Risk Management in Information Security Test Questions
Course Introduction
Risk Management in Information Security explores the principles and practices of identifying, assessing, and mitigating risks related to information assets within organizations. The course examines frameworks and standards such as ISO/IEC 27005, NIST, and FAIR, emphasizing the importance of risk analysis, evaluation, and treatment in creating robust security strategies. Students learn how to assess threats, vulnerabilities, and potential impacts, as well as how to implement controls that balance security needs with organizational objectives. Through case studies and practical exercises, the course prepares students to make informed decisions and design effective risk management processes that align with regulatory requirements and business goals.
Recommended Textbook
Management of Information Security 3rd Edition by Michael E. Whitman
Available Study Resources on Quizplus
12 Chapters
1438 Verified Questions
1438 Flashcards
Source URL: https://quizplus.com/study-set/2354 Page 2
Chapter 1: Introduction to the Management of Information Security
Available Study Resources on Quizplus for this Chatper
139 Verified Questions
139 Flashcards
Source URL: https://quizplus.com/quiz/46799
Sample Questions
Q1) ____________________ are the operations conducted within InfoSec,which are specifically managed as separate entities.
Answer: Programs
Q2) Which of the following is NOT a step in the problem-solving process?
A) Select, implement and evaluate a solution
B) Analyze and compare possible solutions
C) Build support among management for the candidate solution
D) Gather facts and make assumptions
Answer: C
Q3) ____________________ occurs when the quantity or quality of project deliverables is expanded from the original project plan.
Answer: Scope creep
Q4) The Gantt chart lists ____ on its vertical axis and provides a simple time line on the horizontal axis.
A) resources
B) time
C) activities
D) None of these
Answer: C
Page 3
To view all questions and flashcards with answers, click on the resource link above.
Chapter 2: Planning for Security
Available Study Resources on Quizplus for this Chatper
123 Verified Questions
123 Flashcards
Source URL: https://quizplus.com/quiz/46800
Sample Questions
Q1) According to the IGTI,Boards of directors should supervise strategic information security objectives by all but which of the following?
A) Inculcating a culture that recognizes the criticality of information and information security to the organization
B) Verifying that management's investment in information security is properly aligned with organizational budgets and the organization's financial environment
C) Assuring that a comprehensive information security program is developed and implemented
D) Demanding reports from the various layers of management on the information security program's effectiveness and adequacy
Answer: B
Q2) The long-term direction taken by the organization is based on ____ planning.
A) strategic
B) tactical
C) operational
D) managerial
Answer: A
To view all questions and flashcards with answers, click on the resource link above.
Page 4
Chapter 3: Planning for Contingencies
Available Study Resources on Quizplus for this Chatper
114 Verified Questions
114 Flashcards
Source URL: https://quizplus.com/quiz/46801
Sample Questions
Q1) In a ____ activation,a single person calls all the people on the roster.
A) sequential
B) linear
C) random
D) hierarchical
Answer: A
Q2) The \(\text {\underline{ disaster recovery} }\) team is responsible for detecting,evaluating,and responding to disasters,and reestablishing operations at the primary business site._________________________
A)True
B)False
Answer: True
Q3) A sequential system of activating an alert roster is more accurate than a hierarchical system.
A)True
B)False
Answer: True
To view all questions and flashcards with answers, click on the resource link above.
Page 5
Chapter 4: Information Security Policy
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46802
Sample Questions
Q1) An automated policy management system is able to assess readers' understanding of the policy and electronically record reader acknowledgments.
A)True
B)False
Q2) In order to avoid reprisal or retaliation against employees,reporting of violations of policy should be set up to be ____________________ .
Q3) The Flesch-Kincaid Grade Level score evaluates writing on a U.S.grade-school level. A)True
B)False
Q4) A(n)<u>issue-specific</u> security policy sets the strategic direction,scope,and tone for all of an organization's security efforts._________________________ A)True B)False
Q5) Policies should be published without a date of origin. A)True B)False
Q6) List and briefly describe the major components of the ISSP.
To view all questions and flashcards with answers, click on the resource link above.
Page 6
Chapter 5: Developing the Security Program
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46803
Sample Questions
Q1) An organization's information security Web site should be placed on the <u>Internet</u>._________________________
A)True
B)False
Q2) A SETA program consists of three elements: security education,security training,and ____.
A) security accountability
B) security authentication
C) security awareness
D) security authorization
Q3) A ____ program keeps information security at the forefront of users' minds on a daily basis.
A) security accountability
B) security education
C) security training
D) security awareness
Q4) <u>Managers</u> often resist organized training of any kind._________________________
A)True
B)False
Page 7
To view all questions and flashcards with answers, click on the resource link above.
Chapter 6: Security Management Models
Available Study Resources on Quizplus for this Chatper
120 Verified Questions
120 Flashcards
Source URL: https://quizplus.com/quiz/46804
Sample Questions
Q1) <u>Need to know</u> limits a user's access to the specific information required to perform the currently assigned task,and not merely to the category of data required for a general work function._________________________
A)True
B)False
Q2) A convenience store safe that can only be opened during store hours is an example of the ____________________ isolation access control.
Q3) COBIT is an IT development framework and supporting toolset that allows managers to bridge the gap between control requirements,technical issues,and design specifications.
A)True
B)False
Q4) ____________________ access controls are required and is structured and coordinated within a data classification scheme that rates each collection of information as well as each user.
Q5) ISO/IEC 27001's primary purpose is to enable organizations that adopt it to obtain ____________________,and thus the standard makes a better assessment tool than an implementation framework.
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Security Management Practices
Available Study Resources on Quizplus for this Chatper
114 Verified Questions
114 Flashcards
Source URL: https://quizplus.com/quiz/46805
Sample Questions
Q1) One of the most popular references for developing process improvement and performance measures is the ____ model from the Software Engineering Institute at Carnegie Mellon University.
A) Creative Measures & Management Implementation
B) California Metropolitan Management International
C) InfoSec Process and Performance Measures
D) none of these
Q2) The last phase in the NIST performance measures implementation process is to apply ____________________ actions; close the gap by implementing the recommended corrective actions in the security program or in the security controls.
Q3) Organizations strive to deliver the most value with a given level of investment-this is called the value proposition.
A)True
B)False
Q4) NIST recommends the documentation of each performance measure in a customized format to ensure repeatability of measures development,tailoring,collection,and reporting activities.
A)True B)False
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: Risk Management: Identifying and Assessing Risk
Available Study Resources on Quizplus for this Chatper
78 Verified Questions
78 Flashcards
Source URL: https://quizplus.com/quiz/46806
Sample Questions
Q1) Piracy and copyright infringement are examples of the threat of compromise to ____________________ property.
Q2) The ultimate goal of risk identification is to assess the circumstances and setting of each information asset to reveal any<u> threats</u>._________________________
A)True
B)False
Q3) The last stage in the risk identification process is to document the organization's ____________________.
Q4) When determining the relative importance of each information asset,refer to the organization's ____ or statement of objectives.From this source,determine which assets are essential for meeting the organization's objectives,which assets support the objectives,and which are merely adjuncts.
A) mission statement
B) security plan
C) values statement
D) security policy
Q5) The standard IT system components include: people,data,networks,hardware,software,and ____________________.
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 9: Risk Management: Controlling Risk
Available Study Resources on Quizplus for this Chatper
105 Verified Questions
105 Flashcards
Source URL: https://quizplus.com/quiz/46807
Sample Questions
Q1) Which of the following is NOT an alternative to cost-benefit analyses?
A) Benchmarking
B) Due care/due diligence
C) Baselining
D) ISO 17799 based controls
Q2) Cost Benefit Analysis is determined by calculating the<u> single</u> loss expectancy before new controls minus the annualized loss expectancy after controls are implemented minus the annualized cost of the safeguard._________________________
A)True
B)False
Q3) The ____________________ technique is process in which a group ranks a set of information.
Q4) Communicating new or revised policy to employees is adequate to assure compliance.
A)True
B)False
Q5) The effectiveness of controls should be ____________________ and measured regularly once a control strategy has been selected.
Q6) What is a cost/benefit analysis and how is it calculated?
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 10: Protection Mechanisms
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46808
Sample Questions
Q1) It is advisable to deny all<u> ICMP </u>data in order to limit the number of attacks to a network as the protocol is a common method for hacker reconnaissance and can be used for snooping._________________________
A)True
B)False
Q2) In cryptology,an original message is in a ____ form.
A) cipheranalysis
B) ciphergraphic
C) plaintext
D) ciphertext
Q3) To prevent illegal zone transfers,Telnet access to the organization's ____________________ server should be blocked.
Q4) ____ is a popular extension to the TCP/IP protocol suite and provides security for remote access connections over public networks by creating a secure and persistent connection.
A) Secure Electronic Transactions
B) Secure Sockets Layer
C) IP Security
D) Secure Shell
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 11: Personnel and Security
Available Study Resources on Quizplus for this Chatper
133 Verified Questions
133 Flashcards
Source URL: https://quizplus.com/quiz/46809
Sample Questions
Q1) The principle of ____________________ privilege allows employees to only have access to the information they need,and only for the period required to perform their tasks.
Q2) Which of the following is a domain of the CISSP certification?
A) Cryptography
B) Administration
C) Audit and monitoring
D) Malicious code/malware
Q3) The <u>SCP</u> credential is geared toward experienced information security managers and others who may have information security management responsibilities,and includes areas of information security governance.________________________________________
A)True
B)False
Q4) Which of the following job titles with information security elements is part of the IT community of interest?
A) Access control system administrator
B) Local InfoSec coordinator
C) Physical asset protection specialist
D) Business analyst
Page 13
To view all questions and flashcards with answers, click on the resource link above.
Chapter 12: Law and Ethics
Available Study Resources on Quizplus for this Chatper
113 Verified Questions
113 Flashcards
Source URL: https://quizplus.com/quiz/46810
Sample Questions
Q1) If an individual wishes to request information from a federal agency,the agency must provide that information (unless doing so is a breach of law or national security)under which Act?
A) FOIA
B) EEA
C) ECPA
D) GLBA
Q2) The Freedom of Information Act of 1966 does not create a right of access to records held by Congress,the courts,or by state or local government agencies.
A)True
B)False
Q3) Due ____________________ requires that an organization make sufficient and ongoing efforts to protect others.
Q4) The Health Insurance Portability & Accountability Act of 1996 has five essential privacy principles focusing on the protection of personal <u>identity </u>information._________________________
A)True
B)False
Q5) Briefly describe five different types of laws.
To view all questions and flashcards with answers, click on the resource link above. Page 14