Information Systems Security Exam Solutions

Course Introduction

Information Systems Security explores the principles, practices, and technologies essential for protecting digital information and information systems from unauthorized access, misuse, and threats. The course covers security concepts, risk management, security policies, access control mechanisms, cryptography, network and application security, and incident response. Students will analyze real-world security breaches, examine legal and ethical considerations, and learn how to develop strategies that safeguard organizational assets in a rapidly evolving digital landscape. Emphasis is placed on both technical and managerial aspects of information security, preparing students to address current and emerging security challenges.

Recommended Textbook Principles of Information Security 5th Edition by Michael E. Whitman

Available Study Resources on Quizplus

12 Chapters

696 Verified Questions

696 Flashcards

Source URL: https://quizplus.com/study-set/2374

Page 2

Chapter 1: Introduction to the Management of Information Security

Available Study Resources on Quizplus for this Chatper

63 Verified Questions

63 Flashcards

Source URL: https://quizplus.com/quiz/47110

Sample Questions

Q1) The term phreaker is now commonly associated with an individual who cracks or removes software protection that is designed to prevent unauthorized duplication._________________________

A)True

B)False

Answer: False

Q2) One form of online vandalism is ____________________operations,which interfere with or disrupt systems to protest the operations,policies,or actions of an organization or government agency.

A) hacktivist

B) phreak

C) hackcyber

D) cyberhack

Answer: A

Q3) The macro virus infects the key operating system files located in a computer's start up sector._________________________

A)True

B)False

Answer: False

To view all questions and flashcards with answers, click on the resource link above. Page 3

Chapter 2: Compliance: Law and Ethics

Available Study Resources on Quizplus for this Chatper

50 Verified Questions

50 Flashcards

Source URL: https://quizplus.com/quiz/47111

Sample Questions

Q1) A key difference between policy and law is that ignorance of policy is a viable defense.What steps must be taken to assure that an organization has a reasonable expectation that policy violations can be appropriately penalized without fear of legal retribution?

Answer: Policies must be: Distributed to all individuals who are expected to comply with them Read by all employees Understood by all employees,with multilingual translations and translations for visually impaired or low-literacy employees Acknowledged by the employee,usually by means of a signed consent form Uniformly enforced,with no special treatment for any group (e.g.,executives)

Q2) Deterrence is the best method for preventing an illegal or unethical activity.____________

A)True

B)False

Answer: True

Q3) Ethics carry the sanction of a governing authority.

A)True

B)False

Answer: False

To view all questions and flashcards with answers, click on the resource link above.

Chapter 3: Governance and Strategic Planning for Security

Available Study Resources on Quizplus for this Chatper

52 Verified Questions

52 Flashcards

Source URL: https://quizplus.com/quiz/47112

Sample Questions

Q1) What is the role of planning in InfoSec management?What are the factors that affect planning?

Answer: Planning usually involves many interrelated groups and organizational processes.The groups involved in planning represent the three communities of interest; they may be internal or external to the organization and can include employees,management,stockholders,and other outside stakeholder.Among the factors that affect planning are the physical environment,the political and legal environment,the competitive environment,and the technological environment.

Q2) The ______________________ phase is the last phase of SecSDLC,but perhaps the most important.

Answer: maintenance and change

Q3) Which model of SecSDLC does the work product from each phase fall into the next phase to serve as its starting point?

A) modular continuous

B) elementary cyclical

C) time-boxed circular

D) traditional waterfall

Answer: D

To view all questions and flashcards with answers, click on the resource link above.

Chapter 4: Information Security Policy

Available Study Resources on Quizplus for this Chatper

56 Verified Questions

56 Flashcards

Source URL: https://quizplus.com/quiz/47113

Sample Questions

Q1) The 'Authorized Uses' section of an ISSP specifies what the identified technology cannot be used for.

A)True

B)False

Q2) Which of the following is NOT an aspect of access regulated by ACLs?

A) what authorized users can access

B) where the system is located

C) how authorized users can access the system

D) when authorized users can access the system

Q3) Information securitypolicies are designed to provide structure in the workplace and explain the will of the organization'smanagement.____________

A)True

B)False

Q4) A risk assessment is performed during which phase of the SecSDLC?

A) implementation

B) analysis

C) design

D) investigation

Q5) What are configuration rules?Provide examples.

To view all questions and flashcards with answers, click on the resource link above. Page 6

Chapter 5: Developing the Security Program

Available Study Resources on Quizplus for this Chatper

55 Verified Questions

55 Flashcards

Source URL: https://quizplus.com/quiz/47114

Sample Questions

Q1) The three methods for selecting or developing advanced technical training are by job category,by job function,and by ____________________.

Q2) A(n)____________________ is a specific point in the project plan when a task that has a noticeable impact on plan's the progress is complete.

Q3) What is the security education,training,and awareness program? Describe how the program aims to enhance security.

Q4) __________ is a simple project management planning tool.

A) RFP

B) WBS

C) ISO 17799

D) SDLC

Q5) Which function needed to implement the information security program includes researching,creating,maintaining,and promoting information security plans?

A) compliance

B) policy

C) planning

D) systems security administration

Q6) What is the Chief Information Security Office primarily responsible for?

To view all questions and flashcards with answers, click on the resource link above. Page 7

Chapter 6: Risk Management: Identifying and Assessing Risk

Available Study Resources on Quizplus for this Chatper

60 Verified Questions

60 Flashcards

Source URL: https://quizplus.com/quiz/47115

Sample Questions

Q1) For the purposes of relative risk assessment how is risk calculated?

Q2) Once an information asset is identified,categorized,and classified,what must also be assigned to it?

A) Asset tag

B) Relative value

C) Location ID

D) Threat risk

Q3) Some threats can manifest in multiple ways,yielding multiple exploits for an asset-threat pair. ____________

A)True

B)False

Q4) Briefly describe any three standard categories of information asset and their respective risk management components.

Q5) The InfoSec community often takes on the leadership role in addressing risk.

A)True

B)False

Q6) List the stages in the risk identification process in order of occurrence.

Q7) What are the included tasks in the identification of risks?

Q8) Why is threat identification so important in the process of risk management? Page 8

To view all questions and flashcards with answers, click on the resource link above.

Page 9

Chapter 7: Risk Management: Controlling Risk

Available Study Resources on Quizplus for this Chatper

60 Verified Questions

60 Flashcards

Source URL: https://quizplus.com/quiz/47116

Sample Questions

Q1) Unlike other risk management frameworks,FAIR relies on the qualitative assessment of many risk components using scales with value ranges.

A)True

B)False

Q2) What should each information asset-threat pair have at a minimum that clearly identifies any residual risk that remains after the proposed strategy has been executed?

A) probability calculation

B) documented control strategy

C) risk acceptance plan

D) mitigation plan

Q3) Once an organization has estimated the worth of various assets,what three questions must be asked to calculate the potential loss from the successful exploitation of a vulnerability?

Q4) What are the four phases of the Microsoft risk management strategy?

Q5) The ____________________ risk control strategy attempts to shift the risk to other assets,processes,or organizations.

Q6) Explain two practical guidelines to follow in risk control strategy selection.

Q7) Discuss three alternatives to feasibility analysis.

Page 10

To view all questions and flashcards with answers, click on the resource link above.

Chapter 8: Security Management Models

Available Study Resources on Quizplus for this Chatper

60 Verified Questions

60 Flashcards

Source URL: https://quizplus.com/quiz/47117

Sample Questions

Q1) Which control category discourages an incipient incident?

A) preventative B) deterrent C) remitting D) compensating

Q2) Which of the following is NOT one of the three levels in the U.S.military data classification scheme for National Security Information?

A) confidential

B) secret C) top secret D) for official use only

Q3) What is the data classification for information deemed to be National Security Information for the U.S.military as specified in 2009 in Executive Order 13526?

Q4) What are the two primary access modes of the Bell-LaPadula model and what do they restrict?

Q5) What are the five principles that are focused on the governance and management of IT as specified by COBIT 5?

Q6) Under what circumstances should access controls be centralized vs.decentralized?

To view all questions and flashcards with answers, click on the resource link above. Page 11

Chapter 9: Security Management Practices

Available Study Resources on Quizplus for this Chatper

59 Verified Questions

59 Flashcards

Source URL: https://quizplus.com/quiz/47118

Sample Questions

Q1) A legal standard that requires an organization and its employees to actas a reasonable and prudent individual or organization would under similar circumstances.

A)accreditation

B)baseline

C)benchmarking

D)certification

E)due diligence

F)best security practices

G)recommended business practices

H)standard of due care

I)performance measurements

J)NIST SP 800-37

Q2) Which of the following is Tier 3 (indicating environment of operation)of the tiered risk management approach?

A) Mission/business process

B) Information system

C) Accounting/logistics

D) Organization

Q3) Describe the three tier approach of the RMF as defined by NIST SP 800-37.

To view all questions and flashcards with answers, click on the resource link above.

Page 12

Chapter 10: Planning for Contingencies

Available Study Resources on Quizplus for this Chatper

60 Verified Questions

60 Flashcards

Source URL: https://quizplus.com/quiz/47119

Sample Questions

Q1) The first component of the analysis phase of a digital forensic investigation is ___________,which allows the investigator to quickly and easily search for a specific type of file.

Q2) Describe the methodology an organization should follow in an investigation.

Q3) In which contingency plan testing strategy do individuals participate in a role-playing exercise inwhich the CP team is presented with a scenario of an actual incident or disaster and expected to react as if it had occurred?

A) Desk check

B) Simulation

C) Structured walk-through

D) Parallel testing

Q4) A(n) wrap-up review is a detailedexamination and discussion of the events that occurred duringan incident or disaster,from first detection to final recovery.____________

A)True

B)False

Q5) If operations at the primary site cannot be quickly restored,the ____________________ occurs concurrently with the DR plan,enabling the business to continue at an alternate site.

To view all questions and flashcards with answers, click on the resource link above. Page 13

Chapter 11: Personnel and Security

Available Study Resources on Quizplus for this Chatper

60 Verified Questions

60 Flashcards

Source URL: https://quizplus.com/quiz/47120

Sample Questions

Q1) List the six key principles that should shape the career of a CISO.

Q2) A technically qualified individual who may configure firewalls and IDPSs,implement security software,diagnose and troubleshoot problems,and coordinate with systemsand network administrators to ensure that security technical controls are properly implemented is known as asecurity architect.____________

A)True

B)False

Q3) A conspiracy or cooperation between two or more individuals or groups to commitillegal or unethical actions is known as racketeering.____________

A)True

B)False

Q4) InfoSec is a profession with little personnel turnover - most InfoSec professionals stay in their positions for a very long time.

A)True

B)False

Q5) It is the responsibility of a _______________________ to develop appropriate InfoSec policies,standards,guidelines,and procedures.

To view all questions and flashcards with answers, click on the resource link above.

Chapter 12: Protection Mechanisms

Available Study Resources on Quizplus for this Chatper

61 Verified Questions

61 Flashcards

Source URL: https://quizplus.com/quiz/47121

Sample Questions

Q1) Technical controls alone,when properly configured,can secure an IT environment.

A)True

B)False

Q2) The KDC component of Kerberos knows the secret keys of all clients and servers on the network.

A)True

B)False

Q3) The "something a person has" authentication mechanism takes advantage of something inherent in the user that is evaluated using biometrics.

A)True

B)False

Q4) What is the next phase of the preattack data gathering process after an attacker has collected all of an organization's Internet addresses?

A) Footprinting

B) Content filtering

C) Deciphering

D) Fingerprinting

Q5) What is a packet sniffer and how can it be used for good or nefarious purposes?

Q6) List the most common firewall implementation architectures.

Page 15

To view all questions and flashcards with answers, click on the resource link above.