Information Systems Security Final Exam Questions

Course Introduction

Information Systems Security focuses on the principles, practices, and technologies used to protect information assets within organizations. The course covers essential topics such as risk management, access control, encryption, security policies, network and data security, threat detection, and incident response. Students learn about common vulnerabilities and attack vectors, as well as legal, ethical, and social issues related to information security. Through case studies and practical exercises, students develop the skills needed to assess security needs, implement protective measures, and respond to security breaches, preparing them for roles in securing information systems across various industries.

Recommended Textbook

Principles of Information Security 5th Edition by Michael E. Whitman

Available Study Resources on Quizplus

12 Chapters

696 Verified Questions

696 Flashcards

Source URL: https://quizplus.com/study-set/2374 Page 2

Chapter 1: Introduction to the Management of Information Security

Available Study Resources on Quizplus for this Chatper

63 Verified Questions

63 Flashcards

Source URL: https://quizplus.com/quiz/47110

Sample Questions

Q1) Which of the following is the first step in the problem-solving process?

A) Analyze and compare the possible solutions

B) Develop possible solutions

C) Recognize and define the problem

D) Select, implement and evaluate a solution

Answer: C

Q2) In the____________________attack,an attacker monitors (or sniffs)packets from the network,modifies them,and inserts them back into the network.

A) zombie-in-the-middle

B) sniff-in-the-middle

C) server-in-the-middle

D) man-in-the-middle

Answer: D

Q3) Explain the differences between a leader and a manager.

Answer: The distinctions between a leader and a manager arise in the execution of organizational tasks.A leader provides purpose,direction,and motivation to those that follow.By comparison,a manager administers the resources of the organization.He or she creates budgets,authorizes expenditures,and hires employees.

To view all questions and flashcards with answers, click on the resource link above. Page 3

Chapter 2: Compliance: Law and Ethics

Available Study Resources on Quizplus for this Chatper

50 Verified Questions

50 Flashcards

Source URL: https://quizplus.com/quiz/47111

Sample Questions

Q1) What is the key difference between law an ethics?

Answer: The key difference between law and ethics is that law carries the sanction of a governing authority and ethics do not.

Q2) regulates the structure and administration of government agencies and their relationships with citizens,employees,and other governments

A)criminal law

B)public law

C)ethics

D)Computer Security Act (CSA)

E)Electronic Communications Privacy Act

F)Cybersecurity Act

G)normative ethics

H)applied ethics

Answer: B

Q3) InfraGard began as a cooperative effortbetween the FBI's Cleveland field office and local intelligence professionals. ___________

A)True

B)False

Answer: False

To view all questions and flashcards with answers, click on the resource link above.

Page 4

Chapter 3: Governance and Strategic Planning for Security

Available Study Resources on Quizplus for this Chatper

52 Verified Questions

52 Flashcards

Source URL: https://quizplus.com/quiz/47112

Sample Questions

Q1) A 2007 Deloitte report found that valuable approach that can better align security functions with the business mission while offering opportunities to lower costs is

A) enterprise risk management.

B) joint application design

C) security policy review

D) disaster recovery planning

Answer: A

Q2) In which phase of the SecSDLC does the risk management task occur?

A) physical design

B) implementation

C) investigation

D) analysis

Answer: D

Q3) What is the first phase of the SecSDLC?

A) analysis

B) investigation

C) logical design

D) physical design

Answer: B

To view all questions and flashcards with answers, click on the resource link above. Page 5

Chapter 4: Information Security Policy

Available Study Resources on Quizplus for this Chatper

56 Verified Questions

56 Flashcards

Source URL: https://quizplus.com/quiz/47113

Sample Questions

Q1) Which of the following is NOT one of the basic rules that must be followed when shaping a policy?

A) policy should never conflict with law

B) policy must be able to stand up in court if challenged

C) policy should be agreed upon by all employees and management

D) policy must be properly supported and administered

Q2) Examples of actions that illustrate compliance with policies are known as laws.

A)True

B)False

Q3) The champion and manager of the information security policy is called the ____________________.

Q4) List the advantages and disadvantages of using a modular approach for creating and managing the ISSP.

Q5) Which type of document is a more detailed statement of what must be done to comply with a policy?

A) procedure

B) standard

C) guideline

D) practice

To view all questions and flashcards with answers, click on the resource link above. Page 6

Chapter 5: Developing the Security Program

Available Study Resources on Quizplus for this Chatper

55 Verified Questions

55 Flashcards

Source URL: https://quizplus.com/quiz/47114

Sample Questions

Q1) What is the purpose of a security awareness program?What advantage does an awareness program have for the InfoSec program?

Q2) Which function needed to implement the information security program includes researching,creating,maintaining,and promoting information security plans?

A) compliance

B) policy

C) planning

D) systems security administration

Q3) Which of the following functions includes identifying the sources of risk and may include offering advice on controls that can reduce risk?

A) Risk management

B) Risk assessment

C) Systems testing

D) Vulnerability assessment

Q4) List the steps of the seven-step methodology for implementing training.

Q5) What is the Chief Information Security Office primarily responsible for?

Q6) What is the security education,training,and awareness program? Describe how the program aims to enhance security.

To view all questions and flashcards with answers, click on the resource link above. Page 7

Chapter 6: Risk Management: Identifying and Assessing Risk

Available Study Resources on Quizplus for this Chatper

60 Verified Questions

60 Flashcards

Source URL: https://quizplus.com/quiz/47115

Sample Questions

Q1) Which of the following distinctly identifies an asset and can be vital in later analysis of threats directed to specific models of certain devices or software components?

A) Name

B) MAC address

C) Serial number

D) Manufacturer's model or part number

Q2) The secretarial community often takes on the leadership role in addressing risk.____________

A)True

B)False

Q3) Classification categories must be ____________________ and mutually exclusive.

Q4) Which of the following is a network device attribute that may be used in conjunction with DHCP,making asset-identification using this attribute difficult?

A) Part number

B) Serial number

C) MAC address

D) IP address

Page 8

Q5) Why is threat identification so important in the process of risk management?

To view all questions and flashcards with answers, click on the resource link above.

Chapter 7: Risk Management: Controlling Risk

Available Study Resources on Quizplus for this Chatper

60 Verified Questions

60 Flashcards

Source URL: https://quizplus.com/quiz/47116

Sample Questions

Q1) Explain two practical guidelines to follow in risk control strategy selection.

Q2) By multiplying the asset value by the exposure factor,you can calculate which of the following?

A) annualized cost of the safeguard

B) single loss expectancy

C) value to adversaries

D) annualized loss expectancy

Q3) Which of the following is NOT an alternative to using CBA to justify risk controls?

A) benchmarking

B) due care and due diligence

C) selective risk avoidance

D) the gold standard

Q4) Which of the following determines acceptable practices based on consensus and relationships among the communities of interest.

A) organizational feasibility

B) political feasibility

C) technical feasibility

D) operational feasibility

Q5) Describe operational feasibility.

To view all questions and flashcards with answers, click on the resource link above. Page 9

Chapter 8: Security Management Models

Available Study Resources on Quizplus for this Chatper

60 Verified Questions

60 Flashcards

Source URL: https://quizplus.com/quiz/47117

Sample Questions

Q1) Access is granted based on a set of rules specified by the central authority.

A)blueprint

B)DAC

C)content-dependent access controls

D)rule-based access controls

E)separation of duties

F)sensitivity levels

G)storage channels

H)task-based controls

I)timing channels

J)TCB

Q2) What is the data classification for information deemed to be National Security Information for the U.S.military as specified in 2009 in Executive Order 13526?

Q3) Which type of access controls can be role-based or task-based?

A) constrained

B) content-dependent

C) nondiscretionary

D) discretionary

Q4) Under what circumstances should access controls be centralized vs.decentralized?

Q5) Access controls are build on three key principles.List and briefly define them.

To view all questions and flashcards with answers, click on the resource link above. Page 10

Chapter 9: Security Management Practices

Available Study Resources on Quizplus for this Chatper

59 Verified Questions

59 Flashcards

Source URL: https://quizplus.com/quiz/47118

Sample Questions

Q1) Performance measurements are seldom required in today's regulated InfoSec environment.

A)True

B)False

Q2) Astandard of due process is a legal standard that requires an organization and its employees to actas a "reasonable and prudent" individual or organization would under similar circumstances.____________

A)True

B)False

Q3) Creating a blueprint by looking at the paths taken by organizations similar to the one whose plan you are developing is known as which of the following?

A) benchmarking

B) best practices

C) baselining

D) due diligence

Q4) When choosing from among recommended practices,an organization should consider a number of questions.List four.

Q5) Why it measurement prioritization and selection important?How can it be achieved?

To view all questions and flashcards with answers, click on the resource link above. Page 11

Chapter 10: Planning for Contingencies

Available Study Resources on Quizplus for this Chatper

60 Verified Questions

60 Flashcards

Source URL: https://quizplus.com/quiz/47119

Sample Questions

Q1) Which of the following is usually conducted via leased lines or secure Internet connections whereby the receiving server archives the data as it is received?.

A) Database shadowing

B) Timesharing

C) Traditional backups

D) Electronic vaulting

Q2) At what point in the incident lifecycle is the IR plan initiated?

A) Before an incident takes place

B) Once the DRP is activated

C) When an incident is detectedthataffects it

D) Once the BCP is activated

Q3) In a warm site,all services and communications links are fully configured and the site can be fully functional within minutes.

A)True

B)False

Q4) Compare and contrast a hot site,a warm site,and a cold site.

Q5) A(n)____________________ is an agency that provides,in the case of DR/BC planning,physical facilities for a fee.

Q6) List four of the eight key components of a typical IR policy.

Page 12

To view all questions and flashcards with answers, click on the resource link above.

Chapter 11: Personnel and Security

Available Study Resources on Quizplus for this Chatper

60 Verified Questions

60 Flashcards

Source URL: https://quizplus.com/quiz/47120

Sample Questions

Q1) Briefly describe at least five types of background checks.

Q2) a member of the general business community having an information security related role

A)definers

B)builders

C)security manager

D)security technician

E)systems programmer

F)ethics officer

G)CISSP

H)SSCP

I)SANS

J)CCE

Q3) A requirement that all employees take time off from work,whichallows the organization to audit the individual's areas of responsibility is known as a mandatory vacation policy.____________

A)True

B)False

Q4) What are some of the common qualifications for a CISO?

Q5) Describe the position of security manager.

To view all questions and flashcards with answers, click on the resource link above. Page 13

Chapter 12: Protection Mechanisms

Available Study Resources on Quizplus for this Chatper

61 Verified Questions

61 Flashcards

Source URL: https://quizplus.com/quiz/47121

Sample Questions

Q1) Public key container files that allow PKI system components and end usersto validate a public key and identify its owner.

A)VPN

B)transport mode

C)SSL

D)PKI

E)digital certificate

F)asymmetric encryption

G)Vernam cipher

H)transposition cipher

I)content filter

J)footprinting

Q2) What is asymmetric encryption?

Q3) Which port number is commonly used for the Simple Mail Transfer Protocol service?

A) 25

B) 53

C) 68

D) 443

Q4) List the most common firewall implementation architectures.

To view all questions and flashcards with answers, click on the resource link above. Page 14