IT Governance and Security
Mock Exam
Course Introduction
IT Governance and Security explores the frameworks, processes, and best practices for aligning information technology with organizational goals while ensuring the protection of digital assets. The course covers critical topics such as IT risk management, policy development, regulatory compliance, security standards, and the role of leadership in establishing a security-conscious culture. Students will learn to evaluate and implement governance models, identify potential threats, and design comprehensive security strategies that support both business objectives and regulatory requirements. Through case studies and practical exercises, participants will gain skills necessary to create robust IT governance structures and manage the evolving landscape of cybersecurity threats.
Recommended Textbook
Principles of Information Security 6th Edition by Michael E. Whitman
Available Study Resources on Quizplus 12 Chapters
1148 Verified Questions
1148 Flashcards
Source URL: https://quizplus.com/study-set/2123
Page 2
Chapter 1: Introduction to Information Security
Available Study Resources on Quizplus for this Chatper
87 Verified Questions
87 Flashcards
Source URL: https://quizplus.com/quiz/42300
Sample Questions
Q1) ____________________ of information is the quality or state of being genuine or original, rather than a reproduction or fabrication.
Answer: Authenticity
Q2) __________ of information is the quality or state of being genuine or original.
A) Authenticity
B) Spoofing
C) Confidentiality
D) Authorization
Answer: A
Q3) The protection of tangible items, objects, or areas from unauthorized access and misuse is known as ___________.
A) communications security
B) network security
C) physical security
D) information security
Answer: C
Q4) A(n) ____________________ is a formal approach to solving a problem by means of a structured sequence of procedures. Answer: methodology
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: The Need for Security
Available Study Resources on Quizplus for this Chatper
91 Verified Questions
91 Flashcards
Source URL: https://quizplus.com/quiz/42301
Sample Questions
Q1) "4-1-9" fraud is an example of a ____________________ attack.
A) social engineering
B) virus
C) worm
D) spam
Answer: A
Q2) A table of hash values and their corresponding plaintext values that can be used to look up password values if an attacker is able to steal a system's encrypted password file is known as a(n) __________.
A) rainbow table
B) dictionary
C) crib
D) crack file
Answer: A
Q3) In the context of information security, ____________________ is the process of using social skills to convince people to reveal access credentials or other valuable information to the attacker.
Answer: social engineering
Q4) ESD is the acronym for ____________________ discharge.
Answer: electrostatic
Page 4
To view all questions and flashcards with answers, click on the resource link above.
Chapter 3: Legal, Ethical, and Professional Issues in Information Security
Available Study Resources on Quizplus for this Chatper
83 Verified Questions
83 Flashcards
Source URL: https://quizplus.com/quiz/42302
Sample Questions
Q1) The <u>Federal Bureau of Investigation's National InfraGard Program</u> serves its members in four basic ways: Maintains an intrusion alert network using encrypted e-mail; maintains a secure Web site for communication about suspicious activity or intrusions; sponsors local chapter activities; and operates a help desk for questions.
A)True
B)False
Answer: True
Q2) __________ is the legal obligation of an entity that extends beyond criminal or contract law.
Answer: Liability
Q3) Individuals with authorization and privileges to manage information within the organization are most likely to cause harm or damage by accident.
A)True
B)False
Answer: True
Q4) Key studies reveal that the overriding factor in leveling the ethical perceptions within a small population is __________.
Answer: education
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Planning for Security
Available Study Resources on Quizplus for this Chatper
109 Verified Questions
109 Flashcards
Source URL: https://quizplus.com/quiz/42303
Sample Questions
Q1) In early 2014, in response to Executive Order 13636, NIST published the Cybersecurity Framework, which intends to allow organizations to __________.
A) identify and prioritize opportunities for improvement within the context of a continuous and repeatable process
B) assess progress toward a recommended target state
C) communicate among local, state, and national agencies about cybersecurity risk
D) None of these
Q2) The security framework is a more detailed version of the security blueprint.
A)True
B)False
Q3) According to NIST SP 800-14's security principles, security should ________.
A) support the mission of the organization
B) require a comprehensive and integrated approach
C) be cost-effective
D) All of the above
Q4) A(n) ____________________ directs members of an organization as to how issues should be addressed and how technologies should be used.
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Risk Management
Available Study Resources on Quizplus for this Chatper
108 Verified Questions
108 Flashcards
Source URL: https://quizplus.com/quiz/42304
Sample Questions
Q1) When determining the relative importance of each asset, refer to the organization's mission statement or statement of objectives to determine which elements are essential, which are supportive, and which are merely adjuncts.
A)True
B)False
Q2) A best practice proposed for a small to medium-sized business will be similar to one used to help design control strategies for a large multinational company.
A)True
B)False
Q3) After identifying and performing the preliminary classification of an organization's information assets, the analysis phase moves on to an examination of the ____________________ facing the organization.
Q4) You should adopt naming standards that do not convey information to potential system attackers.
A)True
B)False
Q5) A(n) ____________________ is a performance value or metric used to compare changes in the object being measured.
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Security Technology: Access Controls, Firewalls, and VPNS
Available Study Resources on Quizplus for this Chatper
106 Verified Questions
106 Flashcards
Source URL: https://quizplus.com/quiz/42305
Sample Questions
Q1) Because the bastion host stands as a sole defender on the network perimeter, it is commonly referred to as the ____________________ host.
Q2) A content filter, also known as a reverse firewall, is a network device that allows administrators to restrict access to external content from within a network.
A)True
B)False
Q3) Best practices in firewall rule set configuration state that the<u> firewall</u> device never allows administrative access directly from the public network.
A)True B)False
Q4) The ability of a router to restrict traffic to a specific service is an advanced capability and not considered a standard feature for most routers.
A)True B)False
Q5) Good firewall rules include denying all data that is not verifiably authentic. A)True
B)False
8
To view all questions and flashcards with answers, click on the resource link above.
Chapter 7: Security Technology: Intrusion
Detection and Prevention Systems, and Other Security Tools
Available Study Resources on Quizplus for this Chatper
107 Verified Questions
107 Flashcards
Source URL: https://quizplus.com/quiz/42306
Sample Questions
Q1) To determine whether an attack has occurred or is underway, NIDPSs compare measured activity to known __________ in their knowledge base.
A) vulnerabilities
B) fingerprints
C) signatures
D) footprints
Q2) A(n) <u>port</u> is the equivalent of a network channel or connection point in a data communications system. _________________________
A)True
B)False
Q3) <u>Enticement</u> is the action of luring an individual into committing a crime to get a conviction. _________________________
A)True
B)False
Q4) Under the guise of justice, some less scrupulous administrators may be tempted to ____________________, or hack into a hacker's system to find out as much as possible about the hacker.
Q5) A signature-based IDPS is sometimes called a(n) ____________________-based IDPS.
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: Cryptography
Available Study Resources on Quizplus for this Chatper
109 Verified Questions
109 Flashcards
Source URL: https://quizplus.com/quiz/42307
Sample Questions
Q1) ____________________ is the process of making and using codes to secure the transmission of information.
Q2) Within a PKI, a(n)<u>registration</u> authority issues, manages, authenticates, signs, and revokes users' digital certificates, which typically contain the user name, public key, and other identifying information. _________________________ A)True
B)False
Q3) The Secure ____________________ Standard issued by the National Institute of Standards and Technology specifies secure algorithms, such as SHA-1, for computing a condensed representation of a message or data file.
Q4) To <u>encipher</u> means to decrypt, decode, or convert ciphertext into the equivalent plaintext. _________________________ A)True B)False
Q5) The ____________________ cipher simply rearranges the values within a block to create the ciphertext.
Q6) To use a(n) ____________________ cipher, you substitute one value for another.
Q7) Describe how hash functions work and what they are used for.
Page 10
To view all questions and flashcards with answers, click on the resource link above.
Chapter 9: Physical Security
Available Study Resources on Quizplus for this Chatper
77 Verified Questions
77 Flashcards
Source URL: https://quizplus.com/quiz/42308
Sample Questions
Q1) In a double conversion <u>offline</u> UPS, the primary power source is the inverter, and the power feed from the utility is constantly recharging the battery, which in turn powers the output inverter. _________________________
A)True
B)False
Q2) A(n) _________________________ system has pressurized water in all pipes and has some form of valve in each protected area.
Q3) Some sprinkler systems, called _________________________ systems, keep all individual sprinkler heads open; as soon as the system is activated, water is immediately applied to all areas.
Q4) Standby power supply (SPS) UPSs provide power conditioning.
A)True
B)False
Q5) Fire suppression systems typically work by denying an environment one of the three requirements for a fire to burn: a match, fuel, and oxygen.
A)True
B)False
Q6) Describe different types of sensors to detect intrusions.
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 10: Implementing Information Security
Available Study Resources on Quizplus for this Chatper
78 Verified Questions
78 Flashcards
Source URL: https://quizplus.com/quiz/42309
Sample Questions
Q1) The <u>RFP</u> determines the impact that a specific technology or approach can have on the organization's information assets and what it may cost.
A)True
B)False
Q2) A __________ is usually the best approach to security project implementation.
A) direct changeover
B) phased implementation
C) pilot implementation
D) parallel operation
Q3) The Lewin change model includes __________.
A) unfreezing
B) moving
C) refreezing
D) All of the above
Q4) Each organization has to determine its own project management methodology for IT and information security projects.
A)True
B)False
Q5) What are the major steps in executing the project plan
Page 12
To view all questions and flashcards with answers, click on the resource link above.
Chapter 11: Security and Personnel
Available Study Resources on Quizplus for this Chatper
77 Verified Questions
77 Flashcards
Source URL: https://quizplus.com/quiz/42310
Sample Questions
Q1) What functions does the CISO perform
Q2) The former System Administration, Networking, and Security Organization is now better known as __________.
A) SANO
B) SAN
C) SANS
D) SANSO
Q3) __________ are hired by the organization to serve in a temporary position or to supplement the existing workforce.
A) Temporary employees
B) Consultants
C) Contractors
D) Self-employees
Q4) What tasks must be performed when an employee prepares to leave an organization
Q5) ISACA offers the CGEIT as well as the CISA and ____________________ certifications.
Q6) Once a candidate has accepted a job offer, the employment ____________________ becomes an important security instrument.
Q7) Describe the concept of separation of duties.
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Information Security Maintenance
Available Study Resources on Quizplus for this Chatper
116 Verified Questions
116 Flashcards
Source URL: https://quizplus.com/quiz/42311
Sample Questions
Q1) List the four steps to developing a CM plan.
Q2) An affidavit is sworn testimony that certain facts are in the possession of an investigating officer and that they warrant the examination of specific items located at a specific place.
A)True
B)False
Q3) A(n) <u>war</u> game puts a subset of plans in place to create a realistic test environment. _________________________
A)True
B)False
Q4) A performance ____________________ is an expected level of performance against which all subsequent levels of performance are compared.
Q5) Documentation procedures are not required for configuration and change management processes.
A)True
B)False
Q6) The ____________________ vulnerability assessment is designed to find and document vulnerabilities that may be present in the organization's public network.
To view all questions and flashcards with answers, click on the resource link above. Page 14