Deck 1: Introduction to the Management of Information Security

Question 1

The application of computing and network resources to try every possible combination of options of a password is called a dictionary attack._________________________

Answer 1

 False
brute force

Question 2

Communications security involves the protection of which of the following?.

A) radio handsets
B) people, physical assets 
C) the IT department
D) media, technology, and content

Answer 2

D

Question 3

What do audit logs that track user activity on an information system provide? 

A) identification
B) authorization 
C) accountability
D) authentication

Answer 3

C

Question 4

One form of e-mail attack that is also a DoS attack is called a mail spoof,in which an attacker overwhelms the receiver with excessive quantities of e-mail._________________________

Question 5

A(n)polymorphic threat is one that over time changes the way it appears to antivirus software programs,making it undetectable by techniques that look for pre-configured signatures._________________________

Question 6

The malicious code attack includes the execution of viruses,worms,Trojan horses,and active Web scripts with the intent to destroy or steal information._________________________

Question 7

Which of the following is a C.I.A.characteristic that ensures that only those with sufficient privileges and a demonstrated need may access certain information? 

A) Integrity
B) Availability 
C) Authentication
D) Confidentiality

Question 8

A device (or a software program on a computer)that can monitor data traveling on a network is known as a socket sniffer._________________________

Question 9

The first step in solving problems is to gather facts and make assumptions.

Question 10

When voltage levels lag (experience a momentary increase),the extra voltage can severely damage or destroy equipment._________________________

Question 11

The term phreaker is now commonly associated with an individual who cracks or removes software protection that is designed to prevent unauthorized duplication._________________________

Question 12

A worm may be able to deposit copies of itself onto all Web servers that the infected system can reach,so that users who subsequently visit those sites become infected.

Question 13

Which of the following is the principle of management that develops,creates,and implements strategies for the accomplishment of objectives? 

A) leading
B) controlling 
C) organizing
D) planning

Question 14

"Shoulder spying" is used in public or semi-public settings when individuals gather information they are not authorized to have by looking over another individual's shoulder or viewing the information from a distance._________________________

Question 15

The use of cryptographic certificates to establish Secure Sockets Layer (SSL)connections is an example of which process? 

A) accountability
B) authorization 
C) identification
D) authentication

Question 16

According to the C.I.A.triad,which of the following is a desirable characteristic for computer security? 

A) accountability
B) availability 
C) authorization
D) authentication

Question 17

DoS attacks cannot be launched against routers.

Question 18

Corruption of information can occur only while information is being stored.

Question 19

The authorization process takes place before the authentication process.

Question 20

The macro virus infects the key operating system files located in a computer's start up sector._________________________

Question 21

Which of the following is NOT a step in the problem-solving process? 

A) Select, implement and evaluate a solution 
B) Analyze and compare possible solutions 
C) Build support among management for the candidate solution 
D) Gather facts and make assumptions

Question 22

Which of the following is the principle of management dedicated to the structuring of resources to support the accomplishment of objectives? 

A) organization
B) planning 
C) controlling
D) leading

Question 23

Which of the following is a feature left behind by system designers or maintenance staff that allows quick access to a system at a later time by bypassing access controls? 

A) brute force
B) DoS 
C) back door
D) hoax

Question 24

As frustrating as viruses and worms are,perhaps more time and money is spent on resolving virus ____________________.

A) false alarms
B) polymorphisms 
C) hoaxes
D) urban legends

Question 25

Web hosting services are usually arranged with an agreement defining minimum service levels known as a(n)____.

A) SSL
B) SLA 
C) MSL
D) MIN

Question 26

One form of online vandalism is ____________________ operations,which interfere with or disrupt systems to protest the operations,policies,or actions of an organization or government agency.

A) hacktivist
B) phreak 
C) hackcyber
D) cyberhack

Question 27

Which of the following functions of Information Security Management seeks to dictate certain behavior within the organization through a set of organizational guidelines? 

A) planning
B) policy 
C) programs
D) people

Question 28

Blackmail threat of informational disclosure is an example of which threat category? 

A) Espionage or trespass
B) Information extortion 
C) Sabotage or vandalism
D) Compromises of intellectual property

Question 29

Acts of ____________________ can lead to unauthorized real or virtual actions that enable information gatherers to enter premises or systems they have not been authorized to enter.

A) bypass
B) theft 
C) trespass
D) security

Question 30

A short-term interruption in electrical power availability is known as a ____.

A) ​fault
B) ​brownout 
C) ​blackout
D) ​lag

Question 31

"4-1-9" fraud is an example of a ____________________ attack.

A) social engineering
B) virus 
C) worm
D) spam

Question 32

Which of the following is NOT a primary function of Information Security Management? 

A) planning
B) protection 
C) projects
D) performance

Question 33

In the ____________________ attack,an attacker monitors (or sniffs)packets from the network,modifies them,and inserts them back into the network.

A) zombie-in-the-middle
B) sniff-in-the-middle 
C) server-in-the-middle
D) man-in-the-middle

Question 34

​Which of the following is not among the 'deadly sins of software security'? 

A) ​Extortion sins 
B) Implementation sins 
C) ​Web application sins 
D) ​Networking sins

Question 35

Which of the following is the first step in the problem-solving process? 

A) Analyze and compare the possible solutions 
B) Develop possible solutions 
C) Recognize and define the problem 
D) Select, implement and evaluate a solution

Question 36

Which type of attack involves sending a large number of connection or information requests to a target? 

A) malicious code
B) denial-of-service (DoS) 
C) brute force
D) spear fishing

Question 37

____________________ are malware programs that hide their true nature,and reveal their designed behavior only when activated.

A) Viruses
B) Worms 
C) Spam
D) Trojan horses

Question 38

Which function of InfoSec Management encompasses security personnel as well as aspects of the SETA program? 

A) protection 
B) people 
C) projects 
D) policy

Question 39

A ____________________ is an attack in which a coordinated stream of requests is launched against a target from many locations at the same time.

A) denial-of-service
B) distributed denial-of-service 
C) virus
D) spam

Question 40

Human error or failure often can be prevented with training,ongoing awareness activities, and ____________________.

A) threats
B) education 
C) hugs
D) paperwork

Question 41

____________________ is unsolicited commercial e-mail.

Question 42

ESD is the acronym for ____________________ discharge.

Question 43

A ____________ overflow is an application error that occurs when the system can't handle the amount of data that is sent.

Question 44

What are the three distinct groups of decision makers or communities of interest on an information security team?

Question 45

Duplication of software-based intellectual property is more commonly known as software ____________________.

Question 46

List the measures that are commonly used to protect the confidentiality of information.

Question 47

A(n)____________________ hacks the public telephone network to make free calls or disrupt services.

Question 48

Attempting to reverse-calculate a password is called ____________________.

Question 49

Explain the differences between a leader and a manager.

Question 50

A(n)____________________ is an act against an asset that could result in a loss.

Question 51

List and explain the critical characteristics of information as defined by the C.I.A.triad.

Question 52

The three levels of planning are strategic planning,tactical planning,and ____________________ planning.

Question 53

A virus or worm can have a payload that installs a(n)____________________ door or trap door component in a system,which allows the attacker to access the system at will with special privileges.

Question 54

List the specialized areas of security.

Question 55

The set of organizational guidelines that dictates certain behavior within the organization is called ____________________.

Question 56

Some information gathering techniques are quite legal,for example,using a Web browser to perform market research.These legal techniques are called,collectively,competitive ____________________.

Question 57

List and explain the four principles of management under the contemporary or popular management theory.Briefly define each.

Question 58

A(n)____________________ is a potential weakness in an asset or its defensive control(s).

Question 59

List the steps that can be used as a basic blueprint for solving organizational problems.

Question 60

A momentary low voltage is called a(n)____________________.

Question 61

Discuss the planning element of information security.

Question 62

What is authentication?  Provide some examples.

Question 63

There are 12 general categories of threat to an organization's people,information,and systems.List at least six of the general categories of threat and identify at least one example of those listed.