Security and Risk Management Exam Solutions
Course Introduction
Security and Risk Management explores the principles, frameworks, and practices used to identify, assess, and mitigate risks in organizational environments. The course covers key concepts such as threat analysis, vulnerability assessment, risk treatment strategies, and the development of effective security policies. Students will learn about the legal, ethical, and regulatory aspects of information security and risk management, as well as methods for securing physical, digital, and human assets. By examining real-world case studies and engaging in practical exercises, learners will develop the skills necessary to anticipate potential threats, implement preventive measures, and respond to security incidents, ensuring the overall resilience and integrity of organizations.
Recommended Textbook
Principles of Information Security 6th Edition by Michael E. Whitman
Available Study Resources on Quizplus
12 Chapters
1148 Verified Questions
1148 Flashcards
Source URL: https://quizplus.com/study-set/2123 Page 2
Chapter 1: Introduction to Information Security
Available Study Resources on Quizplus for this Chatper
87 Verified Questions
87 Flashcards
Source URL: https://quizplus.com/quiz/42300
Sample Questions
Q1) Using a methodology will usually have no effect on the probability of success.
A)True
B)False
Answer: False
Q2) An information system is the entire set of __________, people, procedures, and networks that enable the use of information resources in the organization.
A) software
B) hardware
C) data
D) All of the above Answer: D
Q3) The <u>Security</u> Development Life Cycle (SDLC) is a general methodology for the design and implementation of an information system.
A)True
B)False
Answer: False
Q4) Information has ____________________ when it is whole, complete, and uncorrupted.
Answer: integrity
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: The Need for Security
Available Study Resources on Quizplus for this Chatper
91 Verified Questions
91 Flashcards
Source URL: https://quizplus.com/quiz/42301
Sample Questions
Q1) A long-term interruption (outage) in electrical power availability is known as a(n)
A) blackout
B) sag
C) brownout
D) fault
Answer: A
Q2) The term <u>phreaker</u> is now commonly associated with an individual who cracks or removes software protection that is designed to prevent unauthorized duplication. _________________________
A)True
B)False
Answer: False
Q3) A virus or worm can have a payload that installs a(n) ____________________ door or trap door component in a system, which allows the attacker to access the system at will with special privileges.
Answer: back
Q4) ESD is the acronym for ____________________ discharge.
Answer: electrostatic
To view all questions and flashcards with answers, click on the resource link above. Page 4
Chapter 3: Legal, Ethical, and Professional Issues in Information Security
Available Study Resources on Quizplus for this Chatper
83 Verified Questions
83 Flashcards
Source URL: https://quizplus.com/quiz/42302
Sample Questions
Q1) __________ are the fixed moral attitudes or customs of a particular group.
Answer: Cultural mores
Q2) The __________ attempts to prevent trade secrets from being illegally shared.
A) Electronic Communications Privacy Act
B) Sarbanes-Oxley Act
C) Financial Services Modernization Act
D) Economic Espionage Act
Answer: D
Q3) Which of the following acts is also widely known as the Gramm-Leach-Bliley Act
A) Financial Services Modernization Act
B) Communications Act
C) Computer Security Act
D) Health Insurance Portability and Accountability Act
Answer: A
Q4) Criminal laws address activities and conduct harmful to society and is categorized as private or public.
A)True
B)False
Answer: True
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Planning for Security
Available Study Resources on Quizplus for this Chatper
109 Verified Questions
109 Flashcards
Source URL: https://quizplus.com/quiz/42303
Sample Questions
Q1) <u>Evidence</u> is the physical object or documented information that proves an action occurred or identifies the intent of a perpetrator.
A)True
B)False
Q2) The goals of information security governance include all but which of the following
A) Regulatory compliance by using information security knowledge and infrastructure to support minimum standards of due care
B) Strategic alignment of information security with business strategy to support organizational objectives
C) Risk management by executing appropriate measures to manage and mitigate threats to information resources
D) Performance measurement by measuring, monitoring, and reporting information security governance metrics to ensure that organizational objectives are achieved
Q3) The transfer of live transactions in real time to an off-site facility is called
Q4) RAID Level 1 is commonly called disk ____________________.
To view all questions and flashcards with answers, click on the resource link above.
Chapter 5: Risk Management
Available Study Resources on Quizplus for this Chatper
108 Verified Questions
108 Flashcards
Source URL: https://quizplus.com/quiz/42304
Sample Questions
Q1) ____________________ is the process of comparing other organizations' activities against the practices used in one's own organization to produce results it would like to duplicate.
Q2) The ____________________ control strategy attempts to reduce the impact caused by the exploitation of vulnerability through planning and preparation.
Q3) One of the first components of risk identification is identification, inventory, and categorization of assets, including all elements, or attributes, of an organization's information system. List and describe these asset attributes.
Q4) The calculation of the likelihood of an attack coupled with the attack frequency to determine the expected number of losses within a specified time range is called the
A) loss frequency
B) annualized loss expectancy
C) likelihood
D) benefit of loss
Q5) The combination of an asset's value and the percentage of the asset that might be lost in an attack is known as the loss ____________________.
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Security Technology: Access Controls, Firewalls, and VPNS
Available Study Resources on Quizplus for this Chatper
106 Verified Questions
106 Flashcards
Source URL: https://quizplus.com/quiz/42305
Sample Questions
Q1) Some firewalls can filter packets by protocol name.
A)True
B)False
Q2) Discretionary access control is an approach whereby the organization specifies use of resources based on the assignment of data classification schemes to resources and clearance levels to users.
A)True
B)False
Q3) Kerberos is based on the principle that the ____________________ knows the secret keys of all clients and servers on the network.
Q4) In SESAME, the user is first authenticated to an authentication server and receives a token. The token is then presented to a privilege attribute server as proof of identity to gain a(n) __________.
A) VPN
B) ECMA
C) ticket
D) PAC
Q5) List and describe the interacting services of the Kerberos system.
To view all questions and flashcards with answers, click on the resource link above. Page 8
Q6) The application firewall is also known as a(n) ____________________ server.
Chapter 7: Security Technology: Intrusion Detection and
Prevention Systems, and Other Security Tools
Available Study Resources on Quizplus for this Chatper
107 Verified Questions
107 Flashcards
Source URL: https://quizplus.com/quiz/42306
Sample Questions
Q1) Which of the following ports is commonly used for the HTTP protocol
A) 20
B) 25
C) 53
D) 80
Q2) Using __________, the system reviews the log files generated by servers, network devices, and even other IDPSs.
A) LFM
B) stat IDPS
C) AppIDPS
D) HIDPS
Q3) List and describe at least four reasons to acquire and use an IDPS.
Q4) Services using the TCP/IP protocol can run only on their commonly used port number as specified in their original Internet standard.
A)True
B)False
Q5) Three methods dominate IDPS detection methods: the ____________________-based approach, the statistical anomaly-based approach, and the stateful packet inspection approach.
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: Cryptography
Available Study Resources on Quizplus for this Chatper
109 Verified Questions
109 Flashcards
Source URL: https://quizplus.com/quiz/42307
Sample Questions
Q1) The most common hybrid system is based on the Diffie-Hellman key exchange, which is a method for exchanging private keys using public-key encryption.
A)True
B)False
Q2) The ____________________ cipher simply rearranges the values within a block to create the ciphertext.
Q3) ____________________ is the process of making and using codes to secure the transmission of information.
Q4) __________ are encrypted message components that can be mathematically proven to be authentic.
A) Digital signatures
B) MACs
C) Message certificates
D) Message digests
Q5) The ____________________ operation is a function of Boolean algebra in which two bits are compared, and if the two bits are identical, the result is a binary 0.
Q6) Digital ____________________ are encrypted messages that can be mathematically proven to be authentic.
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 9: Physical Security
Available Study Resources on Quizplus for this Chatper
77 Verified Questions
77 Flashcards
Source URL: https://quizplus.com/quiz/42308
Sample Questions
Q1) A __________ system is designed to work in areas where electrical equipment is used. Instead of containing water, the system contains pressurized air.
A) wet-pipe
B) dry-pipe
C) deluge
D) sprinkler
Q2) Class <u>C </u>fires are those fueled by combustible metals, such as magnesium, lithium, and sodium. _________________________
A)True
B)False
Q3) There are three methods of data interception: direct observation, interception of data transmission, and mechanical interception.
A)True
B)False
Q4) <u>Vibration</u> detectors measure rates of change in the ambient temperature of a room. _________________________
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above.
11
Chapter 10: Implementing Information Security
Available Study Resources on Quizplus for this Chatper
78 Verified Questions
78 Flashcards
Source URL: https://quizplus.com/quiz/42309
Sample Questions
Q1) If the task is to write firewall specifications for the preparation of a(n) __________, the planner would note that the deliverable is a specification document suitable for distribution to vendors.
A) WBS
B) CBA
C) SDLC
D) RFP
Q2) In general, the design phase is accomplished by changing the configuration and operation of the organization's information systems to make them more secure.
A)True
B)False
Q3) The need for qualified, trained, and available personnel constrains the project plan.
A)True
B)False
Q4) "Unfreezing" in the Lewin change model involves thawing hard-and-fast habits and established procedures.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 11: Security and Personnel
Available Study Resources on Quizplus for this Chatper
77 Verified Questions
77 Flashcards
Source URL: https://quizplus.com/quiz/42310
Sample Questions
Q1) The CISSP-ISSEP concentration focuses on the knowledge areas that are part of enterprise security management.
A)True
B)False
Q2) To maintain a secure facility, all contract employees should be escorted from room to room, as well as into and out of the facility.
A)True
B)False
Q3) "<u>Administrators</u>" provide the policies, guidelines, and standards in the Schwartz, Erwin, Weafer, and Briney classification. _________________________
A)True
B)False
Q4) The process of integrating information security perspectives into the hiring process begins with reviewing and updating all job descriptions.
A)True
B)False
Q5) What tasks must be performed when an employee prepares to leave an organization
Q6) Describe the concept of separation of duties.
Page 13
To view all questions and flashcards with answers, click on the resource link above.
Chapter 12: Information Security Maintenance
Available Study Resources on Quizplus for this Chatper
116 Verified Questions
116 Flashcards
Source URL: https://quizplus.com/quiz/42311
Sample Questions
Q1) Threats cannot be removed without requiring a repair of the vulnerability.
A)True
B)False
Q2) List the five domains of the recommended maintenance model.
Q3) An <u>affidavit</u> is used as permission to search for evidentiary material at a specified location and/or to seize items to return to an investigator's lab for examination after being signed by an approving authority. _____________
A)True
B)False
Q4) A general guideline for performance of hard drives suggests that when the amount of data stored on a particular hard drive averages 95% of available capacity for a prolonged period, you should consider an upgrade for the drive.
A)True
B)False
Q5) As each project nears , a(n) ____________________ risk assessment group reviews the impact of the project on the organization's risk profile.
Q6) Proven cases of real vulnerabilities can be considered vulnerability
To view all questions and flashcards with answers, click on the resource link above. Page 14