Question 1

The investigation phase of the SDLC involves specification of the objectives, constraints, and
scope of the project.

Accepted Answer

The investigation phase is the first stage of the SDLC where the objectives, constraints, and scope of the project are identified and analyzed.

Question 2

The physical design is the blueprint for the desired solution.

Accepted Answer

False

Question 3

Hardware is often the most valuable asset possessed by an organization, and it is the main target of intentional attacks.

Accepted Answer

While hardware can be valuable, information or data is often considered the most valuable asset for many organizations and is frequently the main target of intentional attacks due to its sensitive and proprietary nature.

Question 4

When a computer is the subject of an attack, it is the entity being attacked.

Accepted Answer

The answer of When a computer is the subject of...

Question 5

The possession of information is the quality or state of having value for some purpose or end.

Accepted Answer

The possession of information refers to the state of having knowledge or data, not necessarily its value for a purpose or end. The value of information is determined by its relevance and applicability to a specific purpose or end, not merely by possessing it.

Question 6

Network security focuses on the protection of physical items, objects, or areas from unauthorized access and
misuse.

Accepted Answer

Network security focuses on the protection of data and information transmitted across a network, not physical items or areas.

Question 7

To achieve balance-that is, to operate an information system that satisfies the user and the security professional-the security level must allow reasonable access, yet protect against threats.

Accepted Answer

Achieving balance between user access and security is a fundamental principle in information security. It involves finding a security level that does not overly restrict user access but still protects against potential threats.

Question 8

The roles of information security professionals are almost always aligned with the goals and mission of the information security community of interest.

Accepted Answer

Information security professionals are responsible for protecting the confidentiality, integrity, and availability of an organization's information assets. Their roles are aligned with the goals and mission of the information security community of interest which is to ensure the protection of these assets from unauthorized access, use, disclosure, disruption, modification, or destruction. Therefore, the statement "the roles of information security professionals are almost always aligned with the goals and mission of the information security community of interest" is true.

Question 9

The implementation phase is the longest and most expensive phase of the systems development life cycle (SDLC).

Accepted Answer

The implementation phase, while significant, is not necessarily the longest or most expensive phase of the SDLC. The analysis and design phases can be equally or more time-consuming and costly, depending on the complexity of the project.

Question 10

A data custodian works directly with data owners and is responsible for the storage, maintenance, and protection of the information.

Accepted Answer

A data custodian is responsible for the maintenance, security, and storage of data received from data owners. They ensure the data is stored and protected in accordance with organization policies and regulatory requirements.

Question 11

The bottom-up approach to information security has a higher probability of success than the top-down approach.

Accepted Answer

The top-down approach to information security is generally considered more effective because it involves support and commitment from senior management, ensuring that policies and procedures are aligned with the organization's objectives and enforced throughout the organization.

Question 12

E-mail spoofing involves sending an e-mail message with a harmful attachment.

Accepted Answer

E-mail spoofing involves sending an e-mail message with a falsified sender address, but it may or may not have a harmful attachment.

Question 13

In the physical design phase, specific technologies are selected.

Accepted Answer

In the physical design phase, specific technologies are chosen based on the requirements and constraints identified in the conceptual and logical design phases. This includes selecting hardware, software, and network infrastructure components.

Question 14

The value of information comes from the characteristics it possesses.

Accepted Answer

The value of information depends on its characteristics such as relevance, accuracy, completeness, timeliness, reliability, and accessibility. These characteristics determine how useful and beneficial the information is to the decision-making process.

Question 15

Using a methodology will usually have no effect on the probability of success.

Accepted Answer

Using a methodology can increase the probability of success by providing a structured approach and clear guidelines for achieving goals. It can help avoid errors, improve efficiency, and increase overall effectiveness. However, the choice of methodology and its implementation are important factors that can affect the outcome.

Question 16

Information security can be an absolute.

Accepted Answer

Information security cannot be an absolute because there is no such thing as 100% security. Security measures can be implemented to reduce risk and protect data, but there is always a possibility of a security breach or vulnerability.

Question 17

A breach of possession may not always result in a breach of confidentiality.

Accepted Answer

A breach of possession refers to a situation where there is unauthorized access to or loss of physical or digital assets. On the other hand, a breach of confidentiality occurs when there is improper disclosure of sensitive or confidential information. While a breach of possession can lead to a breach of confidentiality, it is not always the case. For example, if someone steals a laptop containing confidential data, it would be a breach of possession and confidentiality, but if someone finds a lost USB drive with confidential data, it would be a breach of possession but not necessarily confidentiality if they do not disclose the information.

Question 18

During the early years of computing, the primary threats to security were physical theft of equipment, espionage against the products of the systems, and sabotage.

Accepted Answer

During the early years of computing, the primary threats to security were physical theft of equipment, espionage against the products of the systems, and sabotage.

Question 19

The water-ski model is a type of SDLC in which each phase of the process flows from the information gained in the previous phase, with multiple opportunities to return to previous phases and make adjustments.

Accepted Answer

The water-ski model is not a recognized model of the Software Development Life Cycle (SDLC). The description given matches more closely with iterative models like the Agile methodology, where there is flexibility to revisit and adjust previous phases based on new information.

Question 20

A champion is a project manager, who may be a departmental line manager or staff unit manager, and has expertise in project management and information security technical requirements.

Accepted Answer

A champion in the context of project management and organizational change typically refers to a person who promotes and supports a project, idea, or initiative within the organization, but they are not necessarily a project manager with expertise in project management and information security technical requirements. They are more often a high-level supporter who believes in the project's value and helps to overcome resistance and garner organizational support.

Quiz 1: Introduction to Information Security

The investigation phase of the SDLC involves specification of the objectives, constraints, and scope of the project.

The physical design is the blueprint for the desired solution.

Hardware is often the most valuable asset possessed by an organization, and it is the main target of intentional attacks.

When a computer is the subject of an attack, it is the entity being attacked.

The possession of information is the quality or state of having value for some purpose or end.

Network security focuses on the protection of physical items, objects, or areas from unauthorized access and misuse.

To achieve balance-that is, to operate an information system that satisfies the user and the security professional-the security level must allow reasonable access, yet protect against threats.

The roles of information security professionals are almost always aligned with the goals and mission of the information security community of interest.

The implementation phase is the longest and most expensive phase of the systems development life cycle (SDLC).

A data custodian works directly with data owners and is responsible for the storage, maintenance, and protection of the information.

The bottom-up approach to information security has a higher probability of success than the top-down approach.

E-mail spoofing involves sending an e-mail message with a harmful attachment.

In the physical design phase, specific technologies are selected.

The value of information comes from the characteristics it possesses.

Using a methodology will usually have no effect on the probability of success.

Information security can be an absolute.

A breach of possession may not always result in a breach of confidentiality.

During the early years of computing, the primary threats to security were physical theft of equipment, espionage against the products of the systems, and sabotage.

The water-ski model is a type of SDLC in which each phase of the process flows from the information gained in the previous phase, with multiple opportunities to return to previous phases and make adjustments.

A champion is a project manager, who may be a departmental line manager or staff unit manager, and has expertise in project management and information security technical requirements.