MGMT CSGE Ch 1-6

When using the Governing for Enterprise Security (GES) program, an Enterprise Security Program (ESP) should be structured so that governance activities are driven by the organization's executive management, select key stakeholders, as well as the ____________.

Board risk committee

Which of the following is NOT a step in the problem-solving process?

Build support among management for the candidate solution

The purpose of SETA is to enhance security in all but which of the following ways?

By adding barriers

An ISACA certification targeted at upper-level executives, including CISOs and CIOs, directors, and consultants with knowledge and experience in IT governance is known as the __________

CGEIT

The __________ certification, considered to be one of the most prestigious certifications for security managers and CISOs, recognizes mastery of an internationally identified common body of knowledge (CBK) in InfoSec and is considered to be vendor neutral.

CISSP

A model of InfoSec that offers a comprehensive view of security for data while being stored, processed, or transmitted is the __________ security model.

CNSS

An ISACA certification targeted at IT professionals who are in careers that link IT risk management with enterprise risk management is known as the __________

CRISC

The individual responsible for the assessment, management, and implementation of information-protection activities in the organization is known as a(n) ____________.

Chief information security officer

Which of the following organizations put forth a code of ethics designed primarily for InfoSec professionals who have earned their certifications? The code includes the canon: Provide diligent and competent service to principals.

(ISC)2

Which of the following is a C.I.A. characteristic that ensures that only those with sufficient privileges and a demonstrated need may access certain information?

Confidentiality

A hacker who intentionally removes or bypasses software copyright protection designed to prevent unauthorized duplication or use is known as a

Cracker

Which of the following is the result of a U.S. led international effort to reduce the impact of copyright, trademark, and privacy infringement, especially via the removal of technological copyright protection measures?

DCMA

Which type of attack involves sending a large number of connection or information requests to a target?

Denial-of-service (DoS)

Which of the following is the study of the rightness or wrongness of intentions and motives as opposed to the rightness or wrongness of the consequences and is also known as duty- or obligation-based ethics?

Deontological ethics

Which of the following organizations offers the Certified CISO (C|CISO) certification?

EC-Council

Which policy is the highest level of policy and is usually created first?

EISP

To move the InfoSec discipline forward, organizations should take all of the following steps EXCEPT:

Form a committee and approve suggestions from the CISO

__________ is the set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately, and verifying that the enterprise's resources are used responsibly.

Governance

ISO 27014:2013 is the ISO 27000 series standard for ____________.

Governance of information security

Which act requires organizations that retain health care information to use InfoSec mechanisms to protect this information, as well as policies and procedures to maintain them?

HIPPA

One form of online vandalism is _____ in which individuals interfere with or disrupt systems to protest the operations, policies, or actions of an organization of government agency.

Hacktivism

Which law addresses privacy and security concerns associated with the electronic transmission of PHI?

Health information technology for economic and clinical health act

The National Association of Corporate Directors (NACD) recommends four essential practices for boards of directors. Which of the following is NOT one of these recommended practices?

Hold regular meetings with the CIO to discuss tactical InfoSec planning

Which of the following is a network device attribute that may be used in conjunction with DHCP, making asset-identification using this attribute difficult?

IP address

Which of the following organizations is best known for its series of certifications targeted to Information Systems Audit, Information Security, Risk Control and IT Governance?

ISACA

In large organizations, the InfoSec department is often located within an _________ division headed by the _________, who reports directly to the _________.

IT, CISO, CIO

Which of the following is the first step in the process of implementing training?

Identify program scope, goals, and objectives

Medium-sized organizations tend to spend approximately __________ percent of the total IT budget on security.

11

Smaller organizations tend to spend approximately __________ percent of the total IT budget on security.

20

Larger organizations tend to spend approximately __________ percent of the total IT budget on security.

5

"4-1-9" is one form of an _____ fraud.

Advance fee

Which of the following should be included in an InfoSec governance program?

An infoSec risk management methodology

In digital forensics, all investigations follow the same basic methodology once permission to search and seize is received, beginning with _________.

identifying relevant items of evidentiary value

An understanding of the potential consequences of a successful attack on aninformation asset by a threat is known as __________.

impact

The protection of confidentiality, integrity, and availability of data regardless of its location is known as __________ security.

information

__________ is the risk assessment deliverable that places each information asset into a ranked list according to its value based on criteria developed by the organization.

information asset value weighted table analysis

Which of the following is a common element of the enterprise information security policy?

information on the structure of the infosec organization

Blackmail threat of informational disclosure is an example of which threat category?

information or trespass

Which of the following is an advantage of the formal class method of training?

interaction with trainer is possible

Which of the following is NOT an origin used to categorize types of law?

international

Digital forensics can be used for two key purposes: ________ or _________.

investigate allegations of digital malfeasance; perform root cause analysis

The __________ phase of the SecSDLC begins with a directive from upper management specifying the process, outcomes, and goals of the project as well as its budget and other constraints.

investigation

What is the first phase of the SecSDLC?

investigation

Which phase of the SecSDLC should see support from senior management?

investigation

A well-defined risk appetite should have the following characteristics EXCEPT:

is not limited by stakeholder expectations

According to Wood, which of the following are reasons the InfoSec department should report directly to top management?

it fosters objectivity and the ability to perceive whats truly in the best interest of the organization as a whole

Which of the following is true about a company's InfoSec awareness Web site?

it should be tested with multiple browsers

Once the members of the RM framework team have been identified, the governance group should communicate all of these for the overall RM program EXCEPT:

its personnel structure

Any court can impose its authority over an individual or organization if it can establish which of the following?

jurisdiction

The organization can perform risk determination using certain risk elements, including all but which of the following?

legacy cost of recovery

Which of the following is not a role of managers within the Communities of Interest in controlling risk?

legal management must develop corporate-wise standards

The probability that a specific vulnerability within an organization will beattacked by a threat is known as __________.

likelihood

There are three general categories of unethical behavior that organizations and society should seek to eliminate. Which of the following is NOT one of them?

malice

Which of the following distinctly identifies an asset and can be vital in later analysis of threats directed to specific models of certain devices or software components?

manufacturers model or part number

The InfoSec needs of an organization are unique to all but which one of the following organizational characteristics?

market

Communications Security involves the protection of which of the following?

media, technology, and content

Organizations classified as __________ may still be large enough to implement the multi tier approach to security, though perhaps with fewer dedicated groups and more functions assigned to each group.

medium sized

A formal approach to solving a problem based on a structured sequence of procedures, the use of which ensures a rigorous process and increases the likelihood of achieving the desired final objective. is known as a(n) ____________.

methodlogy

Which of the following explicitly declares the business of the organization and its intended areas of operations?

mission statement

Which type of planning is used to organize the ongoing, day-to-day performance of tasks?

operational

Which of the following is the principle of management dedicated to the structuring of resources to support the accomplishment of objectives?

organization

Which of the following is an example of a technological obsolescence threat?

outdated servers

An information security professional with authorization to attempt to gain system access in an effort to identify and recommend resolutions for vulnerabilities in those systems is known as a(n) __________.

penetration tester

Which function of InfoSec Management encompasses security personnel as well as aspects of the SETA program?

people

GGG security is commonly used to describe which aspect of security?

physical

Which function needed to implement the information security program includes researching, creating, maintaining, and promoting information security plans?

planning

Which of the following functions of Information Security Management seeks to dictate certain behavior within the organization through a set of organizational guidelines?

policy

According to NIST SP 800-18, Rev. 1, which individual is responsible for the creation, revision, distribution, and storage of the policy?

policy administrator

Which section of an ISSP should outline a specific methodology for the review and modification of the ISSP?

policy review and modification

Which of the following is NOT one of the basic rules that must be followed when developing a policy?

policy should be focused on protecting the organization from public embarassment

_________ devices often pose special challenges to investigators since they can be configured to use advanced encryption and they can be wiped by the user even when the user is not present.

portable

Which of the following is recognition that data used by an organization should only be used for the purposes stated by the information owner at the time it was collected?

privacy

Which subset of civil law regulates the relationships among individuals and among individuals and organizations?

private

The Risk Management Framework includes all of the following EXCEPT:

process contingency planning

Which of the following attributes does NOT apply to software information assets?

product deminsions

What should you be armed with to adequately assess potential weaknesses in each information asset?

properly classified inventory

Policy is only enforceable and legally defensible if it uses a process that assures repeatable results and conforms to each of the following EXCEPT is true and __________.

properly conceived

IT's focus is the efficient and effective delivery of information and administration of information resources, while InfoSec's primary focus is the __________ of all information assets.

protection

What is the final step in the risk identification process?

ranking assets in order of importance

an attack that uses phishing techniques along with specialized forms of malware to encrypt the victim's data files is known as _____?

ransomware

What is the SETA program designed to do?

reduce the occurrence of accidental security breaches

Once an information asset is identified, categorized, and classified, what must also be assigned to it?

relative value

The risk to information assets that remains even after current controls have been applied.

residual risk

Which of the following is a disadvantage of the one-on-one training method?

resource intensive, to the point of being inefficient

Which of the following is compensation for a wrong committed by an individual or organization?

restitution

The quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility is known as __________.

risk appetite

The identification, analysis and evaluation of risk in an organization describes which of the following?

risk assessment

Which of the following functions includes identifying the sources of risk and may include offering advice on controls that can reduce risk?

risk assessment

The __________ converts the instructions and perspectives provided to the RM framework team into cohesive guidance that structures and directs all subsequent risk management efforts

risk management policy

Which of the following is NOT among the typical columns in the risk rating worksheet?

risk threshold

The assessment of the amount of risk an organization is willing to accept for a particular information asset.

risk tolerance

Permission to search for evidentiary material at a specified location and/or to seize items to return to the investigator's lab for examination is known as a(n) _________.

search warrant

A SETA program consists of three elements: security education, security training, and which of the following?

security awareness

The individual accountable for ensuring the day-to-day operation of the InfoSec program, accomplishing the objectives identified by the CISO and resolving issues identified by technicians are known as a(n) ____________.

security manager

Qualified individuals who are tasked with configuring security technologies and operating other technical control systems are known as a(n) ____________.

security technician

Which of the following would most likely be responsible for configuring firewalls and IDPSs, implementing security software, and diagnosing and troubleshooting problems?

security technician

Data classification schemes should categorize information assets based on which of the following?

sensitivity and security needs

Which of the following is NOT a task performed by the governance group during the framework design phase, in cooperation with the framework team?

specifying who will supervise and perform the RM process

A person or organization that has a vested interest in a particular aspect of the planning or operation of the organization in this case, the information assets used in a particular organization is known as a(n) _________.

stakeholder

Which type of document is a more detailed statement of what must be done to comply with a policy?

standard

Which type of planning is the primary tool in determining the long-term direction taken by an organization?

strategic

When creating a __________, each level of each division translates those goals into more specific goals for the level below it.

strategic plan

A clearly directed __________ flows from top to bottom, and a systematic approach is required to translate it into a program that can inform andlead all members of the organization.

strategy

The first priority of the CISO and the InfoSec management team should be the __________.

structure of a strategic plan

Which of the following functions needed to implement the information security program evaluates patches used to close software vulnerabilities and acceptance testing of new systems to assure compliance with policy and effectiveness?

systems testing

Which level of planning breaks down each applicable strategic goal into a series of incremental objectives?

tactical

A project manager who understands project management, personnel management, and InfoSec technical requirements is needed to fill the role of a(n) ____________.

team leader

Human error or failure can often be prevented with training and awareness programs, policy and _____.

technical controls

In the area of risk management, process communications is the necessary information flow within and between all of the following EXCEPT:

the corporate change control officer

Which act is a collection of statutes that regulates the interception of wire, electronic, and oral communications?

the electronic communications privacy act of 1986

An example of a stakeholder of a company includes all of the following EXCEPT:

the general public

Factors that affect the external context and impact the RM process, its goals, and its objectives include the following EXCEPT:

the organizations governance structure

Factors that affect the internal context and impact the RM process, its goals, and its objectives include the following EXCEPT:

the threat environment-- threats, known vulnerabilities, attack vectors

When an incident violates civil or criminal law, it is the organization's responsibility to notify the proper authorities; selecting the appropriate law enforcement agency depends on __________.

the type of crime committed

Which of the 12 Categories of Threats best describes a situation where the adversary removes data from a victim's computer?

theft

Which of the following is true about the security staffing, budget, and needs of a medium-sized organization?

they have large information security needs than a small orgnization

Any event or circumstance that has the potential to adversely affect operations and assets is known as a(n) __________.

threat

The risk assessment deliverable titled __________ serves to rank-order each threat to the organization's information assets according to criteria developed by the organization.

threat severity weighted table analysis

What should the prioritized list of assets and their vulnerabilities and the prioritized list of threats facing the organization be combined to create?

threats-vulnerabilities-assets worksheet

An estimate made by the manager using good judgement and experience can account for which factor of risk assessment?

uncertainty

The state of having limited or imperfect knowledge of a situation, making itless likely that organizations can successfully anticipate future events or outcomes is known as __________.

uncertainty

Which of the following is an advantage of the user support group form of training?

usually conducted in an informal social setting

Which of the following is a key advantage of the bottom-up approach to security implementation?

utilizes the technical expertise of the individual administrators

Which of the following sections of the ISSP provides instructions on how to report observed or suspected policy infractions?

violations of policy

What is defined as specific avenues that threat agents can exploit to attack an information asset?

vulnerabilities

In which SDLC model does the work product from each phase transition into the next phase to serve as its starting point while allowing movement back to a previous phase should the project require it?

waterfall

Which of the following is NOT an aspect of access regulated by ACLs?

where the system is located

Three options for placing the CISO (and his or her security group) in the organization (as noted by Kosutic), are generally driven by organizational size and include all of the following EXCEPT:

within a division/department with a conflict of interest

This collaborative support group began as a cooperative effort between the FBI's Cleveland field office and local technology professionals with a focus of protecting critical national infrastructure.

InfraGard

According to the Corporate Governance Task Force (CGTF), which phase in the IDEAL model and framework lays the groundwork for a successful improvement effort?

Initiating

Which of the following is a C.I.A. characteristic that addresses the threat from corruption, damage, destruction, or other disruption of its authentic state?

Integrity

Which of the following is an attribute of a network device is built into the network interface?

MAC address

In the _____ attack, an attacker monitors (or sniffs) packets from the network, modifies them, and inserts them back into the networks.

Man in the middle

Which of the following set the direction and scope of the security process and provide detailed instruction for its conduct?

Managerial controls

Another key U.S. federal agency is _________ which is responsible for coordinating, directing, and performing highly specialized activities to protect U.S. information systems and produce foreign intelligence information.

National Security Agency

The protection of voice and data components, connection, and content is known as _____security.

Network.

Which of the following variables is the most influential in determining how to structure an information security program?

Organizational culture

Which of the following is NOT a primary function of Information Security Management?

Performance

Which of the follow is the principal of management that develops, creates, and implements strategies for the accomplishment of objectives?

Planning

Which of these denotes the overall structure of the strategic planning and design for the entirety of the organization's RM efforts.

RM framework

Which of these denotes the identification, analysis, evaluation, and treatment of risk to information assets.

RM process

The hash values for a wide variety of passwords can be stored in a database known as a(n) __________ which can be indexed and quickly searched using the hash value allowing the corresponding plaintext password to be determined

Rainbow table

Which of the following is NOT an approach to password cracking?

Ransomware (approaches are brute force, dictionary attacks, social engineering attacks)

__________ is the risk assessment deliverable that assigns a value to each TVA triple, incorporating likelihood, impact, and possibly a measure of uncertainty

Risk ranking worksheet

Which of the following organizations is best known for its series of technical InfoSec certifications through an entity known as Global Information Assurance Certification (GIAC)?

SANS institute

Technology services are usually arranges with an agreement defining minimum service levels known as a

SLA

Which of the following is the first step in the problem-solving process?

Select, implement and evaluate a solution

Which of the following is an information security governance responsibility of the Chief Information Security Officer?

Set security policy, procedures, programs and training

The unauthorized duplication, installations, or distribution of copyrighted computer software, which is a violation of intellectual property called _____.

Software piracy

Which of the following is true about planning?

Strategic plans are used to create tactical plans.

Which law requires mandatory periodic training in computer security awareness and accepted computer security practice for all employees who are involved with the management, use, or operation of each federal computer system?

The computer security act

Which of the following describes the primary reason the InfoSec department should NOT fall under the IT function?

There is a misalignment between the goals of the InfoSec department, which focuses on protecting information, and the IT function, which focuses on efficiency in processing and accessing information

The basic outcomes of InfoSec governance should include all but which of the following?

Time management by aligning resources with personnel schedules and organizational objectives

_____ are malware programs that hide their true nature, and reveal their designed behavior only when activated.

Trojan horses

Which law extends protection to intellectual property, which includes words published in electronic formats?

U.S. copyright law

A potential weakness in an asset or its defensive control system(s) is known as a _____?

Vulnerability

__________ is a simple project management planning tool.

WBS

Which statement defines the differences between a computer virus and a computer worm?

Worms can make copies all by themselves but viruses need to attach to an existing program on the host computer it replicates

A specialized security administrator responsible for performing systems development life cycle (SDLC) activities in the development of a security system is known as a(n) __________

a security analyist

This person would be responsible for some aspect of information security and report to the CISO; in smaller organizations, this title may be assigned to the only or senior security administrator and is known as a(n) __________

a security manager

What do audit logs that track user activity on an information system provide?

accountability

Sworn testimony that certain facts are in the possession of the investigating officer and that they warrant the examination of specific items located at a specific place is known as a(n) _________.

affidavit

Which if the following is NOT a part of an information security program.

all of these are part of an information security program technologies, activities and personnel used by an organization to manager the risks to its information assets

For an organization to manage its InfoSec risk properly, managers should understand how information is __________.

all of these: collected, processes, transmitted

A gathering of key reference materials is performed during which phase of the SecSDLC?

analysis

A risk assessment is performed during which phase of the SecSDLC?

analysis

In which phase of the SecSDLC does the risk management task occur?

analysis

The __________ phase of the SecSDLC, the team studies the documents from earlier and looks at of relevant legal issues that could affect the design of the security solution.

analysis

The most complex part of an investigation is usually __________.

analysis for potential evidentiary material

Force majeure includes all of these EXCEPT:

armed robbery

Which of the following activities is part of the risk identification process?

assigning a value to each information asset

An (ISC)2 program geared toward individuals who want to take any of its certification exams before obtaining the requisite experience for certification is the __________.

associate of (ISC)2

An intentional or unintentional act that can damage or otherwise compromise information and the systems that support it is known as a(n) __________.

attack

The use of cryptographic certificates to establish Secure Sockets Layer (SSL) connections is an example of which process?

authentication

A process that defines what the user is permitted to do is known as __________?

authorization

Which of the following is a feature left behind by system designers or maintenance staff that allows quick access to a system at a later time by bypassing access controls?

back door

A more recently created area of law related to information security specifies a requirement for organizations to notify affected parties when they have experienced a specified type of loss of information. This commonly known as a __________ law.

breach

A 2007 Deloitte report found that enterprise risk management is a valuable approach that can better align security functions with the __________ while offering opportunities to lower costs.

business mission

Which of the following activities is part of the risk evaluation process?

calculating the severity of risks to which assets are exposed in their current setting

Which of the following is NOT among the functions typically performed within the InfoSec department as a compliance enforcement obligation?

centralized authentication

A high-level executive, such as a CIO or VP-IT, who will provide political support and influence for a specific project is known as a(n) _________.

champion

A senior executive who promotes the project and ensures its support, both financially and administratively, at the highest levels of the organization is needed to fill the role of a(n) ____________ on a development team.

champion

Which ethical standard is based on the notion that life in community yields a positive outcome for the individual, requiring each individual to contribute to that community?

common good

Classification categories must be mutually exclusive and which of the following?

comprehensive

According to the C.I.A. triad, which of the following is the most desirable characteristic for privacy?

confidentiality

Which of the following are instructional codes that guide the execution of the system when information is passing through it?

configuration rules

The process of integrating the governance of the physical security and information security efforts is known in the industry as __________.

convergence

Rather than making the effort to conduct a detailed assessment of the cost of recovery from an attack when estimating the danger from possible threats, organizations often __________.

create a subjective ranking based on anticipated recovery costs

Which of the following is an advantage of the one-on-one method of training?

customized to the needs of the trainee

Individuals who control, and are therefore responsible for, the security and use of a particular set of information are known as ____________.

data owners

Internal and external stakeholders such as customers, suppliers, or employees who interact with the information in support of their organization's planning and operations are known as ____________.

data users

Which of the following ethical frameworks is the study of the choices that have been made by individuals in the past; attempting to answer the question, what do others think is right?

descriptive ethics

The __________ phase of the SecSDLC, has team members create and develop the blueprint for security and develop critical contingency plans for incident response.

design

Which of the following is the best method for preventing an illegal or unethical activity? Examples include laws, policies and technical controls.

deterrence

Investigations involving the preservation, identification, extraction, documentation, and interpretation of computer media for evidentiary and root cause analysis is known as _________.

digital forensics

A __________ is an attack in which a coordinated stream of requests is launched against a target from many locations at the same time.

distributed denial-of-service

A process focused on the identification and location of potential evidence related to a specific legal action after it was collected through digital forensics is known as _________.

e-discovery

With policy, the most common distribution methods are hard copy and __________.

electronic

Which of the following is the most cost-effective method for disseminating security information and news to employees?

emailed security newsletter

According to the Corporate Governance Task Force (CGTF), during which phase in the IDEAL model and framework does the organization plan the specifics of how it will reach its destination?

establishing

Also known as "items of potential evidentiary value," any information that could potentially support the organization's legal or policy-based case against a suspect is known as _________.

evidentiary material

A technique used to compromise a system.is known as a(n) _____.

exploit

Which of the following is not among the 'deadly sins of software security'?

extortion sins

A short-term interruption in electrical power availability is known as a _____.

fault

Which of the following is NOT a requirement for laws and policies to deter illegal or unethical activity?

fear of humiliation

The penalties for offenses related to the National Information Infrastructure Protection Act of 1996 depend on whether the offense is judged to have been committed for one of the following reasons except which of the following?

for political advantage

The coherent application of methodical investigatory techniques to collect, preserve, and present evidence of crimes in a court or court-like setting is known as _________.

forensics

Laws, policies, and their associated penalties only provide deterrence if three conditions are present. Which of these is NOT one of them?

frequency of review

There are a number of methods for customizing training for users; two of the most common involve customizing by __________ and by __________.

functional background, skill level

The set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately, and verifying that the enterprise's resources are used responsibly is known as __________.

governance

The letters GRC represent an approach to information security strategic guidance from a board of directors or senior management perspective and stands for __________, __________, and __________.

governance, risk management, compliance

Which of the following is NOT a step in the process of implementing training?

hire expert consultants

__________ is the collection and analysis of information about an organization's business competitors, often through illegal or unethical means, to gain an unfair edge over them.

Industrial espionage