Deck 2: Compliance: Law and Ethics

Question 1

To protect intellectual property and competitive advantage,Congress passed the Entrepreneur Espionage Act (EEA)in 1996.​ ___________

Answer 1

 False
Economic

Question 2

​Deterrence is the best method for preventing an illegal or unethical activity.____________

Answer 2

 True

Question 3

Which law requires mandatory periodic training in computer security awareness and accepted computer security practice for all employees who are involved with the management,use,or operation of each federal computer system? 

A) The Telecommunications Deregulation and Competition Act 
B) National Information Infrastructure Protection Act 
C) Computer Fraud and Abuse Act 
D) The Computer Security Act

Answer 3

D

Question 4

Information ambiguation occurs when pieces of non-private data are combined to create information that violates privacy. _________________________

Question 5

Ethics carry the sanction of a governing authority.

Question 6

The penalties for offenses related to the National Information Infrastructure Protection Act of 1996 depend on whether the offense is judged to have been committed for one of the following reasons except which of the following? 

A) For purposes of commercial advantage 
B) For private financial gain 
C) For political advantage 
D) In furtherance of a criminal act

Question 7

InfraGard began as a cooperative effort between the FBI's Cleveland field office and local intelligence ​professionals.​ ___________

Question 8

Which law addresses privacy and security concerns associated with the electronic transmission of PHI? 

A) USA Patriot Act of 2001 
B) American Recovery and Reinvestment Act 
C) Health Information Technology for Economic and Clinical Health Act 
D) National Information Infrastructure Protection Act of 1996

Question 9

​Due diligence requires that an organization make a valid and ongoing effort to protect others.____________

Question 10

Which law extends protection to intellectual property,which includes words published in electronic formats? 

A) Freedom of Information Act
B) U.S. Copyright Law 
C) Security and Freedom through Encryption Act
D) Sarbanes-Oxley Act

Question 11

​It is the responsibility of InfoSec professionals to understand state laws and standards.____________

Question 12

Which of the following is the study of the rightness or wrongness of intentions and motives as opposed to the rightness or wrongness of the consequences and is also known as duty- or obligation-based ethics? 

A) Applied ethics
B) Meta-ethics 
C) Normative ethics
D) Deontological ethics

Question 13

​The Gramm-Leach-Bliley (GLB)Act (also known as the Financial Services Modernization Act of 1999)contains a number of provisions that affect banks,securities firms,and insurance companies.___________

Question 14

The Secret Service is charged with the detection and arrest of any person committing a U.S.federal offense relating to computer fraud,as well as false identification crimes.

Question 15

Which subset of civil law regulates the relationships among individuals and among individualsand organizations? 

A) tort
B) criminal 
C) private
D) public

Question 16

Which of the following is an international effort to reduce the impact of copyright,trademark,and privacy infringement,especially via the removal of technological copyright protection measures? 

A) U.S. Copyright Law 
B) PCI DSS 
C) European Council Cybercrime Convention 
D) DMCA

Question 17

Which act requires organizations that retain health care information to use InfoSec mechanisms to protect this information,as well as policies and procedures to maintain them? 

A) ECPA 
B) Sarbanes-Oxley 
C) HIPAA 
D) Gramm-Leach-Bliley

Question 18

ISACA is a professional association with a focus on authorization,control,and security.___________

Question 19

Which act is a collection of statutes that regulates the interception of wire,electronic,and oral communications? 

A) The Electronic Communications Privacy Act of 1986 
B) The Telecommunications Deregulation and Competition Act of 1996 
C) National Information Infrastructure Protection Act of 1996 
D) Federal Privacy Act of 1974

Question 20

​A signaling law specifies a requirement for organizations to notify affected parties when they have experienced a specified type of loss of information.____________

Question 21

Which of the following ethical frameworks is the study of the choices that have been made by individuals in the past; attempting to answer the question,what do others think is right? 

A) Applied ethics
B) Descriptive ethics 
C) Normative ethics
D) Deontological ethics

Question 22

An organization increases its _____________ if it refuses to take measures-due care-to make sure that every employee knows what is acceptable and what is not,and the consequences of illegal or unethical actions.

Question 23

Any court can impose its authority over an individual or organization if it can establish which of the following? 

A) jurisprudence
B) jurisdiction 
C) liability
D) sovereignty

Question 24

Discuss the three general categories of unethical behavior that organizations should try to control.

Question 25

There are three general categories of unethical behavior that organizations and society should seek to eliminate.Which of the following is NOT one of them? 

A) ignorance
B) malice 
C) accident
D) intent

Question 26

Ethics are based on ___________________,which are the relatively fixed moral attitudes or customs of a societal group.

Question 27

Information ____________ occurs when pieces of non-private data are combined to create information that violates privacy.​

Question 28

___________________ is a subset of civil law that allows individuals to seek redress in the event of personal,physical,or financial injury.

Question 29

Which of the following is compensation for a wrong committed by an employee acting with or without authorization? 

A) liability
B) restitution 
C) due diligence
D) jurisdiction

Question 30

The branch of philosophy that considers nature,criteria,sources,logic,and the validity of moral judgment is known as ___________.

Question 31

Briefly describe five different types of laws.

Question 32

The penalty for violating the National Information Infrastructure Protection Act of 1996 depends on the value of the information obtained and whether the offense is judged to have been committed for one of three reasons. What are those reasons?

Question 33

The Computer Security Act charges the National Bureau of Standards,in cooperation with the National Security Agency (NSA),with the development of five standards and guidelines establishing minimum acceptable security practices. What are three of these principles?

Question 34

Which of the following is the best method for preventing an illegal or unethical activity? Examples include laws,policies and technical controls.

A) remediation
B) deterrence 
C) persecution
D) rehabilitation

Question 35

Which ethical standard is based on the notion that life in community yields a positive outcome for the individual,requiring each individual to contribute to that community? 

A) utilitarian
B) virtue 
C) fairness or justice
D) common good

Question 36

The act of attempting to prevent an unwanted action by threatening punishment or retaliation on the instigator if the act takes place is known as ___________.

Question 37

Laws and policies and their associated penalties only deter if three conditions are present. What are these conditions?

Question 38

Describe the Freedom of Information Act. How does its application apply to federal vs.state agencies?

Question 39

What is the key difference between law an ethics?

Question 40

Which of the following organizations put forth a code of ethics designed primarily for InfoSec professionals who have earned their certifications?  The code includes the canon: Provide diligent and competent service to principals.

A) (ISC)²
B) ACM 
C) SANS
D) ISACA

Question 41

​a. criminal law
b. public law
c. ethics
d. Computer Security Act (CSA)
e. Electronic Communications Privacy Act
f. Cybersecurity Actg. normative ethicsh. applied ethics
regulates the structure and administration of government agencies and their relationships with citizens,employees,and other governments

Question 42

​a. criminal law
b. public law
c. ethics
d. Computer Security Act (CSA)
e. Electronic Communications Privacy Act
f. Cybersecurity Actg. normative ethicsh. applied ethics
a collection of statutes that regulates the interception of wire,electronic,and oral communications​

Question 43

​a. criminal law
b. public law
c. ethics
d. Computer Security Act (CSA)
e. Electronic Communications Privacy Act
f. Cybersecurity Actg. normative ethicsh. applied ethics
one of the first attempts to protect federal computer systems by establishing minimum acceptable security practices

Question 44

A key difference between policy and law is that ignorance of policy is a viable defense. What steps must be taken to assure that an organization has a reasonable expectation that policy violations can be appropriately penalized without fear of legal retribution?

Question 45

​a. criminal law
b. public law
c. ethics
d. Computer Security Act (CSA)
e. Electronic Communications Privacy Act
f. Cybersecurity Actg. normative ethicsh. applied ethics
focuses on enhancing the security of the critical infrastructure in the United States

Question 46

​a. criminal law
b. public law
c. ethics
d. Computer Security Act (CSA)
e. Electronic Communications Privacy Act
f. Cybersecurity Actg. normative ethicsh. applied ethics
an approach that applies moral codes to actions drawn from realistic situations

Question 47

Describe three of the five foundations and frameworks of ethics.

Question 48

​a. criminal law
b. public law
c. ethics
d. Computer Security Act (CSA)
e. Electronic Communications Privacy Act
f. Cybersecurity Actg. normative ethicsh. applied ethics
defines socially acceptable behaviors

Question 49

​a. criminal law
b. public law
c. ethics
d. Computer Security Act (CSA)
e. Electronic Communications Privacy Act
f. Cybersecurity Actg. normative ethicsh. applied ethics
addresses violations harmful to society and is actively enforced and prosecuted by the state

Question 50

​a. criminal law
b. public law
c. ethics
d. Computer Security Act (CSA)
e. Electronic Communications Privacy Act
f. Cybersecurity Actg. normative ethicsh. applied ethics
the study of what makes actions right or wrong,also known as moral theory