Information Security Governance Exam Solutions
Course Introduction
Information Security Governance explores the frameworks, policies, and processes that ensure an organizations information security strategies are aligned with its business objectives, legal requirements, and risk management practices. The course examines the roles and responsibilities of leadership in establishing security vision and culture, evaluates the development and implementation of security policies, and addresses compliance with international standards and regulations. Students gain insight into the assessment of security posture, the allocation of resources for security initiatives, and the measurement of performance to enable effective decision-making and continuous improvement within the organizations security program.
Recommended Textbook Management of Information Security 3rd Edition by Michael
E. Whitman
Verified Questions
Flashcards
Source URL: https://quizplus.com/study-set/2354
Page 2
Chapter 1: Introduction to the Management of Information Security
Available Study Resources on Quizplus for this Chatper
139 Verified Questions
139 Flashcards
Source URL: https://quizplus.com/quiz/46799
Sample Questions
Q1) A project can have more than one critical path.
A)True
B)False Answer: True
Q2) Unlike ongoing operations,project management involves the short-term gathering of a group that completes the project,and whose members are then released,and perhaps assigned to other projects.
A)True
B)False
Answer: True
Q3) A manager is responsible for coordinating the completion of tasks.
A)True
B)False Answer: True
Q4) \(\text {\underline{ Leadership} }\) generally addresses the direction and motivation of the human resource._________________________
A)True
B)False Answer: True
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: Planning for Security
Available Study Resources on Quizplus for this Chatper
123 Verified Questions
123 Flashcards
Source URL: https://quizplus.com/quiz/46800
Sample Questions
Q1) A vision statement is meant to be a factual depiction of the current state of the organization.
A)True
B)False
Answer: False
Q2) A(n)____ approach to security implementation is frequently referred to as a grass-roots effort.
A) SDLC
B) SecSDLC
C) top-down
D) bottom-up
Answer: D
Q3) A ____ attack involves sending a large number of connection or information requests to a target.
A) man-in-the-middle
B) denial-of-service (DoS)
C) brute force
D) dictionary
Answer: B
To view all questions and flashcards with answers, click on the resource link above.
Page 4
Chapter 3: Planning for Contingencies
Available Study Resources on Quizplus for this Chatper
114 Verified Questions
114 Flashcards
Source URL: https://quizplus.com/quiz/46801
Sample Questions
Q1) When a disaster threatens the viability of an organization at the primary site,the ____ is started.
A) crisis management process
B) business continuity process
C) incident response process
D) disaster recovery process
Answer: B
Q2) Which of the following can be fully functional within minutes?
A) A warm site
B) A hot site
C) A cold site
D) All of these
Answer: B
Q3) \(\text {\underline{Parallel } }\)
testing is the most rigorous strategy for testing contingency plans._________________________
A)True
B)False
Answer: False
To view all questions and flashcards with answers, click on the resource link above.
Page 5
Chapter 4: Information Security Policy
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46802
Sample Questions
Q1) <u>Practices</u> are built on sound policy and carry the weight of policy._________________________
A)True
B)False
Q2) A typical EULA screen may require the user to ____.
A) click a button on the screen
B) type specific words
C) press a function key
D) All of these
Q3) Information security is defined in the ____ component of an EISP.
A) Information Technology Security Responsibilities and Roles
B) Information Technology Security Elements
C) Need for Information Technology Security
D) Reference to Other Information Technology Standards and Guidelines
Q4) Unless a policy actually reaches the end users,it cannot be enforced.
A)True
B)False
Q5) ____________________ servers take organization-specific policies and code them in a special machine-readable language.
Page 6
Q6) List and briefly describe the major components of the ISSP.
To view all questions and flashcards with answers, click on the resource link above.
Chapter 5: Developing the Security Program
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46803
Sample Questions
Q1) The scope of the security training program should focus on information security personnel responsible for the protection of organizational information assets.
A)True
B)False
Q2) A security<u> trinket</u> program is one of the most expensive security awareness programs._________________________
A)True
B)False
Q3) The typical security staff in a small organization consists of ____.
A) one person
B) one to two people
C) one to three people
D) two to five people
Q4) Which of the following is a disadvantage of user support groups?
A) Relatively inflexible
B) Resource intensive, to the point of being inefficient
C) Centered on a specific topic or product
D) Software can be very expensive
Q5) Explain the conflict between the goals and objectives of the CIO and the CISO.
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Security Management Models
Available Study Resources on Quizplus for this Chatper
120 Verified Questions
120 Flashcards
Source URL: https://quizplus.com/quiz/46804
Sample Questions
Q1) What are the two primary properties of the Bell-LaPadula model and what do they restrict?
Q2) Information Technology-Code of Practice for Information Security Management was originally published as British Standard BS7799.
A)True
B)False
Q3) The objective of <u>COBIT</u> is to identify the factors that cause fraudulent financial reporting and to make recommendations to reduce its incidence._________________________
A)True
B)False
Q4) ____ access controls are determined by a central authority and can be based on roles or tasks.
A) Mandatory
B) Nondiscretionary
C) Discretionary
D) Lattice-based
Q5) A convenience store safe that can only be opened during store hours is an example of the ____________________ isolation access control.
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Security Management Practices
Available Study Resources on Quizplus for this Chatper
114 Verified Questions
114 Flashcards
Source URL: https://quizplus.com/quiz/46805
Sample Questions
Q1) Performance measurement is an ongoing,<u>continuous improvement
</u>operation._________________________
A)True
B)False
Q2) The purpose of NIST SP 800-53 (R3)as part of the NIST System C&A Project is to establish a set of standardized,minimum security controls for IT systems addressing low,moderate,and high levels of concern for ____.
A) confidentiality
B) integrity
C) availability
D) all of these
Q3) Information security ____ is the process of designing,implementing,and managing the use of the collected data elements called measures to determine the effectiveness of the overall security program.
A) performance management
B) baselining
C) best practices
D) standards of due care/diligence
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: Risk Management: Identifying and Assessing Risk
Available Study Resources on Quizplus for this Chatper
78 Verified Questions
78 Flashcards
Source URL: https://quizplus.com/quiz/46806
Sample Questions
Q1) One of the calculations that guides corporate spending on controls is the cost of ____ operations if an attack occurs and is successful.
A) recovery
B) response
C) mitigation
D) asset valuation
Q2) A TVA spreadsheet combines prioritized lists of assets and threats to identify vulnerabilities and provide a prioritized list of efforts relating to the implementation of needed controls.
A)True
B)False
Q3) Which of the following is the final step in the risk identification process of information assets?
A) Assessing relative value
B) Listing by order of importance
C) Preparing deliverables
D) Identifying and categorizing
Q4) The process of evaluating potential weaknesses in each information asset is known as ____________________ identification.
10
To view all questions and flashcards with answers, click on the resource link above.
Chapter 9: Risk Management: Controlling Risk
Available Study Resources on Quizplus for this Chatper
105 Verified Questions
105 Flashcards
Source URL: https://quizplus.com/quiz/46807
Sample Questions
Q1) The Single Loss Expectancy (SLE)is the result of the asset's value (AV)multiplied by the ____________________ factor.
Q2) <u>Avoidance</u> of risk is the choice to forgo the use of security measures and accept loss in the event of an attack._________________________
A)True
B)False
Q3) Risk ____________________ defines the quantity and nature of risk that an organization is willing to accept.
Q4) At a minimum,each information asset-threat pair should have a(n)____ that clearly identifies any residual risk that remains after the proposed strategy has been executed.
A) risk management plan
B) documented control strategy
C) asset valuation
D) cost-benefit analysis
Q5) Explain any two practical guidelines to follow in risk control strategy selection.
Q6) Risk appetite is also known as risk ____________________.
Q7) What is a cost/benefit analysis and how is it calculated?
Page 11
To view all questions and flashcards with answers, click on the resource link above.
Chapter 10: Protection Mechanisms
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46808
Sample Questions
Q1) Polyalphabetic substitutions are advanced substitution ciphers that use two or more <u>algorithms</u>._________________________
A)True
B)False
Q2) A(n)____________________ token uses a challenge-response system in which the server challenges the user with a number,that when entered into the token provides a response that provides access.
Q3) The set of transformations necessary to convert an unencrypted message into an encrypted message is known as a ____.
A) key
B) cryptosystem
C) cipher
D) steganography
Q4) Automated control systems for the most part can learn from mistakes,and they can adapt to changing situations.
A)True
B)False
Q5) "Something you are" and "something you ____________________" are considered to be biometric.
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 11: Personnel and Security
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46809
Sample Questions
Q1) In addition to the responsibility of conducting investigations of information security violations,a(n)<u>CISO</u> has to work effectively with external law enforcement to resolve these situations._________________________
A)True
B)False
Q2) The ____ certification program is an option for individuals who wish to take the CISSP or SSCP exams before obtaining the requisite experience for certification.
A) TICSA
B) SCP
C) MCSE
D) (ISC)² Associate
Q3) Which of the following is a responsibility of an information security technician?
A) Developing information security requirements for the organization
B) Providing hands-on technical consulting services to teams of technical specialists
C) Establishing procedures for the identification of information assets
D) Managing the development of information security policies
Q4) The GIAC ____________________ is the pinnacle of the GIAC certification program.
To view all questions and flashcards with answers, click on the resource link above.
13
Chapter 12: Law and Ethics
Available Study Resources on Quizplus for this Chatper
113 Verified Questions
113 Flashcards
Source URL: https://quizplus.com/quiz/46810
Sample Questions
Q1) Due ____________________ requires that an organization make sufficient and ongoing efforts to protect others.
Q2) Digital forensics is based on the field of traditional forensics.Forensics is the coherent application of <u>criminal</u> investigatory techniques to present evidence of crimes in a court or court-like setting._________________________
A)True
B)False
Q3) Founded in 1989,____ has a membership of over 156,000 security professionals,auditors,system administrators,and network administrators.
A) (ISC)²
B) ISACA
C) ISSA
D) SANS
Q4) _________________________ refers to the ability of law to reach across boundaries to bring accused individuals into its court systems.
Q5) Ethics tend to be based on cultural mores.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 14