Information Security Management Exam Questions
Course Introduction
Information Security Management explores the principles, processes, and best practices for safeguarding organizational information assets against internal and external threats. The course covers risk assessment, development and implementation of security policies, compliance with legal and regulatory requirements, and the integration of security measures into organizational culture. Topics include security frameworks (such as ISO/IEC 27001), incident response planning, business continuity, and the roles and responsibilities of information security professionals. Through case studies and real-world examples, students gain practical skills in identifying vulnerabilities, mitigating threats, and managing ethical and legal considerations in a rapidly evolving digital landscape.
Recommended Textbook
Principles of Information Security 6th Edition by Michael E. Whitman
Available Study Resources on Quizplus 12 Chapters
1148 Verified Questions
1148 Flashcards
Source URL: https://quizplus.com/study-set/2123
Page 2
Chapter 1: Introduction to Information Security
Available Study Resources on Quizplus for this Chatper
87 Verified Questions
87 Flashcards
Source URL: https://quizplus.com/quiz/42300
Sample Questions
Q1) In an organization, the value of ____________________ of information is especially high when it involves personal information about employees, customers, or patients.
Answer: confidentiality
Q2) A server would experience a(n) __________ attack when a hacker compromises it to acquire information via a remote location using a network connection.
A) indirect
B) direct
C) software
D) hardware
Answer: B
Q3) During the ____________________ phase of the systems life cycle, the process begins by examining theevent or plan that initiated the process. During this phase, the objectives, constraints, and scope of the project are specified.
Answer: investigation
Q4) Using a methodology will usually have no effect on the probability of success.
A)True
B)False
Answer: False
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: The Need for Security
Available Study Resources on Quizplus for this Chatper
91 Verified Questions
91 Flashcards
Source URL: https://quizplus.com/quiz/42301
Sample Questions
Q1) Some information gathering techniques are quite legal-for example, using a Web browser to perform market research. These legal techniques are called, collectively, competitive ____________________.
Answer: intelligence
Q2) A(n) ____________________ is a potential weakness in an asset or its defensive control(s).
Answer: vulnerability
Q3) A(n) ____________________ is a potential risk to an information asset.
Answer: threat
Q4) A(n) ____________________ is an act against an asset that could result in a loss.
Answer: attack
Q5) As frustrating as viruses and worms are, perhaps more time and money is spent on resolving virus ____________________.
A) false alarms
B) polymorphisms
C) hoaxes
D) urban legends
Answer: C
To view all questions and flashcards with answers, click on the resource link above. Page 4
Chapter 3: Legal, Ethical, and Professional Issues in Information Security
Available Study Resources on Quizplus for this Chatper
83 Verified Questions
83 Flashcards
Source URL: https://quizplus.com/quiz/42302
Sample Questions
Q1) The FTC recommends that people place an initial fraud alert (among other things) when they suspect they are victims of identity theft.
A)True
B)False
Answer: True
Q2) In 2002, Congress passed the Federal Information Security Management Act (FISMA), which mandates that all federal agencies __________.
A) provide security awareness training
B) periodic assessment of risk
C) develop policies and procedures based on risk assessments
D) All of the above
Answer: A
Q3) Laws, policies, and their associated penalties only provide deterrence if, among other things, potential offenders fear the probability of a <u>penalty</u> being applied.
A)True
B)False
Answer: True
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Planning for Security
Available Study Resources on Quizplus for this Chatper
109 Verified Questions
109 Flashcards
Source URL: https://quizplus.com/quiz/42303
Sample Questions
Q1) In early 2014, in response to Executive Order 13636, NIST published the Cybersecurity Framework, which intends to allow organizations to __________.
A) identify and prioritize opportunities for improvement within the context of a continuous and repeatable process
B) assess progress toward a recommended target state
C) communicate among local, state, and national agencies about cybersecurity risk
D) None of these
Q2) The transfer of live transactions in real time to an off-site facility is called
Q3) Incident ____________________ is the set of activities taken to plan for, detect, and correct the impact of an incident on information assets.
Q4) The stated purpose of ISO/IEC 27002 is to "offer guidelines and voluntary directions for information security __________."
A) implementation
B) certification
C) management
D) accreditation
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Risk Management
Available Study Resources on Quizplus for this Chatper
108 Verified Questions
108 Flashcards
Source URL: https://quizplus.com/quiz/42304
Sample Questions
Q1) The combination of an asset's value and the percentage of the asset that might be lost in an attack is known as the loss ____________________.
Q2) When deciding which information assets to track, consider the following asset attributes: people, ____________________, data, software, and hardware.
Q3) ____________________ components account for the management of information in all its states: transmission, processing, and storage.
Q4) Within organizations, the most important feasibility is<u> technical</u> feasibility, which defines what can and cannot occur based on the consensus and relationships between the communities of interest. _________________________
A)True
B)False
Q5) The defense control strategy is the risk control strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards, but it is not the preferred approach to controlling risk.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above.
Chapter 6: Security Technology: Access Controls, Firewalls, and VPNS
Available Study Resources on Quizplus for this Chatper
106 Verified Questions
106 Flashcards
Source URL: https://quizplus.com/quiz/42305
Sample Questions
Q1) The restrictions most commonly implemented in packet-filtering firewalls are based on __________.
A) IP source and destination address
B) Direction (inbound or outbound)
C) TCP or UDP source and destination port requests
D) All of the above
Q2) The firewall device must never be accessible directly from the ____________________ network.
Q3) List and describe the interacting services of the Kerberos system.
Q4) It is important that e-mail traffic reach your e-mail server and only your e-mail server.
A)True
B)False
Q5) A(n) ____________________ dialer is an automatic phone-dialing program that dials every number in a configured range and checks to see if a person, answering machine, or modem picks up.
Q6) SESAME uses ____________________ key encryption to distribute secret keys.
Page 8
Q7) Because the bastion host stands as a sole defender on the network perimeter, it is commonly referred to as the ____________________ host.
To view all questions and flashcards with answers, click on the resource link above.
Chapter 7: Security Technology: Intrusion
Detection and Prevention Systems, and Other Security Tools
Available Study Resources on Quizplus for this Chatper
107 Verified Questions
107 Flashcards
Source URL: https://quizplus.com/quiz/42306
Sample Questions
Q1) In the process of protocol <u>application </u>verification, the NIDPSs look for invalid data packets. _________________________
A)True
B)False
Q2) Passive scanners are advantageous in that they require vulnerability analysts to get approval prior to testing.
A)True
B)False
Q3) List and describe the four advantages of HIDPSs.
Q4) The <u>integrity</u> value, which is based upon fuzzy logic, helps an administrator determine how likely it is that an IDPS alert or alarm indicates an actual attack in progress. _________________________
A)True
B)False
Q5) A(n) ____________________ occurs when an attacker attempts to gain entry or disrupt the normal operations of an information system, almost always with the intent to do harm.
Q7) List and describe at least four reasons to acquire and use an IDPS. Page 9
Q6) A signature-based IDPS is sometimes called a(n) ____________________-based IDPS.
To view all questions and flashcards with answers, click on the resource link above.
Page 10
Chapter 8: Cryptography
Available Study Resources on Quizplus for this Chatper
109 Verified Questions
109 Flashcards
Source URL: https://quizplus.com/quiz/42307
Sample Questions
Q1) The science of encryption is known as ____________________.
Q2) In addition to being credited with inventing a substitution cipher, Julius Caesar was associated with an early version of the transposition cipher.
A)True
B)False
Q3) The successor to 3DES is the ____________________ Encryption Standard.
Q4) PKI systems are based on public-key cryptosystems and include digital certificates and certificate authorities.
A)True
B)False
Q5) Sequence encryption is a series of encryptions and decryptions between a number of systems, wherein each system in a network decrypts the message sent to it and then reencrypts it using different keys and sends it to the next neighbor. This process continues until the message reaches the final destination.
A)True
B)False
Q6) A message ____________________ is a fingerprint of the author's message that is compared with the recipient's locally calculated hash of the same message.
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 9: Physical Security
Available Study Resources on Quizplus for this Chatper
77 Verified Questions
77 Flashcards
Source URL: https://quizplus.com/quiz/42308
Sample Questions
Q1) A(n) _________________________ or offline UPS is an offline battery backup that detects the interruption of power to the power equipment.
Q2) The capacity of UPS devices is measured using the voltage output rating.
A)True
B)False
Q3) When the lock of a door fails and causes the door to become unlocked, it is classified as a fail-secure lock.
A)True
B)False
Q4) A __________ system is designed to work in areas where electrical equipment is used. Instead of containing water, the system contains pressurized air.
A) wet-pipe
B) dry-pipe
C) deluge
D) sprinkler
Q5) The presence of additional and disruptive signals in network communications or electrical power delivery is referred to as _________________________.
Q6) List and describe the "Seven Major Sources of Physical Loss."
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 10: Implementing Information Security
Available Study Resources on Quizplus for this Chatper
78 Verified Questions
78 Flashcards
Source URL: https://quizplus.com/quiz/42309
Sample Questions
Q1) The tasks or action steps that come before the specific task at hand are called
Q2) At the center of the bull's-eye model are the ____________________ used by the organization to accomplish its work.
Q3) A direct changeover is also known as going "<u>fast turnkey</u>."
A)True
B)False
Q4) A direct ____________________ involves stopping the old system and starting the new one without any overlap.
Q5) In the __________ process, measured results are compared against expected results.
A) negative feedback loop
B) wrap-up
C) direct changeover
D) turnover
Q6) Once a project is underway, it is managed to using a process known as a negative ____________________ loop.
Q7) What minimum attributes for project tasks does the WBS document
Page 13
To view all questions and flashcards with answers, click on the resource link above.
Chapter 11: Security and Personnel
Available Study Resources on Quizplus for this Chatper
77 Verified Questions
77 Flashcards
Source URL: https://quizplus.com/quiz/42310
Sample Questions
Q1) <u>Friendly</u> departures include termination for cause, permanent downsizing, temporary lay-off, or some instances of quitting. _________________________
A)True
B)False
Q2) Separation of ____________________ is used to reduce the chance of an individual violating information security and breaching the confidentiality, integrity, or availability of information.
Q3) Upper <u>management</u> should learn more about the budgetary needs of the information security function and the positions within it.
A)True
B)False
Q4) The former System Administration, Networking, and Security Organization is now better known as __________.
A) SANO
B) SAN
C) SANS
D) SANSO
Q5) What tasks must be performed when an employee prepares to leave an organization
To view all questions and flashcards with answers, click on the resource link above. Page 14
Chapter 12: Information Security Maintenance
Available Study Resources on Quizplus for this Chatper
116 Verified Questions
116 Flashcards
Source URL: https://quizplus.com/quiz/42311
Sample Questions
Q1) Documentation procedures are not required for configuration and change management processes.
A)True
B)False
Q2) The optimum approach for escalation is based on a thorough integration of the monitoring process into the __________.
A) IDE
B) CERT
C) ERP
D) IRP
Q3) Tracking compliance involves assessing the status of the program as indicated by the database information and mapping it to <u>goals</u> established by the agency.
A)True
B)False
Q4) Specific <u>routine</u> bulletins are issued when developing threats and specific attacks pose a measurable risk to the organization. _________________________
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 15