Question 1

Which of the following is a network of the national standards institutes of more than 160 countries?

Accepted Answer

ISO (International Organization for Standardization) is a network of the national standards institutes of more than 160 countries, with one member per country.

Question 2

Which of the following is the official publication series for NIST standards and guidelines?

Accepted Answer

B

Question 3

Which of the following key information security principles traces actions to their source?

Accepted Answer

Accountability in information security ensures that actions can be traced back to the individual who performed them, allowing for proper attribution and responsibility.

Question 4

Which of the following key information security principles grants users and systems a predetermined level of access to information resources?

Accepted Answer

Authorization is the principle that defines the access and privileges a user or system has to resources, ensuring they can only access what they are permitted to.

Question 5

Which of the following is a behavioral control that can be used to safeguard against the loss of integrity?

Accepted Answer

Rotation of duties is a behavioral control that helps prevent fraud and errors, thus safeguarding the integrity of processes and data by ensuring that no single individual has control over all aspects of any critical task.

Question 6

Which of the following is a monitoring control that safeguards against the loss of integrity?

Accepted Answer

File integrity monitoring is a control that detects unauthorized changes to files, ensuring their integrity is maintained.

Question 7

Which of the following are the three elements of the CIA triad?

Accepted Answer

The CIA triad stands for Confidentiality, Integrity, and Availability, which are key principles designed to guide information security policies within an organization.

Question 8

Which of the following refers to a computer used in a DDoS attack?

Accepted Answer

A "Bot" refers to an individual computer that has been compromised and is used in a DDoS attack as part of a larger network called a botnet.

Question 9

Which of the following statements best describes NIST?

Accepted Answer

NIST, the National Institute of Standards and Technology, is a nonregulatory federal agency within the U.S. Department of Commerce. It develops and promotes measurement, standards, and technology to enhance productivity, facilitate trade, and improve the quality of life.

Question 10

Which of the following best describes the accounting key information security principle?

Accepted Answer

The accounting key information security principle refers to the logging of access and usage of information resources.

Question 11

Which of the following best describes the accountability key information security principle?

Accepted Answer

Accountability in information security refers to the ability to trace actions to their source, ensuring that individuals are held responsible for their actions within a system.

Question 12

Which of the following can achieve authentication in information security?

Accepted Answer

Tokens are used in authentication processes to verify the identity of users or devices.

Question 13

Which of the following refers to the requirement that private or confidential information not be disclosed to unauthorized individuals?

Accepted Answer

Confidentiality refers to the protection of information from being accessed by unauthorized parties, ensuring that private or sensitive data is not disclosed without proper authorization.

Question 14

Which of the following is an example of a security mechanism designed to preserve confidentiality?

Accepted Answer

All of the options listed are mechanisms designed to preserve confidentiality in different ways. Controlled traffic routing can prevent unauthorized access to sensitive information by controlling how data packets move across a network. Logical and physical access controls restrict access to information to authorized users only, whether by requiring passwords (logical) or by locking server rooms (physical). Database views can be used to limit the visibility of sensitive data to authorized users, ensuring that individuals can only access the data they are permitted to see.

Question 15

CVSS is short for which of the following?

Accepted Answer

CVSS stands for Common Vulnerability Scoring System, which is a standardized framework for rating the severity of security vulnerabilities in software.

Question 16

Which of the following is not one of the "Five A's" of information security?

Accepted Answer

The answer of Which of the following is not one...

Question 17

Which of the following is a collective term given to guidance on topics related to information systems security, predominantly regarding the planning, implementing, managing, and auditing of overall information security practices?

Accepted Answer

Security frameworks provide comprehensive guidelines and best practices for managing and securing information systems. They encompass various aspects of information security including planning, implementation, management, and auditing.

Question 18

The ISO 27002 standard has its origins in which of the following countries?

Accepted Answer

ISO 27002 originated as a British Standard, BS 7799, before being adopted by the International Organization for Standardization (ISO).

Question 19

Which of the following NIST publications focuses on cybersecurity practices and guidelines?

Accepted Answer

The NIST Special Publication 1800 series specifically focuses on cybersecurity practices and guidelines, providing detailed and practical examples of cybersecurity standards, guidelines, and practices for various industries.

Question 20

Which of the following refers to those responsible for implementing, maintaining, and monitoring safeguards and systems?

Accepted Answer

System administrators, network engineers, and webmasters all play roles in implementing, maintaining, and monitoring safeguards and systems within their respective domains.

Quiz 3: Cybersecurity Framework