Question 1

A(n)____ is a category of objects,persons,or other entities that pose a potential risk of loss to an asset.

Accepted Answer

A threat is a potential danger or risk that could result in harm to an asset. This can include anything that could cause damage, loss, theft, or other negative consequences to a person, organization, or system. Examples of threats include hackers, malware, natural disasters, and human error. Identifying and evaluating threats is a key part of risk management and cybersecurity planning.

Question 2

The ____ has been the industry standard for computer security since the development of the mainframe.

Accepted Answer

The C.I.A. (Confidentiality, Integrity, Availability) triangle has been the industry standard for computer security since the development of the mainframe. It represents the three main areas of concern in computer security and helps guide the development of security strategies and measures. Disaster recovery plans, strategic plans, and asset classification are related but distinct concepts in computer security.

Question 3

____ is the control approach that attempts to shift the risk to other assets,other processes,or other organizations.

Accepted Answer

Transference is a control approach that attempts to shift the risk to other assets, processes, or organizations. This can be achieved through insurance policies, outsourcing, or contracts that transfer the risk to another party. Mitigation involves reducing the impact and likelihood of a risk, while acceptance acknowledges the risk but chooses not to take any action. Avoidance involves eliminating the risk altogether by avoiding the activity or asset that poses the risk. In this context, transference is the best choice for addressing the risk by transferring it to another party who is better equipped to handle it.

Question 4

____ ensures that only those with the rights and privileges to access information are able to do so.

Accepted Answer

Confidentiality refers to the protection of sensitive data from unauthorized access, use, or disclosure. It ensures that only those with the proper permissions are able to view, modify, or access sensitive information. The other options, availability, integrity, and risk assessment, are important aspects of information security as well but do not directly relate to controlling access to information.

Question 5

An asset can be logical,such as a Web site,information,or data;or an asset can be physical,such as a person,computer system,or other tangible object.

Accepted Answer

This statement is true. Assets can be either logical or physical.

Question 6

A ____ attack seeks to deny legitimate users access to services by either tying up a server's available resources or causing it to shut down.

Accepted Answer

A Denial-of-Service (DoS) attack is intended to prevent legitimate users from accessing a service. These attacks can target various services, including web servers, email servers, and even phone services. The attacker seeks to either tie up a server's resources or cause it to crash or shut down entirely, thus rendering the service unavailable to legitimate users.

Question 7

____ enables authorized users - persons or computer systems - to access information without interference or obstruction,and to receive it in the required format.

Accepted Answer

Availability refers to authorized users being able to access information without interference or obstruction, and receive it in the required format. Integrity refers to ensuring that information is not tampered with or altered. Confidentiality refers to ensuring that information is kept private and not disclosed to unauthorized parties. Risk assessment is a process used to identify, analyze, and evaluate risks to an organization's information and systems.

Question 8

A(n)____ is prepared by the organization to anticipate,react to,and recover from events that threaten the security of information and information assets in the organization,and,subsequently,to restore the organization to normal modes of business operations.

Accepted Answer

A contingency plan is specifically designed to address potential threats to information security and outlines how the organization will react and recover from these incidents. It includes a plan for restoring normal business operations as quickly and efficiently as possible. A threat is a potential danger or risk to information security. A social plan is a plan for managing social media accounts or interactions. An asset is something of value to the organization, including information and information systems.

Question 9

An information security policy provides rules for the protection of the information assets of the organization.

Accepted Answer

An information security policy is a formal document that outlines an organization's rules, guidelines, and responsibilities to protect its information assets from unauthorized access, use, disclosure, modification or destruction. It provides a framework to prevent, detect, and respond to security incidents. Thus, the given statement is true.

Question 10

____ hack systems to conduct terrorist activities through network or Internet pathways.

Accepted Answer

Cyberterrorists specifically use hacking techniques to carry out acts of terror through digital means, while script kiddies, programmers, and social engineers may use hacking techniques for other purposes such as personal gain or espionage.

Question 11

____ is the process of examining and documenting the security posture of an organization's information technology and the risks it faces.

Accepted Answer

The process described is commonly referred to as a risk assessment or risk analysis, which involves identifying potential threats, vulnerabilities, and impacts to an organization's information technology environment. This process is an essential part of developing effective security controls and mitigating potential risks. Data classification, security clearance, and DR (disaster recovery) are related concepts but do not fully encompass the process of assessing an organization's security posture.

Question 12

____ of risk is the choice to do nothing to protect a vulnerability,and to accept the outcome of its exploitation.

Accepted Answer

Acceptance of risk means that no action is taken to mitigate or avoid the potential negative consequences of a vulnerability. This may be an appropriate choice when the cost of mitigation exceeds the expected loss from an attack, or when the risk is considered acceptable within the overall risk management strategy. However, acceptance should not be confused with ignorance or neglect of security risks, and should be based on a thoughtful evaluation of the potential consequences and the organization's risk tolerance.

Question 13

IRP focuses more on preparations completed before and actions taken after the incident,whereas DRP focuses on intelligence gathering,information analysis,coordinated decision making,and urgent,concrete actions.

Accepted Answer

IRP (Incident Response Plan) focuses on intelligence gathering, information analysis, coordinated decision making, and urgent, concrete actions in response to security incidents, whereas DRP (Disaster Recovery Plan) is more about preparations before and actions taken after an incident to recover and maintain business continuity.

Question 14

The vision of an organization is a written statement of an organization's purpose.

Accepted Answer

The vision of an organization is a written statement of its long-term goals and aspirations, describing what it wants to achieve in the future, not its purpose.

Question 15

____ is the control approach that attempts to reduce the impact caused by the exploitation of vulnerability through planning and preparation.

Accepted Answer

Mitigation is the control approach that aims to reduce the impact of vulnerability exploitation by planning and preparation. It involves taking proactive steps to minimize the likelihood and impact of a potential threat. Mitigation strategies include implementing firewalls and intrusion detection systems, performing regular backups of critical data, and training employees on security best practices.

Question 16

____ is defined as "the ownership of ideas and control over the tangible or virtual representation of those ideas".

Accepted Answer

Intellectual property is the ownership of ideas and control over the tangible or virtual representation of those ideas. This can include patents, copyrights, trademarks, and trade secrets.

Question 17

____ assigns a risk rating or score to each information asset.While this number does not mean anything in absolute terms,it is useful in gauging the relative risk to each vulnerable information asset and facilitates the development of comparative ratings later in the risk control process.

Accepted Answer

Risk assessment assigns a risk rating or score to each information asset to gauge the relative risk and facilitate the development of comparative ratings later in the risk control process.

Question 18

____ is the risk control strategy that attempts to prevent the exploitation of the vulnerability.

Accepted Answer

Avoidance is the risk control strategy that aims to prevent the exploitation of a vulnerability by eliminating the risk altogether. This can be done by removing the asset that is being targeted or by completely avoiding the activity that poses the risk.

Question 19

Once intellectual property (IP)has been defined and properly identified,breaches in the controls that have been placed around the IP constitute a threat to the security of this information.

Accepted Answer

Once intellectual property has been defined and identified, breaches in controls can lead to theft or unauthorized access to this information, making it a threat to its security.

Question 20

The threat of corruption can occur while information is being stored or transmitted.____ is the prevention of that corruption.

Accepted Answer

Integrity is the prevention of corruption in stored or transmitted information. It ensures that the information is accurate and complete and has not been tampered with or altered in any way. Risk assessment determines the potential risks and evaluates the probability of corruption occurring, Availability refers to the accessibility of the information when needed, and Confidentiality is the protection of sensitive or private information from unauthorized access.

Quiz 1: Contingency Planning Within Information Security

A(n) ____ is a category of objects,persons,or other entities that pose a potential risk of loss to an asset.