Question 1

A worm is a virus that has the ability to copy itself from machine to machine,usually over a network.

Accepted Answer

A worm is a type of virus that self-replicates and spreads over a network or through communication channels.

Question 2

Electronic Records management (ERM)practices became a more important information security management issue in the U.S.in 2006 when new legislation established new rules for timely information gathering in response to potential litigation.

Accepted Answer

The statement is true, as the new legislation mentioned in the statement is likely referring to the amendments to the Federal Rules of Civil Procedure, which were enacted in December 2006 and placed new emphasis on the need for organizations to manage their electronic records in a timely and effective manner to comply with e-discovery obligations in the event of litigation.

Question 3

Which statement about computer crimes is not true?

Accepted Answer

Data and application encryption are actually considered robust security approaches and are often used to protect sensitive information from cyber attacks.

Question 4

The Sarbanes-Oxley act requires officers of publicly traded companies in the U.S.to certify that:

Accepted Answer

The Sarbanes-Oxley act requires officers of publicly traded companies in the U.S. to certify that they are responsible for establishing and maintaining internal financial controls. This means that they are responsible for ensuring the accuracy and completeness of financial reports and disclosures, and for establishing processes and procedures to prevent fraud and financial misconduct. The act does not require the organization to have a CIO or CSO, or to securely delete old emails.

Question 5

Due to several recent laws regarding information security,it is a good practice to provide existing civil and criminal laws rather than have a company-specific information security policy.

Accepted Answer

It is essential for companies to have their own information security policies in addition to adhering to existing civil and criminal laws. These policies are tailored to the specific needs and operations of the company, ensuring more effective and comprehensive protection of their information assets.

Question 6

BCP shortcomings recently identified during crises include:

Accepted Answer

All three options listed are legitimate shortcomings that have been identified during crises. Backup IT sites being too close to data centers can result in both facilities being affected if there is a major disaster. Plans for alternative workplaces for human resources can be crucial if the main office is damaged or inaccessible. Finally, evacuation plans should always be practiced to ensure that everyone knows what to do in the event of an emergency.

Question 7

Which of the following is the recommended means for disseminating an organization's information security policy?

Accepted Answer

All of the methods mentioned are recommended for disseminating an organization's information security policy to ensure that it reaches as many employees as possible in various formats.

Question 8

Primary sources of thefts of intellectual property rights,trade secrets,and research and development knowledge are employees.

Accepted Answer

According to studies and surveys, employees are the primary source of thefts of intellectual property rights, trade secrets, and research and development knowledge.

Question 9

Which position is responsible for continually assessing an organization's information security risks and developing and implementing effective countermeasures?

Accepted Answer

The Chief Security Officer (CSO) or Chief Information Security Officer (CISO) is responsible for continually assessing an organization's information security risks and developing and implementing effective countermeasures. The CEO may be involved in overall strategy and decision making, but they typically delegate the day-to-day responsibility to the CSO/CISO. COSO (Committee of Sponsoring Organizations of the Treadway Commission) is an organization that provides guidance on enterprise risk management, but they are not directly responsible for information security risks and countermeasures.

Question 10

Creating a BCP in the U.S.requires:

Accepted Answer

Identifying interdependencies between critical business processes and business units is essential for creating a Business Continuity Plan (BCP) in the U.S. It helps in understanding the impact of downtime or disruption of one process on other dependent processes and units. This understanding aids in developing strategies to mitigate the effects of such incidents and recover quickly.

Answer: D
 Following Federal Rules of Civil Procedure is not a requirement for creating a BCP in the U.S. The Federal Rules of Civil Procedure govern the procedures used by federal courts for civil lawsuits, and they do not have a direct relation to the process of creating a BCP. Therefore, option D is incorrect.

Option A and B are also incorrect because creating a BCP is not primarily focused on keeping an inventory of desktop PCs or using magnetic tapes.

Question 11

A denial of service attack is implemented by simultaneously sending a large number of messages to a target computer to create a computer or communications overload,so that legitimate users cannot obtain access.

Accepted Answer

This is a correct definition of a denial of service (DoS) attack.

Question 12

The goal of the IS manager responsible for information security is to eliminate all information risk.

Accepted Answer

It is not possible to eliminate all information risk as there will always be some potential vulnerabilities and threats. The role of the IS manager is to manage and mitigate these risks to an acceptable level, taking into account the organization's risk tolerance and overall business objectives.

Question 13

What should an ERM manager (or an ERM committee)be responsible for?

Accepted Answer

An ERM (Enterprise Risk Management) manager or committee should be responsible for classifying specific records based upon their importance, regulatory requirements, and duration to ensure proper management of risk. Defining electronic transactions and formulating/managing SOX compliance may fall under other areas of responsibility within the organization.

Quiz 14: Information Security