Introduction to Information Assurance Exam
Bank
Course Introduction
Introduction to Information Assurance provides students with a foundational understanding of the principles and practices that protect information systems and data from threats and vulnerabilities. The course covers core topics such as risk management, security policies, cryptography, access control, network security, ethical and legal considerations, and incident response. Emphasis is placed on identifying potential risks, implementing effective safeguards, and ensuring the confidentiality, integrity, and availability of information. Students will develop practical skills through case studies and hands-on activities, preparing them to contribute to the security and resilience of modern information systems.
Recommended Textbook Principles of Information Security 5th Edition by Michael E. Whitman
Available Study Resources on Quizplus
12 Chapters
696 Verified Questions
696 Flashcards
Source URL: https://quizplus.com/study-set/2374
Page 2
Chapter 1: Introduction to the Management of Information Security
Available Study Resources on Quizplus for this Chatper
63 Verified Questions
63 Flashcards
Source URL: https://quizplus.com/quiz/47110
Sample Questions
Q1) Human error or failure often can be prevented with training,ongoing awareness activities,and ____________________.
A) threats
B) education
C) hugs
D) paperwork
Answer: B
Q2) What is authentication?Provide some examples.
Answer: Authentication is the process by which a control establishes whether a user (or system)has the identity it claims to have.Examples include the use of cryptographic certificates to establish Secure Sockets Layer (SSL)connections as well as the use of cryptographic hardware devices-for example,hardware tokens such as RSA's SecurID.Individual users may disclose a personal identification number (PIN)or a password to authenticate their identities to a computer system.
Q3) DoS attacks cannot be launched against routers.
A)True
B)False
Answer: False
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: Compliance: Law and Ethics
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/47111
Sample Questions
Q1) Which subset of civil law regulates the relationships among individuals and among individuals and organizations?
A) tort
B) criminal
C) private
D) public
Answer: C
Q2) ___________________ is a subset of civil law that allows individuals to seek redress in the event of personal,physical,or financial injury.
Answer: tort law
Q3) Due <U>diligence</U> requires that an organization make a valid and ongoing effort to protect others.____________
A)True
B)False
Answer: True
Q4) Information ____________ occurs when pieces of non-private data are combined to createinformation that violates privacy.
Answer: aggregation
To view all questions and flashcards with answers, click on the resource link above.
Page 4
Chapter 3: Governance and Strategic Planning for Security
Available Study Resources on Quizplus for this Chatper
52 Verified Questions
52 Flashcards
Source URL: https://quizplus.com/quiz/47112
Sample Questions
Q1) When using theGoverningfor Enterprise Security (GES)program,anEnterprise Security Program (ESP)should be structured so that governance activities aredriven by the organization's executive management,select key stakeholders,as well as the
A) Board Risk Committee
B) Board Finance Committee
C) Board Audit Committee
D) Chairman of the Board
Answer: A
Q2) Contrast the vision statement with the mission statement.
Answer: If the vision statement states where the organization wants to go,the mission statement describes how it wants to get there.
Q3) Enterprise<U> risk management </U>is a valuable approach that can better align security functions with the business mission while offering opportunities to lower costs.
A)True
B)False
Answer: True
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Information Security Policy
Available Study Resources on Quizplus for this Chatper
56 Verified Questions
56 Flashcards
Source URL: https://quizplus.com/quiz/47113
Sample Questions
Q1) Which of the following is a policy implementation model that addresses issues by moving from the general to the specific and is a proven mechanism for prioritizing complex changes?
A) On-target model
B) Wood's model
C) Bull's-eye model
D) Bergeron and Berube model
Q2) Which section of an ISSP should outline a specific methodology for the review and modification of the ISSP?
A) Policy Review and Modification
B) Limitations of Liability
C) Systems Management
D) Statement of Purpose
Q3) A risk assessment is performed during which phase of the SecSDLC?
A) implementation
B) analysis
C) design
D) investigation
Q4) List the major components of the ISSP.
Q5) What is a SysSP and what is one likely to include?
Page 6
To view all questions and flashcards with answers, click on the resource link above.
Chapter 5: Developing the Security Program
Available Study Resources on Quizplus for this Chatper
55 Verified Questions
55 Flashcards
Source URL: https://quizplus.com/quiz/47114
Sample Questions
Q1) Each organization has to determine its own project management methodology for IT and information security projects.
A)True
B)False
Q2) In the early stages of planning,the project planner should attempt to specify completion dates only for major <U>employees</U> within the project._________________________
A)True
B)False
Q3) Most information security projects require a trained project <U>developer</U>._________________________
A)True
B)False
Q4) Which of the following is NOT a step in the process of implementing training?
A) administer the program
B) hire expert consultants
C) motivate management and employees
D) identify target audiences
Q5) Explain the conflict between the goals and objectives of the CIO and the CISO.
Page 7
Q6) List the steps of the seven-step methodology for implementing training.
To view all questions and flashcards with answers, click on the resource link above.
Chapter 6: Risk Management: Identifying and Assessing Risk
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47115
Sample Questions
Q1) The probability that a specific vulnerability within an organization will be the targetof an attack is known as <U>risk</U>.____________
A)True
B)False
Q2) An estimate made by the manager using good judgement and experience can account for which factor of risk assessment?
A) Risk determination
B) Assessing potential loss
C) Likelihood and consequences
D) Uncertainty
Q3) How should the initial inventory be used when classifying and categorizing assets?
Q4) A formal access control methodology used to assign a level ofconfidentiality to an information asset and thus restrict the number of people who can access it is known as a data <U>categorization</U> scheme.____________
A)True
B)False
Q5) What are the included tasks in the identification of risks?
Page 8
Q6) Why is threat identification so important in the process of risk management?
To view all questions and flashcards with answers, click on the resource link above.
Chapter 7: Risk Management: Controlling Risk
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47116
Sample Questions
Q1) What does the result of a CBA determine?What is the formula for the CBA?
Q2) Which of the following affects the cost of a control?
A) liability insurance
B) CBA report
C) asset resale
D) maintenance
Q3) The quantity and nature of risk that organizations are willing to accept.
A)defense risk control strategy
B)mitigation risk control strategy
C)acceptance risk control strategy
D)termination risk control strategy
E)risk appetite
F)cost-benefit analysis
G)cost avoidance
H)asset valuation
I)organizational feasibility
J)single loss expectancy
Q4) The risk control strategy that seeks to reduce the impact of a successful attack through the use of IR,DR and BC plans is ____________________ .
Q5) What are the four stages of a basic FAIR analysis?
Page 9
To view all questions and flashcards with answers, click on the resource link above.
Chapter 8: Security Management Models
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47117
Sample Questions
Q1) Which security architecture model is based on the premise that higher levels of integrity are more worthy of trust than lower ones.
A) Clark-Wilson
B) Bell-LaPadula
C) Common Criteria
D) Biba
Q2) A person'ssecurity clearance is a personnel security structure in which each user of an information asset isassigned an authorization level that identifies the level of<U> classified</U> information he or she iscleared to access.____________
A)True
B)False
Q3) What are the five principles that are focused on the governance and management of IT as specified by COBIT 5?
Q4) Under what circumstances should access controls be centralized vs.decentralized?
Q5) One approach used to categorize access control methodologies categorizes controls based on their operational impact on the organization.What are these categories as described by NIST?
Q6) Access controls are build on three key principles.List and briefly define them.
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 9: Security Management Practices
Available Study Resources on Quizplus for this Chatper
59 Verified Questions
59 Flashcards
Source URL: https://quizplus.com/quiz/47118
Sample Questions
Q1) <U>Standardization</U> is an an attempt to improve information security practices by comparing anorganization's efforts against those of a similar organization or an industry-developedstandard to produce results it would like to duplicate.____________
A)True
B)False
Q2) What are the two major activities into which the InfoSec measurement development process recommended by NIST is divided?
Q3) Organizations must consider all but which of the following during development and implementation of an InfoSec measurement program?
A) Measurements must yield quantifiable information
B) Data that supports the measures needs to be readily obtainable
C) Only repeatable InfoSec processes should be considered for measurement
D) Measurements must be useful for tracking non-compliance by internal personnel
Q4) Before beginning the process of designing,collecting,and using measures,the CISO should be prepared to answer the following questions posed by Kovacich.List four of these questions.
Q5) List the four factors critical to the success of an InfoSec performance program,according to NIST SP 800-55,Rev.1.
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 10: Planning for Contingencies
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47119
Sample Questions
Q1) When a disaster renders the current business location unusable,which plan is put into action?
A) Business continuity
B) Crisis management
C) Incident response
D) Business impact analysis
Q2) In ____________________ testing of contingency plans,the individuals follow each and every procedure,including the interruption of service,restoration of data from backups,and notification of appropriate individuals.
Q3) The ____________________ plan is a detailed set of processes and procedures that anticipate,detect,and mitigate the effects of an unexpected event that might compromise information resources and assets.
Q4) List four of the eight key components of a typical IR policy.
Q5) Which of the following is a responsibility of the crisis management team?
A) Restoring the data from backups
B) Evaluating monitoring capabilities
C) Keeping the public informed about the event and the actions being taken
D) Restoring the services and processes in use
Q6) When undertaking the BIA,whatshouldthe organization consider?
Page 12
To view all questions and flashcards with answers, click on the resource link above.
Chapter 11: Personnel and Security
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47120
Sample Questions
Q1) Which of the following policies requires that two individuals review and approve each other's work before the task is considered complete?
A) Task rotation
B) Two-person control
C) Separation of duties
D) Job rotation
Q2) A requirement that all employees take time off from work,whichallows the organization to audit the individual's areas of responsibility is known as a <U>mandatory</U> vacation policy.____________
A)True
B)False
Q3) Temporary hires called contract employees - or simply contractors - should not be allowed to do what?
A) Work on the premises
B) Wander freely in and out of buildings
C) Visit the facility without specific, prior coordination
D) Compensated by the organization based on hourly rates
Q4) A security ____________________ is the typical information security entry-level position.
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Protection Mechanisms
Available Study Resources on Quizplus for this Chatper
61 Verified Questions
61 Flashcards
Source URL: https://quizplus.com/quiz/47121
Sample Questions
Q1) Which of the following provides an identification card of sorts to clients who request services in a Kerberos system?
A) Ticket Granting Service
B) Authentication Server
C) Authentication Client
D) Key Distribution Center
Q2) What is most commonly used for the goal of nonrepudiation in cryptography?
A) Block cipher
B) Secret key
C) PKI
D) Digital signature
Q3) The "something a person has" authentication mechanism takes advantage of something inherent in the user that is evaluated using biometrics.
A)True
B)False
Q4) ____________________ presents a threat to wireless communications,a practice that makes it prudent to use a wireless encryption protocol to prevent unauthorized use of your Wi-Fi network.
Q5) What is asymmetric encryption?
To view all questions and flashcards with answers, click on the resource link above. Page 14