Security Policy and Strategy Exam Review
Course Introduction
This course explores the formulation, implementation, and evaluation of security policies and strategies at national and organizational levels. Students will examine the historical, political, economic, and social factors influencing security policy decisions, with a focus on both traditional and contemporary security challenges. The curriculum covers key concepts in strategic planning, risk assessment, policy analysis, and crisis management, equipping students with the analytical tools needed to understand and assess security strategies. Case studies, policy documents, and current events will be used to illustrate the complexities and practicalities involved in safeguarding national interests and ensuring organizational resilience in an evolving global environment.
Recommended Textbook
Information Security and IT Risk Management 1st Edition by Manish Agrawal
Available Study Resources on Quizplus
14 Chapters
349 Verified Questions
349 Flashcards
Source URL: https://quizplus.com/study-set/3541
2
Chapter 1: Introduction
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70324
Sample Questions
Q1) Information security professional do not report spending a lot of time on
A) Researching new technologies
B) Political issues
C) Developing internal security policies, standards and procedures
D) Fixing software bugs
Answer: D
Q2) The ILOVEYOU virus is important to information security for
A) Intruding into a number of high profile computer installations
B) Stealing commercial information by exploiting weakness is wireless networks
C) Exposing the implications of international differences in cyber-law
D) Popularizing computers among the masses
Answer: C
Q3) Windows 95 is important to information security for
A) Intruding into a number of high profile computer installations
B) Stealing commercial information by exploiting weakness is wireless networks
C) Causing one of the most significant Internet outages ever
D) Popularizing computers among the masses
Answer: D
To view all questions and flashcards with answers, click on the resource link above.
3
Chapter 2: System Administration
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70325
Sample Questions
Q1) The system administrator is the person responsible for
A) Day-to-day operation of a technology system
B) Writing , enforcing , and reviewing security-operating procedures
C) Developing new technology systems
D) Upgrading existing technology systems
Answer: A
Q2) Selecting one among many possible combinations of features of a system is called
A) User management
B) Access control
C) Installation
D) Configuration
Answer: D
Q3) Linux is
A) An operating system that behaves like UNIX, though it has an independent code base
B) A different brand of UNIX
C) A version of Windows
D) A database system
Answer: A
To view all questions and flashcards with answers, click on the resource link above. Page 4
Chapter 3: System Administration 2
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70326
Sample Questions
Q1) In the context of system administration, the kernel is
A) Software that manages computer hardware and provides common services to user applications
B) Software which controls hardware devices, manages memory, and hides underlying physical hardware from user applications
C) A text based program that allows users to interact with the shell
D) The graphical interface for users to interact with applications
Answer: B
Q2) Vi is a
A) Graphical editor
B) Text editor
C) Game on Linux systems
D) Substitute for MS Word
Answer: B
Q3) To view the contents of a file, we can use the command
A) less
B) more
C) cat
D) all of the above
Answer: D
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Basic Information Security Model
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70327
Sample Questions
Q1) Rootkits are
A) Software used to hide the existence of malicious software on computer systems
B) Exploits that compromise a previously unknown software vulnerability
C) Computers that perform malicious tasks at the direction of a remote controller
D) Manipulating people into performing desired actions
Q2) Zeus and Spyeye are examples of
A) Viruses
B) Vulnerabilities
C) IDEs to create new attacks
D) Systems to defend against attacks
Q3) Zombies are
A) Software used to hide the existence of malicious software on computer systems
B) Exploits that compromise a previously unknown software vulnerability
C) Computers that perform malicious tasks at the direction of a remote controller
D) Manipulating people into performing desired actions
Q4) Vulnerabilities in IT systems can be eliminated through secure coding practices
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above.
Chapter 5: Asset Identification and Characterization
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70328
Sample Questions
Q1) Restricted assets are
A) Assets whose loss would cause severe repercussions to the organization immediately
B) Importance of an asset to the immediate survival of an organization
C) The damage caused to an organization from a breach of confidentiality or integrity of an asset
D) Assets whose disclosure or alteration would have adverse consequences for the organization
Q2) In most organizations, the most important assets from the perspective of information security are
A) Hardware assets
B) Information assets
C) Software assets
D) Personnel assets
Q3) An example of a top-down approach to asset identification is
A) Reading the mission statement of the organization
B) Talking to co-workers
C) Reading on-boarding documentation
D) All of the above
To view all questions and flashcards with answers, click on the resource link above.
7
Chapter 6: Threats and Vulnerabilities
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70329
Sample Questions
Q1) Help desk staff can be a threat due to A) Abuse of privileges
B) Human errors
C) Lack of training
D) All of the above
Q2) Threat models are
A) Capabilities, intentions and attack methods of adversaries
B) Interactions between relevant agents, actions
C) Individuals, organizations or groups that originate a particular threat action
D) Activist groups
Q3) Internal auditors can be a threat agent by
A) Excessive adherence to compliance
B) Lack of attention to detail
C) Lack of training
D) Causing outages
To view all questions and flashcards with answers, click on the resource link above.
8
Chapter 7: Encryption Controls
Available Study Resources on Quizplus for this Chatper
24 Verified Questions
24 Flashcards
Source URL: https://quizplus.com/quiz/70330
Sample Questions
Q1) Digital signatures are
A) The transformation of data to produce ciphertext
B) The use of cryptography that allows a user to prove the source and integrity of data
C) Text that is unintelligible to the reader
D) A sequence of symbols that controls the operations of encipherment and decipherment
Q2) A cryptographic algorithm is
A) Symbols that controls encipherment and decipherment
B) A well-defined sequence of steps used to describe cryptographic processes
C) An encryption method that uses no keys
D) Text that is unintelligible to the reader
Q3) A certificate used in web applications contains the
A) Shared secret key prior to network transmission
B) The hash output of the data to be transmitted
C) Saved password of the end user for recovery
D) Public key of the server and information about the key provider
To view all questions and flashcards with answers, click on the resource link above.
9
Chapter 8: Identity and Access Management
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70331
Sample Questions
Q1) Access management involves
A) Locating all new and updated identities in the organization
B) Comparing each discovered identity to a master record of all individuals in the organization
C) Making decisions about granting users access to resources
D) Collecting data about each individual's relationship to the organization
Q2) Federations are useful to
A) Authenticate users within an organization
B) Determine the authorizations of users to resources
C) Bridge authentication systems in separate organizations
D) Eliminate single points of failure in IT systems
Q3) A password is
A) The process of proving that a user is the owner of the identity being used
B) A secret series of characters known only to the user
C) The use of minute differences in physical traits to prove identity
D) A protocol that allows nodes in an insecure network to securely identify themselves to each other using tokens
Q4) Kerberos has been very useful in securing corporate desktop infrastructures
A)True
B)False
Page 10
To view all questions and flashcards with answers, click on the resource link above.
Chapter 9: Hardware and Software Controls
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70332
Sample Questions
Q1) Password cracking is
A) Passwords on the system known to unauthorized users
B) Acquiring passwords from storage, network transmission or user knowledge
C) Repeated attempts to authenticate using possible passwords
D) Generating character strings to match existing passwords
Q2) Compromised passwords is/ are
A) Passwords on the system known to unauthorized users
B) Acquiring passwords from storage, network transmission or user knowledge
C) Repeated attempts to authenticate using possible passwords
D) Generating character strings to match existing passwords
Q3) End-point protection defends against attacks on A) Firewalls
B) Offices
C) Vehicles
D) Desktops
Q4) Patches should always be installed as soon as they become available
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above.
11
Chapter 10: Shell Scripting
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70333
Sample Questions
Q1) The pipe operator, which directs the output from one command to another, is
A) /
B) #
C) |
D) >
Q2) Shell scripts can obtain user input using the command
A) input
B) var
C) read
D) cat
Q3) File users.csv contains lines as: Christine:Riggs:christine.riggs@sunshine.edu. The command to extract emails from the file is
A) cut -d: -f3 users.csv
B) cut -d, -f3 users.csv
C) cut -d: -f1,2,3 users.csv
D) cut -d, -f1,2,3 users.csv
Q4) An infinite loop a loop that runs forever can sometimes be useful
A)True
B)False
Page 12
To view all questions and flashcards with answers, click on the resource link above.
Chapter 11: Incident Handling
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70334
Sample Questions
Q1) During an incident, it is advisable to pull members away from current projects to assist the IRT
A)True
B)False
Q2) Eradication is
A) Saving log files in a server container configured specially for this purpose
B) Preventing the expansion of harm
C) Removing the causes of the adverse event
D) Returning systems to owners for normal operations after the incident
Q3) The technical members of the IRT are chosen
A) By rotation from the different departments in the organization
B) From the senior-most members of the IT teams
C) Depending upon the threat action
D) From the fresh entrants in the IT teams
Q4) A disaster is
A) A calamitous event that causes great harm
B) When the dog really eats the assignment
C) A hurricane
D) Returning systems to owners for normal operations after the incident
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Incident Analysis
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70335
Sample Questions
Q1) Information about users currently logged into the system is recorded in A) authlog
B) wtmp
C) messages
D) utmp
Q2) Syslog priorities include all of the following except A) debug
B) error
C) audit
D) panic
Q3) The simplest way to determine when the system was last rebooted is to look at the output from
A) authlog
B) wtmp
C) last
D) utmp
Q4) Cloud storage adds complexity to the work of security administrators
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 14
Chapter 13: Policies, Standards and Guidelines
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70336
Sample Questions
Q1) Acceptable use policies describe
A) Procedures that tell units when it would be nice if things were operated a certain way, but it is not a requirement to do so
B) A defined set of rules, accepted and adopted by several organizations
C) Guidelines to users and customers on what is appropriate and what is not appropriate to do with information technology resources
D) A document that records a high-level principle or course of action that has been decided on
Q2) Activities, settings and measurements accepted by all firms in an industry are
A) Global policies
B) General guidelines
C) Acceptable use policies
D) Industry standards
Q3) The sections of a policy are generally written in the sequence
A) Overview, scope, definitions, statement, enforcement
B) Definitions, overview, scope, statement, enforcement
C) Overview, definitions, statement, scope, enforcement
D) Overview, enforcement, scope, definitions, statement
To view all questions and flashcards with answers, click on the resource link above.
Chapter 14: It Risk Analysis and Risk Management
Available Study Resources on Quizplus for this Chatper
25 Verified Questions
25 Flashcards
Source URL: https://quizplus.com/quiz/70337
Sample Questions
Q1) In the NIST 800-39 framework, risk response
A) Addresses how organizations respond to risks
B) Identifies and aggregates the risks facing the organization
C) Describes the environment in which risk-based decisions are made
D) Evaluates the effectiveness of the organization's risk-management plan
Q2) The NIST risk-management framework is specified in the NIST document
A) 27002
B) 404
C) 800-39
D) 27000
Q3) Section 906 of the Sarbanes-Oxley act of 2002 specifies
A) Penalties for non-compliance with the law
B) That the signing officer has reviewed financial statements
C) Privacy requirements for healthcare records have been followed
D) That attestations are made in accordance with PCAOB standards
Q4) If assessed using the NIST 800-39 framework, the risk estimate is an accurate measure of the IT risk facing the organization
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 16