Information Assurance
Textbook Exam Questions
Course Introduction
Information Assurance is a comprehensive course focused on the strategies, technologies, and best practices used to protect and manage information systems against threats and vulnerabilities. The course covers key concepts such as risk management, data integrity, confidentiality, availability, and authentication. Students will explore legal, ethical, and regulatory frameworks, as well as methods for developing and implementing security policies, disaster recovery plans, and incident response procedures. Emphasis is placed on both organizational and technical aspects of securing information assets, preparing students to assess risks, mitigate cyber threats, and ensure business continuity in evolving digital environments.
Recommended Textbook
Computer Security Principles and Practice 3rd Edition by William Stallings
Available Study Resources on Quizplus
24 Chapters
1076 Verified Questions
1076 Flashcards
Source URL: https://quizplus.com/study-set/3981 Page 2
Chapter 1: Computer Systems Overview
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79973
Sample Questions
Q1) Assurance is the process of examining a computer product or system with respect to certain criteria.
A)True
B)False
Answer: False
Q2) The _________ prevents or inhibits the normal use or management of communications facilities.
A)passive attack
B)denial of service
C)traffic encryption
D)masquerade
Answer: B
Q3) A loss of _________ is the unauthorized disclosure of information.
A)confidentiality
B)authenticity
C)integrity
D)availability
Answer: A
Q4) A(n)_________ is any means taken to deal with a security attack.
Answer: countermeasure
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: Cryptographic Tools
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79962
Sample Questions
Q1) The __________ algorithm takes the ciphertext and the secret key and produces the original plaintext.
Answer: decryption
Q2) Public-key cryptography is asymmetric.
A)True
B)False
Answer: True
Q3) A _________ protects against an attack in which one party generates a message for another party to sign.
A)data authenticator
B)strong hash function
C)weak hash function
D)digital signature
Answer: B
Q4) __________ is the scrambled message produced as output.
A)Plaintext
B)Ciphertext
C)Secret key
D)Cryptanalysis
Answer: B
Page 4
To view all questions and flashcards with answers, click on the resource link above.
Chapter 3: User Authentication
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79956
Sample Questions
Q1) Identification is the means of establishing the validity of a claimed identity provided by a user.
A)True
B)False
Answer: True
Q2) User authentication is a procedure that allows communicating parties to verify that the contents of a received message have not been altered and that the source is authentic.
A)True
B)False Answer: False
Q3) An institution that issues debit cards to cardholders and is responsible for the cardholder's account and authorizing transactions is the _________.
A)cardholder
B)issuer
C)auditor
D)processor
Answer: B
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Access Control
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79955
Sample Questions
Q1) _________ is the granting of a right or permission to a system entity to access a system resource.
A)Authorization
B)Authentication
C)Control
D)Monitoring
Q2) A user program executes in a kernel mode in which certain areas of memory are protected from the user's use and certain instructions may not be executed.
A)True
B)False
Q3) A __________ is an entity capable of accessing objects.
A)group
B)object
C)subject
D)owner
Q4) An independent review and examination of system records and activities in order to test for adequacy of system controls,to ensure compliance with established policy and operational procedures,to detect breaches in security,and to recommend any indicated changes in control,policy and procedures is a(n)__________ .
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Database and Cloud Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79954
Sample Questions
Q1) Encryption is a pervasive service that can be provided for data at rest in the cloud.
.
A)True
B)False
Q2) Fixed server roles operate at the level of an individual database.
A)True
B)False
Q3) Business continuity consists of security services that allocate access, distribute,monitor,and protect the underlying resource services.
A)True
B)False
Q4) The cloud carrier is useful when cloud services are too complex for a cloud consumer to easily manage.
A)True
B)False
Q5) In a ___________ administration a small number of privileged users may grant and revoke access rights.
Q6) In a relational database columns are referred to as _________.
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Malicious Software
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/79953
Sample Questions
Q1) Countermeasures for malware are generally known as _________ mechanisms because they were first developed to specifically target virus infections.
Q2) The __________ is when the virus function is performed.
A)dormant phase
B)propagation phase
C)triggering phase
D)execution phase
Q3) __________ is the first function in the propagation phase for a network worm.
A)Propagating
B)Fingerprinting
C)Keylogging
D)Spear phishing
Q4) Developed by IBM and refined by Symantec,the __________ provides a malware detection system that will automatically capture,analyze,add detection and shielding,or remove new malware and pass information about it to client systems so the malware can be detected before it is allowed to run elsewhere.
Q5) Programmers use backdoors to debug and test programs.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Denial-Of-Service Attacks
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79952
Sample Questions
Q1) The attacker needs access to a high-volume network connection for a SYN spoof attack.
A)True
B)False
Q2) ______ attacks are a variant of reflector attacks and also involve sending a packet with a spoofed source address for the target system to intermediaries.
Q3) A SIP flood attack exploits the fact that a single INVITE request triggers considerable resource consumption.
A)True
B)False
Q4) A cyberslam is an application attack that consumes significant resources,limiting the server's ability to respond to valid requests from other users.
A)True
B)False
Q5) A denial-of-service attack is an attempt to compromise availability by hindering or blocking completely the provision of some service.
A)True
B)False
Q6) The standard protocol used for call setup in VoIP is the ________ Protocol.
Page 9
To view all questions and flashcards with answers, click on the resource link above.
Chapter 8: Intrusion Detection
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79951
Sample Questions
Q1) The functional components of an _________ are: data source,sensor,analyzer,administration,manager,and operator.
Q2) The broad classes of intruders are: cyber criminals,state-sponsored organizations,_________ ,and others.
Q3) ________ are decoy systems that are designed to lure a potential attacker away from critical systems.
Q4) The _______ is the ID component that analyzes the data collected by the sensor for signs of unauthorized or undesired activity or for events that might be of interest to the security administrator.
A)data source
B)sensor
C)operator
D)analyzer
Q5) The _________ to an IDS enables a user to view output from the system or control the behavior of the system.
Q6) An IDS comprises three logical components: analyzers,user interface and _____.
Q7) An intruder can also be referred to as a hacker or cracker.
A)True
B)False
Page 10
To view all questions and flashcards with answers, click on the resource link above.
Chapter 9: Firewalls and Intrusion Prevention Systems
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79950
Sample Questions
Q1) An important aspect of a distributed firewall configuration is security monitoring.
A)True
B)False
Q2) A firewall can serve as the platform for IPSec.
A)True
B)False
Q3) The firewall can protect against attacks that bypass the firewall.
A)True
B)False
Q4) A __________ firewall controls the traffic between a personal computer or workstation on one side and the Internet or enterprise network on the other side.
Q5) Snort Inline enables Snort to function as an intrusion prevention capability.
A)True
B)False
Q6) An intruder transmitting packets from the outside with a source IP address field containing an address of an internal host is known as IP address _________.
Q7) Snort Inline adds three new rule types: drop,reject,and _________.
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 10: Buffer Overflow
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/79972
Sample Questions
Q1) Traditionally the function of __________ was to transfer control to a user command-line interpreter,which gave access to any program available on the system with the privileges of the attacked program.
A)shellcode
B)C coding
C)assembly language
D)all of the above
Q2) A stack overflow can result in some form of a denial-of-service attack on a system.
A)True
B)False
Q3) The function of ________ was to transfer control to a user command-line interpreter,which gave access to any program available on the system with the privileges of the attacked program.
A)shellcode
B)stacking
C)no-execute
D)memory management
Q4) The __________ project produces a free,multiplatform 4.4BSD-based UNIX-like operating system.
Page 12
To view all questions and flashcards with answers, click on the resource link above.
Chapter 11: Software Security
Available Study Resources on Quizplus for this Chatper
43 Verified Questions
43 Flashcards
Source URL: https://quizplus.com/quiz/79971
Sample Questions
Q1) To prevent XSS attacks any user supplied input should be examined and any dangerous code removed or escaped to block its execution.
A)True
B)False
Q2) Program _______ refers to any source of data that originates outside the program and whose value is not explicitly known by the programmer when the code was written.
Q3) To counter XSS attacks a defensive programmer needs to explicitly identify any assumptions as to the form of input and to verify that any input data conform to those assumptions before any use of the data.
A)True
B)False
Q4) A stead reduction in memory available on the heap to the point where it is completely exhausted is known as a ________.
A)fuzzing
B)deadlock
C)memory injection
D)memory leak
Q5) A ________ occurs when multiple processes and threads compete to gain uncontrolled access to some resource.
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Operating System Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79970
Sample Questions
Q1) The following steps should be used to secure an operating system:
A)test the security of the basic operating system
B)remove unnecessary services
C)install and patch the operating system
D)all of the above
Q2) The range of logging data acquired should be determined _______.
A)during security testing
B)as a final step
C)after monitoring average data flow volume
D)during the system planning stage
Q3) Most large software systems do not have security weaknesses.
A)True
B)False
Q4) System security begins with the installation of the ________.
Q5) Which of the following need to be taken into consideration during the system security planning process?
A)how users are authenticated
B)the categories of users of the system
C)what access the system has to information stored on other hosts
D)all of the above
To view all questions and flashcards with answers, click on the resource link above. Page 14
Chapter 13: Trusted Computing and Multilevel Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79969
Sample Questions
Q1) Inserting a new row at a lower level without modifying the existing row at the higher level is known as ________ .
A)polyinstantiation
B)ds-property
C)trust
D)MAC
Q2) A subject can exercise only accesses for which it has the necessary authorization and which satisfy the MAC rules.
A)True
B)False
Q3) The BLP model includes a set of rules based on abstract operations that change the state of the system.
A)True
B)False
Q4) The _________ Model was developed for commercial applications in which conflicts of interest can arise.
A)Biba
B)Clark-Wilson Integrity
C)Bell-Lapadula
D)Chinese Wall
To view all questions and flashcards with answers, click on the resource link above. Page 15
Chapter 14: It Security Management and Risk Assessment
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79968
Sample Questions
Q1) IT security management has evolved considerably over the last few decades due to the rise in risks to networked systems.
A)True
B)False
Q2) IT security management functions include:
A)determining organizational IT security objectives,strategies,and policies
B)detecting and reacting to incidents
C)specifying appropriate safeguards
D)all of the above
Q3) The use of the _________ approach would generally be recommended for small to medium-sized organizations where the IT systems are not necessarily essential to meeting the organization's business objectives and additional expenditure on risk analysis cannot be justified.
Q4) _________ is choosing to accept a risk level greater than normal for business reasons.
A)Risk avoidance
B)Reducing likelihood
C)Risk transfer
D)Risk acceptance
Q5) Not proceeding with the activity or system that creates the risk is _________.
Page 16
To view all questions and flashcards with answers, click on the resource link above.
Chapter 15: It Security Controls,plans,and Procedures
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79967
Sample Questions
Q1) Physical access or environmental controls are only relevant to areas housing the relevant equipment.
A)True
B)False
Q2) Water damage protection is included in security controls.
A)True
B)False
Q3) The objective of the ________ control category is to counteract interruptions to business activities and to protect critical business processes from the effects of major failures of information systems or disasters and to ensure their timely resumption.
A)asset management
B)business continuity management
C)information security incident management
D)physical and environmental security
Q4) The implementation phase comprises not only the direct implementation of the controls,but also the associated training and general security awareness programs for the organization.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 17
Chapter 16: Physical and Infrastructure Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79966
Sample Questions
Q1) Physical security must prevent misuse of the physical infrastructure that leads to the misuse or damage of the protected information.
A)True
B)False
Q2) A(n)________ is a battery backup unit that can maintain power to processors,monitors,and other equipment and can also function as a surge protector,power noise filter,and an automatic shutdown device.
Q3) Tornados,tropical cyclones,earthquakes,blizzards,lightning,and floods are all types of ________ disasters.
Q4) Physical security must also prevent any type of physical access or intrusion that can compromise logical security.
A)True
B)False
Q5) Human-caused threats can be grouped into the following categories: unauthorized physical access,theft,_________ and misuse.
Q6) _________ security,also called infrastructure security,protects the information systems that contain data and the people who use,operate,and maintain the systems.
Q7) The most essential element of recovery from physical security breaches is ____.
Page 18
To view all questions and flashcards with answers, click on the resource link above.
Chapter 17: Human Resources Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79965
Sample Questions
Q1) Employee behavior is not a critical concern in ensuring the security of computer systems.
A)True
B)False
Q2) ________ can include computer viruses,Trojan horse programs,worms,exploit scripts,and toolkits.
A)Artifacts
B)Vulnerabilities
C)CSIRT
D)Constituencies
Q3) ___________ scan critical system files,directories,and services to ensure they have not been changed without proper authorization.
A)Intrusion prevention systems
B)System integrity verification tools
C)Log analysis tools
D)Network and host intrusion detection systems
Q4) A(n)_______ is a characteristic of a piece of technology that can be exploited to perpetrate a security incident.
To view all questions and flashcards with answers, click on the resource link above. Page 19
Chapter 18: Security Auditing
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79964
Sample Questions
Q1) Windows is equipped with three types of event logs: system event log,security event log,and ________ event log.
Q2) Data representing behavior that does not trigger an alarm cannot serve as input to intrusion detection analysis.
A)True
B)False
Q3) Severe messages,such as immediate system shutdown,is a(n)_____ severity.
A)alert
B)emerg
C)crit
D)warning
Q4) Thresholding is a form of baseline analysis.
A)True
B)False
Q5) The basic audit objective is to establish accountability for system entities that initiate or participate in security-relevant events and actions.
A)True
B)False
Q6) _________ is a form of auditing that focuses on the security of an organization's IS assets.
Page 20
To view all questions and flashcards with answers, click on the resource link above.
Chapter 19: Legal and Ethical Aspects
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79963
Sample Questions
Q1) The successful use of law enforcement depends much more on technical skills than on people skills.
A)True
B)False
Q2) The U.S.legal system distinguishes three primary types of property: real property,personal property,and _________ property.
Q3) Anyone can join the Ad Hoc Committee on Responsible Computing.
A)True
B)False
Q4) The three types of patents are: utility patents,design patents,and ________.
Q5) _______ or cybercrime,is a term used broadly to describe criminal activity in which computers or computer networks are a tool,a target,or a place of criminal activity.
Q6) No cybercriminal databases exist that can point investigators to likely suspects.
A)True
B)False
Q7) A(n)_________ may be granted to anyone who invents or discovers any new and useful process,machine,article of manufacture,or composition of matter,or any new and useful improvement thereof.
Page 21
To view all questions and flashcards with answers, click on the resource link above.
Chapter 20: Symmetric Encryption and Message
Confidentiality
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79961
Sample Questions
Q1) A brute-force approach involves trying every possible key until an intelligible translation of the ciphertext into plaintext is obtained.
A)True
B)False
Q2) If the analyst is able to get the source system to insert into the system a message chosen by the analyst,then a ________ attack is possible.
A)known-plaintext
B)chosen-plaintext
C)chosen ciphertext
D)chosen text
Q3) A ________ cipher processes the input one block of elements at a time,producing an output block for each input block.
Q4) The _________ was issued as a federal information-processing standard and is intended to replace DES and 3DES with an algorithm that is more secure and efficient.
Q5) _________ is the process of attempting to discover the plaintext or key.
Q6) AES uses a Feistel structure.
A)True
B)False
Page 22
To view all questions and flashcards with answers, click on the resource link above.
Chapter 21: Public-Key Cryptography and Message
Authentication
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79960
Sample Questions
Q1) ___________ was the first published public-key algorithm.
A)NIST
B)Diffie-Hellman
C)RC4
D)RSA
Q2) A __________ type of attack exploits properties of the RSA algorithm.
A)timing
B)brute-force
C)chosen ciphertext
D)mathematical
Q3) The Diffie-Hellman algorithm depends for its effectiveness on the difficulty of computing discrete logarithms.
A)True
B)False
Q4) One of the simplest hash functions is the ________ of every block.
Q5) Cryptographic hash functions generally execute faster in software than conventional encryption algorithms such as DES.
A)True
B)False
Q6) NIST has published FIPS PUB 186,which is known as the ___________. Page 23
To view all questions and flashcards with answers, click on the resource link above.
Page 24
Chapter 22: Internet Security Protocols and Standards
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79959
Sample Questions
Q1) A _________ is formed by taking the message digest of the content to be signed and then encrypting that with the private key of the signer.
Q2) The result of S/MIME encrypting the digest using DSS and the sender's private DSS key is the ________.
A)digital signature
B)envelope
C)digest code
D)mail extension
Q3) If encryption is used alone,_______ is used to convert the ciphertext to ASCII format.
Q4) As an alternative the RSA public-key encryption algorithm can be used with either the SHA-1 or the MD5 message digest algorithm for forming signatures.
A)True
B)False
Q5) An ADMD is an Internet e-mail provider.
A)True
B)False
Q6) The _________ is used to convey SSL-related alerts to the peer entity.
To view all questions and flashcards with answers, click on the resource link above. Page 25
Chapter 23: Internet Authentication Applications
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79958
Sample Questions
Q1) The approach taken by Kerberos is using authentication software tied to a secure authentication server.
A)True
B)False
Q2) The principal objective for developing a PKI is to enable secure, convenient,and efficient acquisition of private keys.
A)True
B)False
Q3) _______ is important as part of the directory service that it supports and is also a basic building block used in other standards.
A)PKI
B)X.509
C)Kerberos
D)FIM
Q4) The ticket contains the user's ID,the server's ID,a __________,a lifetime after which the ticket is invalid,and a copy of the same session key sent in the outer message to the client.
Q5) X.509 provides a format for use in revoking a key before it expires.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above.
Chapter 24: Wireless Network Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79957
Sample Questions
Q1) The purpose of the discovery phase is for an STA and an AP to recognize each other,agree on a set of security capabilities,and establish an association for future communication using those security capabilities.
A)True
B)False
Q2) The smallest building block of a wireless LAN is a ______.
A)BSS
B)ESS
C)WPA
D)CCMP
Q3) The wireless environment consists of three components that provide point of attack: the wireless client,the transmission medium,and the _________.
Q4) The MAC service data unit contains any protocol control information needed for the functioning of the MAC protocol.
A)True
B)False
Q5) The transmission medium carries the radio waves for data transfer. A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 27