Deck 1: Introduction to Information Security

Question 1

Network security focuses on the protection of the details of a particular operation or series of activities.

Answer 1

False

Question 2

Using a methodology increases the probability of success.

Answer 2

True

Question 3

The physical design is the blueprint for the desired solution.

Answer 3

False

Question 4

To achieve balance - that is,to operate an information system that satisfies the user and the security professional - the security level must allow reasonable access,yet protect against threats.

Question 5

The investigation phase of the SecSDLC begins with a directive from upper management.

Question 6

Recently,many states have implemented legislation making certain computer-related activities illegal.

Question 7

Information security can be an absolute.

Question 8

The value of information comes from the characteristics it possesses.

Question 9

The possession of information is the quality or state of having value for some purpose or end.

Question 10

Hardware is often the most valuable asset possessed by an organization and it is the main target of intentional attacks.

Question 11

A champion is a project manager,who may be a departmental line manager or staff unit manager,and understands project management,personnel management,and information security technical requirements.

Question 12

When a computer is the subject of an attack,it is the entity being attacked.

Question 13

The implementation phase is the longest and most expensive phase of the systems development life cycle (SDLC).

Question 14

A data custodian works directly with data owners and is responsible for the storage,maintenance,and protection of the information.

Question 15

The bottom-up approach to information security has a higher probability of success than the top-down approach.

Question 16

Applications systems developed within the framework of the traditional SDLC are designed to anticipate a software attack that requires some degree of application reconstruction.

Question 17

An e-mail virus involves sending an e-mail message with a modified field.

Question 18

The roles of information security professionals are aligned with the goals and mission of the information security community of interest.

Question 19

The primary threats to security during the early years of computers were physical theft of equipment,espionage against the products of the systems,and sabotage.

Question 20

A breach of possession always results in a breach of confidentiality.

Question 21

____ is the predecessor to the Internet.

A)NIST
B)ARPANET
C)FIPS
D)DES

Question 22

The Security Development Life Cycle (SDLC)is a methodology for the design and implementation of an information system._________________________

Question 23

A(n)____ attack is a hacker using a personal computer to break into a system.

A)indirect
B)direct
C)software
D)hardware

Question 24

A famous study entitled "Protection Analysis: Final Report" was published in ____.

A)1868
B)1978
C)1988
D)1998

Question 25

Hardware is the physical technology that houses and executes the software,stores and transports the data,and provides interfaces for the entry and removal of information from the system._________________________

Question 26

____ was the first operating system to integrate security as its core functions.

A)UNIX
B)DOS
C)MULTICS
D)ARPANET

Question 27

Of the two approaches to information security implementation,the top-down approach has a higher probability of success._________________________

Question 28

Information has redundancy when it is free from mistakes or errors and it has the value that the end user expects._________________________

Question 29

Confidentiality ensures that only those with the rights and privileges to access information are able to do so._________________________

Question 30

Direct attacks originate from a compromised system or resource that is malfunctioning or working under the control of a threat._________________________

Question 31

MULTICS stands for Multiple Information and Computing Service._________________________

Question 32

____ security addresses the issues necessary to protect the tangible items,objects,or areas of an organization from unauthorized access and misuse.

A)Physical
B)Personal
C)Object
D)Standard

Question 33

In information security,salami theft occurs when an employee steals a few pieces of information at a time,knowing that taking more would be noticed - but eventually the employee gets something complete or useable._________________________

Question 34

Information security can begin as a grassroots effort in which systems administrators attempt to improve the security of their systems,which is often referred to as a bottom-up approach._________________________

Question 35

In general,protection is "the quality or state of being secure-to be free from danger." _________________________

Question 36

The Analysis phase of the SecSDLC begins with a directive from upper management._________________________

Question 37

Key end users should be assigned to a developmental team,known as the united application development team._________________________

Question 38

Risk evaluation is the process of identifying,assessing,and evaluating the levels of risk facing the organization,specifically the threats to the organization's security and to the information stored and processed by the organization._________________________

Question 39

A(n)project team should consist of a number of individuals who are experienced in one or multiple facets of the technical and nontechnical areas._________________________

Question 40

Policies are written instructions for accomplishing a specific task._________________________

Question 41

In file hashing,a file is read by a special algorithm that uses the value of the bits in the file to compute a single large number called a ____ value.

A)key
B)hashing
C)hash
D)code

Question 42

The ____ is the individual primarily responsible for the assessment,management,and implementation of information security in the organization.

A)ISO
B)CIO
C)CISO
D)CTO

Question 43

The ____ is a methodology for the design and implementation of an information system in an organization.

A)DSLC
B)SDLC
C)LCSD
D)CLSD

Question 44

The Internet brought connectivity to virtually all computers that could reach a phone line or an Internet-connected local area ____________________.

Question 45

During the early years,information security was a straightforward process composed predominantly of ____________________ security and simple document classification schemes.

Question 46

A computer is the ____ of an attack when it is used to conduct the attack.

A)subject
B)object
C)target
D)facilitator

Question 47

The CNSS model of information security evolved from a concept developed by the computer security industry known as the ____________________ triangle.

Question 48

Which of the following phases is the longest and most expensive phase of the systems development life cycle?

A)investigation
B)logical design
C)implementation
D)maintenance and change

Question 49

Organizations are moving toward more ____-focused development approaches,seeking to improve not only the functionality of the systems they have in place,but consumer confidence in their product.

A)security
B)reliability
C)accessibility
D)availability

Question 50

An information system is the entire set of ____,people,procedures,and networks that make possible the use of information resources in the organization.

A)software
B)hardware
C)data
D)All of the above

Question 51

____ of information is the quality or state of being genuine or original.

A)Authenticity
B)Spoofing
C)Confidentiality
D)Authorization

Question 52

The history of information security begins with the history of ____________________ security.

Question 53

People with the primary responsibility for administering the systems that house the information used by the organization perform the ____ role.

A)security policy developers
B)security professionals
C)system administrators
D)end users

Question 54

During the ____________________ War,many mainframes were brought online to accomplish more complex and sophisticated tasks so it became necessary to enable the mainframes to communicate via a less cumbersome process than mailing magnetic tapes between computer centers.

Question 55

The ____ model consists of six general phases.

A)pitfall
B)5SA&D
C)waterfall
D)SysSP

Question 56

During the ____ phase,specific technologies are selected to support the alternatives identified and evaluated in the logical design.

A)investigation
B)implementation
C)analysis
D)physical design

Question 57

____ presents a comprehensive information security model and has become a widely accepted evaluation standard for the security of information systems.

A)NIST SP 800-12
B)NSTISSI No.4011
C)IEEE 802.11(g)
D)ISO 17788

Question 58

The most successful kind of top-down approach involves a formal development strategy referred to as a ____.

A)systems design
B)development life project
C)systems development life cycle
D)systems schema

Question 59

Part of the logical design phase of the SecSDLC is planning for partial or catastrophic loss.____ dictates what steps are taken when an attack occurs.

A)Continuity planning
B)Incident response
C)Disaster recovery
D)Security response

Question 60

Which of the following is a valid type of data ownership?

A)Data owners
B)Data custodians
C)Data users
D)All of the above

Question 61

In the ____________________ approach,the project is initiated by upper-level managers who issue policy,procedures and processes,dictate the goals and expected outcomes,and determine accountability for each required action.

Question 62

Information has ____________________ when it is whole,complete,and uncorrupted.

Question 63

In an organization,the value of ____________________ of information is especially high when it involves personal information about employees,customers,or patients.

Question 64

A(n)____________________ is a formal approach to solving a problem by means of a structured sequence of procedures.

Question 65

____________________ enables authorized users - persons or computer systems - to access information without interference or obstruction and to receive it in the required format.

Question 66

A frequently overlooked component of an IS,____________________ are written instructions for accomplishing a specific task.

Question 67

The senior technology officer is typically the chief ____________________ officer.

Question 68

List and describe the six phases of the security systems development life cycle.

Question 69

Describe the multiple types of security systems present in many organizations.

Question 70

____________________ carries the lifeblood of information through an organization.

Question 71

The ____________________ component of the IS comprises applications,operating systems,and assorted command utilities.

Question 72

Outline types of data ownership and their respective responsibilities.

Question 73

A(n)____________________ information security policy outlines the implementation of a security program within the organization.

Question 74

The ____________________ of information is the quality or state of ownership or control of some object or item.

Question 75

A(n)_________________________ is a group of individuals who are united by similar interests or values within an organization and who share a common goal of helping the organization to meet its objectives.

Question 76

A computer is the ____________________ of an attack when it is the target entity.

Question 77

The ____________________ phase consists primarily of assessments of the organization,its current systems,and its capability to support the proposed systems.

Question 78

____________________ of information is the quality or state of being genuine or original,rather than a reproduction or fabrication.