Deck 1: Introduction to Information Security

Question 1

By balancing information security and access, a completely secure information system can be created.

Answer 1

False

Question 2

The value of information comes from the characteristics it possesses.

Answer 2

True

Question 3

Which security project team role is filled by a senior executive who promotes the project and ensures that it is supported, both financially and administratively, at the highest levels of the organization?

A) Team leader
C) Chief information officer
B) Champion
D) Chief information security officer

Answer 3

B

Question 4

The security blueprint is a detailed version of the security framework.

Question 5

Which individual interferes with or disrupts systems to protest the operations, policies, or actions of an organization or government agency?

A) Cyberterrorist
C) Phreaker
B) Packet monkey
D) Hacktivist

Question 6

Which e-mail attack occurs when an attacker routes large quantities of e-mail to the target system?

A) Buffer overflow
C) Spam
B) Mail bomb
D) Timing attack

Question 7

Which attack is used when a copy of the hash of the user's password has been obtained?

A) Rainbow attack
C) Dictionary attack
B) Brute force attack
D) Spoofing

Question 8

An unlocked door is an example of a(n) ____.

A) vulnerability
C) risk
B) threat
D) exploit

Question 9

The McCumber Cube provides a ____ description of the architectural approach widely used in computer and information security.

A) linear
C) graphical
B) triangular
D) semantic

Question 10

In information security, ____ exists when a vulnerability known to an attacker is present.

A) threat
C) risk
B) loss
D) exposure

Question 11

One of the basic tenets of security architectures is the spheres of security.

Question 12

Which resource is a physical asset?

A) Web site
C) Data
B) Computer system
D) Information

Question 13

Which term identifies a single instance of an information asset suffering damage, unintended or unauthorized modification, or disclosure?

A) Exploit
C) Vulnerability
B) Exposure
D) Loss

Question 14

Which term describes a subject or object's ability to use, manipulate, modify, or affect another subject or object?

A) Attack
C) Exploit
B) Possession
D) Access

Question 15

The CIA triad is based on three characteristics of information that form the foundation for many security programs: ____.

A) confidentiality, integrity, and asset
B) confidentiality, integrity, and availability
C) confidentiality, information, and availability
D) communication, information, and asset

Question 16

An indirect attack involves a hacker using a personal computer to break into a system.

Question 17

A(n) ____ is an application error that occurs when more data is sent to a buffer than it can handle.

A) timing attack
C) dictionary attack
B) application control list
D) buffer overflow

Question 18

Which threat is the most common intellectual property (IP) breach?

A) Software piracy
C) Shoulder surfing
B) Spoofing
D) Password cracking

Question 19

Organizations must minimize ____ to match their risk appetite.

A) threats
C) risk
B) access
D) loss

Question 20

Which individual is considered to be a script kiddie who uses automated tools to inundate a Web site with a barrage of network traffic, usually resulting in a denial of service?

A) Cyberterrorist
C) Phreaker
B) Packet monkey
D) Hacktivist

Question 21

The ____ are the foundation of a security framework.

A) spheres of security
C) layered implementations of security
B) NIST documents
D) CIA triads

Question 22

A(n) ____ is a written statement of the organization's purpose.

A) vision
C) framework
B) strategic plan
D) mission

Question 23

Match each item with a statement below.
a.Accuracy
f.Data users
b.Authenticity
g.Integrity
c.Availability
h.Utility
d.Confidentiality
i.Data custodians
e.Data owners
End users who work with the information to perform their daily jobs supporting the mission of the organization, and who therefore share the responsibility for data security.

Question 24

Match each item with a statement below.
a.Accuracy
f.Data users
b.Authenticity
g.Integrity
c.Availability
h.Utility
d.Confidentiality
i.Data custodians
e.Data owners
A term referring to the quality or state of being genuine or original rather than a reproduction or fabrication.

Question 25

A(n) ____________________ defines the boundary between the outer limit of an organization's security and the beginning of the outside world.

Question 26

When organizations record versions of their policy in English and alternate languages, they are attempting to meet the ____ criteria to make the policy effective and legally enforceable.

A) Comprehension (understanding)
C) Review (reading)
B) Compliance (agreement)
D) Dissemination (distribution)

Question 27

Match each item with a statement below.
a.Accuracy
f.Data users
b.Authenticity
g.Integrity
c.Availability
h.Utility
d.Confidentiality
i.Data custodians
e.Data owners
People who work directly with data owners and are responsible for the storage, maintenance, and protection of the information.

Question 28

Match each item with a statement below.
a.Accuracy
f.Data users
b.Authenticity
g.Integrity
c.Availability
h.Utility
d.Confidentiality
i.Data custodians
e.Data owners
A term meaning information is free from mistakes or errors and has the value that the end user expects it to have.

Question 29

An enterprise information security policy (EISP) is also known as a(n) ____.

A) issue-specific security policy
C) systems-specific security policy
B) general security policy
D) strategic planning policy

Question 30

____________________ is the protection of information and its critical elements, including the systems and hardware that use, store, and transmit that information.

Question 31

Match each item with a statement below.
a.Accuracy
f.Data users
b.Authenticity
g.Integrity
c.Availability
h.Utility
d.Confidentiality
i.Data custodians
e.Data owners
Enables authorized users to access information without interference or obstruction, and to receive it in the required format.

Question 32

Implementing multiple types of technology and thereby preventing the failure of one system from compromising the security of information is referred to as ____________________.

Question 33

Match each item with a statement below.
a.Accuracy
f.Data users
b.Authenticity
g.Integrity
c.Availability
h.Utility
d.Confidentiality
i.Data custodians
e.Data owners
The quality or state of having value for some purpose or end.

Question 34

A(n) ____________________ is a program or device that monitors data traveling over a network.

Question 35

____________________ is a technique used to gain unauthorized access to computers, wherein the intruder sends messages whose IP addresses indicate to the recipient that the messages are coming from a trusted host.

Question 36

There are two general methods for implementing technical controls within a specific application to enforce policy: ____ and configuration rules.

A) assessment control lists
C) application control lists
B) authenticity control lists
D) access control lists

Question 37

Match each item with a statement below.
a.Accuracy
f.Data users
b.Authenticity
g.Integrity
c.Availability
h.Utility
d.Confidentiality
i.Data custodians
e.Data owners
The protection of information from disclosure or exposure to unauthorized individuals or systems.

Question 38

Match each item with a statement below.
a.Accuracy
f.Data users
b.Authenticity
g.Integrity
c.Availability
h.Utility
d.Confidentiality
i.Data custodians
e.Data owners
A term meaning information remains whole, complete, and uncorrupted.

Question 39

Match each item with a statement below.
a.Accuracy
f.Data users
b.Authenticity
g.Integrity
c.Availability
h.Utility
d.Confidentiality
i.Data custodians
e.Data owners
People responsible for the security and use of a particular set of information.

Question 40

Which security project team role is filled by individuals who understand the organizational culture, existing policies, and requirements for developing and implementing successful policies?

A) Security policy developers
C) Security professionals
B) Risk assessment specialists
D) Team leader

Question 41

Describe how benchmarking and best practices are used and where more information on best practices may be found.

Question 42

Describe the issue-specific security policy (ISSP) and list three issues it may cover.

Question 43

How does a distributed denial-of-service (DDoS) attack work and why are they so dangerous?

Question 44

Define configuration rule policies and compare them to access control lists(ACLs).

Question 45

Define social engineering and briefly describe how it is accomplished.

Question 46

List the four important organizational functions an information security program performs.

Question 47

How does a man-in-the-middle attack work?

Question 48

Discuss the layered implementation of security.

Question 49

Describe the chief information security officer (CISO) position.

Question 50

Describe the purpose of the Security Area Working Group and RFC 2196.