IS3340 CHAPTER 1 Flashcards
A management action, written policy, procedure, guideline, regulation, law, or rule of any kind is called ___?
ADMINISTRATIVE CONTROL
Availability, Integrity, Confidentiality – goals of information security is called ___?
A-I-C TRIAD
Any person or program that attempts to interact with a computer information system in an unauthorized manner is called ___?
ATTACKER
Any person or program that possesses permission to access a resource is called ___?
AUTHORIZED USER
The assurance that requested information is available to authorized uses upon request is called?
AVAILABILITY
A collection of computer and network devices connected to one or more networks, generally for the purpose of fulfilling business functions is called ___?
COMPUTER ENVIRONMENT
The assurance that information can only be accessed and viewed by authorized users is called ___?
CONFIDENTIALITY
A control that repairs the effects of damage from an attack. This includes virus removal procedures, firewall table updates, and user authorization database updates and is called ___?
CORRECTIVE CONTROL
A security strategy that relies on multiple layers of security that require attackers to defeat multiple controls to access any protected resource is called ___?
DEFENSE IN DEPTH
A control that detects when an action has occurred. This includes smoke detectors, log monitors, and system audits and is called ___?
DETECTIVE CONTROL
An agreement between the software producer and the end user. It addresses issues regarding approved use and liability. This is called ___?
END USER LICENSE AGREEMENT (EULA)
The practice of ensuring electronic information is safe from unauthorized use and accessible for authorized use is called ___?
INFORMATION SYSTEMS SECURITY
The assurance that information can be modified only by authorized users is called ___?
INTEGRITY
An alternate term for technical control is called ___?
LOGICAL CONTROL
Software that is designed to infiltrate a target computer and make it do something the attacker has instructed it to do is called ___?
MALICIOUS SOFTWARE
A device that limits access or otherwise protects a resource, such as a fence, door, lock, or fire extinguisher is called ___?
PHYSICAL CONTROL
A control that stops an action before it occurs and includes locked doors, firewall rules, and user passwords is called ___?
PREVENTATIVE CONTROL
Any exposure to a threat is called a ___?
RISK
A mechanism used to protect information and related assets is called ___?
SECURITY CONTROL
A device or process that limits access to a resource. Examples would be user authentication, antivirus software, and firewalls. This is called ___?
TECHNICAL CONTROL
Any action that could lead to damage or loss is called ___?
THREAT
Any person or program that does not possess permission to access a resource is called ___?
UNAUTHORIZED USER
Any weakness that could allow a threat to be realized is called ___?
VULNERABILITY
Standalone malicious software programs that actively transmit themselves, generally over networks, to infect other computers is called ___?
WORMS
- Which of the following is the best description of the defense in depth strategy?
- Hiding protected resources behind multiple firewalls
- Using multiple layers of security controls to protect resources
- Fully securing the most important resources first
- Staying current on as many known attacks as possible
Using multiple layers of security controls to protect resources
- What is the main goal of information security ?
- Protect information from unauthorized use
- Catch as many unauthorized uses as possible
- Protect information from unauthorized modification
- Stop anonymous users from accessing information
Protect information from unauthorized use
- Does turning off a computer make the information it contains secure?
- Yes, because no unauthorized user can access information on a computer that is turned off
- No, because the information might be copied somewhere else
- Yes, because aggressive actions always result in more secure systems
- No, because secure data must still be available to authorized users
No, because secure data must still be available to authorized users
- Which of the following is the best description of a security control?
- A mechanism to stop attacks before they occur
- A rule that defines acceptable use of a computer
- A mechanism that protects a resource
- A device that detects unusual activity
A mechanism that protects a resource
- Which of the following could be classified as a logical control?
- Firewall
- Fence
- Acceptable use policy
- Smoke detector
Firewall
- Which of the following could be classified as a detective control?
- Password
- Door
- Acceptable use policy
- Log monitor
Log monitor
- Which of the tenets of information security must directly serves the needs of authorized users?
- Availability
- Integrity
- Confidentiality
- None of the above
Availability
- Which of the tenets of information security is most related to the “need to know” property?
- Availability
- Integrity
- Confidentiality
- None of the above
Confidentiality
- Where is the most likely place a database management system would run?
- Network device
- Server
- Thin client
- Thick client
Server
- Which Microsoft Windows Server 2008 R2 edition would be most appropriate for large-scale deployment using extensive virtualization?
- Datacenter
- HPC
- Enterprise
- Web
Datacenter
- According to the Microsoft EULA, what is the extent of the damages that can be recovered due to a Windows fault?
- Nothing
- The price paid for the software license
- Actual damages incurred
- Actual damages incurred plus the cost of the software license
The price paid for the software license
- Which of the following is the best definition of a threat?
- Any exposure to damage
- A weakness that allow damage to occur
- An action that exploits a weakness
- Any action that could lead to damage
Any action that could lead to damage
- What worm was released in 2001 and primarily defaced Web sites?
- SQL Slammer
- Conficker
- Code Red
- Melissa
Code Red
- What term describes a malicious software program that users are tricked into running?
- Trojan horse
- Worm
- Virus
- Phishing message
Trojan horse
- Which of the following defines the cycle used to address Window threats and vulnerabilities?
- Plan-do-review
- Discovery-analyze-remediation
- Design-implementation-verificatoin
- Detection-containment-eradication
Discovery-analyze-remediation
