IT Risk Management Exam Bank
Course Introduction
IT Risk Management explores the principles, practices, and tools used to identify, assess, and mitigate risks associated with information technology systems. This course covers the lifecycle of risk management, including risk identification, analysis, evaluation, treatment, and monitoring, with a focus on aligning IT risk strategies with organizational objectives. Topics include regulatory compliance, threat modeling, vulnerability assessment, business continuity planning, and risk reporting. Students will gain practical skills in risk assessment methods and frameworks, and learn how to develop resilient IT policies and controls to safeguard information assets in dynamic and complex environments.
Recommended Textbook
CompTIA Security+ Guide to Network Security Fundamentals 5th Edition by Mark Ciampa
Available Study Resources on Quizplus
15 Chapters
750 Verified Questions
750 Flashcards
Source URL: https://quizplus.com/study-set/3831 Page 2
Chapter 1: Introduction to Security
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/76425
Sample Questions
Q1) What type of theft involves stealing another person's personal information, such as a Social Security number, and then using the information to impersonate the victim, generally for financial gain?
A)Cyberterrorism
B)Identity theft
C)Phishing
D)Scam
Answer: B
Q2) Proper ________________ involves identifying risks but making the decision to not engage in the activity.
Answer: risk avoidance
Q3) Security is the goal to be free from danger as well as the process that achieves that freedom.
A)True
B)False
Answer: True
Q4) What is a state sponsored attacker?
Answer: A state-sponsored attacker is a government supported attacker that attacks foreign governments or citizens who are considered hostile or threatening.
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: Malware and Social Engineering Attacks
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/76418
Sample Questions
Q1) A virus that infects an executable program file is known as?
A)macro virus
B)program virus
C)companion virus
D)boot sector virus
Answer: B
Q2) Computer code that is typically added to a legitimate program but lies dormant until it is triggered by a specific logical event is known as a?
A)Trojan
B)logic bomb
C)macro virus
D)metamorphic virus
Answer: B
Q3) A(n) ____________________ is either a small hardware device or a program that monitors each keystroke a user types on the computer's keyboard.
Answer: keylogger
Q4) Malicious software, or ____________________, silently infiltrate computers with the intent to do harm.
Answer: malware
To view all questions and flashcards with answers, click on the resource link above. Page 4
Chapter 3: Application and Networking-Based Attacks
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/76417
Sample Questions
Q1) An attack that broadcasts a ping request to computers yet changes the address so that all responses are sent to the victim.
A)Address Resolution Protocol (ARP)
B)ARP Poisoning
C)Buffer overflow attack
D)Command injection
E)Cross-site scripting (XSS)
F)DNS poisoning
G)Flash cookie
H)Ping flood
I) Session token
J) Smurf attack
Answer: J
Q2) Although traditional network security devices can block traditional network attacks, they cannot always block Web application attacks.
A)True
B)False
Answer: True
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Host, Application, and Data Security
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/76416
Sample Questions
Q1) What are the five steps that can be used to ensure the security of an OS?
Q2) ____________________ paint is a nontoxic petroleum gel-based paint that is thickly applied and does not harden, making any coated surface very difficult to climb. Match the following terms to the appropriate definitions.
Q3) How can an area be made secure from a non-secured area via two interlocking doors to a small room?
A)Using a lockout
B)Using a mantrap
C)Using a closet
D)Using a pit
Q4) A _____________ is a document or series of documents that clearly defines the defense mechanisms an organization will employ in order to keep information secure.
Q5) ____________________ security is the physical security that specifically involves protecting the hardware of the host system, particularly portable laptops, netbooks, and tablet computers that can easily be stolen.
Q6) Describe how a DLP can be configured.
Q7) Explain how tailgate sensors work.
Q8) How does an RFID tag embedded into an ID badge function without a power supply?
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Basic Cryptography
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/76415
Sample Questions
Q1) If using the MD5 hashing algorithm, what is the length to which each message is padded?
A)32 bits
B)64 bits
C)128 bits
D)512 bits
Q2) Describe how Message Digest2 (MD2) works.
Q3) The simplest type of stream cipher, one in which one letter or character is exchanged for another, is known as what?
A)shift
B)substitution
C)lock
D)loop
Q4) A block cipher works on a single character at a time, and is faster than a stream cipher.
A)True
B)False
Q5) The original cryptographic algorithms for encrypting and decrypting documents are ____________________ cryptographic algorithms.
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Advanced Cryptography
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/76414
Sample Questions
Q1) A document that describes in detail how a CA uses and manages certificates, as well as how end users register for a digital certificate, is known as?
A)Certificate practice statement (CPS)
B)Certificate policy (CP)
C)Lifecycle policy (LP)
D)Access policy (AP)
Q2) A trust model with one CA that acts as a facilitator to interconnect all other CAs
A)Bridge trust model
B)Certificate Authority (CA)
C)Certificate Repository
D)Digital certificate
E)Distributed trust model
F)key escrow
G)Public key Infrastructure (PKI)
H)Session keys
I)Third-party trust
J)Trust model
Q3) Identify the general duties of an RA.
Q4) List the four stages of a certificate life cycle.
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Network Security
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/76413
Sample Questions
Q1) Discuss the two advantages that NAT provides.
Q2) A firewall that keeps a record of the state of a connection between an internal computer and an external device is using what technology below?
A)Stateful frame filtering
B)Stateless frame filtering
C)Stateful packet filtering
D)Stateless packet filtering
Q3) Describe how NAC works.
Q4) When a private network uses a single public IP address, and each outgoing TCP packet uses a different port to allow for proper translation, what networking technology is in use?
A)PAT
B)PNAT
C)NAPT
D)NAT
Q5) What are the two TCP/IP protocols that are used by mail servers for clients accessing incoming mail?
Q6) List and describe three features of Internet content filters.
Q7) Describe the difference between subnetting and VLANs.
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: Administering a Secure Network
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/76412
Sample Questions
Q1) Discuss the problems associated with storing the entire database of names and IP addresses in one location.
Q2) IEEE 802.1x is commonly used on wireless networks.
A)True
B)False
Q3) A TCP/IP protocol that uses Secure Sockets Layer or Transport Layer Security to encrypt commands sent over the control port (port 21) in an FTP session.
A)Audit log
B)Event log
C)File Transfer Protocol (FTP)
D)Flood guard
E)FTP Secure (FTPS)
F)Host elasticity
G)Loop protection
H)Snapshot
I)Telnet
J)Virtualization
Q4) What are the two types of community strings?
Q5) Why is the Physical Layer omitted in the TCP/IP model?
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 9: Wireless Network Security
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/76411
Sample Questions
Q1) Because PEAP can be vulnerable to specific types of attacks, Cisco now recommends that users migrate to a more secure EAP than PEAP.
A)True
B)False
Q2) Bluetooth is an example of what type of technology below?
A)Small Area Network
B)Private Area Network
C)Personal Area Network
D)Limited Area Network
Q3) A __________________ is an in-depth examination and analysis of a wireless LAN site.
Q4) What term below is used to describe an attack that sends unsolicited messages to Bluetooth enabled devices?
A)Bluesnarfing
B)Bluejacking
C)Bluecracking
D)Bluetalking
Q5) What is the Message Integrity Check (MIC) within WPA used for?
Q6) Explain what war driving is.
11
To view all questions and flashcards with answers, click on the resource link above.
Chapter 10: Mobile Device Security
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/76424
Sample Questions
Q1) What is the difference between a feature phone and a smartphone?
Q2) A _____________ is a matrix or two-dimensional barcode first designed for the automotive industry in Japan.
Q3) _____________ are portable computing devices that are generally larger than smartphones and smaller than notebooks, and are focused on ease of use.
Q4) What term below describes a hand-held mobile device that was intended to replace paper systems, and typically included an appointment calendar, an address book, a "to-do" list, a calculator, and the ability to record limited notes?
A)Notebook
B)Netbook
C)Web-based
D)Personal digital assistant (PDA)
Q5) Select below the item that is not considered to be a basic characteristic of mobile devices:
A)Small form factor
B)Mobile operating system
C)Removable media storage
D)Data synchronization capabilities
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 11: Access Control Fundamentals
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/76423
Sample Questions
Q1) During RADIUS authentication, what type of packet includes information such as identification of a specific AP that is sending the packet and the username and password?
A)accounting request
B)access request
C)verification request
D)authentication request
Q2) Describe the MAC lattice model.
Q3) The capability to look up information by name under the X.500 standard is known as a(n) ____________________-pages service.
Q4) A vulnerable process that is divided between two or more individuals to prevent fraudulent application of the process is known as:
A)Separation of duties
B)Job rotation
C)Mandatory vacation
D)Role reversal
Q5) A RADIUS ____________________ is a computer that forwards RADIUS messages among RADIUS clients and RADIUS servers.
Q6) List two major access control models.
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Authentication and Account Management
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/76422
Sample Questions
Q1) Which term below describes the time it takes for a key to be pressed and then released?
A)Dwell time
B)Lead time
C)Sync time
D)Show time
Q2) Using one authentication credential to access multiple accounts or applications.
A)Authentication factors
B)Bcrypt
C)Brute force attack
D)Dictionary attack
E)Hybrid attack
F)Key stretching
G)NTLM (New Technology LAN Manager) hash
H)Salt
I)Single sign-on
J)Token
Q3) What are the three advantages of a rainbow table over other password attacks?
Q4) List and describe two of the common password setting objects.
Q5) Discuss the weaknesses of OpenID.
To view all questions and flashcards with answers, click on the resource link above. Page 14
Chapter 13: Business Continuity
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/76421
Sample Questions
Q1) What kind of slack is created from information stored on a hard drive, which can contain remnants of previously deleted files or data?
A)RAM slack
B)Edge slack
C)Drive file slack
D)Sector slack
Q2) What RAID type below utilizes parity data across all drives instead of using a separate drive to hold parity error checking information?
A)RAID 0
B)RAID 1
C)RAID 2
D)RAID 5
Q3) The remaining cluster space of a partially filled sector is padded with contents from RAM. What is the name for this type of scenario?
A)Disk slack
B)RAM slack
C)ROM slack
D)Edge slack
To view all questions and flashcards with answers, click on the resource link above. Page 15
Chapter 14: Risk Mitigation
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/76420
Sample Questions
Q1) A written document that states how an organization plans to protect the company's information technology assets is a:
A)security policy
B)guideline
C)security procedure
D)standard
Q2) What type of learner tends to sit in the middle of the class and learns best through lectures and discussions?
A)Visual
B)Auditory
C)Kinesthetic
D)Spatial
Q3) Which roles should be represented on the security policy development team?
Q4) What is a general security tip for using a social networking site?
Q5) A(n) ____________________ is a collection of requirements specific to the system or procedure that must be met by everyone.
Q6) Most people are taught using a(n) ____________________ approach. Matching
Q7) List two characteristics of a policy.
Page 16
To view all questions and flashcards with answers, click on the resource link above.
Chapter 15: Vulnerability Assessment and Third Party Integration
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/76419
Sample Questions
Q1) When using a black box test, many testers use ____________________ tricks to learn about the network infrastructure from inside employees.
Q2) What term below describes a prearranged purchase or sale agreement between a government agency and a business?
A)Service Level Agreement (SLA)
B)Memorandum of Understanding (MOU)
C)Blanket Purchase Agreement (BPA)
D)Interconnection Security Agreement (ISA)
Q3) An administrator running a port scan wants to ensure that no processes are listening on port 23. What state should the port be in?
A)open port
B)open address
C)closed address
D)closed port
Q4) What is the end result of a penetration test?
A)penetration test profile
B)penetration test report
C)penetration test system
D)penetration test view
17
To view all questions and flashcards with answers, click on the resource link above.