Security Policy and Governance
Chapter Exam Questions
Course Introduction
Security Policy and Governance explores the frameworks, principles, and practices essential for designing, implementing, and managing effective security policies within organizations. The course examines the interplay between security governance, risk management, and compliance, highlighting how organizations align security strategies with broader business objectives and regulatory requirements. Topics include policy formulation; roles and responsibilities; the impact of laws, standards, and ethics; strategic governance structures; and incident response planning. Students gain practical insights into creating policy documents, overseeing policy enforcement, and ensuring continuous alignment with evolving security landscapes and organizational needs.
Recommended Textbook
Computer Security Principles and Practice 2nd Edition by William Stallings
Available Study Resources on Quizplus 24 Chapters
1078 Verified Questions
1078 Flashcards
Source URL: https://quizplus.com/study-set/3971
Page 2
Chapter 1: Computer Systems Overview
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79799
Sample Questions
Q1) A threat action in which sensitive data are directly released to an unauthorized entity is __________.
A)corruption
B)intrusion
C)disruption
D)exposure
Answer: D
Q2) A(n)_________ is a threat that is carried out and,if successful,leads to an undesirable violation of security,or threat consequence.
Answer: attack
Q3) Hardware is the most vulnerable to attack and the least susceptible to automated controls.
A)True
B)False
Answer: True
Q4) Confidentiality,Integrity,and Availability form what is often referred to as the _____.
Answer: CIA triad
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: Cryptographic Tools
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79788
Sample Questions
Q1) The purpose of the __________ algorithm is to enable two users to securely reach agreement about a shared secret that can be used as a secret key for subsequent symmetric encryption of messages.
Answer: Diffie-Hellman Key Agreement
Q2) A __________ attack exploits the characteristics of the algorithm to attempt to deduce a specific plaintext or to deduce the key being used.
Answer: cryptanalytic
Q3) The __________ algorithm takes the ciphertext and the secret key and produces the original plaintext.
Answer: decryption
Q4) On average,__________ of all possible keys must be tried in order to achieve success with a brute-force attack.
A)one-fourth
B)half
C)two-thirds
D)three-fourths
Answer: B
Q5) Public-key encryption was first publicly proposed by __________ in 1976.
Answer: Diffie and Hellman
To view all questions and flashcards with answers, click on the resource link above. Page 4
Chapter 3: User Authentication
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/79782
Sample Questions
Q1) In a biometric scheme some physical characteristic of the individual is mapped into a digital representation.
A)True
B)False
Answer: True
Q2) User authentication is the fundamental building block and the primary line of defense.
A)True
B)False
Answer: True
Q3) A __________ strategy is one in which the system periodically runs its own password cracker to find guessable passwords.
A)user education
B)reactive password checking
C)proactive password checking
D)computer-generated password
Answer: B
Q4) The __________ is the pattern formed by veins beneath the retinal surface. Answer: retinal pattern
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Access Control
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79781
Sample Questions
Q1) Security labels indicate which system entities are eligible to access certain resources.
A)True
B)False
Q2) A __________ is a mapping between a user and an activated subset of the set of roles to which the user is assigned.
Q3) _________ specifications limit the availability of the permissions by placing constraints on the roles that can be activated within or across a user's sessions.
A)PSD
B)DSD
C)SSD
D)SDS ¸
Q4) __________ implements a security policy that specifies who or what may have access to each specific system resource and the type of access that is permitted in each instance.
A)Audit control
B)Resource control
C)System control
D)Access control
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Database Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79780
Sample Questions
Q1) The _________ model provides a predefined environment for the cloud subscriber that is shared with other tenants,typically through tagging data with a subscriber identifier.
Q2) To create a relationship between two tables,the attributes that define the primary key in one table must appear as attributes in another table,where they are referred to as a foreign key.
A)True
B)False
Q3) A _________ is the result of a query that returns selected rows and columns from one or more tables.
Q4) _________ is a model for enabling ubiquitous,convenient,on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort or service provider interaction.
Q5) The __________ is a human entity that presents requests (queries)to the system.
Q6) Random-sample query is a simple output perturbation technique.
A)True
B)False
Q7) In a relational database columns are referred to as _________.
Page 7
To view all questions and flashcards with answers, click on the resource link above.
Chapter 6: Malicious Software
Available Study Resources on Quizplus for this Chatper
44 Verified Questions
44 Flashcards
Source URL: https://quizplus.com/quiz/79779
Sample Questions
Q1) Packet sniffers are mostly used to retrieve sensitive information like usernames and passwords.
A)True
B)False
Q2) The __________ is what the virus "does".
A)infection mechanism
B)trigger
C)logic bomb
D)payload
Q3) A __________ uses multiple methods of infection or propagation to maximize the speed of contagion and the severity of the attack.
Q4) A __________ attack is a bot attack on a computer system or network that causes a loss of service to users.
A)spam
B)phishing
C)DDoS
D)sniff
Q5) A macro virus infects executable portions of code.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Denial-Of-Service Attacks
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79778
Sample Questions
Q1) The attacker needs access to a high-volume network connection for a SYN spoof attack.
A)True
B)False
Q2) Requests and _______ are the two different types of SIP messages.
Q3) ______ relates to the capacity of the network links connecting a server to the wider Internet.
A)Application resource
B)Network bandwidth
C)System payload
D)Directed broadcast
Q4) In a _______ attack the attacker creates a series of DNS requests containing the spoofed source address for the target system.
A)SYN flood
B)DNS amplification
C)poison packet
D)UDP flood
Q5) There is very little that can be done to prevent a flash crowd.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: Intrusion Detection
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79777
Sample Questions
Q1) Signature-based approaches attempt to define normal,or expected, behavior,whereas anomaly approaches attempt to define proper behavior.
A)True
B)False
Q2) ________ are decoy systems that are designed to lure a potential attacker away from critical systems.
Q3) __________ involves an attempt to define a set of rules or attack patterns that can be used to decide if a given behavior is that of an intruder.
A)Profile based detection
B)Signature detection
C)Threshold detection
D)Anomaly detection
Q4) A common location for a NIDS sensor is just inside the external firewall.
A)True
B)False
Q5) The _________ detection approach involves defining thresholds,independent of user,for the frequency of occurrence of various events.
Q6) The three classes of intruders are masquerader,clandestine user and _________.
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 9: Firewalls and Intrusion Prevention Systems
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79776
Sample Questions
Q1) The ________ IP address is the IP address of the system that originated the IP packet.
Q2) A ___________ makes use of both signature and anomaly detection techniques to identify attacks.
Q3) _________ matching scans incoming packets for specific byte sequences (the signature)stored in a database of known attacks.
Q4) The primary role of the personal firewall is to deny unauthorized remote access to the computer.
A)True
B)False
Q5) An intruder transmitting packets from the outside with a source IP address field containing an address of an internal host is known as IP address _________.
Q6) A single device that integrates a variety of approaches to dealing with network-based attacks is referred to as a __________ system.
Q7) An important aspect of a distributed firewall configuration is security monitoring.
A)True
B)False
11
To view all questions and flashcards with answers, click on the resource link above.
Chapter 10: Buffer Overflow
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79798
Sample Questions
Q1) The x86 Assembly Language Instruction NOP means _______.
A)no operation or do nothing instruction
B)call function at addr
C)software interrupt to access operating system function
D)no push value onto the stack
Q2) In 1996 ________ published "Smashing the Stack for Fun and Profit" in Phrack magazine,giving a step-by-step introduction to exploiting stack-based buffer overflow vulnerabilities.
Q3) Memory is requested from the ______ by programs for use in dynamic data structures,such as linked lists of records.
A)shell
B)heap
C)address space
D)ROM
Q4) _______ defenses aim to detect and abort attacking existing programs.
Q5) The responsibility is placed on the assembly language programmer to ensure that the correct interpretation is placed on any saved data value.
A)True
B)False
Q6) ______ defenses aim to harden programs to resist attacks in new programs.
Page 12
To view all questions and flashcards with answers, click on the resource link above.
Chapter 11: Software Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79797
Sample Questions
Q1) Software security is closely related to software quality and reliability.
A)True
B)False
Q2) Incorrect handling of program _______ is one of the most common failings in software security.
A)lines
B)input
C)output
D)disciplines
Q3) Security flaws occur as a consequence of sufficient checking and validation of data and error codes in programs.
A)True
B)False
Q4) In the ________ attack the user supplied input is used to construct a SQL request to retrieve information from a database.
Q5) The principle of ________ strongly suggests that programs should execute with the least amount of privileges needed to complete their function.
Q6) "Failure to Preserve SQL Query Structure" is in the __________ CWE/SANS software error category.
Page 13
To view all questions and flashcards with answers, click on the resource link above.
Chapter 12: Operating System Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79796
Sample Questions
Q1) __________ applications is a control that limits the programs that can execute on the system to just those in an explicit list.
A)Virtualizing
B)White listing
C)Logging
D)Patching
Q2) Unix and Linux systems grant access permissions for each resource using the ______ command.
Q3) ______ virtualization systems are typically seen in servers,with the goal of improving the execution efficiency of the hardware.
Q4) The following steps should be used to secure an operating system:
A)test the security of the basic operating system
B)remove unnecessary services
C)install and patch the operating system
D)all of the above
Q5) A malicious driver can potentially bypass many security controls to install malware.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 14
Chapter 13: Trusted Computing and Multilevel Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79795
Sample Questions
Q1) The ________ access mode allows the subject only write access to the object.
A)read
B)append
C)write
D)execute
Q2) The BLP model effectively breaks down when (untrusted)low classified executable data are allowed to be executed by a high clearance (trusted) subject.
A)True
B)False
Q3) The Biba models deals with confidentiality and is concerned with unauthorized disclosure of information.
A)True
B)False
Q4) The ________ control the manner by which a subject may access an object.
A)security classes
B)security classifications
C)security clearances
D)security properties
Q5) An object is said to have a security ________ of a given level.
To view all questions and flashcards with answers, click on the resource link above. Page 15
Chapter 14: It Security Management and Risk Assessment
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79794
Sample Questions
Q1) _________ is choosing to accept a risk level greater than normal for business reasons.
A)Risk avoidance
B)Reducing likelihood
C)Risk transfer
D)Risk acceptance
Q2) The _________ provides the most accurate evaluation of an organization's IT system's security risks.
Q3) The purpose of ________ is to determine the basic parameters within which the risk assessment will be conducted and then to identify the assets to be examined.
A)establishing the context
B)control
C)risk avoidance
D)combining
Q4) The assignment of responsibilities relating to the management of IT security and the organizational infrastructure is not addressed in a corporate security policy.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 16
Chapter 15: It Security Controls, plans, and Procedures
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79793
Sample Questions
Q1) Controls can be classified as belonging to one of the following classes: management controls,__________,and technical controls.
Q2) _________ controls focus on preventing security beaches from occurring by inhibiting attempts to violate security policies or exploit a vulnerability.
Q3) The objective of the ________ control category is to counteract interruptions to business activities and to protect critical business processes from the effects of major failures of information systems or disasters and to ensure their timely resumption.
A)asset management
B)business continuity management
C)information security incident management
D)physical and environmental security
Q4) _______ management is concerned with specifically keeping track of the configuration of each system in use and the changes made to each.
Q5) The recommended controls need to be compatible with the organization's systems and policies.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above.
17
Chapter 16: Physical and Infrastructure Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79792
Sample Questions
Q1) An _______ condition occurs when the IS equipment receives less voltage than is required for normal operation.
Q2) The _______ authentication has an attendant supervise the use of the PIV card and the submission of the PIN and the sample biometric by the cardholder.
Q3) An area of a facility that has no security interest is classified as _________.
A)unrestricted
B)controlled
C)limited
D)exclusion
Q4) Noise along a power supply line,motors,fans,heavy equipment,microwave relay antennas,and other computers are all sources of _________.
Q5) ________ includes data processing and storage equipment,transmission and networking facilities,and offline storage media.
A)Supporting facilities
B)Physical facilities
C)Information system hardware
D)Infrastructure facilities
Q6) The most essential element of recovery from physical security breaches is ____.
To view all questions and flashcards with answers, click on the resource link above. Page 18
Chapter 17: Human Resources Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79791
Sample Questions
Q1) Any action that threatens one or more of the classic security services of confidentiality,integrity,availability,accountability,authenticity,and reliability in a system constitutes a(n)________.
Q2) ________ lists the following security objective with respect to current employees: to ensure that employees,contractors,and third-party users are aware of information security threats and concerns and their responsibilities and liabilities with regard to information security and are equipped to support organizational security policy in the course of their normal work and to reduce the risk of human error.
Q3) Security education is most often taught by outside sources.
A)True B)False
Q4) Awareness only communicates information security policies and procedures that need to be followed and does not provide the foundation for any sanctions or disciplinary actions imposed for noncompliance.
A)True B)False
Q5) A _______ is a characteristic of a piece of technology that can be exploited to perpetrate a security incident.
To view all questions and flashcards with answers, click on the resource link above.
Page 19
Chapter 18: Security Auditing
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79790
Sample Questions
Q1) ______ is UNIX's general-purpose logging mechanism found on all UNIX variants and Linux.
Q2) Messages in the BSD syslog format consist of three parts: PRI,Header,and ___.
Q3) Windows is equipped with three types of event logs: system event log,security event log,and ________ event log.
Q4) Security auditing can:
A)provide data that can be used to define anomalous behavior
B)maintain a record useful in computer forensics
C)generate data that can be used in after-the-fact analysis of an attack D)all of the above
Q5) The first order of business in security audit trail design is the selection of data items to capture.
A)True
B)False
Q6) ______ software is a centralized logging software package similar to,but much more complex than,syslog.
A)NetScan
B)McAfee
C)IPConfig
D)SIEM
Page 20
To view all questions and flashcards with answers, click on the resource link above.
Chapter 19: Legal and Ethical Aspects
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79789
Sample Questions
Q1) The copyright owner has which exclusive right(s)?
A)reproduction right
B)distribution right
C)modification right
D)all of the above
Q2) ________ rights may be used to prevent others from using a confusingly similar mark,but not to prevent others from making the same goods or from selling the same goods or services under a clearly different mark.
Q3) The invasion of the rights secured by patents,copyrights,and trademarks is ________.
Q4) The relative lack of success in bringing cybercriminals to justice has led to an increase in their numbers,boldness,and the global scale of their operations.
A)True
B)False
Q5) A(n)_________ may be granted to anyone who invents or discovers any new and useful process,machine,article of manufacture,or composition of matter,or any new and useful improvement thereof.
Q6) The three types of patents are: utility patents,design patents,and ________.
To view all questions and flashcards with answers, click on the resource link above. Page 21
Chapter 20: Symmetric Encryption and Message
Confidentiality
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79787
Sample Questions
Q1) The most widely used encryption scheme is based on the _________ adopted in 1977 by the National Bureau of Standards.
A)AES
B)3DES
C)CES
D)DES
Q2) "The input to the encryption algorithm is the XOR of the next 64 bits of plaintext and the preceding 64 bits of ciphertext" is a description of the ________ mode of operation.
Q3) The _________ is the encryption algorithm run in reverse.
A)decryption algorithm
B)ciphertext
C)plaintext
D)secret key
Q4) The _________ was issued as a federal information-processing standard and is intended to replace DES and 3DES with an algorithm that is more secure and efficient.
Q5) A ________ cipher processes the input one block of elements at a time,producing an output block for each input block.
To view all questions and flashcards with answers, click on the resource link above. Page 22
Chapter 21: Public-Key Cryptography and Message
Authentication
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79786
Sample Questions
Q1) The principal attraction of __________ compared to RSA is that it appears to offer equal security for a far smaller bit size,thereby reducing processing overhead.
A)ECC
B)MD5
C)Diffie-Hellman
D)none of the above
Q2) _________ are analogous to a burglar guessing a safe combination by observing how long it takes to turn the dial from number to number.
A)Digital standards
B)Mathematical attacks
C)Ciphers
D)Timing attacks
Q3) The purpose of the __________ algorithm is to enable two users to exchange a secret key securely that can then be used for subsequent encryption of messages.
Q4) Unlike RSA,DSS cannot be used for encryption or key exchange.
A)True
B)False
Q5) NIST has published FIPS PUB 186,which is known as the ___________.
To view all questions and flashcards with answers, click on the resource link above. Page 23
Chapter 22: Internet Security Protocols and Standards
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79785
Sample Questions
Q1) At its most fundamental level the Internet mail architecture consists of a user world in the form of _________.
A)MHS
B)MSA
C)MUA
D)MDA
Q2) DKIM is designed to provide an e-mail authentication technique that is transparent to the end user.
A)True
B)False
Q3) The default algorithms used for encrypting S/MIME messages are the triple DES and a public-key scheme known as _______.
Q4) An ADMD is an Internet e-mail provider.
A)True
B)False
Q5) IPsec provides two main functions: a combined authentication/encryption function called ___________ and a key exchange function.
Q6) A signed data message can only be viewed by a recipient with __________ capability.
Page 24
To view all questions and flashcards with answers, click on the resource link above.
Chapter 23: Internet Authentication Applications
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79784
Sample Questions
Q1) A full-service Kerberos environment consisting of a Kerberos server that has the user ID and password of all participating users in its database and shares a secret key with each server,all users and servers being registered with the Kerberos server,is referred to as a Kerberos ______.
Q2) ______ is the set of hardware,software,people,policies,and procedures needed to create,manage,store,distribute,and revoke digital certificates based on asymmetric cryptography.
Q3) _______ is movement of data in a business process.
A)Provisioning
B)Workflow automation
C)Revocation
D)Initialization
Q4) An obvious security risk is that of impersonation.
A)True
B)False
Q5) In a generic identity management architecture _______ are entities that obtain and employ data maintained and provided by identity and attribute providers,often to support authorization decisions and to collect audit information.
Q6) In a generic identity management architecture a ________ is an identity holder.
Page 25
To view all questions and flashcards with answers, click on the resource link above.
Chapter 24: Wireless Network Security
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/79783
Sample Questions
Q1) CRC is an error detecting code.
A)True
B)False
Q2) An extended service set (ESS)is a set of stations controlled by a single coordination function.
A)True
B)False
Q3) The principal threats to wireless transmission are disruption,_____________,and altering or inserting messages.
Q4) Like TKIP,CCMP provides two services: message integrity and ________.
Q5) A system used to interconnect a set of basic service sets and LANs to create an extended service set is a _________.
A)distribution system
B)coordination function
C)MAC data unit
D)wireless access system
Q6) The association service enables transfer of data between a station on an IEEE 802.11 LAN and a station on an integrated IEEE 802.x LAN.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 26