Deck 1: Introduction to Information Security

Question 1

When a computer is the subject of an attack, it is the entity being attacked.

Answer 1

False

Question 2

In the physical design phase, specific technologies are selected.

Answer 2

True

Question 3

Hardware is often the most valuable asset possessed by an organization, and it is the main target of intentional attacks.

Answer 3

False

Question 4

To achieve balance-that is, to operate an information system that satisfies the user and the security professional-the security level must allow reasonable access, yet protect against threats.

Question 5

The water-ski model is a type of SDLC in which each phase of the process flows from the information gained in the previous phase, with multiple opportunities to return to previous phases and make adjustments.

Question 6

During the early years of computing, the primary threats to security were physical theft of equipment, espionage against the products of the systems, and sabotage.

Question 7

A data custodian works directly with data owners and is responsible for the storage, maintenance, and protection of the information.

Question 8

A breach of possession may not always result in a breach of confidentiality.

Question 9

The value of information comes from the characteristics it possesses.

Question 10

Information security can be an absolute.

Question 11

A champion is a project manager, who may be a departmental line manager or staff unit manager, and has expertise in project management and information security technical requirements.

Question 12

The implementation phase is the longest and most expensive phase of the systems development life cycle (SDLC).

Question 13

The bottom-up approach to information security has a higher probability of success than the top-down approach.

Question 14

The investigation phase of the SDLC involves specification of the objectives, constraints, andscope of the project.

Question 15

The physical design is the blueprint for the desired solution.

Question 16

E-mail spoofing involves sending an e-mail message with a harmful attachment.

Question 17

Using a methodology will usually have no effect on the probability of success.

Question 18

The roles of information security professionals are almost always aligned with the goals and mission of the information security community of interest.

Question 19

The possession of information is the quality or state of having value for some purpose or end.

Question 20

Network security focuses on the protection of physical items, objects, or areas from unauthorized access and
misuse.

Question 21

__________ security addresses the issues necessary to protect the tangible items, objects, or areas of an organization from unauthorized access and misuse.

A) Physical
B) Personal 
C) Object
D) Standard

Question 22

MULTICS stands for Multiple Information and Computing Service. _________________________

Question 23

Confidentiality ensures that only those with the rights and privileges to access information are able to do so. _________________________

Question 24

A(n) project team should consist of a number of individuals who are experienced in one or multiple facets of the technical and nontechnical areas. _________________________

Question 25

__________ is a network project that preceded the Internet.

A) NIST
B) ARPANET 
C) FIPS
D) DES

Question 26

A(n) hardware system is the entire set of people, procedures, and technology that enable business to use information. _________________________

Question 27

Of the two approaches to information security implementation, the top-down approach has a higher probability of success. _________________________

Question 28

Key end users should be assigned to a developmental team, known as the united application development team. _________________________

Question 29

Indirect attacks originate from a compromised system or resource that is malfunctioning or working under the control of a threat. _________________________

Question 30

Information security can begin as a grassroots effort in which systems administrators attempt to improve the security of their systems, often referred to as the bottom-up approach. _________________________

Question 31

The Security Development Life Cycle (SDLC) is a general methodology for the design and implementation of an information system. _________________________

Question 32

Information has redundancy when it is free from mistakes or errors and it has the value that the end user expects. _________________________

Question 33

__________ was the first operating system to integrate security as one of its core functions.

A) UNIX
B) DOS 
C) MULTICS
D) ARPANET

Question 34

When unauthorized individuals or systems can view information, confidentiality is breached. _________________________

Question 35

A server would experience a(n) __________ attack when a hacker compromises it to acquire information via a remote location using a network connection.

A) indirect
B) direct 
C) software
D) hardware

Question 36

According to the CNSS, networking is "the protection of information and its critical elements." _________________________

Question 37

The famous study entitled "Protection Analysis: Final Report" focused on a project undertaken by ARPA to understand and detect __________ in operating systems security.

A) bugs
B) vulnerabilities 
C) malware
D) maintenance hooks

Question 38

The Analysis phase of the SDLC examines the event or plan that initiates the process and specifies the objectives, constraints, and scope of the project. _________________________

Question 39

Hardware is the physical technology that houses and executes the software, stores and transports the data, and provides interfaces for the entry and removal of information from the system. _________________________

Question 40

SecOps focuses on integrating the need for the development team to provide iterative and
rapid improvements to system functionality and the need for the operations team to improve
security and minimize the disruption from software release cycles. _________________________

Question 41

During the __________ phase, specific technologies are selected to support the alternatives identified and evaluated in the prior phases.

A) investigation
B) implementation 
C) analysis
D) physical design

Question 42

The protection of the confidentiality, integrity, and availability of information assets, whether in storage, processing, or transmission, via the application of policy, education, training and awareness, and technology is known as ___________.

A) ​communications security  
B) ​network security 
C) ​physical security 
D) ​information security

Question 43

An organizational resource that is being protected is sometimes logical, such as a Web site, software information, or data. Sometimes the resource is physical, such as a person, computer system, hardware, or other tangible object. Either way, the resource is known as a(n) ___________.

A) access method 
B) asset 
C) exploit 
D) risk

Question 44

The protection of tangible items, objects, or areas from unauthorized access and misuse is known as ___________.

A) ​communications security  
B) ​network security 
C) ​physical security 
D) ​information security

Question 45

Organizations are moving toward more __________-focused development approaches, seeking to improve not only the functionality of the systems they have in place, but consumer confidence in their product.

A) security
B) reliability 
C) accessibility
D) availability

Question 46

The __________ design phase of an SDLC methodology is implementation independent, meaning that it contains no reference to specific technologies, vendors, or products.

A) conceptual
B) logical 
C) integral
D) physical

Question 47

A methodology and formal development strategy for the design and implementation of an information system is referred to as a __________.

A) systems design
B) development life project 
C) systems development life cycle
D) systems schema

Question 48

A subject or object's ability to use, manipulate, modify, or affect another subject or object is known as ___________.

A) access 
B) assets 
C) exploits 
D) risk

Question 49

An information system is the entire set of __________, people, procedures, and networks that enable the use of information resources in the organization.

A) software
B) hardware 
C) data
D) All of the above

Question 50

​The protection of all communications media, technology, and content is known as ___________.

A) ​communications security  
B) ​network security 
C) ​physical security 
D) ​information security

Question 51

Which of the following is a valid type of role when it comes to data ownership  

A) Data owners
B) Data custodians 
C) Data users
D) All of the above

Question 52

__________ of information is the quality or state of being genuine or original.

A) Authenticity
B) Spoofing 
C) Confidentiality
D) Authorization

Question 53

A type of SDLC in which each phase has results that flow into the next phase is called the  __________ model.

A) pitfall
B) SA&D 
C) waterfall
D) Method 7

Question 54

Which of the following phases is often considered the longest and most expensive phase of the systems development life cycle  

A) investigation
B) logical design 
C) implementation
D) maintenance and change

Question 55

The ____ is the individual primarily responsible for the assessment, management, and implementation of information security in the organization.

A) ISO
B) CIO 
C) CISO
D) CTO

Question 56

An emerging methodology to integrate the effort of the development team and the operations team to improve the functionality and security of applications is known as __________.

A) SDLC
B) DevOps 
C) JAD/RAD
D) SecOps

Question 57

__________ has become a widely accepted evaluation standard for training and education related to the security of information systems.

A) NIST SP 800-12
B) NSTISSI No. 4011 
C) IEEE 802.11(g)
D) ISO 17788

Question 58

People with the primary responsibility for administering the systems that house the information used by the organization perform the role of ____.

A) Security policy developers 
B) Security professionals 
C) System administrators 
D) End users

Question 59

In file hashing, a file is read by a special algorithm that uses the value of the bits in the file to compute a single number called the __________ value.

A) result
B) smashing 
C) hash
D) code

Question 60

A computer is the __________ of an attack when it is used to conduct an attack against another computer.

A) subject
B) object 
C) target
D) facilitator

Question 61

The ____________________ component of an information system comprises applications, operating systems, and assorted command utilities.

Question 62

The history of information security begins with the concept of ____________________ security.

Question 63

In an organization, the value of ____________________ of information is especially high when it involves personal information about employees, customers, or patients.

Question 64

____________________ enables authorized users-people or computer systems-to access information without interference or obstruction and to receive it in the required format.

Question 65

The CNSS model of information security evolved from a concept developed by the computer security industry known as the ____________________ triad.

Question 66

A computer is the ____________________ of an attack when it is the entity being targeted.

Question 67

The senior technology officer is typically the chief ____________________ officer.

Question 68

Software is often created under the constraints of ____________________ management, placing limits on time, cost, and manpower.

Question 69

In the ____________________ approach, the project is initiated by upper-level managers who issue policy, procedures, and processes, dictate the goals and expected outcomes, and determine accountability for each required action.

Question 70

A frequently overlooked component of an information system, ____________________ are the written instructions for accomplishing a specific task.

Question 71

The ____________________ phase consists primarily of assessments of the organization, its current systems, and its capability to support the proposed systems.

Question 72

A technique used to compromise a system is known as a(n) ___________.

A) access method 
B) asset 
C) exploit 
D) risk

Question 73

A(n) ____________________ is a formal approach to solving a problem by means of a structured sequence of procedures.

Question 74

During the early years, information security was a straightforward process composed predominantly of ____________________ security and simple document classification schemes.

Question 75

____________________ of information is the quality or state of being genuine or original, rather than a reproduction or fabrication.

Question 76

The Internet brought ____________________ to virtually all computers that could reach a phone line or an Internet-connected local area network.

Question 77

The ____________________ of information is the quality or state of ownership or control of some object or item.

Question 78

During the ____________________ War, many mainframes were brought online to accomplish more complex and sophisticated tasks, so it became necessary to enable the mainframes to communicate via a less cumbersome process than mailing magnetic tapes between computer centers.

Question 79

During the  ____________________ phase of the systems life cycle, the process begins by examining theevent or plan that initiated the process. During this phase, the objectives, constraints, and scope of the project are specified.

Question 80

Information has ____________________ when it is whole, complete, and uncorrupted.