Deck 6: Management

Question 1

What is the assurance that information is not disclosed by an unauthorized individual, program, or process?

A)Trust
B)Confidentiality
C)Secret Keeping
D)None of the above

Answer 1

Confidentiality

Question 2

Rachel is focusing on tools, personnel, and business processes, with the goal of security implantation meeting her organization's specific needs. What is Rachel practicing?

A)Security Management
B)Security Organizing
C)Security Governance
D)Security Navigating

Answer 2

Security Governance

Question 3

What role is usually filled by the IT or security department and is responsible for maintaining and protecting the data?

A)Data Custodian
B)Data Owner
C)Audit Committee
D)Security Administrator

Answer 3

Data Custodian

Question 4

Jeff is informing Mark that he believes there has been a security breach and wants things checked. Mark checks all security systems within the computer, completes an access audit, and checks exterior security devices, although he knows that his company has installed every security option possible. What is Mark practicing?

A)Due Care
B)Due Diligence
C)Both A and B
D)Neither A nor B

Question 5

What does Administrative Law deal with?

A)Regulatory standards that regulate performance and conduct
B)Regulatory term limits
C)Regulatory Computer Standards
D)All of the above

Question 6

What was created to protect banks from overextending themselves and becoming insolvent?

A)The Computer Fraud and Abuse Act
B)Basel II
C)Intellectual Property Act of Internet Access
D)Federal Privacy Act of 1974

Question 7

What addresses the issues involved with identify theft and credit card fraud?

A)The Computer Fraud and Abuse Act
B)Basel II
C)Payment Card Industry Data Security Standard (PCI DSS)
D)Federal Privacy Act of 1974

Question 8

What Act requires U.S. federal agencies to identify computer systems that contain sensitive information?

A)The Computer Fraud and Abuse Act
B)Basel II
C)Computer Security Act of 1987
D)Federal Privacy Act of 1974

Question 9

What was the first international treaty seeking to address computer crimes?

A)Council of Europe Convention on Cybercrime
B)NATO Treaty on Cybercrime
C)The Hague Cybercrime Treaty
D)The International Cybercrime Treaty

Question 10

Trade secret laws protect certain types of information or resources from unauthorized used or disclosure. What would not be protected under such law?

A)Soda Formula
B)Calling the sky blue
C)Computer Software
D)Laundry Process

Question 11

Copyright law protects the right of authors to control the public distribution, reproduction, display, and adaptation of his original work. What would not be protected under this law?

A)Pictorial
B)Musical
C)Pantomime
D)All of the above are protected.

Question 12

Copyright law protects the right of authors to control their work. What does trademark protect?

A)Colors
B)Symbols
C)Shapes
D)All of the Above

Question 13

Thad is applying to gain legal ownership of his invention. What is Thad applying for?

A)Trademark
B)Intellectual Property Protection
C)Patent
D)Trade Secret

Question 14

There are four categories of software licensing. Which item is not one of those categories?

A)Freeware
B)Loan-ware
C)Shareware
D)Academic

Question 15

What is the name for the primary U.S. federal antihacking statue?

A)The Computer Fraud and Abuse Act
B)The Fraud and Abuse Act for Computers
C)Intellectual Property Act of Internet Access
D)Computer Piracy Act

Question 16

What act was created to address and stop the government from acting as "Big Brother?"

A)The Computer Fraud and Abuse Act
B)Freedom of Information Act
C)Intellectual Property Act of Internet Access
D)Federal Privacy Act of 1974

Question 17

John is a hacker who is on the run. However, since he broke international laws under the most common type of law used, there is nowhere to hide. What type of law is John running from?

A)Administrative Law
B)Common Law
C)Civil Law
D)Criminal Law

Question 18

Jessica committed a crime a few months ago. She isn't as worried as others may be because she believes she is the first to ever commit this particular crime, but she is wrong and there has been precedent set. What type of law did Jessica break?

A)Tort Law
B)Common Law
C)Civil Law
D)Criminal Law

Question 19

Lulu took medicine created by XYZ Pharmaceutical that damaged her liver. Now they are being sued. What type of law will this trial be held under?

A)Civil Law
B)Common Law
C)Regulatory Law
D)Criminal Law

Question 20

XYZ Pharmaceutical is being sued because their baby aspirin was contaminated. The CEO wanted to cut corners to save money and increase his bonus. What type of law will deal with this company?

A)Civil Law
B)Common Law
C)Administrative Law
D)Criminal Law

Question 21

Ron is an executive who is being sued by an ex-employee. He is not worried, for he knows he has done everything within the regulation guidelines and has acted ethically. Who wrote the guidelines that Ron has followed?

A)Ethics Board International
B)The International Internet Associations
C)The Federal Sentencing Guidelines for Organizations
D)Corporate Ethics and Internet Organization

Question 22

Mark, the manager, must create a policy that establishes how a security program will be set up, lay out the program's goals, assign responsibility, show the strategic and tactical value of security, and outline how enforcement should be carried out. What policy is Mark creating?

A)Company Policy
B)Organizational Security Policy
C)Issue-specific Policy
D)Standard Policy

Question 23

What type of policy presents management's decisions that are more specific to the actual computers, networks, applications, and data?

A)Company Policy
B)Organizational Security Policy
C)Issue-specific Policy
D)System-specific Policy

Question 24

Management feels it needs more detailed explanation of and attention toward a specific security issue. What do they want?

A)Company Policy
B)Organizational Security Policy
C)Issue-specific Policy
D)Standard Policy

Question 25

Atticus is facing a serious situation with an employee that may have breached the operations he can carry out. Where should Atticus find this information?

A)Security Model
B)Security Policy
C)Security Digest
D)Security Applications

Question 26

What order should these steps be completed in when conducting a Business Impact Analysis (BIA)?

A)Assess impact if crisis were to happen; Determine maximum allowable outage and recovery times; Identify critical processes
B)Identify critical processes; Assess impact if crisis were to happen; Determine maximum allowable outage and recovery times
C)Identify critical processes; Determine maximum allowable outage and recovery times; Assess impact if crisis were to happen
D)None of the above

Question 27

Indecisive is working on his company's Business Continuity Plan and performing the Business Impact Analysis. One of the critical processes that he has identified is year-end tax documentation and preparation. However, because this is a seasonal process, he is unsure of how to handle it in his analysis. What advice should you give Mr. Indecisive?

A)Determine the recovery time objective based on the shortest time required (when it is tax season)
B)Determine the recovery time objective based on the non-tax season time period (since this is the majority of the year)
C)Calculate optimal recovery time for both scenarios - tax season and non-tax season - and average the two together to get the overall optimal recovery time objective
D)Create two different recovery time objectives - one based on tax season and one on non-tax season - and include both in the report.

Question 28

Company XYZ just hired Richard and insists that to protect the company he sign:

A)Employee Jurisdiction Form
B)Nondisclosure Agreement
C)Corporate Employee Analysis
D)All of the above

Question 29

Richard has accepted a job at company XYZ. The company will now perform a background check. What is normally checked during this procedure?

A)Social Security trace
B)Federal Criminal Check
C)Immigration Check
D)All of the above

Question 30

What estimates the loss of an asset if a threat were true?

A)Single Loss Expectancy
B)Annualized Rate of Occurrence
C)Exposure Factor
D)Risk Transfer

Question 31

What causes vulnerability that can lead to threats and exposures?

A)Employees
B)Competitors
C)Risks
D)Threats

Question 32

Craig is responsible for any issues involving risk at his company. There seems to be a constant problem with chronic failure and pinpointing vulnerabilities. What type of analysis should be done to determine where the chronic failure is taking place?

A)Control Analysis
B)Result Analysis
C)Failure and Fault Analysis
D)Crypt Failure Analysis

Question 33

What value tells a company how much should sensibly be spent per year on safeguard measures to protect assets from threats?

A)Control Analysis
B)Annualized Rate of Occurrence
C)Failure and Fault Analysis
D)Crypt Failure Analysis

Question 34

Mitch is not sure if a risk analysis estimate has been completed. What term is assigned to this situation?

A)Scenario Approximation Fear
B)Uncertainty
C)Scenario Uncertainty Risk
D)Risk Uncertainty and Risk Fear

Question 35

Sally helps determine risk issues at her job. She has informed her boss that there are no safeguards put in place to protect against threats. What type of risk is this company under?

A)Handled Risk
B)Possible Risk
C)Total Risk
D)Residual Risk

Question 36

Sally finally got her boss to understand that the company needs protection against threats. But her boss questions if there is such a thing as total protection. What is Sally's boss concerned about?

A)Handled Risk
B)Possible Risk
C)Total Risk
D)Residual Risk

Question 37

The functionality and effectiveness of countermeasures is as important as determining the type of risk by completing quantitative and qualitative analysis. What risk can prove to be the most detrimental to a company long after the original risk event?

A)Cascading Errors
B)Illogical Processing
C)Delayed Loss
D)Immediate Loss

Question 38

You have been assigned to deal with the company's risk issues to protect again total risk and residual risk. What approach can you use?

A)Risk Avoidance
B)Risk Mitigation
C)Risk Acceptance
D)All of the above

Question 39

Paul has just completed identifying and assessing risk, reduced it to an acceptable level, and implemented the right mechanisms to maintain that level. What did Paul just do?

A)Information Basing
B)Information Risk Management
C)Equipment Malfunction Checks
D)Application Checks

Question 40

Marcus received an e-mail from his bank that said there was a problem with his bank account and information was needed for verification. However, the e-mail was not from the bank. What did Marcus experience?

A)Spoofing
B)Honeypot
C)Network Sniffers
D)Phishing

Question 41

What type of attack has the goal of uncovering sensitive information without wanting to compromise any type of flaw or weakness?

A)Differential Power Analysis
B)Electromagnetic Analysis
C)Side-Channel Attacks
D)All of the above

Question 42

Sean has been promoted and crossed-trained in several departments and each time, he has received more access rights and permissions. What is the company threatened by?

A)Authorization Creep
B)Network Sniffers
C)Default to No Access
D)Need-to-know Fallacy

Question 43

Rick is a security guard at his job. He has worked there for the past 15 years and knows everyone by name and trusts them. Every so often there is a face he doesn't recognize, but trusts the person that the individual is walking with. What would this situation be called?

A)Tracking
B)Porting
C)Piggybacking
D)Back-riding

Question 44

Jack's computer has been compromised. Someone has gained access and uploaded a bundle of tools that allow an attacker to enter the system at any time. What did the attacker upload?

A)Bluetooth Vector
B)Rootkit
C)Rootbox
D)Bluekit

Question 45

If a hacker is not sure where to obtain information that they are not authorized to access, what may they do?

A)Keep trying
B)Try browsing
C)Give up
D)Wrap it up and move on

Question 46

I wish to find as much information about as many people as possible without them knowing about it and I need to see who has modems. How should I go about this?

A)Browsing
B)Wardialing
C)Line Attacks
D)None of the Above

Question 47

Indecisive is assigned responsibility for creating the initial draft of the Risk Assessment. When Mr. Newbie is assigned to help with prioritization of the threats identified in the Risk Assessment. Each potential threat is already listed, along with its likelihood and severity rating. In order to create a priority list and order the threats correctly, what should Mr. Newbie do?

A)Organize the lists alphabetically and assign priority based on the order that the threats appear in the alphabetical lists.
B)Create two lists-one is a priority list based on likelihood and the other is a priority list based on severity.
C)Multiply the likelihood rating with the severity rating and then organize the list according to that number (the relative weight). The higher the relative weight, the higher the priority.
D)Add the likelihood rating to the severity rating and then organize the list according to that number (the relative weight). The higher the relative weight, the higher the priority.

Question 48

Will doesn't know that Kenny is looking over his shoulder and taking notes on information displayed on Will's computer monitor. What is Kenny doing?

A)Security Surfing
B)Perimeter Testing
C)Shoulder Surfing
D)Perimeter Surfing

Question 49

When designing security measures to protect assets, there are a number of variables that must be considered. What situation is the hardest to protect against?

A)Security Surfing
B)Perimeter Testing
C)Social Engineering
D)Perimeter Surfing

Question 50

Paul is talking to his employees about threat agents. What item is not a threat agent?

A)Malware
B)Users
C)Rain
D)Contractor

Question 51

April's computer is acting strange. She keeps trying to find information that she worked on yesterday, but the computer keeps displaying the incorrect information. She thinks the problem is with the memory of the hardware. Where does April think the problem is?

A)Central Access Unit
B)System Access Unit
C)Central Processing Unit
D)System Processing Unit