IS4550 CHAPTER 1

Question 1

The process of determining the identity of an individual or device is called ___.

Answer 1

AUTHENTICATION

Question 2

Ensuring accessibility of information to authorized users when required is called ___.

Answer 2

AVAILABILITY

Question 3

A management technique used to improve the efficiency and effectiveness of a process within an organization is called ___.

Answer 3

BUSINESS PROCESS REENGINEERING (BPR)

Question 4

Limiting access to information/data to authorized users only is called ___.

Answer 4

CONFIDENTIALITY

Question 5

An ad hoc, ongoing effort to improve business products, services, or process is called ___.

Answer 5

CONTINUOUS IMPROVEMENT

Question 6

The state of data stored on any type of media is called ___.

Answer 6

DATA AT REST

Question 7

The state of data when traveling over or through a network is called ___..

Answer 7

DATA IN TRANSIT

Question 8

The act of managing implementation and compliance with organizational policies is called ___.

Answer 8

GOVERNANCE

Question 9

The parameters within which a policy, standard, or procedure recommended when possible but are optional is called ___.

Answer 9

GUIDELINE

Question 10

The implementation of controls designed to ensure confidentiality, integrity, availability, and non-repudiation is called ___.

Answer 10

INFORMATION ASSURANCE

Question 11

The act of protecting information systems or IT infrastructures from unauthorized use, access, disruption, or destruction is called ___.

Answer 11

INFORMATION SYSTEMS SECURITY (ISS)

Question 12

The five-phase management process of controlling the planning, implementation, evaluation, and maintenance of information systems security is called ___.

Answer 12

INFORMATION SYSTEMS SECURITY MANAGEMENT LIFE CYCLE

Question 13

The act of ensuring that information has not been improperly changed is called ___.

Answer 13

INTEGRITY

Question 14

A principle that restricts information access to only those users with an approved and valid requirement is called ___.

Answer 14

NEED TO KNOW

Question 15

The concept of applying technology in way that an individual cannot deny or dispute they were part of a transaction is called ___.

Answer 15

NONREPUDIATION

Question 16

A document that states how the organization is to perform and conduct business functions and transactions with a desired outcome is called ___.

Answer 16

POLICY

Question 17

A structure for organizing policies, standards, procedures, and guidelines is called ___.

Answer 17

POLICY FRAMEWORK

Question 18

A written statement describing the steps required to implement a process is called ___.

Answer 18

PROCEDURE

Question 19

A set of policies that establish how an organization secures its facilities and IT infrastructure. It can also address how the organization meets regulatory requirements is called ___.

Answer 19

SECURITY POLICIES

Question 20

The portion of a service contract that formally defines the level of service. These agreements are typical in telecommunications contracts for voice and data transmission circuits is called ___.

Answer 20

SERVICE LEVEL AGREEMENT (SLA)

Question 21

An established and proven norm or method. The can be a procedural or technical ___ implemented organization-wide.

Answer 21

STANDARD

Question 22

1. What is the issue in the following? John works in the accounting dept. but travels to other company locations. He must present the past quarter’s figures to the CEO in the morning. He forgot to update the Power Point presentation on his desktop computer at the main office.
2. Unauthorized access to the system
3. Integrity of the data
4. Availability of the data
5. Nonrepudiation of the data
6. Unauthorized use of the system

Answer 22

Availability of the data

Question 23

2. Governance is the practice of ensuring an entity is in conformance to policies, regulations, ___, and procedures.

Answer 23

Standards

Question 24

3. COBIT is a widely accepted international best practices policy framework.
   TRUE OR FALSE

Answer 24

True

Question 25

4. Which of the following are generally accepted as IA tenets but not ISS tenets? (Select 2)
5. Confidentiality
6. Integrity
7. Availability
8. Authentication
9. Nonrepudiation

Answer 25

Authentication

Nonrepudiation

Question 26

5. Greg has developed a document on how to operate and back up the new financial sections storage area network. In it, he lists the steps required for powering up and down the system as well as configuring the backup tape unit. Greg has written ___.

Answer 26

Procedure

Question 27

6. When should a wireless security policy be initially written?
7. When the industry publishes new wireless standards
8. When a vendor presents wireless solutions to the business
9. When the next generation of wireless technology is launched
10. After a company decides to implement wireless and before it is installed

Answer 27

After a company decides to implement wireless and before it is installed

Question 28

7. A toy company is developing the next generation of children’s reading aids. They already produced a comparable product, but the new one will not be available on shelves for another two years. What process would drive policies related to the new product’s information systems security?
8. Continuous improvement
9. Business process reengineering
10. Encryption
11. Information systems security management life cycle
12. Software development life cycle

Answer 28

Business process reengineering

Question 29

8. Implementation and enforcement of policies is a challenge. The biggest hindrance to implementation of policies is the ___ factor.

Answer 29

Human

Question 30

9. Information systems security policies should support ___.

Answer 30

Business Operations

Question 31

10. Security policies focus on providing consistent protection of information in the system. This happens by controlling multiple aspects of the information system that directly or indirectly affect normal operations at some point.While there are many different benefits to supporting operations, some are more prevalent than others. Which of the following are aspects of ISS policies that extend to support business operations?
11. Controlling change to the IT infrastructure
12. Protecting data at rest and in transit
13. Protecting systems from the insider threat
14. 2 & 3 Only
15. All the above

Answer 31

Controlling change to the IT infrastructure
Protecting data at rest and in transit
Protecting systems from the insider threat

Question 32

11. Ted is an administrator in the server backup area. He is reviewing the contract for the offsite storage facility for validity. This contract includes topics such as the amount of storage space required, the pickup and delivery of media, response times during an outage, and security of media within the facility. This contract is an example of information security.
    TRUE OR FALSE

Answer 32

FALSE