Question 1

Most information security incidents will occur because of users who do not follow secure computing practices and procedures.

Accepted Answer

This is a commonly accepted fact in the field of information security. While there may be technical vulnerabilities and attacks, the majority of security incidents are due to human error or negligence. Therefore, education and awareness training for users is crucial in preventing security incidents.

Question 2

Time-to-exploitation is the elapsed time between when vulnerability in a software app or system is discovered and when it's exploited.

Accepted Answer

Time-to-exploitation is indeed the elapsed time between when vulnerability in a software app or system is discovered and when it's exploited.

Question 3

When new vulnerabilities are found in operating systems, applications, or wired and wireless networks, vendors of those products release firewalls or downloads to fix the vulnerabilities.

Accepted Answer

Vendors release patches or updates, not firewalls, to fix vulnerabilities in operating systems, applications, or networks.

Question 4

The typical name for a company's policy that informs users of their responsibilities regarding the use of computing resources and information, including acceptable and unacceptable actions, and consequences for noncompliance is the Terms of Service TOS) agreement.

Accepted Answer

The typical name for such a policy is an Acceptable Use Policy (AUP), not a Terms of Service (TOS) agreement. An AUP specifically outlines the acceptable and unacceptable uses of a company's computing resources.

Question 5

The "Payment Card Industry Data Security Standard PCI DSS)" created by Visa, MasterCard, American Express, and Discover is a set of voluntary security guidelines for retailers who accept Visa, MasterCard, American Express, and Discover credit cards.

Accepted Answer

The Payment Card Industry Data Security Standard (PCI DSS) is not voluntary; it is a mandatory set of security standards for all entities that store, process, or transmit cardholder data from major credit card brands, including Visa, MasterCard, American Express, and Discover.

Question 6

Intrusion Detection Systems IDS) are designed to detect and protect a network primarily from external threats.

Accepted Answer

While IDS can be used to detect and protect against external threats, they are also designed to detect and prevent internal threats, such as insider attacks or malware infections.

Question 7

While security threats from e-mail viruses and malware have been declining for years as e-mail security has improved, threats from social networks and cloud computing have increased considerably in recent years.

Accepted Answer

As stated in the sentence, threats from social networks and cloud computing have increased considerably in recent years while e-mail virus and malware threats have been declining.

Question 8

The director of the Federal Trade Commission FTC) bureau of consumer protection warned that the agency would bring enforcement action against small businesses that failed to transmit sensitive data.

Accepted Answer

There is no evidence or statement indicating that the director of the FTC bureau of consumer protection made such a warning.

Question 9

Intrusion Detection Systems IDS) are designed to monitor network traffic and identify threats that may have breached the networks initial defenses.

Accepted Answer

This is the basic function of an Intrusion Detection System (IDS).

Question 10

In the United States, the Sarbanes-Oxley Act SOX), Gramm-Leach-Bliley Act GLB), Federal Information Security Management Act FISMA), and USA Patriot Act all require businesses to protect personally identifiable information.

Accepted Answer

All of these acts have provisions regarding the protection of personally identifiable information. SOX requires publicly traded companies to secure financial data, GLB mandates financial institutions to protect customer information, FISMA requires federal agencies to secure sensitive information, and the USA Patriot Act contains provisions related to the protection of personal information from terrorist activities.

Question 11

Organizations that use the defense-in-depth model of network security develop strategic layers of protection against security breaches.

Accepted Answer

The defense-in-depth model involves creating layers of security measures to protect against cyber threats, making it true that organizations employing this model develop strategic layers of protection against security breaches.

Question 12

Theft of data, inappropriate use of data
e.g., manipulating inputs) and malicious damage to computer resources are all considered "intentional" security threats.

Accepted Answer

Theft of data, inappropriate use of data, and malicious damage to computer resources all involve deliberate or intentional actions, making them intentional security threats.

Question 13

The supervision, monitoring, and control of the organization's IT assets is called strategic planning for IT.

Accepted Answer

The supervision, monitoring, and control of the organization's IT assets is called IT asset management or IT governance, but it is not the same as strategic planning for IT. Strategic planning for IT involves the development of a long-term plan that aligns the organization's IT goals with its overall business strategy.

Question 14

The Computing Cost/Benefit CCB) audit is an exercise that determines the impact of losing the support or availability of a resource.

Accepted Answer

The Computing Cost/Benefit (CCB) audit is an exercise that evaluates the costs and benefits of a computing project or investment, not the impact of losing the support or availability of a resource.

Question 15

In cybersecurity terms, the function of a password together with a username is to authenticate a user's identity to verify that the person has the right to access a computer or network.

Accepted Answer

This is true. The combination of a password and username is a common method of authentication used in cybersecurity to verify a user's identity and grant access to a computer or network.

Question 16

The Business impact analysis BIA) is an exercise that determines the impact of losing the support or availability of a resource.

Accepted Answer

The Business impact analysis (BIA) is an exercise that identifies and evaluates the potential effects of a disruption or loss of critical business functions and processes. It determines the impact of losing the support or availability of a resource and helps in developing strategies to minimize the impact on the business.

Question 17

The supervision, monitoring, and control of the organization's IT assets is called IT governance.

Accepted Answer

This statement is true. IT governance refers to the management of the organization's IT assets, including supervising, monitoring, and controlling them to ensure they align with the organization's goals and objectives.

Question 18

Intrusion Detection Systems IDS) are designed to detect and protect a network primarily from internal threats.

Accepted Answer

The answer of Intrusion Detection Systems IDS) are designed to...

Question 19

IT professionals work hard to protect key characteristics of an asset from security breaches. One of these characteristics is flexibility, or the property that data is accessible and modifiable when needed by those authorized to do so.

Accepted Answer

The key characteristics of an asset that IT professionals work hard to protect from security breaches are confidentiality, integrity, and availability, not flexibility. Flexibility refers to the adaptability of systems and processes, not a direct characteristic of data security.

Question 20

Effective organizations develop an Acceptable Use Policy AUP) that informs users of their responsibilities regarding the use of computing resources and information, including acceptable and unacceptable actions, and consequences for noncompliance.

Accepted Answer

It is true that effective organizations develop an Acceptable Use Policy (AUP) to inform users of their responsibilities regarding the use of computing resources and information.

Quiz 5: Cybersecurity, Compliance, and Business Continuity