(Test Bank) Information Security and Assurance

Unknown, 1

Computer Science & Engineering

Test Bank

1st Edition

• $10.00 $35.00

---

Description

Test Bank for Information Security and Assurance, The downloadable file consists of 152 pages, and the total size of the file is 0.6 MB. Purchase now only for highly discounted price.

---

---

Study Note Preview

WGU C725 Infor mation Security and Assurance People - - - ✔✔Information security is primarily a discipline to manage the behavior of _____. A. Technology B. People C. Processes D. Organizations All of these - - - ✔✔Careers in information security are booming because of which of the following factors? A. Threats of cyberterrorism B. Government regulations C. Growth of the Internet D. All of these Security policies and procedures Explanation: Answer A is correct. The Carnegie Melon Information Network Institute (INI) designed programs to carry out multiple tasks including Information Security Policies. - - - ✔✔A program for information security should include which of the following elements? A. Security policies and procedures B. Intentional attacks only C. Unintentional attacks only D. None of these D. All of these - - - ✔✔The growing demand for InfoSec specialists is occurring predominantly in which of the following types of organizations? A. Government B. Corporations C. Not -for-profit foundations D. All of these Confidentiality - - - ✔✔The concept of the measures used to ensure the protection of the secrecy of data, objects, or resources. B-Rate Safe Rating - - - ✔✔A catchall safe rating for any box w ith a lock on it. This rating describes the thickness of the steel used to make the lockbox. No actual testing is performed to gain this rating. C-Rate Safe Rating - - - ✔✔This safe rating is defined as a variably thick steel box with a 1 - inch-thick door and a lock. No tests are conducted to provide this rating, either. UL TL -15 Safe Rating - - - ✔✔Safes with an Underwriters Laboratory rating that have passed standardized tests as defined in Underwriters Laboratory Standard 687 using tools and an expert group of safe -testing engineers. The safe rating label requires that the safe be constructed of 1 - inch solid steel or equivalent. The label means that the safe has been tested for a net working time of 15 minutes using "common hand tools, drills, punches ha mmers, and pressure applying devices." Net working time means that when the tool comes off the safe, the clock stops. Engineers exercise more than 50 different types of attacks that have proven effective for safecracking. UL TL -30 Safe Rating - - - ✔✔This Underwriters Laboratory rating testing is essentially the same as the TL -15 testing, except for the net working time. Testers get 30 minutes and a few more tools to help them gain access. Testing engineers usually have a safe's manufacturing blueprints an d can disassemble the safe before the test begins to see how it works. B. Disclosure Explanation: Confidentiality models are primarily intended to ensure that no unauthorized access to information is permitted and that accidental disclosure of sensitive information is not possible. - - - ✔✔Related to information security, confidentiality is the opposite of which of the following? A. Closure B. Disclosure C. Disaster D. Disposal D. All of these Explanation: Integrity models keep data pure and trustworthy by protecting system data from intentional or accidental changes. - - - ✔✔Integrity models have which of the three goals: A. Prevent unauthorized users from making modifications to data or programs B. Preven t authorized users from making improper or unauthorized modifications C. Maintain internal and external consistency of data and programs D. All of these D. All of these Explanation: Availability models keep data and resources available for authorized us e, especially during emergencies or disasters. - - - ✔✔Information security professionals usually address which of these three common challenges to availability: A. Denial of service (DoS) due to intentional attacks or because of undiscovered flaws in implementation (for example, a program written by a programmer who is unaware of a flaw that could crash the program if a certain unexpected input is encountered) B. Loss of information system capabilities because of natural disasters (fires, floods, storms, or earthquakes) or human actions (bombs or strikes) C. Equipment failures during normal use. D. All of these A. Confidentiality, integrity, and availability Explanation: These goals form the confidentiality, integrity, availability (CIA) triad, the basi s of all security programs. - - - ✔✔Which of the following represents the three goals of information security? A. Confidentiality, integrity, and availability B. Prevention, detection, and response C. People controls, process controls, and technology controls D. Network security, PC security, and mainframe security business case Explanation: A business case is often made to justify the start of a new project, especially a project related to securi ty. - - - ✔✔Usually a documented argument or stated position in order to define a need to make a decision or take some form of action. top-down approach - - - ✔✔A type of security management planning where upper, or senior, management is responsible for i nitiating and defining policies for the organization. bottom -up approach - - - ✔✔A type of security management planning where IT staff makes security decisions directly without input from senior management. This approach is rarely used in organizations an d is considered problematic in the IT industry. Strategic Plan - - - ✔✔This security plan is a long -term plan that is fairly stable. It defines the organization's security purpose. It also helps to understand security function and align it to the goals, m ission, and objectives of the organization. It's useful for about five years if it is maintained and updated annually. This plan also serves as the planning horizon. Long -term goals and visions for the future are discussed this plan. This plan should i nclude a risk assessment. Tactical Plan - - - ✔✔This security plan is a midterm plan developed to provide more details on accomplishing the goals set forth in the strategic plan or can be crafted ad hoc based upon unpredicted events. This plan is typicall y useful for about a year and often prescribes and schedules the tasks necessary to accomplish organizational goals. Some examples of these plans are project plans, acquisition plans, hiring plans, budget plans, maintenance plans, support plans, and system development plans. Operational Plan - - - ✔✔This security plan is a short -term, highly detailed plan based on the strategic and tactical plans. It is valid or useful only for a short time. These plans must be updated often (such as monthly or quarterly) to retain compliance with tactical plans. These plans spell out how to accomplish the various goals of the organization. They include resource allotments, budgetary requirements, staffing assignments, scheduling, and step -by-step or implementation procedur es. These plans include details on how the implementation processes are in compliance with the organization's security policy. Examples of these plans are training plans, system deployment plans, and product design plans. Data classification - - - ✔✔Also called classification, the primary means by which data is protected based on its need for secrecy, sensitivity, or confidentiality. It is the process of organizing items, objects, subjects, and so on into groups, categories, or collections with similaritie s. Five levels of government/military classification - - - ✔✔Top secret, Secret, Confidential, Sensitive but unclassified, Unclassified. Top Secret - - - ✔✔The highest level of government/military data classification. The unauthorized disclosure of top -secret data will have drastic effects and cause grave damage to national security. This data is compartmentalized on a need -to-know basis such that a user could have this clearance and have access to no data until the user has a need to know. Secret - - - ✔✔This level of government/military data classification is used for data of a restricted nature. The unauthorized disclosure of data classified as secret will have significant effects and cause critical damage to national security. Confidenti al - - - ✔✔This level of government/military data classification is used for data of a sensitive, proprietary, or highly valuable nature. The unauthorized disclosure of data with this classification level will have noticeable effects and cause serious dama ge to national security. This classification is used for all data between secret and sensitive but unclassified classifications. Sensitive But Unclassified (SBU) - - - ✔✔This level of government/military data classification is used for data that is for in ternal use or for office use only (FOUO). Often this data classification is used to protect information that could violate the privacy rights of individuals. This is not technically a classification label; instead, it is a marking or label used to indicate use or management. Unclassified - - - ✔✔This level of government/military data classification is used for data that is neither sensitive nor classified. The disclosure of this type of data does not compromise confidentiality or cause any noticeable damag e. This is not technically a classification label; instead, it is a marking or label used to indicate use or management. U.S. Can Stop Terrorism. Top Secret Secret Confidential Sensitive But unclassified Unclassified - - - ✔✔The easy way to remember the names of the five levels of the government or military data classification scheme, Four common or possible business classification levels - - - ✔✔Confidential Private Sensitive Public Confidential - - - ✔✔This common business/private sector data classifi cation level is the highest level of classification. This is used for data that is extremely sensitive and for internal use only. A significant negative impact could occur for a company if this type of data is disclosed. Sometimes the label proprietary is substituted. Sometimes proprietary data is considered a specific form of this type of information. If proprietary data is disclosed, it can have drastic effects on the competitive edge of an organization. Private - - - ✔✔This common business/private secto r data classification level is used for data that is of a private or personal nature and intended for internal use only. A significant negative impact could occur for the company or individuals if private data is disclosed. Sensitive - - - ✔✔This common b usiness/private sector data classification level is used for data that is more classified than public data. A negative impact could occur for the company if sensitive data is disclosed. Public - - - ✔✔This common business/private sector data classificatio n level is the lowest level of classification. This is used for all data that does not fit in one of the higher classifications. Its disclosure does not have a serious negative impact on the organization. Ownership - - - ✔✔Relating to data classification or categorization, this is the formal assignment of responsibility to an individual or group. Senior Manager - - - ✔✔This role is assigned to the person who is ultimately responsible for the security maint ained by an organization and who should be most concerned about the protection of its assets. They sign off on all policy issues. Security Professional - - - ✔✔This Role is assigned to a trained and experienced network, systems, and security engineer who is responsible for following the directives mandated by senior management. Data Owner - - - ✔✔This role is assigned to the person who is responsible for classifying information for placement and protection within the security solution. They are typically a high - level manager who is ultimately responsible for data protection. Data Custodian - - - ✔✔This role is assigned to the user who is responsible for the tasks of implementing the prescribed protection defined by the security policy and senior managemen t. They perform all activities necessary to provide adequate protection for the CIA Triad (confidentiality, integrity, and availability) of data and to fulfill the requirements and responsibilities delegated from upper management. These activities can incl ude performing and testing backups, validating data integrity, deploying security solutions, and managing data storage based on classification. User - - - ✔✔This role is assigned to any person who has access to the secured system. Their access is tied to their work tasks and is limited so they have only enough access to perform the tasks necessary for their job position (the principle of least privilege). They are responsible for understanding and upholding the security policy of an organization by followi ng prescribed operational procedures and operating within defined security parameters. Auditor - - - ✔✔This role is responsible for reviewing and verifying that the security policy is properly implemented and the derived security solutions are adequate. T hey may be assigned to a security professional or a trained user. The auditor produces compliance and effectiveness reports that are reviewed by the senior manager. Control Objectives for Information and Related Technology (COBIT ) - - - ✔✔One of the more widely used security control frameworks. It is a documented set of best IT security practices crafted by the Information Systems Audit and Control Association (ISACA). COBIT 5 (Five Key principles for governance and management of enterprise IT) - - - ✔✔Principle 1: Meeting Stakeholder Needs Principle 2: Covering the Enterprise End -to-End Principle 3: Applying a Single, Integrated Framework Principle 4: Enabling a Holistic Approach Principle 5: Separating Governance From Management C. Prevention, detectio n, and response Explanation: Defense in depth is implemented in overlapping layers that provide the three elements needed to secure assets: prevention, detection, and response. - - - ✔✔Defense in depth is needed to ensure that which three mandatory activ ities are present in a security system? A. Prevention, response, and prosecution B. Response, collection of evidence, and prosecution C. Prevention, detection, and response D. Prevention, response, and management True - - - ✔✔T or F Functional requirements describe what a system should do. True - - - ✔✔T or F Assurance requirements describe how functional requirements should be implemented and tested. Functional and assurance Explanation: Functional requirements describe what a s ystem should do. Assurance requirements describe how functional requirements should be implemented and tested. - - - ✔✔Which of the following best represents the two types of IT security requirements? A. Functional and logical B. Logical and physical C. Functional and assurance D. Functional and physical D) Risk Explanation: Risk involves looking at what is the consequence of a loss and the likelihood that this loss will occur. - - - ✔✔Which of the following terms best describes the probability that a t hreat to an information system will materialize? A. Threat B. Vulnerability C. Hole D. Risk B. Controls are implemented to mitigate risk and reduce the potential for loss. Explanation: Controls mitigate a wide variety of information security risks and reduce loss. - - - ✔✔Which of the following statements is true? A. Controls are implemented to eliminate risk and eliminate the potential for loss. B. Controls are implemented to mitigat e risk and reduce the potential for loss. C. Controls are implemented to eliminate risk and reduce the potential for loss. D. Controls are implemented to mitigate risk and eliminate the potential for loss. A. What a security system should do by design - - - ✔✔Security functional requirements describe which of the following? A. What a security system should do by design B. What controls a security system must implement C. Quality assurance description and testing approach D. How to implement the system D. All of these Explanation: The goals of (ISC)2 are maintaining a Common Body of Knowledge for information security, certifying industry professionals and practitioners according to the international IS standard, administering training and certification examinations and ensuring that credentials are maintained, primarily through continuing education. - - - ✔✔Question : ISC2 was formed for which of the following purposes? A. Maintaining a Common Body of Knowledge for information security B. Certifying industry professionals and prac titioners in an international IS standard C. Ensuring that credentials are maintained, primarily through continuing education D. All of these A. The information security Common Body of Knowledge is a compilation and distillation of all security informat ion collected internationally of relevance to information security professionals. - - - ✔✔Which of the following statements best describes the information security Common Body of Knowledge? A. The information security Common Body of Knowledge is a compila tion and distillation of all security information collected internationally of relevance to information security professionals. B. The information security Common Body of Knowledge is a volume of books published by the ISC2. C. The information security C ommon Body of Knowledge is a reference list of books and other publications put together by practitioners in information security. D. The information security Common Body of Knowledge is an encyclopedia of information security principles, best practices, and regulations. The 10 Domains of the Information Security Common Body of Knowledge (CBK) - - - ✔✔1. Information Security Governance and Risk Management 2. Security Architecture and Design 3. Business Continuity and Disaster Recovery Planning 4. Legal Regulations, Investigations, and Compliance 5. Physical (Environmental) Security 6. Operations Security 7. Access Control 8. Cryptography 9. Telecommunications and Network Security 10. Software Development Security B. Identification of controls over hardware, media, and personnel - - - ✔✔The Operations Security domain includes which of the following? A. Mechanisms for secure access to a data center B.Identification of controls over hardware, media, and personnel C. Help -desk support for security incidents D. Consulting on IT projects F. Information Security Governance and Risk Management - - - ✔✔This CBK domain emphasizes the importance of a comprehensive security plan that includes security policies and procedu res for protecting data and how it is administered. Topics include: Understanding and aligning security functions with the goals, mission, and objectives of the organization Understanding and applying security governance Understanding and applying concepts of confidentiality, integrity, and availability Developing and implementing security policies Managing the information life cycle (classification, categorization, and ownership) Managing third -party governance (on -site assessments, document exchange and review, process and policy reviews) Understanding and applying risk management concepts Managing personnel security Developing and managing security education, training, and awareness Managing the security function (budgets, metrics, and so on) ANSWER CHOICES: A. Business Continuity and Disaster Recovery Planning B. Physical (Environmental) Security C. Legal Regulations, Investigations, and Compliance D. Software Development Security E. Operations Security F. Information Security Governance and Risk Management G. Access Control H. Security Architecture and Design I. Cryptography J. Telecommunications and Network Security H. Security Architecture and Design - - - ✔✔This CBK domain discusses concepts, pri nciples, structures, and standards used to design, implement, monitor, and secure operating systems, equipment, networks, applications, and other controls to enforce various levels of confidentiality, integrity, and availability. Topics include: Understa nding the fundamental concepts of security models (confidentiality models, integrity models, and multilevel models) Identifying the components of information systems security evaluation models (such as Common Criteria) Understanding security capabilities of information systems (memory protection, trusted platform modules, and so on) Pinpointing the vulnerabilities of security architectures Recognizing software and system vulnerabilities and threats Understanding countermeasure principles (such as defen se in depth) ANSWER CHOICES: A. Business Continuity and Disaster Recovery Planning B. Physical (Environmental) Security C. Legal Regulations, Investigations, and Compliance D. Software Development Security E. Operations Security F. Information Security Governance and Risk Management G. Access Control H. Security Architecture and Design I. Cryptography J. Telecommunications and Network Security A. Business Continuity and Disaster Recovery Planning - - - ✔✔This CBK domain demon strates business continuity requirements, conducting business impact analysis, developing a recovery strategy, understanding the disaster recovery process, exercising, assessing, and maintaining the plans. Topics include: Understanding business continuit y requirements Conducting business impact analysis Developing a recovery strategy Understanding the disaster recovery process Exercising, assessing, and maintaining the plans ANSWER CHOICES: A. Business Continuity and Disaster Recovery Planning B. Physical (Environmental) Security C. Legal Regulations, Investigations, and Compliance D. Software Development Security E. Operations Security F. Information Security Governance and Risk Management G. Access Control H. Security Architecture and De sign I. Cryptography J. Telecommunications and Network Security C. Legal Regulations, Investigations, and Compliance - - - ✔✔This CBK domain covers the different targets of computer crimes, bodies of law, and the different types of laws and regulations as they apply to computer security. Topics include: Understanding legal issues that pertain to information security internationally Adopting professional ethics Understanding and supporting investigations Understanding forensic procedures Following compliance requirements and procedures Ensuring security in contractual agreements and procurement processes (such as cloud computing, outsourcing, and vendor governance) ANSWER CHOICES: A. Business Continuity and Disaster Recovery Planning B. Physical (Environmental) Security C. Legal Regulations, Investigations, and Compliance D. Software Development Security