IT Security Management
Pre-Test Questions
Course Introduction
IT Security Management explores the principles, practices, and tools necessary to protect an organization's information assets from threats and vulnerabilities. The course covers risk assessment, policy development, incident response, and strategies for ensuring compliance with relevant legal and regulatory requirements. Students will learn to develop comprehensive security plans, manage security operations, and implement effective governance frameworks to safeguard data. Emphasis is placed on real-world challenges in contemporary IT environments, including emerging threats, employee awareness, and the role of leadership in fostering a security-conscious culture.
Recommended Textbook
Principles of Information Security 5th Edition by Michael E. Whitman
Available Study Resources on Quizplus
12 Chapters
696 Verified Questions
696 Flashcards
Source URL: https://quizplus.com/study-set/2374
Page 2
Chapter 1: Introduction to the Management of Information Security
Available Study Resources on Quizplus for this Chatper
63 Verified Questions
63 Flashcards
Source URL: https://quizplus.com/quiz/47110
Sample Questions
Q1) A short-term interruption in electrical power availability is known as a ____.
A) fault
B) brownout
C) blackout
D) lag
Answer: A
Q2) Web hosting services are usually arranged with an agreement defining minimum service levels known as a(n)____.
A) SSL
B) SLA
C) MSL
D) MIN
Answer: B
Q3) The<U> macro</U> virus infects the key operating system files located in a computer's start up sector._________________________
A)True
B)False
Answer: False
Q4) A momentary low voltage is called a(n)____________________.
Answer: sag
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: Compliance: Law and Ethics
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/47111
Sample Questions
Q1) The act of attempting to prevent an unwanted action by threatening punishment orretaliation on the instigator if the act takes place is known as ___________.
Answer: deterrence
Q2) defines socially acceptable behaviors
A)criminal law
B)public law
C)ethics
D)Computer Security Act (CSA)
E)Electronic Communications Privacy Act
F)Cybersecurity Act
G)normative ethics
H)applied ethics
Answer: C
Q3) An organization increases its _____________ if it refuses to take measures-due care-to make sure that every employee knows what is acceptable and what is not,and the consequences of illegal or unethical actions.
Answer: liability
To view all questions and flashcards with answers, click on the resource link above.
4
Chapter 3: Governance and Strategic Planning for Security
Available Study Resources on Quizplus for this Chatper
52 Verified Questions
52 Flashcards
Source URL: https://quizplus.com/quiz/47112
Sample Questions
Q1) In which phase of the SecSDLC does the risk management task occur?
A) physical design
B) implementation
C) investigation
D) analysis
Answer: D
Q2) Which of these is a systems development approach that incorporates teams ofrepresentatives from multiple constituencies,including users,management,and IT,each with avested interest in the project's success?
A) software engineering
B) joint application design
C) sequence-driven policies
D) event-driven procedures
Answer: B
Q3) Describe the key approaches organizations are using to achieve unified Enterprise Risk Management.
Answer: Combining physical security and InfoSec under one leader as one business function Using separate business functions that report to a common senior executive
Using a risk council approach to provide a collaborative approach to risk management
To view all questions and flashcards with answers, click on the resource link above.
Page 5
Chapter 4: Information Security Policy
Available Study Resources on Quizplus for this Chatper
56 Verified Questions
56 Flashcards
Source URL: https://quizplus.com/quiz/47113
Sample Questions
Q1) Examples of actions that illustrate compliance with policies are known as <U>laws</U>.
A)True
B)False
Q2) In the bull's-eye model,the ____________________ layer is the place where threats from public networks meet the organization's networking infrastructure.
Q3) Which policy is the highest level of policy and is usually created first?
A) SysSP
B) USSP
C) ISSP
D) EISP
Q4) ____________________ include the user access lists,matrices,and capability tables that govern the rights and privileges of users.
Q5) Non mandatory recommendations that the employee may use as a reference incomplying with a policy.are known as<U> regulations</U>.____________
A)True
B)False
Q6) How should a policy administrator facilitate policy reviews?
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Developing the Security Program
Available Study Resources on Quizplus for this Chatper
55 Verified Questions
55 Flashcards
Source URL: https://quizplus.com/quiz/47114
Sample Questions
Q1) Legal assessment for the implementation of the information security program is almost always done by the information security or IT departments.
A)True
B)False
Q2) Which of the following is an advantage of the user support group form of training?
A) Usually conducted in an informal social setting
B) Formal training plan
C) Can be live, or can be archived and viewed at the trainee's convenience
D) Can be customized to the needs of the trainee
Q3) What are the components of the security program element described as preparing for contingencies and disasters?
Q4) Which of the following is true about a company's InfoSec awareness Web site?
A) it should contain large images to maintain interest
B) appearance doesn't matter if the information is there
C) it should be placed on the Internet for public use
D) it should be tested with multiple browsers
Q5) What is the role of help desk personnel in the InfoSec team?
Q6) What minimum attributes for project tasks does the WBS document?
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Risk Management: Identifying and Assessing Risk
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47115
Sample Questions
Q1) The probability that a specific vulnerability within an organization will be the targetof an attack is known as <U>risk</U>.____________
A)True
B)False
Q2) An evaluation of the dangers to information assets,including adetermination of their potential to endanger the organization.
A)risk management
B)risk analysis
C)classification categories
D)risk identification
E)field change order
F)threat assessment
G)risk appetite
H)qualitative assessment
I)residual risk
J)ranked vulnerability risk worksheet
Q3) Risk ____________ is the process of discovering and assessing the risks to an organization's operations and determining how those risks can be mitigated.
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Risk Management: Controlling Risk
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47116
Sample Questions
Q1) In which technique does a group rate or rank a set of information,compile the results and repeat until everyone is satisfied with the result?
A) OCTAVE
B) FAIR
C) Hybrid Measures
D) Delphi
Q2) The NIST risk management approach includes all but which of the following elements?
A) inform
B) assess
C) frame
D) respond
Q3) The risk control strategy that eliminates all risk associated with an information asset by removing it from service is known as the <U>termination</U> risk control strategy.
A)True
B)False
Q4) Describe operational feasibility.
Q5) Explain two practical guidelines to follow in risk control strategy selection.
Q6) What are the four stages of a basic FAIR analysis?
Page 9
To view all questions and flashcards with answers, click on the resource link above.
Chapter 8: Security Management Models
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47117
Sample Questions
Q1) One approach used to categorize access control methodologies categorizes controls based on their operational impact on the organization.What are these categories as described by NIST?
Q2) Which access control principle specifies that no unnecessary access to data exists by regulating members so they can perform only the minimum data manipulation necessary?
A) need-to-know
B) eyes only
C) least privilege
D) separation of duties
Q3) In information security,a specification of a model to be followed during the design,selection,and initial and ongoing implementation of all subsequent security controls is known as a<U> blueprint</U>.____________
A)True
B)False
Q4) What are the two primary access modes of the Bell-LaPadula model and what do they restrict?
Q5) ISO/IEC 27001 provides implementation detailson how to implement ISO/IEC 27002 and how to set up a(n)____________________.
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 9: Security Management Practices
Available Study Resources on Quizplus for this Chatper
59 Verified Questions
59 Flashcards
Source URL: https://quizplus.com/quiz/47118
Sample Questions
Q1) Why must you do more than simply list the InfoSec measurements collected when reporting them?Explain.
Q2) Astandard of due<U> process </U>is a legal standard that requires an organization and its employees to actas a "reasonable and prudent" individual or organization would under similar circumstances.____________
A)True
B)False
Q3) Which of the following is NOT a consideration when selecting recommended best practices?
A) Threat environment is similar
B) Resource expenditures are practical
C) Organization structure is similar
D) Same certification and accreditation agency or standard
Q4) In security management,which of the following is issued by a management official and serves as a means of assuring that systems are of adequate quality?
A) Accreditation
B) Certification
C) Performance measurement
D) Testimonial
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 10: Planning for Contingencies
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47119
Sample Questions
Q1) Which of the following has the main goal of restoring normal modes of operation with minimal cost and disruption to normal business activities after an adverse event?
A) Risk management
B) Contingency planning
C) Business response
D) Disaster readiness
Q2) In the event of an incident or disaster,which planning element is used to guide off-site operations?
A) Project management
B) Business continuity
C) Disaster recovery
D) Incident response
Q3) When performing simlation testing,normal operations of the business are not impacted.
A)True
B)False
Q4) Discuss three of the five strategies that can be used to test contingency strategies.
Q5) What teams are involved in contingency planning and contingency operations?
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 11: Personnel and Security
Available Study Resources on Quizplus for this Chatper
60 Verified Questions
60 Flashcards
Source URL: https://quizplus.com/quiz/47120
Sample Questions
Q1) Most hiring organizations are aware of the precise value of information security certifications because these programs have been in existence for a long time.
A)True
B)False
Q2) Briefly describe the two outprocessing methods of handling employees who leave their positions at a company.
Q3) Temporary hires called contract employees - or simply contractors - should not be allowed to do what?
A) Work on the premises
B) Wander freely in and out of buildings
C) Visit the facility without specific, prior coordination
D) Compensated by the organization based on hourly rates
Q4) Which of the following is typically true about the CISO position?
A) Business managers first and technologists second
B) Accountable for the day-to-day operation of all or part of the InfoSec program
C) Frequently reports directly to the Chief Executive Officer
D) Technically qualified individual who
May configure firewalls and IDPSs
To view all questions and flashcards with answers, click on the resource link above.
13
Chapter 12: Protection Mechanisms
Available Study Resources on Quizplus for this Chatper
61 Verified Questions
61 Flashcards
Source URL: https://quizplus.com/quiz/47121
Sample Questions
Q1) Which of the following is true about firewalls and their ability to adapt in a network?
A) Firewalls can interpret human actions and make decisions outside their programming
B) Because firewalls are not programmed like a computer, they are less error prone
C) Firewalls are flexible and can adapt to new threats
D) Firewalls deal strictly with defined patterns of measured observation
Q2) Acryptographic operation that involves simply rearranging the valueswithin a block based on an established pattern.
A)VPN
B)transport mode
C)SSL
D)PKI
E)digital certificate
F)asymmetric encryption
G)Vernam cipher
H)transposition cipher
I)content filter
J)footprinting
To view all questions and flashcards with answers, click on the resource link above. Page 14