Chapter 1 - ITSY 1300, Chapter 2 - ITSY 1300, Chapter 3 - ITSY 1300, Chapter 4 - ITSY 1300

Laws, policies and their associated penalties only provide deterrence if offenders fear the penalty, expect to be caught, and expect the penalty to be applied if they are caught. Select one: True False

True

Laws, policies, and their associated penalties only provide deterrence if, among other things, potential offenders fear the probability of a penalty being applied. _________________________ Select one: True False

True

Many industry observers claim that ISO/IEC 17799, the precursor to ISO/IEC 27001, is not as complete as other frameworks. Select one: True False

True

Many states have implemented legislation making certain computer-related activities illegal. Select one: True False

True

Much human error or failure can be prevented with effective training and ongoing awareness activities. Select one: True False

True

NIST 800-14's Principles for Securing Information Technology Systems, can be used to make sure the needed key elements of a successful effort are factored into the design of an information security program and to produce a blueprint for an effective security architecture. Select one: True False

True

NIST Special Publication 800-18 Rev. 1, The Guide for Developing Security Plans for Federal Information Systems, includes templates for major application security plans, and provides detailed methods for assessing, designing, and implementing controls and plans for applications of varying size. Select one: True False

True

Of the two approaches to information security implementation, the top-down approach has a higher probability of success. _________________________ Select one: True False

True

Organizations can use dictionaries to regulate password selection during the reset process and thus guard against easy-to-guess passwords. Select one: True False

True

Privacy is the right of individuals or groups to protect themselves and their information from unauthorized access, providing confidentiality._________________________ Select one: True False

True

Security training provides detailed information and hands-on instruction to employees to prepare them to perform their duties securely. Select one: True False

True

Since it was established in January 2001, every FBI field office has established an InfraGard program to collaborate with public and private organizations and the academic community. Select one: True False

True

Software code known as a(n) cookie can allow an attacker to track a victim's activity on Web sites. _________________________ Select one: True False

True

Some policies may also need a(n) sunset clause indicating their expiration date. _________________________ Select one: True False

True

Studies on ethics and computer use reveal that people of different nationalities have different perspectives; difficulties arise when one nationality's ethical behavior violates the ethics of another national group. Select one: True False

True

Technical controls are the tactical and technical implementations of security in the organization. _________________________ Select one: True False

True

The Computer Security Resource Center at NIST provides several useful documents free of charge in its special publications area. _________________________ Select one: True False

True

The Department of Homeland Security (DHS) works with academic campuses nationally, focusing on resilience, recruitment, internationalization, growing academic maturity and academic research. Select one: True False

True

The Digital Millennium Copyright Act is the American law created in response to Directive 95/46/EC, adopted in 1995 by the European Union. _________________________ Select one: True False

True

The Economic Espionage Act of 1996 protects American ingenuity, intellectual property, and competitive advantage. _________________________ Select one: True False

True

Microsoft acknowledged that if you type a res:// URL (a Microsoft-devised type of URL) which is longer than ____________________ characters in Internet Explorer 4.0, the browser will crash. Select one: a. 256 b. 64 c. 128 d. 512

a. 256

__________ is a network project that preceded the Internet. Select one: a. ARPANET b. DES c. NIST d. FIPS

a. ARPANET

According to NIST SP 800-14's security principles, security should ________. Select one: a. All of the above b. support the mission of the organization c. require a comprehensive and integrated approach d. be cost-effective

a. All of the above

Redundancy can be implemented at a number of points throughout the security architecture, such as in ________ Select one: a. All of the above b. proxy servers c. access controls d. firewalls

a. All of the above

Which of the following is a valid type of role when it comes to data ownership? Select one: a. All of the above b. Data owners c. Data custodians d. Data users

a. All of the above

hich of the following functions does information security perform for an organization? Select one: a. All of the above. b. Enabling the safe operation of applications implemented on the organization's IT systems. c. Protecting the organization's ability to function. d. Protecting the data the organization collects and uses.

a. All of the above.

__________ law comprises a wide variety of laws that govern a nation or state. Select one: a. Civil b. Private c. Criminal d. Public

a. Civil

Which of the following acts defines and formalizes laws to counter threats from computer related acts and offenses? Select one: a. Computer Fraud and Abuse Act of 1986 b. Freedom of Information Act (FOIA) of 1966 c. Electronic Communications Privacy Act of 1986 d. Federal Privacy Act of 1974

a. Computer Fraud and Abuse Act of 1986

Which of the following acts is a collection of statutes that regulate the interception of wire, electronic, and oral communications? Select one: a. Electronic Communications Privacy Act b. Financial Services Modernization Ac c. Sarbanes-Oxley Act d. Economic Espionage Act

a. Electronic Communications Privacy Act

Which of the following is an example of a Trojan horse program? Select one: a. Happy99.exe b. MyDoom c. Netsky d. Klez

a. Happy99.exe

_________ was the first operating system to integrate security as its core functions. Select one: a. MULTICS b. ARPANET c. DOS d. UNIX

a. MULTICS

__________ has become a widely accepted evaluation standard for training and education related to the security of information systems. Select one: a. NSTISSI No. 4011 b. ISO 17788 c. NIST SP 800-12 d. IEEE 802.11(g)

a. NSTISSI No. 4011 b.

__________ law regulates the structure and administration of government agencies and their relationships with citizens, employees, and other governments. Select one: a. Public b. Civil c. Criminal d. Private

a. Public

The ____________________ data file contains the hashed representation of the user's password. Select one: a. SAM b. FBI c. SNMP d. SLA

a. SAM

____ is any technology that aids in gathering information about a person or organization without their knowledge. Select one: a. Spyware b. A bot c. Trojan d. Worm

a. Spyware

The SETA program is a control measure designed to reduce the instances of __________ security breaches by employees. Select one: a. accidental b. physical c. intentional d. external

a. accidental

A(n) _________ is a document containing contact information for the people to be notified in the event of an incident. Select one: a. alert roster b. emergency notification system c. call register d. phone list

a. alert roster

In a ____________________ attack, the attacker sends a large number of connection or information requests to disrupt a target from a small number of sources. Select one: a. denial-of-service b. virus c. distributed denial-of-service d. spam

a. denial-of-service

Criminal or unethical __________ goes to the state of mind of the individual performing the act. Select one: a. intent b. attitude c. ignorance d. accident

a. intent

The stated purpose of ISO/IEC 27002 is to "offer guidelines and voluntary directions for information security __________." Select one: a. management b. implementation c. accreditation d. certification

a. management

Hackers can be generalized into two skill groups: expert and ____________________. Select one: a. novice b. journeyman c. packet monkey d. professional

a. novice

"4-1-9" fraud is an example of a ____________________ attack. Select one: a. social engineering b. spam c. virus d. worm

a. social engineering

A(n) ________ plan is a plan for the organization's intended strategic efforts over the next several years. Select one: a. strategic b. operational c. standard d. tactical

a. strategic

_______ controls cover security processes that are designed by strategic planners and implemented by the security administration of the organization. Select one: a. Operational b. Technical c. Managerial d. Informational

c. Managerial

__________ security addresses the issues necessary to protect the tangible items, objects, or areas of an organization from unauthorized access and misuse. Select one: a. Object b. Personal c. Physical d. Standard

c. Physical

Web hosting services are usually arranged with an agreement defining minimum service levels known as a(n) ____. Select one: a. MIN b. MSL c. SLA d. SSL

c. SLA

The __________ of 1999 provides guidance on the use of encryption and provides protection from government intervention. Select one: a. Economic Espionage Act b. USA PATRIOT Act c. Security and Freedom through Encryption Act d. Prepper Act

c. Security and Freedom through Encryption Act

A fundamental difference between a BIA and risk management is that risk management focuses on identifying the threats, vulnerabilities, and attacks to determine which controls can protect the information, while the BIA assumes __________. Select one: a. controls have proven ineffective b. controls have failed c. controls have been bypassed d. All of the above

d. All of the above

"Shoulder spying" is used in public or semipublic settings when individuals gather information they are not authorized to have by looking over another individual's shoulder or viewing the information from a distance. _________________________ Select one: True False

False

A breach of possession always results in a breach of confidentiality. Select one: True False

False

A champion is a project manager, who may be a departmental line manager or staff unit manager, and has expertise in project management and information security technical requirements. Select one: True False

False

A device (or a software program on a computer) that can monitor data traveling on a network is known as a socket sniffers. _________________________ Select one: True False

False

Confidentiality ensures that only those with the rights and privileges to access information are able to do so. _________________________ Select one: True False

True

Criminal laws addresses activities and conduct harmful to society and is categorized as private or public. Select one: True False

True

Cyberterrorists hack systems to conduct terrorist activities via network or Internet pathways. _________________________ Select one: True False

True

Due care and due diligence require that an organization make a valid effort to protect others and continually maintain this level of effort, ensuring these actions are effective. Select one: True False

True

During the early years of computing, the primary threats to security were physical theft of equipment, espionage against the products of the systems, and sabotage. Select one: True False

True

Expert hackers are extremely talented individuals who usually devote lots of time and energy to attempting to break into other people's information systems. Select one: True False

True

Forces of nature, force majeure, or acts of God can present some of the most dangerous threats, because they are usually occur with very little warning and are beyond the control of people. Select one: True False

True

Hackers are "persons who access systems and information without authorization and often illegally." _________________________ Select one: True False

True

Hardware is the physical technology that houses and executes the software, stores and transports the data, and provides interfaces for the entry and removal of information from the system. _________________________ Select one: True False

True

Individuals with authorization and privileges to manage information within the organization are most likely to cause harm or damage by accident. Select one: True False

True

Information security can begin as a grassroots effort in which systems administrators attempt to improve the security of their systems, often referred to as the bottom-up approach. _________________________ Select one: True False

True

Information security safeguards the technology assets in use at the organization. Select one: True False

True

A worm requires that another program is running before it can begin functioning. Select one: True False

False

According to the CNSS, networking is "the protection of information and its critical elements." _________________________ Select one: True False

False

An act of theft performed by a hacker falls into the category of "theft," but is also often accompanied by defacement actions to delay discovery and thus may also be placed within the category of "forces of nature." Select one: True False

False

An advance-fee fraud attack involves the interception of cryptographic elements to determine keys and encryption algorithms. Select one: True False

False

An e-mail virus involves sending an e-mail message with a modified field. Select one: True False

False

Applications systems developed within the framework of the traditional SDLC are designed to anticipate a software attack that requires some degree of application reconstruction. Select one: True False

False

Attacks conducted by scripts are usually unpredictable. Select one: True False

False

Civil law addresses activities and conduct harmful to society and is actively enforced by the state. _________________________ Select one: True False

False

Compared to Web site defacement, vandalism within a network is less malicious in intent and more public. Select one: True False

False

Cultural differences can make it difficulty to determine what is ethical and is not ethical between cultures, except when it comes to the use of computers, where ethics are considered universal. Select one: True False

False

Direct attacks originate from a compromised system or resource that is malfunctioning or working under the control of a threat. _________________________ Select one: True False

False

DoS attacks cannot be launched against routers. Select one: True False

False

Employees are not deterred by the potential loss of certification or professional accreditation resulting from a breach of a code of conduct as this loss has no effect on employees' marketability and earning power. Select one: True False

False

Ethics are the moral attitudes or customs of a particular group. _________________________ Select one: True False

False

For policy to become enforceable it only needs to be distributed, read, understood, and agreed to. Select one: True False

False

Hardware is often the most valuable asset possessed by an organization and it is the main target of intentional attacks. Select one: True False

False

In a study on software license infringement, those from United States were significantly more permissive than those from the Netherlands and other countries. _________________________ Select one: True False

False

In the context of information security, confidentiality is the right of the individual or group to protect themselves and their information from unauthorized access. Select one: True False

False

Information has redundancy when it is free from mistakes or errors and it has the value that the end user expects. _________________________ Select one: True False

False

Information security can be an absolute. Select one: True False

False

Information security's primary mission is to ensure that systems and their contents retain their confidentiality at any cost. Select one: True False

False

Intellectual privacy is recognized as a protected asset in the United States. _________________________ Select one: True False

False

Key end users should be assigned to a developmental team, known as the united application development team. _________________________ Select one: True False

False

Key studies reveal that legal penalties are the overriding factor in leveling ethical perceptions within a small population. Select one: True False

False

MULTICS stands for Multiple Information and Computing Service. _________________________ Select one: True False

False

Network security focuses on the protection of the details of a particular operation or series of activities. Select one: True False

False

Once a(n) back door has infected a computer, it can redistribute itself to all e-mail addresses found on the infected system. _________________________ Select one: True False

False

One form of e-mail attack that is also a DoS is called a mail spoof, in which an attacker overwhelms the receiver with excessive quantities of e-mail. _________________________ Select one: True False

False

One of the basic tenets of security architectures is the layered implementation of security, which is called defense in redundancy. _________________________ Select one: True False

False

Packet munchkins use automated exploits to engage in distributed denial-of-service attacks. _________________________ Select one: True False

False

Policies are detailed written instructions for accomplishing a specific task. _________________________ Select one: True False

False

Risk evaluation is the process of identifying, assessing, and evaluating the levels of risk facing the organization, specifically the threats to the organization's security and to the information stored and processed by the organization. _________________________ Select one: True False

False

Systems-specific security policies, commonly referred to as a fair and responsible use policy, are used to control constituents' use of a particular resource, asset, or activity. _________________________ Select one: True False

False

The Analysis phase of the SecSDLC begins the methodology initiated by a directive from upper management. _________________________ Select one: True False

False

The Computer Security Act of 1987 is the cornerstone of many computer-related federal laws and enforcement efforts; it was originally written as an extension and clarification of the Comprehensive Crime Control Act of 1984, Select one: True False

False

The Council of Europe Convention on Cyber-Crime has not been well received by advocates of intellectual property rights because it de-emphasizes prosecution for copyright infringement, but has been well received by supporters of individual rights in the U.S. Select one: True False

False

The Department of Homeland Security is the only U.S. federal agency charged with the protection of American information resources and the investigation of threats to, or attacks on, the resources. Select one: True False

False

The Department of Homeland Security was created in 2003 by the 9/11 Memorial Act of 2002. _________________________ Select one: True False

False

The Federal Privacy Act of 1974 regulates government agencies and holds them accountable if they release information about national security without permission. _________________________ Select one: True False

False

Intellectual property is defined as "the creation, ownership, and control of ideas as well as the representation of those ideas." _________________________ Select one: True False

True

The Graham-Leach-Bliley Act is a critical piece of legislation that affects the executive management of publicly traded corporations and public accounting firms. _________________________ Select one: True False

False

The ISSP sets out the requirements that must be met by the information security blueprint or framework. Select one: True False

False

The Security Development Life Cycle (SDLC) is a general methodology for the design and implementation of an information system. _________________________ Select one: True False

False

The application of computing and network resources to try every possible combination of options of a password is called a dictionary attack. _________________________ Select one: True False

False

The bottom-up approach to information security has a higher probability of success than the top-down approach. Select one: True False

False

The difference between a policy and a law is that ignorance of a law is an acceptable defense. Select one: True False

False

The global information security community has universally agreed with the justification for the code of practices as identified in the ISO/IEC 17799. Select one: True False

False

The implementation phase is the longest and most expensive phase of the systems development life cycle (SDLC). Select one: True False

False

The key components of the security perimeter include firewalls, DMZs (demilitarized zones), Web servers, and IDPSs. _________________________ Select one: True False

False

The macro virus infects the key operating system files located in a computer's boot sector. _________________________ Select one: True False

False

The operational plan documents the organization's intended long-term direction and efforts for the next several years. _________________________ Select one: True False

False

The physical design is the blueprint for the desired solution. Select one: True False

False

The possession of information is the quality or state of having value for some purpose or end. Select one: True False

False

The security framework is a more detailed version of the security blueprint. Select one: True False

False

The security model is the basis for the design, selection, and implementation of all security program elements including such things as policy implementation and ongoing policy and program management. _________________________ Select one: True False

False

Within security perimeters the organization can establish security redundancies, each with differing levels of security, between which traffic must be screened. _________________________ Select one: True False

False

​An attack, breach of policy, or other incident always constitutes a violation of law, requiring notification of law enforcement. Select one: True False

False

A data custodian works directly with data owners and is responsible for the storage, maintenance, and protection of the information. Select one: True False

True

A mail bomb is a form of DoS attack. Select one: True False

True

A number of technical mechanisms-digital watermarks and embedded code, copyright codes, and even the intentional placement of bad sectors on software media-have been used to deter or prevent the theft of software intellectual property. Select one: True False

True

A sniffer program can reveal data transmitted on a network segment including passwords, the embedded and attached files-such as word-processing documents-and sensitive data transmitted to or from applications. Select one: True False

True

A worm can deposit copies of itself onto all Web servers that the infected system can reach, so that users who subsequently visit those sites become infected. Select one: True False

True

A(n) polymorphic threat is one that over time changes the way it appears to antivirus software programs, making it undetectable by techniques that look for preconfigured signatures. _________________________ Select one: True False

True

A(n) project team should consist of a number of individuals who are experienced in one or multiple facets of the technical and nontechnical areas. _________________________ Select one: True False

True

As an organization grows it must often use more robust technology to replace the security technologies it may have outgrown. Select one: True False

True

The Federal Bureau of Investigation's National InfraGard Program serves its members in four basic ways: Maintains an intrusion alert network using encrypted e-mail; Maintains a secure Web site for communication about suspicious activity or intrusions; Sponsors local chapter activities; Operates a help desk for questions. _________________________ Select one: True False

True

The code of ethics put forth by (ISC)2 focuses on four mandatory canons: "Protect society, the commonwealth, and the infrastructure; act honorably, honestly, justly, responsibly, and legally; provide diligent and competent service to principals; and advance and protect the profession.". _________________________ Select one: True False

True

The communications networks of the United States carry more funds than all of the armored cars in the world combined. _________________________ Select one: True False

True

The investigation phase of the SecSDLC begins with a directive from upper management. Select one: True False

True

The malicious code attack includes the execution of viruses, worms, Trojan horses, and active Web scripts with the intent to destroy or steal information. _________________________ Select one: True False

True

The policy administrator is responsible for the creation, revision, distribution, and storage of the policy. Select one: True False

True

The process of examining an incident candidate and determining whether it constitutes an actual incident is called incident classification. _________________________ Select one: True False

True

The recovery point objective (RPO) is the point in time prior to a disruption or system outage to which mission/business process data can be recovered after an outage. _________________________ Select one: True False

True

The roles of information security professionals are almost always aligned with the goals and mission of the information security community of interest. Select one: True False

True

The stated purpose of ISO/IEC 27002, as derived from its ISO/IEC 17799 origins, is to offer guidelines and voluntary directions for information security management. _________________________ Select one: True False

True

To achieve defense in depth, an organization must establish multiple layers of security controls and safeguards. Select one: True False

True

To remain viable, security policies must have a responsible individual, a schedule of reviews, a method for making recommendations for reviews, and a policy issuance and planned revision date. Select one: True False

True

To remain viable, security policies must have a responsible manager, a schedule of reviews, a method for making recommendations for reviews, and a policy issuance and revision date.. _________________________ Select one: True False

True

You can create a single comprehensive ISSP document covering all information security issues. Select one: True False

True

aws and policies and their associated penalties only deter if which of the following conditions is present? Select one: a. Probability of penalty being administered b. All of the above c. Fear of penalty d. Probability of being caught

b. All of the above

The __________ attempts to prevent trade secrets from being illegally shared. Select one: a. Electronic Communications Privacy Act b. Economic Espionage Act c. Sarbanes-Oxley Act d. Financial Services Modernization Act

b. Economic Espionage Act

The Health Insurance Portability and Accountability Act Of 1996, also known as the __________ Act, protects the confidentiality and security of health care data by establishing and enforcing standards and by standardizing electronic data interchange. Select one: a. HITECH b. Kennedy-Kessebaum c. Privacy d. Gramm-Leach-Bliley

b. Kennedy-Kessebaum

_________ controls address personnel security, physical security, and the protection of production inputs and outputs. Select one: a. ​Managerial b. Operational c. ​Technical d. ​Informational

b. Operational

__________ is a strategy of using multiple types of technology that prevent the failure of one system from compromising the security of information. Select one: a. Domaining b. Redundancy c. Firewalling d. Hosting

b. Redundancy

A variation of n SDLC that can be used to implement information security solutions in an organizations with little or no formal security in place is the __________. Select one: a. CLSecD b. SecSDLC c. LCSecD d. SecDSLC

b. SecSDLC

Which of the following countries reported the least tolerant attitudes toward personal use of organizational computing resources? Select one: a. United States b. Singapore c. Australia d. Sweden

b. Singapore

_______often function as standards or procedures to be used when configuring or maintaining systems. Select one: a. ISSPs b. SysSPs c. ESSPs d. EISPs

b. SysSPs

When BS 7799 first came out, several countries, including the United States, Germany, and Japan, refused to adopt it, claiming that it had fundamental problems. Which of the following is NOT one of those problems Select one: a. It was not as complete as other frameworks. b. The global information security community had already defined a justification for a code of practice, such as the one identified in ISO/IEC 17799. c. The standard lacked the measurement precision associated with a technical standard. d. The standard was hurriedly prepared given the tremendous impact its adoption could have on industry information security controls.

b. The global information security community had already defined a justification for a code of practice, such as the one identified in ISO/IEC 17799.

A methodology for the design and implementation of an information system that is a formal development strategy is referred to as a __________. Select one: a. development life project b. systems development life cycle c. systems design d. systems schema

b. systems development life cycle

____________________ are malware programs that hide their true nature, and reveal their designed behavior only when activated. Select one: a. Worms b. Trojan horses c. Spam d. Viruses

b. Trojan horses

Individuals with authorization and privileges to manage information within the organization are most likely to cause harm or damage __________. Select one: a. with malice b. by accident c. with negligence d. with intent

b. by accident

A ____ site provides only rudimentary services and facilities. Select one: a. commercial b. cold c. warm d. hot

b. cold

Human error or failure often can be prevented with training, ongoing awareness activities, and ____________________. Select one: a. threats b. controls c. hugs d. paperwork

b. controls

____________________ is the premeditated, politically motivated attacks against information, computer systems, computer programs, and data which result in violence against noncombatant targets by subnational groups or clandestine agents. Select one: a. infoterrorism b. cyberterrorism c. hacking d. cracking

b. cyberterrorism

Incident _________ is the rapid determination of the scope of the breach of the confidentiality, integrity, and availability of information and information assets during or just following an incident. Select one: a. containment strategy b. damage assessment c. incident response d. disaster assessment

b. damage assessment

Standards may be published, scrutinized, and ratified by a group, as in formal or ________standards. Select one: a. de facto b. de jure c. de formale d. de public

b. de jure

The transfer of large batches of data to an off-site facility, usually through leased lines or services, is called ____. Select one: a. remote journaling b. electronic vaulting c. off-site storage d. database shadowing

b. electronic vaulting

As frustrating as viruses and worms are, perhaps more time and money is spent on resolving virus ____________________. Select one: a. false alarms b. hoaxes c. polymorphisms d. urban legends

b. hoaxes

During the __________ phase, specific technologies are selected to support the alternatives identified and evaluated in the prior phases. Select one: a. investigation b. physical design c. analysis d. implementation

b. physical design

Organizations are moving toward more __________-focused development approaches, seeking to improve not only the functionality of the systems they have in place, but consumer confidence in their product. Select one: a. accessibility b. security c. availability d. reliability

b. security

SP 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems, provides best practices and security principles that can direct the security team in the development of a security ________. Select one: a. blueprint b. standard c. policy d. plan

b. standard

According to the National Information Infrastructure Protection Act of 1996, the severity of the penalty for computer crimes depends on the value of the information obtained and whether the offense is judged to have been committed for each of the following except __________. Select one: a. for purposes of commercial advantage b. to harass c. for private financial gain d. in furtherance of a criminal act

b. to harass

​Security __________ are the areas of trust within which users can freely communicate. Select one: a. ​layers b. ​domains c. ​rectangles d. ​perimeters

b. ​domains

Complete loss of power for a moment is known as a ____. Select one: a. ​brownout b. ​fault c. ​lag d. ​blackout

b. ​fault

The CPMT conducts the BIA in three stages. Which of the following is NOT one of those stages? Select one: a. Determine mission/business processes and recovery criticality b. Identify recovery priorities for system resources c. All of these are BIA stages d. Identify resource requirements

c. All of these are BIA stages

The National Information Infrastructure Protection Act of 1996 modified which Act? Select one: a. Computer Security Act b. USA PATRIOT Improvement and Reauthorization Act c. Computer Fraud and Abuse Act d. USA PATRIOT Act

c. Computer Fraud and Abuse Act

__________ is a strategy for the protection of information assets that uses multiple layers and different types of controls (managerial, operational, and technical) to provide optimal protection. Select one: a. Best-effort b. Proxy c. Defense in depth d. Networking

c. Defense in depth

What is the subject of the Sarbanes-Oxley Act? Select one: a. Trade secrets b. Privacy c. Financial Reporting d. Banking

c. Financial Reporting

The Computer __________ and Abuse Act of 1986 is the cornerstone of many computer-related federal laws and enforcement efforts. Select one: a. Violence b. Usage c. Fraud d. Theft

c. Fraud

The Council of Europe adopted the Convention of CyberCrime in 2001 to oversee a range of security functions associated with __________ activities. Select one: a. electronic commerce b. online terrorist c. Internet d. cyberactivist

c. Internet

People with the primary responsibility for administering the systems that house the information used by the organization perform the ____ role. Select one: a. Security professionals b. Security policy developers c. System administrators d. End users

c. System administrators

The ____________________ hijacking attack uses IP spoofing to enable an attacker to impersonate another entity on the network. Select one: a. WWW b. FTP c. TCP d. HTTP

c. TCP

____________________ are compromised systems that are directed remotely (usually by a transmitted command) by the attacker to participate in an attack. Select one: a. Drones b. Servants c. Zombies d. Helpers

c. Zombies

A server would experience a __________ attack when a hacker compromises it to acquire information from it from a remote location using a network connection. Select one: a. hardware b. software c. direct d. indirect

c. direct

One form of online vandalism is ____________________ operations, which interfere with or disrupt systems to protest the operations, policies, or actions of an organization or government agency. Select one: a. hackcyber b. cyberhack c. hacktivist d. phreak

c. hacktivist

In file hashing, a file is read by a special algorithm that uses the value of the bits in the file to compute a single number called the __________ value. Select one: a. smashing b. result c. hash d. code

c. hash

In early 2014, in response to Executive Order 13636, NIST published the Cybersecurity Framework that intends to allow organization to __________. Select one: a. assess progress toward a recommended target state b. communicate among local, state and national agencies about cybersecurity risk c. identify and prioritize opportunities for improvement within the context of a continuous and repeatable process d. None of these

c. identify and prioritize opportunities for improvement within the context of a continuous and repeatable process

The spheres of security are the foundation of the security framework and illustrate how information is under attack from a variety of sources, with far fewer protection layers between the information and potential attackers on the __________ side of the organization. Select one: a. operational b. Internet c. people d. technology

c. people

Acts of ____________________ can lead to unauthorized real or virtual actions that enable information gatherers to enter premises or systems they have not been authorized to enter. Select one: a. theft b. security c. trespass d. bypass

c. trespass

A type of SDLC where each phase has results that flow into the next phase is called the __________ model. Select one: a. Method 7 b. pitfall c. waterfall d. SA&D

c. waterfall

An information system is the entire set of __________, people, procedures, and networks that make possible the use of information resources in the organization. Select one: a. data b. software c. hardware d. All of the above

d. All of the above

__________ of information is the quality or state of being genuine or original. Select one: a. Confidentiality b. Authorization c. Spoofing d. Authenticity

d. Authenticity

The ____ is the individual primarily responsible for the assessment, management, and implementation of information security in the organization. Select one: a. CIO b. CTO c. ISO d. CISO

d. CISO

The ________is based on and directly supports the mission, vision, and direction of the organization and sets the strategic direction, scope, and tone for all security efforts. Select one: a. ISSP b. GSP c. SysSP d. EISP

d. EISP

What is the subject of the Computer Security Act? Select one: a. Telecommunications Common Carriers b. Cryptography Software Vendors c. Banking Industry d. Federal Agency Information Security

d. Federal Agency Information Security

Which of the following acts is also widely known as the Gramm-Leach-Bliley Act? Select one: a. Computer Security Act b. Communications Act c. Health Insurance Portability and Accountability Act d. Financial Services Modernization Act

d. Financial Services Modernization Act

Part of the logical design phase of the SecSDLC is planning for partial or catastrophic loss. ____ dictates what immediate steps are taken when an attack occurs. Select one: a. Security response b. Continuity planning c. Disaster recovery d. Incident response

d. Incident response

The __________ defines stiffer penalties for prosecution of terrorist crimes. Select one: a. Gramm-Leach-Bliley Act b. Economic Espionage Act c. Sarbanes-Oxley Act d. USA PATRIOT Act

d. USA PATRIOT Act

The famous study entitled "Protection Analysis: Final Report" focused on a project undertaken by ARPA to understand and detect __________ in operating systems security. Select one: a. Bugs b. Maintenance hooks c. Malware d. Vulnerabilities

d. Vulnerabilities

A ____________________ is an attack in which a coordinated stream of requests is launched against a target from many locations at the same time. Select one: a. virus b. spam c. denial-of-service d. distributed denial-of-service

d. distributed denial-of-service

A security ________ is an outline of the overall information security strategy for the organization and a roadmap for planned changes to the information security environment of the organization. Select one: a. model b. plan c. policy d. framework

d. framework

Which of the following phases is often considered the longest and most expensive phase of the systems development life cycle? Select one: a. investigation b. implementation c. logical design d. maintenance and change

d. maintenance and change

In the well-known ____________________ attack, an attacker monitors (or sniffs) packets from the network, modifies them, and inserts them back into the network. Select one: a. server-in-the-middle b. zombie-in-the-middle c. sniff-in-the-middle d. man-in-the-middle

d. man-in-the-middle

The Privacy of Customer Information Section of the common carrier regulation states that any proprietary information shall be used explicitly for providing services, and not for any __________ purposes. Select one: a. customer service b. billing c. troubleshooting d. marketing

d. marketing

RAID is an acronym for a __________ array of independent disk drives that stores information across multiple units to spread out data and minimize the impact of a single drive failure. Select one: a. resistant b. replicated c. random d. redundant

d. redundant

A computer is the __________ of an attack when it is used to conduct an attack against another computer. Select one: a. object b. target c. facilitator d. subject

d. subject