Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CSC 6530 MID-TERM > IS3350 CHAPTER 1 > Flashcards

IS3350 CHAPTER 1 Flashcards

1
Q

Management and regulatory controls are usually policies, standards, guidelines, and procedures. They can also be the laws an organization must follow. This is called ___.

A

ADMINISTRATIVE SAFEGUARDS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

The security goal of ensuring that you can access information systems and their data when you need them. They must be available in a dependable and timely manner. This is called ___.

A

AVAILABILITY

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The designs, blueprints, or plans that make an organizations product or service unique is ___.

A

COMPETITIVE EDGE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

The security goal of ensuring that only authorized persons can access information systems and their data. This is called ___.

A

CONFIDENTIALITY

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Any protective action that reduces information security risks. These actions may eliminate or lesson vulnerabilities, control threats, or reduce risk. Safeguards is another term for controls. This is called ___.

A

CONTROL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

The science and practice of hiding information so that unauthorized persons can’t read it is called ___.

A

CRYPTOGRAPHY

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Attack that disrupts information systems so that they’re no longer available to users is called ___.

A

DENIAL OF SERVICE (DoS) ATTACK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

A successful attack against a vulnerability is called ___.

A

EXPLOIT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

An attacker that has no current relationship with the organization they’re attacking is called ___.

A

EXTERNAL ATTACKER

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Intelligence, knowledge, and data. You can store information in paper or electronic form is called ___.

A

INFORMATION

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

The study and practice of protecting information. The main goal of information security is to protect its confidentiality, integrity, and availability is called ___.

A

INFORMATION SECURITY

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

The security goal of ensuring that no changes are made to information systems and their data without permissions is called ___.

A

INTEGRITY

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

An attacker that has a current relationship with the organization he or she is attacking. It can be an angry employee. This is called ___.

A

INTERNAL ATTACKER

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

A rule that systems should run with the lowest level of permissions needed to complete tasks. This means users should have the least amount of access needed to do their jobs is called ___.

A

LEAST PRIVILEGE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

This term refers to any software that performs harmful, unauthorized , or unknown activity and is called ___.

A

MALWARE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

A physical security safeguard that controls entry into a protected area. This entry method has two sets of doors on either end of a small room and is called ___.

A

MANTRAP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

This is a rule that users should have access to only the the information they need to do their jobs and called ___.

A

NEED TO KNOW

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

A piece of software or code that fixes a programs’ security vulnerabilities. These are available for many types of software, including operating systems and is called ___.

A

PATCH

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Controls keep unauthorized individuals out of a building or other controlled areas. You can also use these to keep unauthorized individuals from using an information system. This is called ___.

A

PHYSICAL SAFEGUARD

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

The amount of risk left over after safeguards lessen a vulnerability or threat is called ___.

A

RESIDUAL RISK

21
Q

A business decision to accept an assessed risk and take no action against it is called ___.

A

RISK ACCEPTANCE

22
Q

A business decision to apply safeguards to avoid a negative impact is called ___.

A

RISK AVOIDANCE

23
Q

A business decision to apply safeguards to lessen a negative impact is called ___.

A

RISK MITIGATION

24
Q

A business decision to transfer a risk to a third party to avoid that risk is called ___.

A

RISK TRANSFER

25
Q

Any protective action that reduces information security risks. They may eliminate or lesson vulnerabilities, control threats, or reduce risk and are also known as controls are called ___.

A

SAFEGUARD

26
Q

A rule that two or more employees must split critical task functions. Thus, no one employee know all of the steps required to complete the critical task is called ___.

A

SEPARATION OF DUTIES

27
Q

Looking over the shoulder of another person to obtain sensitive information. The attacker doesn’t have permission to see it. This usually describes an attack in which a person tries to learn sensitive information by viewing keystrokes on a monitor or keyboard is called ___.

A

SHOULDER SURFING

28
Q

In an information system, a piece of hardware or application critical to the entire system’s functioning. If that single item fails, then a critical portion or the entire system could fail and is called ___.

A

SINGLE POINT OF FAILURE

29
Q

An attack that relies on human interaction. They often involve tricking other people to break security procedures so the attacker can gain information about computer systems. This type of attack isn’t technical and is called ___.

A

SOCIAL ENGINEERING

30
Q

Controls implemented in an information system’s hardware and software. Technical controls include passwords, access control mechanisms, and automated logging. They improve the system’s security and is called ___.

A

TECHNICAL SAFEGUARD

31
Q

Any danger that takes advantage of a vulnerability and are unintentional or intentional are called ___.

A

THREAT

32
Q

A weakness or flaw in an information system. Exploiting a vulnerability harms information security. You reduce them by applying security safeguards are called ___.

A

VULNERABILITY

33
Q

The period between discovering a vulnerability and reducing or eliminating it is called ___.

A

WINDOW OF VULNERABILITY

34
Q

A vulnerability exploited shortly after it is discovered. The attacker exploits it before the vendor releases a patch and is called ___.

A

ZERO-DAY VULNERABILITY

35
Q
  1. What are the goals of an information security program?
  2. Authorization, integrity, and confidentiality
  3. Availability, authorization, and integrity
  4. Availability, integrity, and confidentiality
  5. Availability, integrity, and safeguards
  6. Access control, confidentiality, and safeguards
A

Availability, integrity, and confidentiality

36
Q
  1. An employee can add other employees to the payroll database. The same person also can change all employee salaries and print payroll checks for all employees. What safeguard should you implement to make sure that this employee doesn’t engage in wrongdoing?
  2. Need to know
  3. Access control lists
  4. Technical safeguards
  5. Mandatory vacation
  6. Separation of duties
A

Separation of duties

37
Q
  1. An organization obtains an insurance policy against cybercrime. What type of risk response is this?
  2. Risk mitigation
  3. Residual risk
  4. Risk elimination
  5. Risk transfer
  6. Risk management
A

Risk transfer

38
Q
  1. Which of the following is an accidental threat?
  2. A backdoor into a computer system
  3. A hacker
  4. A well-meaning employee who inadvertently deletes a file
  5. An improperly redacted document
  6. A poorly written policy
A

A well-meaning employee who inadvertently deletes a file

39
Q
  1. What is the window of vulnerability?
  2. The period between the discovery of a vulnerability and mitigation of the vulnerability
  3. The period between the discovery of a vulnerability and exploiting the vulnerability
  4. The period between exploiting a vulnerability and mitigating the vulnerability
  5. The period between expiating a vulnerability and eliminating the vulnerability
  6. A broken window
A

The period between the discovery of a vulnerability and mitigation of the vulnerability

40
Q
  1. A technical safeguard is also known as ___.
A

Logical control

41
Q
  1. Which of the following isn’t a threat classification?
  2. Human
  3. Natural
  4. Process
  5. Technology and Operational
  6. Physical and Environmental
A

Process

42
Q
  1. Which of the following is an example of a model for implementing safeguards?
  2. Confidentiality
  3. Integrity
  4. Authentication
  5. Availability
  6. Privacy
A

Availability

43
Q
  1. Which of the following is an example of a model for implementing safeguards?
  2. ISO/IEC 27002
  3. NIST SP 80-553
  4. NIST SP 800-3
  5. ISO/IEC 20072
  6. ISO/IEC 70022
A

ISO/IEC 27002

44
Q
  1. Which of the following is not a type of security safeguard?
  2. Corrective
  3. Preventative
  4. Detective
  5. Physical
  6. Defective
A

Defective

45
Q
  1. It is hard to safeguard against which of the following types of vulnerabilities?
  2. Information leakage
  3. Flooding
  4. Buffer overflow
  5. Zero-day
  6. Hardware failure
A

Zero-day

46
Q
  1. What are the classification levels for US national security information?
  2. Public, Sensitive, Restricted
  3. Confidential, Secret, Top Secret
  4. Confidential, Restricted, Top Secret
  5. Public, Secret, Top Secret
  6. Public, Sensitive, Secret
A

Confidential, Secret, Top Secret

47
Q
  1. Which safeguard is most likely violated if a system administrator logs into an administrator user account in order to surf the Internet and download music files?
  2. Need to know
  3. Access control
  4. Least privilege principle
  5. Using best available path
  6. Separation of duties
A

Least privilege principle

48
Q
  1. Which of the following are vulnerability classifications?
  2. People
  3. Process
  4. Technology
  5. Facility
  6. All the above
A

People
Process
Technology
Facility

49
Q
  1. What is a mantrap?
  2. A method to control access to a secure area
  3. A removable cover that allow access to underground utilities
  4. A logical access control mechanism
  5. An administrative safeguard
  6. None of the above
A

A method to control access to a secure area

CSC 6530 MID-TERM (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions