPS PUB 186,known as the __________.
A)XOR
B)MD5
C)MAC
D)DSS
Page 23
Q5) One of the simplest hash functions is the ________ of every block.
To view all questions and flashcards with answers, click on the resource link above.
Chapter 22: Internet Security Protocols and Standards
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79785
Sample Questions
Q1) At its most fundamental level the Internet mail architecture consists of a user world in the form of _________.
A)MHS
B)MSA
C)MUA
D)MDA
Q2) The ______ is responsible for transferring the message from the MHS to the MS.
A)MDA
B)MS
C)MUA
D)MSA
Q3) Recipients without S/MIME capability can view the message content, although they cannot verify the signature.
A)True
B)False
Q4) Search engines support HTTPS.
A)True
B)False
Q5) If encryption is used alone,_______ is used to convert the ciphertext to ASCII format.
To view all questions and flashcards with answers, click on the resource link above. Page 24
Chapter 23: Internet Authentication Applications
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79784
Sample Questions
Q1) A _______ is a generic term used to denote any method for storing certificates and CRLs so that they can be retrieved by end entities.
A)RA
B)registration
C)repository
D)CA
Q2) Kerberos is designed to counter only one specific threat to the security of a client/server dialogue.
A)True
B)False
Q3) The ticket-granting ticket is encrypted with a secret key known only to the AS and the TGS.
A)True
B)False
Q4) The ticket-granting ticket is not reusable.
A)True
B)False
Q5) In a generic identity management architecture a ________ is an identity holder.
Q6) The certification _________ is the issuer of certificates and certificate revocation lists.
To view all questions and flashcards with answers, click on the resource link above. Page 25
Chapter 24: Wireless Network Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79783
Sample Questions
Q1) The 802.11i RSN security specification defines the following services: authentication,privacy with message integrity,and ________.
Q2) A(n)__________ is any entity that has station functionality and provides access to the distribution system via the wireless medium for associated stations.
A)ESS
B)access point
C)distribution system
D)MPDU
Q3) The final form of the 802.11i standard is referred to as ________.
A)WEP
B)RSN
C)Wi-Fi
D)WPA
Q4) Company wireless LANs or wireless access points to wired LANs in close proximity may create overlapping transmission ranges.
A)True
B)False
Q5) The security requirements are: confidentiality,integrity,availability,authenticity,and
To view all questions and flashcards with answers, click on the resource link above. Page 26