(Test Bank) Management of Information Security

Whitman, 6

Computer Science & Engineering

Test Bank

6th Edition

• $10.00 $35.00

---

Description

Test Bank for Management of Information Security, The downloadable file consists of 174 pages, and the total size of the file is 1.67 MB. Purchase now only for highly discounted price.

Author(s): Whitman

---

---

Study Note Preview

CHAPTER 1 1. Corruption of information can occur only while information is being stored. a. True *b. False 2. The authorization process takes place before the authentication process. a. True *b. False 3. A worm may be able to deposit copies of itself onto all Web servers that the infected system can reach, so that users who subsequently visit those sites become infected. *a. True b. False 4. DoS attacks cannot be launched against routers. a. True *b. False 5. The first step in solving problems is to gather facts and make assumptions. a. True *b. False 6. A device (or a software program on a computer) that can monitor data traveling on a network is known as a socket sniffer. __________ a. True *b. False 7. One form of e-mail attack that is also a DoS attack is called a mail spoof, in which an attacker overwhelms the receiver with excessive quantities of e-mail. __________ a. True *b. False 8. When voltage levels lag (experience a momentary increase), the extra voltage can severely damage or destroy equipment. __________ a. True *b. False 9. "Shoulder spying" is used in public or semi-public settings when individuals gather information they are not authorized to have by looking over another individual’s shoulder or viewing the information from a distance. __________ a. True *b. False 10. The term phreaker is now commonly associated with an individual who cracks or removes software protection that is designed to prevent unauthorized duplication. __________ a. True *b. False 11. The application of computing and network resources to try every possible combination of options of a password is called a dictionary attack. __________ a. True *b. False 12. The macro virus infects the key operating system files located in a computer’s start-up sector. __________ a. True *b. False 13. The malicious code attack includes the execution of viruses, worms, Trojan horses, and active Web scripts with the intent to destroy or steal information. __________ *a. True b. False 14. A(n) polymorphic threat is one that over time changes the way it appears to antivirus software programs, making it undetectable by techniques that look for pre-configured signatures. __________ *a. True b. False 15. Communications security involves the protection of which of the following? a. radio handsets b. people, physical assets c. the IT department *d. media, technology, and content 16. The protection of voice and data components, connections, and content is known as __________ security. *a. network b. national c. cyber d. operational 17. The protection of confidentiality, integrity, and availability of data regardless of its location is known as __________ security. *a. information b. network c. cyber d. operational 18. A model of InfoSec that offers a comprehensive view of security for data while being stored, processed, or transmitted is the __________ security model. *a. CNSS b. USMC c. USNA d. NPC 19. Which of the following is a C.I.A. triad characteristic that addresses the threat from corruption, damage, destruction, or other disruption of its authentic state? *a. integrity b. availability c. authentication d. accountability 20. According to the C.I.A. triad, which of the following is the most desirable characteristic for privacy? *a. confidentiality b. availability c. integrity d. accountability 21. Which of the following is recognition that data used by an organization should only be used for the purposes stated by the information owner at the time it was collected? a. accountability b. availability *c. privacy d. confidentiality 22. Which of the following is a C.I.A. triad characteristic that ensures only those with sufficient privileges and a demonstrated need may access certain information? a. integrity b. availability c. authentication *d. confidentiality 23. The use of cryptographic certificates to establish Secure Sockets Layer (SSL) connections is an example of which process? a. accountability b. authorization c. identification *d. authentication 24. A process that defines what the user is permitted to do is known as __________. a. identification *b. authorization c. accountability d. authentication 25. What do audit logs that track user activity on an information system provide? a. identification b. authorization *c. accountability d. authentication 26. Any event or circumstance that has the potential to adversely affect operations and assets is known as a(n) __________. *a. threat b. attack c. exploit d. vulnerability 27. An intentional or unintentional act that can damage or otherwise compromise information and the systems that support it is known as a(n) __________. a. threat *b. attack c. exploit d. vulnerability 28. A technique used to compromise a system is known as a(n) __________. a. threat b. attack *c. exploit d. vulnerability 29. A potential weakness in an asset or its defensive control system(s) is known as a(n) __________. a. threat b. attack c. exploit *d. vulnerability 30. The unauthorized duplication, installation, or distribution of copyrighted computer software, which is a violation of intellectual property, is called __________. *a. software piracy b. copyright infringement c. trademark violation d. data hijacking 31. Technology services are usually arranged with an agreement defining minimum service levels known as a(n) __________. a. SSL *b. SLA c. MSL d. MIN 32. A short-term interruption in electrical power availability is known as a __________. *a. fault b. brownout c. blackout d. lag 33. Acts of __________ can lead to unauthorized real or virtual actions that enable information gatherers to enter premises or systems they have not been authorized to access. a. bypass b. theft *c. trespass d. security 34. An information security professional with authorization to attempt to gain system access in an effort to identify and recommend resolutions for vulnerabilities in those systems is known as a(n) __________. *a. penetration tester b. expert hacker c. phreaker d. cracker 35. A hacker who intentionally removes or bypasses software copyright protection designed to prevent unauthorized duplication or use is known as a(n) __________. a. penetration tester b. expert hacker c. phreaker *d. cracker 36. __________ is the collection and analysis of information about an organization’s business competitors, often through illegal or unethical means, to gain an unfair edge over them. a. Dumpster diving b. Packet sniffing c. Competitive advantage *d. Industrial espionage 37. The hash values for a wide variety of passwords can be stored in a database known as a(n) __________, which can be indexed and quickly searched using the hash value, allowing the corresponding plaintext password to be determined. *a. rainbow table b. unicorn table c. rainbow matrix d. poison box 38. Which of the following is NOT an approach to password cracking? *a. ransomware b. brute force c. dictionary attacks d. social engineering attacks 39. Force majeure includes all of the following EXCEPT: *a. armed robbery b. acts of war c. civil disorder d. forces of nature 40. Human error or failure often can be prevented with training and awareness programs, policy, and __________. a. outsourcing *b. technical controls c. hugs d. ISO 27000 41. “4-1-9” fraud is an example of a __________ attack. *a. social engineering b. virus c. worm d. spam 42. “4-1-9” is one form of a(n) __________ fraud. *a. advance fee b. privilege escalation c. check kiting d. "Spanish Prisoner" 43. Blackmail threat of informational disclosure is an example of which threat category? a. espionage or trespass *b. information extortion c. sabotage or vandalism d. compromises of intellectual property 44. An attack that uses phishing techniques along with specialized forms of malware to encrypt the victim's data files is known as __________. a. crypto locking *b. ransomware c. jailbreaking d. spam 45. One form of online vandalism is __________, in which individuals interfere with or disrupt systems to protest the operations, policies, or actions of an organization or government agency. *a. hacktivism b. phreaking c. red teaming d. cyberhacking 46. __________ are malware programs that hide their true nature and reveal their designed behavior only when activated. a. Viruses b. Worms c. Spam *d. Trojan horses 47. As frustrating as viruses and worms are, perhaps more time and money is spent on resolving virus __________. a. false alarms b. polymorphisms *c. hoaxes d. urban legends 48. Which of the following is a feature left behind by system designers or maintenance staff that allows quick access to a system at a later time by bypassing access controls? a. brute force b. DoS *c. back door d. hoax 49. A __________ is an attack in which a coordinated stream of requests is launched against a target from many locations at the same time. a. denial of service *b. distributed denial of service c. virus d. spam 50. Which type of attack involves sending a large number of connection or information requests to a target? a. malicious code *b. denial of service (DoS) c. brute force d. spear fishing 51. In the __________ attack, an attacker monitors (or sniffs) packets from the network, modifies them, and inserts them back into the network. a. zombie-in-the-middle b. sniff-in-the-middle c. server-in-the-middle *d. man-in-the-middle 52. Which statement defines the differences between a computer virus and a computer worm? a. Worms and viruses are the same. b. Worms can make copies all by themselves on one kind of computer but viruses can make copies all by themselves on any kind of computer. c. Worms can copy themselves to computers and viruses can copy themselves to smartphones. *d. Worms can make copies all by themselves but viruses need to attach to an existing program on the host computer to replicate. 53. Which of the following is not among the "deadly sins of software security"? *a. extortion sins b. implementation sins c. Web application sins d. networking sins 54. Which of the 12 categories of threats best describes a situation where the adversary removes data from a victim's computer? *a. theft b. espionage or trespass c. sabotage or vandalism d. information extortion 55. Which of the following is the principle of management that develops, creates, and implements strategies for the accomplishment of objectives? a. leading b. controlling c. organizing *d. planning 56. Which of the following is the principle of management dedicated to the structuring of resources to support the accomplishment of objectives? *a. organization b. planning c. controlling d. leading 57. __________ is the set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately, and verifying that the enterprise’s resources are used responsibly. *a. Governance b. Controlling c. Leading d. Strategy 58. Which of the following is the first step in the problem-solving process? a. Analyze and compare the possible solutions. b. Develop possible solutions. *c. Recognize and define the problem. d. Select, implement, and evaluate a solution. 59. Which of the following is NOT a step in the problem-solving process? a. Select, implement, and evaluate a solution. b. Analyze and compare possible solutions. *c. Build support among management for the candidate solution. d. Gather facts and make assumptions. 60. Which of the following is NOT a primary function of information security management? a. planning b. protection c. projects *d. performance 61. Which of the following functions of information security management seeks to dictate certain behavior within the organization through a set of organizational guidelines? a. planning *b. policy c. programs d. people 62. Which function of InfoSec management encompasses security personnel as well as aspects of the SETA program? a. protection *b. people c. projects d. policy 63. A(n) __________ is a potential weakness in an asset or its defensive control(s). Correct Answer(s): a. vulnerability 64. A(n) __________ is an act against an asset that could result in a loss. Correct Answer(s): a. attack 65. Duplication of software-based intellectual property is more commonly known as software __________. Correct Answer(s): a. piracy 66. A(n) __________ hacks the public telephone network to make free calls or disrupt services. Correct Answer(s): a. phreaker 67. A momentary low voltage is called a(n) __________. Correct Answer(s): a. sag 68. Some information gathering techniques are quite legal—for example, using a Web browser to perform market research. These legal techniques are called, collectively, __________. Correct Answer(s): a. competitive intelligence 69. Attempting to reverse-calculate a password or bypass encryption is called __________. Correct Answer(s): a. cracking 70. ESD is the acronym for __________. Correct Answer(s): a. electrostatic discharge 71. A virus or worm can have a payload that installs a(n) __________ door or trap-door component in a system, which allows the attacker to access the system at will with special privileges. Correct Answer(s): a. back 72. __________ is unsolicited commercial e-mail. Correct Answer(s): a. Spam 73. A ___________ overflow is an application error that occurs when the system can’t handle the amount of data that is sent. Correct Answer(s): a. buffer 74. The three levels of planning are strategic planning, tactical planning, and __________ planning. Correct Answer(s): a. operational 75. The set of organizational guidelines that dictates certain behavior within the organization is called __________. Correct Answer(s): a. policy 76. Explain the differences between a leader and a manager. Correct Answer: The distinctions between a leader and a manager arise in the execution of organizational tasks. A leader provides purpose, direction, and motivation to those that follow. By comparison, a manager administers the resources of the organization. He or she creates budgets, authorizes expenditures, and hires employees. 77. List and explain the critical characteristics of information as defined by the C.I.A. triad. Correct Answer: Confidentiality of information ensures that only those with sufficient privileges and a demonstrated need may access certain information. When unauthorized individuals or systems can view information, confidentiality is breached. Integrity is the quality or state of being whole, complete, and uncorrupted. The integrity of information is threatened when it is exposed to corruption, damage, destruction, or other disruption of its authentic state. Availability is the characteristic of information that enables user access to information without interference or obstruction and in a usable format. 78. List and explain the four principles of management under the contemporary or popular management theory. Briefly define each. Correct Answer: Popular management theory categorizes the principles of management into planning, organizing, leading, and controlling (POLC). The process that develops, creates, and implements strategies for the accomplishment of objectives is called planning. The management function dedicated to the structuring of resources to support the accomplishment of objectives is called organization. Leadership includes supervising employee behavior, performance, attendance, and attitude. Leadership generally addresses the direction and motivation of the human resource. Monitoring progress toward completion, and making necessary adjustments to achieve desired objectives, requires the exercise of control. 79. List the steps that can be used as a basic blueprint for solving organizational problems. Correct Answer: 1. Recognize and define the problem.2. Gather facts and make assumptions. 3. Develop possible solutions. 4. Analyze and compare possible solutions. 5. Select, implement, and evaluate a solution. 80. What are the three distinct groups of decision makers or communities of interest on an information security team? Correct Answer: Managers and professionals in the field of information securityManagers and professionals in the field of IT Managers and professionals from the rest of the organization 81. List the specialized areas of security. Correct Answer: Physical securityOperations security Communications security Network security 82. List the measures that are commonly used to protect the confidentiality of information. Correct Answer: Information classificationSecure document (and data) storage Application of general security policies Education of information custodians and end users Cryptography (encryption) 83. What is authentication? Provide some examples. Correct Answer: Authentication is the process by which a control establishes whether a user (or system) has the identity it claims to have. Examples include the use of cryptographic certificates to establish Secure Sockets Layer (SSL) connections as well as the use of cryptographic hardware devices—for example, hardware tokens such as RSA’s SecurID. Individual users may disclose a personal identification number (PIN) or a password to authenticate their identities to a computer system. 84. Discuss the planning element of information security. Correct Answer: Planning in InfoSec management is an extension of the basic planning model. Included in the InfoSec planning model are activities necessary to support the design, creation, and implementation of InfoSec strategies within the IT planning environment. The business strategy is translated into the IT strategy. Both the business strategy and the IT strategy are then used to develop the InfoSec strategy. For example, the CIO uses the IT objectives gleaned from the business unit plans to create the organization’s IT strategy. 85. There are 12 general categories of threat to an organization's people, information, and systems. List at least six of the general categories of threat and identify at least one example of those listed. Correct Answer: Compromises to intellectual propertySoftware attacks Deviations in quality of service Espionage or trespass Forces of nature Human error or failure Information extortion Sabotage or vandalism Theft Technical hardware failures or errors Technical software failures or errors Technological obsolescence CHAPTER 2 1. Ethics carry the sanction of a governing authority. a. True *b. False 2. The Secret Service is charged with the detection and arrest of any person who commits a U.S. federal offense relating to computer fraud, as well as false identification crimes. *a. True b. False 3. Deterrence is the best method for preventing an illegal or unethical activity. ____________ *a. True b. False 4. ISACA is a professional association with a focus on authorization, control, and security. ___________ a. True *b. False 5. Information ambiguation occurs when pieces of nonprivate data are combined to create information that violates privacy. _________________________ a. True *b. False 6. The Gramm-Leach-Bliley (GLB) Act, also known as the Financial Services Modernization Act of 1999, contains a number of provisions that affect banks, securities firms, and insurance companies. ___________ *a. True b. False 7. To protect intellectual property and competitive advantage, Congress passed the Entrepreneur Espionage Act (EEA) in 1996. ___________ a. True *b. False 8. A(n) compromise law specifies a requirement for organizations to notify affected parties when they have experienced a specified type of loss of information. ____________ a. True *b. False 9. It is the responsibility of InfoSec professionals to understand state laws and bills. ____________ a. True *b. False 10. Due diligence requires that an organization make a valid and ongoing effort to protect others. ____________ *a. True b. False 11. InfraGard began as a cooperative effort between the FBI’s Cleveland field office and local intelligence professionals. ___________ a. True *b. False 12. Which of the following ethical frameworks is the study of the choices that have been made by individuals in the past? a. Applied ethics *b. Descriptive ethics c. Normative ethics d. Deontological ethics 13. Which of the following is the study of the rightness or wrongness of intentions and motives as opposed to the rightness or wrongness of the consequences (also known as duty- or obligation-based ethics)? a. Applied ethics b. Meta-ethics c. Normative ethics *d. Deontological ethics 14. Which ethical standard is based on the notion that life in community yields a positive outcome for the individual, requiring each individual to contribute to that community? a. utilitarian b. virtue c. fairness or justice *d. common good 15. There are three general categories of unethical behavior that organizations and society should seek to eliminate. Which of the following is NOT one of them? a. ignorance *b. malice c. accident d. intent 16. Which of the following is the best method for preventing an illegal or unethical activity? Examples include laws, policies, and technical controls. a. remediation *b. deterrence c. persecution d. rehabilitation 17. Which of the following is NOT a requirement for laws and policies to deter illegal or unethical activity? a. fear of penalty b. probability of being penalized c. probability of being caught *d. fear of humiliation 18. Which of the following organizations put forth a code of ethics designed primarily for InfoSec professionals who have earned their certifications? The code includes the canon: Provide diligent and competent service to principals. *a. (ISC)2 b. ACM c. SANS d. ISACA 19. Which subset of civil law regulates the relationships among individuals and among individuals and organizations? a. tort b. criminal *c. private d. public 20. Which of the following is NOT used to categorize some types of law? a. constitutional b. regulatory c. statutory *d. international 21. Which law addresses privacy and security concerns associated with the electronic transmission of PHI? a. USA PATRIOT Act of 2001 b. American Recovery and Reinvestment Act *c. Health Information Technology for Economic and Clinical Health Act d. National Information Infrastructure Protection Act of 1996 22. The penalties for offenses related to the National Information Infrastructure Protection Act of 1996 depend on whether the offense is judged to have been committed for several reasons. Which of the following is NOT one of those reasons? a. For purposes of commercial advantage b. For private financial gain *c. For political advantage d. In furtherance of a criminal act 23. Which law requires mandatory periodic training in computer security awareness and accepted computer security practice for all employees who are involved with the management, use, or operation of a federal computer system? a. The Telecommunications Deregulation and Competition Act b. National Information Infrastructure Protection Act c. Computer Fraud and Abuse Act *d. The Computer Security Act 24. Which act is a collection of statutes that regulates the interception of wire, electronic, and oral communications? *a. The Electronic Communications Privacy Act of 1986 b. The Telecommunications Deregulation and Competition Act of 1996 c. National Information Infrastructure Protection Act of 1996 d. Federal Privacy Act of 1974 25. Which act requires organizations that retain health care information to use InfoSec mechanisms to protect this information, as well as policies and procedures to maintain them? a. ECPA b. Sarbanes-Oxley *c. HIPAA d. Gramm-Leach-Bliley 26. Which law extends protection to intellectual property, which includes words published in electronic formats? a. Freedom of Information Act *b. U.S. Copyright Law c. Security and Freedom through Encryption Act d. Sarbanes-Oxley Act 27. A more recently created area of law related to information security specifies a requirement for organizations to notify affected parties when they have experienced a specified type of information loss. This is commonly known as a __________ law. a. notification *b. breach c. spill d. compromise 28. Which of the following is the result of a U.S. led international effort to reduce the impact of copyright, trademark, and privacy infringement, especially via the removal of technological copyright protection measures? a. U.S. Copyright Law b. PCI DSS c. European Council Cybercrime Convention *d. DMCA 29. This collaborative support group began as a cooperative effort between the FBI’s Cleveland field office and local technology professionals with a focus of protecting critical national infrastructure. *a. InfraGard b. Homeland Security c. CyberWatch d. CyberGard 30. Another key U.S. federal agency is _________, which is responsible for coordinating, directing, and performing highly specialized activities to protect U.S. information systems and produce foreign intelligence information. a. InfraGard b. Homeland Security *c. the National Security Agency d. the Federal Bureau of Investigation 31. Which of the following is compensation for a wrong committed by an individual or organization? a. liability *b. restitution c. due diligence d. jurisdiction 32. Any court can impose its authority over an individual or organization if it can establish which of the following? a. jurisprudence *b. jurisdiction c. liability d. sovereignty 33. Investigations involving the preservation, identification, extraction, documentation, and interpretation of computer media for evidentiary and root cause analysis are known as _________. *a. digital forensics b. criminal investigation c. crime scene investigation d. e-discovery 34. Also known as “items of potential evidentiary value,” any information that could potentially support the organization’s legal or policy-based case against a suspect is known as _________. *a. evidentiary material b. digital forensics c. evidence d. e-discovery 35. The coherent application of methodical investigatory techniques to collect, preserve, and present evidence of crimes in a court or court-like setting is known as _________. a. evidentiary material *b. forensics c. crime scene investigation d. data imaging 36. Permission to search for evidentiary material at a specified location and/or to seize items to return to the investigator’s lab for examination is known as a(n) _________. a. subpoena b. forensic clue *c. search warrant d. affidavit 37. Sworn testimony that certain facts are in the possession of the investigating officer and that they warrant the examination of specific items located at a specific place is known as a(n) _________. a. subpoena b. forensic finding c. search warrant *d. affidavit 38. A process focused on the identification and location of potential evidence related to a specific legal action after it was collected through digital forensics is known as _________. *a. e-discovery b. forensics c. indexing d. root cause analysis 39. Digital forensics can be used for two key purposes: ________ or _________. a. e-discovery; to perform root cause analysis *b. to investigate allegations of digital malfeasance; to perform root cause analysis c. to solicit testimony; to perform root cause analysis d. to investigate allegations of digital malfeasance; to solicit testimony 40. In digital forensics, all investigations follow the same basic methodology once permission to search and seize is received, beginning with _________. *a. identifying relevant items of evidentiary value b. acquiring (seizing) the evidence without alteration or damage c. analyzing the data without risking modification or unauthorized access d. investigating allegations of digital malfeasance 41. _________ devices often pose special challenges to investigators because they can be configured to use advanced encryption and they can be wiped by the user even when the user is not present. *a. Portable b. Desktop computer c. Expansion d. Satellite transceiver 42. The most complex part of an investigation is usually __________. *a. analysis for potential EM b. protecting potential EM c. requesting potential EM d. preventing the destruction of potential EM 43. When an incident violates civil or criminal law, it is the organization’s responsibility to notify the proper authorities; selecting the appropriate law enforcement agency depends on __________. *a. the type of crime committed b. how many perpetrators were involved c. the network provider the hacker used d. what kind of computer the hacker used 44. Ethics are based on ___________________, which are the relatively fixed moral attitudes or customs of a societal group. Correct Answer(s): a. cultural mores 45. The branch of philosophy that considers nature, criteria, sources, logic, and the validity of moral judgment is known as ___________. Correct Answer(s): a. ethics 46. The act of attempting to prevent an unwanted action by threatening punishment or retaliation on the instigator if the act takes place is known as ___________. Correct Answer(s): a. deterrence 47. ___________________ is a subset of civil law that allows individuals to seek redress in the event of personal, physical, or financial injury. Correct Answer(s): a. Tort law 48. Information ____________ occurs when pieces of nonprivate data are combined to create information that violates privacy. Correct Answer(s): a. aggregation 49. An organization increases its liability if it refuses to take the measures a prudent organization should; this is known as the standard of _____________. Correct Answer(s): a. due care 50. Investigations involving the preservation, identification, extraction, documentation, and interpretation of computer media for evidentiary and root cause analysis are known as _________. Correct Answer(s): a. digital forensics 51. _________ devices often pose special challenges to investigators because they can be configured to use advanced encryption and they can be wiped by the user even when the user is not present. Correct Answer(s): a. Portable 52. A process focused on the identification and location of potential evidence related to a specific legal action after it was collected through digital forensics is known as _________. Correct Answer(s): a. e-discovery b. ediscovery