IT Risk Management Review Questions
Course Introduction
IT Risk Management explores the principles and practices essential for identifying, assessing, and mitigating risks associated with information technology systems. The course covers frameworks and methodologies for risk analysis, regulatory and compliance requirements, security policies, and incident response strategies. Students engage with real-world case studies to understand threats such as cyber-attacks, data breaches, and operational failures, and they learn how to develop and implement comprehensive risk management plans that align IT objectives with organizational goals.
Recommended Textbook
Information Security and IT Risk Management 1st Edition by Manish Agrawal Available Study
https://quizplus.com/study-set/3541
Chapter 1: Introduction
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70324
Sample Questions
Q1) Of the measures you can take to improve your personal security, the least important is
A) Spending lot of money
B) Using end-point virus) protection
C) Automating software updates
D) Using appropriate passwords
Answer: A
Q2) Albert Gonzalez and T J Maxx are well known in the information security literature for
A) Intruding into a number of high profile computer installations
B) Stealing commercial information by exploiting weakness is wireless networks
C) Causing one of the most significant Internet outages ever
D) Falsification of financial records at publicly traded companies
Answer: B
Q3) The Sarbanes-Oxley act is important to information security for
A) Compelling investments in specified information security procedures
B) Stealing commercial information by exploiting weakness is wireless networks
C) Exposing the implications of international differences in cyber-law
D) Popularizing computers among the masses
Answer: A
To view all questions and flashcards with answers, click on the resource link above.
Page 3
Chapter 2: System Administration
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70325
Sample Questions
Q1) The types of monitoring include
A) Penetration testing and access control
B) Health checking and log monitoring
C) Nagios and log monitoring
D) Reactive monitoring and pro-active testing
Answer: D
Q2) The domain controller in Active Directory
A) Serves web pages in the domain
B) Bills users in the domain
C) Implements the active directory rules in the domain
D) Installs updated on all computers in the domain
Answer: C
Q3) A cold spare is a
A) Single point of failure
B) Redundant component that can replace a failed component with no downtime
C) Spare components used to replace failed components as quickly as possible
D) Popular component purchased when it is on sale
Answer: C
To view all questions and flashcards with answers, click on the resource link above.
4
Chapter 3: System Administration 2
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70326
Sample Questions
Q1) An example of an absolute path is
A) ./temp.txt
B) /temp.txt
C) temp.txt
D) ../temp.txt
Answer: B
Q2) In the context of system administration, the kernel is
A) Software that manages computer hardware and provides common services to user applications
B) Software which controls hardware devices, manages memory, and hides underlying physical hardware from user applications
C) A text based program that allows users to interact with the shell
D) The graphical interface for users to interact with applications
Answer: B
Q3) Vi is a
A) Graphical editor
B) Text editor
C) Game on Linux systems
D) Substitute for MS Word
Answer: B
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Basic Information Security Model
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70327
Sample Questions
Q1) Controls are
A) Safeguards used to minimize the impact of threats
B) Capabilities, intentions and attack methods of adversaries to cause harm to assets
C) Resource or information that is to be protected
D) Weaknesses in an information system that can lead to a compromise of an asset
Q2) A lack of input validation vulnerability refers to a situation where
A) Files are accepted as input without verifying their specifications
B) Input from other users is supplied as output to other users
C) A program puts more data into a storage location than it can hold
D) User input is used without confirming its validity
Q3) Rootkits are
A) Software used to hide the existence of malicious software on computer systems
B) Exploits that compromise a previously unknown software vulnerability
C) Computers that perform malicious tasks at the direction of a remote controller
D) Manipulating people into performing desired actions
Q4) Vulnerabilities in IT systems can be eliminated through secure coding practices
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Asset Identification and Characterization
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70328
Sample Questions
Q1) Restricted assets are
A) Assets whose loss would cause severe repercussions to the organization immediately
B) Importance of an asset to the immediate survival of an organization
C) The damage caused to an organization from a breach of confidentiality or integrity of an asset
D) Assets whose disclosure or alteration would have adverse consequences for the organization
Q2) RFPs, ITNs, ITBs are associated with the
A) Acquiring stage
B) Deployment stage
C) Management stage
D) Planning stage
Q3) Checklist based approaches can be used to identify
A) Asset priorities
B) Idiosyncratic assets
C) General assets
D) Assets
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Threats and Vulnerabilities
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70329
Sample Questions
Q1) Threat models are
A) Capabilities, intentions and attack methods of adversaries
B) Interactions between relevant agents, actions
C) Individuals, organizations or groups that originate a particular threat action
D) Activist groups
Q2) Help desk staff can be a threat due to
A) Abuse of privileges
B) Human errors
C) Lack of training
D) All of the above
Q3) Top management can be a threat agent by
A) Abusing privileges
B) Lack of understanding of security issues
C) Pulling rank
D) All of the above
To view all questions and flashcards with answers, click on the resource link above.
8
Chapter 7: Encryption Controls
Available Study Resources on Quizplus for this Chatper
24 Verified Questions
24 Flashcards
Source URL: https://quizplus.com/quiz/70330
Sample Questions
Q1) The word Cipher is based on an Arabic word, cifr, that means
A) Sender
B) Secret
C) Nothing
D) Receiver
Q2) Ciphertext is
A) The transformation of data to produce ciphertext
B) Text that is unintelligible to the reader
C) A sequence of symbols that controls the operations of encipherment and decipherment
D) A well-defined sequence of steps used to describe cryptographic processes
E) An encryption method that uses no keys
Q3) A certificate used in web applications contains the
A) Shared secret key prior to network transmission
B) The hash output of the data to be transmitted
C) Saved password of the end user for recovery
D) Public key of the server and information about the key provider
To view all questions and flashcards with answers, click on the resource link above.
Chapter 8: Identity and Access Management
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70331
Sample Questions
Q1) Password synchronization technologies
A) Require the presentation of a token for authentication
B) Allow a user to authenticate once and obtain access to all authorized resources
C) Allow nodes in an insecure network to securely identify themselves to each other using tokens
D) Ensure that the user has the same username and password on all systems
Q2) Biometrics is
A) The process of proving that a user is the owner of the identity being used
B) A secret series of characters known only to the user
C) The use of minute differences in physical traits to prove identity
D) A protocol that allows nodes in an insecure network to securely identify themselves to each other using tokens
Q3) Federations are useful to
A) Authenticate users within an organization
B) Determine the authorizations of users to resources
C) Bridge authentication systems in separate organizations
D) Eliminate single points of failure in IT systems
To view all questions and flashcards with answers, click on the resource link above.
10
Chapter 9: Hardware and Software Controls
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70332
Sample Questions
Q1) An ACL is
A) The process of defining, implementing, and maintaining password policies throughout an enterprise
B) A list of permissions attached to specified objects
C) A form of protection that allows one network to connect to another network while maintaining some amount of protection
D) Passwords on the system known to unauthorized users
Q2) Password guessing is
A) Passwords on the system known to unauthorized users
B) Acquiring passwords from storage, network transmission or user knowledge
C) Repeated attempts to authenticate using possible passwords
D) Generating character strings to match existing passwords
Q3) Limitations of IDS include
A) Evasion
B) Passwords
C) Complexity
D) Access
Q4) Patches should always be installed as soon as they become available
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 10: Shell Scripting
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70333
Sample Questions
Q1) Shell scripts can obtain user input using the command
A) input
B) var
C) read
D) cat
Q2) Shell scripts are
A) A list of shell commands in a text file
B) Scripts used as a shell, with no content until used
C) A type of compiled programs
D) Lists of drugs prescribed by a physician
Q3) The difference between break and continue while processing loop input is that
A) break exits the loop, but continue only exits the current iteration of the loop
B) break only exits the current iteration of the loop, but continue exits the loop
C) break and continue exit the loop
D) break and continue both exit only the current iteration of the loop
To view all questions and flashcards with answers, click on the resource link above.
Chapter 11: Incident Handling
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70334
Sample Questions
Q1) Log consolidation is useful for
A) Identifying irregularities across multiple systems
B) Lowering hardware costs
C) Eliminating the need for clock-synchronization
D) Serving as a honeypot
Q2) The stages of incident handling include
A) Planning, detection, maintenance, retirement
B) Preparation, detection, containment, post-incident analysis
C) Planning, acquisition, deployment, post-incident analysis
D) Preparation, acquisition, deployment, post-incident analysis
Q3) Containment is
A) Saving log files in a server container configured specially for this purpose
B) Preventing the expansion of harm
C) Removing the causes of the adverse event
D) Returning systems to owners for normal operations after the incident
Q4) Since the incident response policy is developed following strict procedures including top management approval, its existence generally is an assurance that the organization will respond satisfactorily to an information security incident
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Incident Analysis
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70335
Sample Questions
Q1) Syslog selectors are composed of
A) Information, warning
B) Facility, priority
C) Event logs, application logs
D) Syslog, logmon
Q2) In IT, BYOD stands for
A) Bring your own drink
B) Buy your own drink
C) Buy your own dress'
D) Bring your own device
Q3) The simplest way to determine when the system was last rebooted is to look at the output from
A) authlog
B) wtmp
C) last
D) utmp
Q4) Cloud storage adds complexity to the work of security administrators
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 14
Chapter 13: Policies, Standards and Guidelines
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70336
Sample Questions
Q1) It is generally advised to consolidate all policy issues into one policy document
A)True
B)False
Q2) Who or what is covered by the policy is specified in the A) Overview
B) Statement
C) Enforcement
D) Scope
Q3) From the perspective of information security, the Family Educational Rights and Privacy FERPA act defines
A) Requirements for financial institutions to protect the privacy of their customers' non-public, personal information
B) Protections for the privacy of student education records
C) The responsibilities of top executives of publicly traded companies for the accuracy and timeliness of financial data
D) Safeguards that covered entities must use to protect the confidentiality, integrity and availability of electronic protected health information
To view all questions and flashcards with answers, click on the resource link above. Page 15
Chapter 14: It Risk Analysis and Risk Management
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70337
Sample Questions
Q1) Section 404 of the Sarbanes-Oxley act of 2002 specifies that
A) The signing officer has reviewed financial statements
B) Penalties for non-compliance with the law
C) Privacy requirements for healthcare records have been followed
D) Attestations are made in accordance with PCAOB standards
Q2) The management model that guides the ISO risk management methodology is
A) Toyota's Muda, Kaizen, Jidoka, Muri
B) Juran's planning, control, improvement
C) Shewart's mean, range, standard error
D) Deming's Plan-Do-Check-Act
Q3) The NIST risk management framework includes
A) Profits, losses
B) Agent, action, asset
C) Assets, threats, vulnerabilities, controls
D) Frame, assess, monitor, respond
Q4) The verification of IT general controls as part of a SOX audit follows a
A) Top-down procedure
B) Bottom-up procedure
C) Either of the above, depending upon the organization
D) Both the above, to ensure comprehensive coverage
Page 16
To view all questions and flashcards with answers, click on the resource link above.