Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

InfoSec. Mngmt > Mid-Term > Flashcards

Mid-Term Flashcards

1
Q

“4-1-9” fraud is an example of a __________ attack

A

social engineering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

“4-1-9” is one form of a(n) __________ fraud.

A

advance-fee

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A __________ is an attack in which a coordinated stream of requests is launched against a target from many locations at the same time.

A

Distributed Denial of service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A hacker who intentionally removes or bypasses software copyright protection designed to prevent unauthorized duplication or use is known as a(n) __________.

A

Cracker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A model of InfoSec that offers a comprehensive view of security for data while being stored, processed, or transmitted is the __________ security model

A

CNSS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A potential weakness in an asset or its defensive control system(s) is known as a(n) __________.

A

vulnerability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

process that defines what the user is permitted to do is known as __________.

A

Authorization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

A short-term interruption in electrical power availability is known as a __________.

A

Fault

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A technique used to compromise a system is known as a(n) __________

A

exploit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Acts of __________ can lead to unauthorized real or virtual actions that enable information gatherers to enter premises or systems they have not been authorized to access.

A

Trepass

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

An attack that uses phishing techniques along with specialized forms of malware to encrypt the victim’s data files is known as__________.

A

ransomware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

An information security professional with authorization to attempt to gain system access in an effort to identify and recommend resolutions for vulnerabilities in those systems is known as a(n) __________.

A

penetration tester.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

An intentional or unintentional act that can damage or otherwise compromise information and the systems that support it is known as a(n) __________.

A

Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Any event or circumstance that has the potential to adversely affect operations and assets is known as a(n) __________

A

Threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

As frustrating as viruses and worms are, perhaps more time and money is spent on resolving virus __________.

A

hoaxes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Human error or failure often can be prevented with training and awareness programs, policy, and __________ .

A

controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

In the __________ attack, an attacker monitors (or sniffs) packets from the network, modifies them, and inserts them back into the network.

A

man-in-the-middle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

One form of online vandalism is __________, in which individuals interfere with or disrupt systems to protest the operations, policies, or actions of an organization or government agency.

A

hacktivist

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Technology services are usually arranged with an agreement defining minimum service levels known as a(n) __________.

A

SLA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

The hash values for a wide variety of passwords can be stored in a database known as a(n) __________, which can be indexed and quickly searched using the hash value, allowing the corresponding plaintext password to be determined.

A

rainbow table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

The protection of confidentiality, integrity, and availability of data regardless of its location is known as _______ security.

A

Information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

The protection of voice and data components, connections, and content is known as _______ security.

A

network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

The unauthorized duplication, installation, or distribution of copyrighted computer software, which is a violation of intellectual property, is called _______

A

software piracy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

The use of cryptographic certificates to establish Secure Sockets Layer (SSL) connections is an example of which process?

A

authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What do audit logs that track user activity on an information system provide?

A

accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

___________is the set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately, and verifying that the enterprise’s resources are used responsibly.

A

Governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

__________ are malware programs that hide their true nature and reveal their designed behavior only when activated.

A

Trojan horses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

__________ is the collection and analysis of information about an organization’s business competitors, often through illegal or unethical means, to gain an unfair edge over them.

A

Industrial espionage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Individuals who control, and are therefore responsible for, the security and use of a particular set of information are known as ____________

A

Data Owners.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

The individual responsible for the assessment, management, and implementation of information-protection activities in the organization is known as a(n) ____________.

A

Chief of Information Security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

A 2007 Deloitte report found that enterprise risk management is a valuable approach that can better align security functions with the __________ while offering opportunities to lower costs.

A

enterprise risk management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

A clearly directed __________ flows from top to bottom, and a systematic approach is required to translate it into a program that can inform and lead all members of the organization.

A

strategy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

A formal approach to solving a problem based on a structured sequence of procedures, the use of which ensures a rigorous process and increases the likelihood of achieving the desired final objective, is known as a(n) ____________.

A

Methodology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

A high-level executive such as a CIO or VP-IT, who will provide political support and influence for a specific project, is known as a(n) _________.

A

champion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

A person or organization that has a vested interest in a particular aspect of the planning or operation of an organization—for example, the information assets used in a particular organization—is known as a(n) _________.

A

stakeholder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

A project manager who understands project management, personnel management, and InfoSec technical requirements is needed to fill the role of a(n) ____________.

A

Team Leader.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

A qualified individual who is tasked with configuring security technologies and operating other technical control systems is known as a(n) ____________

A

Security Technician

38
Q

A senior executive who promotes the project and ensures its support, both financially and administratively, at the highest levels of the organization is needed to fill the role of a(n) ____________ on a development team

A

champion

39
Q

According to the Corporate Governance Task Force (CGTF), during which phase of the IDEAL model and framework does the organization plan the specifics of how it will reach its destination?

A

establishing

40
Q

According to the Corporate Governance Task Force (CGTF), which phase in the IDEAL model and framework lays the groundwork for a successful improvement effort?

A

Initiating

41
Q

ISO 27014:2013 is the ISO 27000 series standard for ____________.

A

Governance of Information Security

42
Q

IT’s focus is the efficient and effective delivery of information and administration of information resources, while InfoSec’s primary focus is the __________ of all information assets.

A

protection

43
Q

In the __________ phase of the SecSDLC, the team studies documents and looks at relevant legal issues that could affect the design of the security solution.

A

Analysis

44
Q

In which SDLC model does the work product from each phase transition into the next phase to serve as its starting point while allowing movement back to a previous phase should the project require it?

A

waterfall

45
Q

In which phase of the SecSDLC does the risk management task occur?

A

analysis

46
Q

Internal and external stakeholders, such as customers, suppliers, or employees who interact withinformation in support of their organization’s planning and operations, are known as ____________.

A

data users.

47
Q

The __________ phase of the SecSDLC begins with a directive from upper management specifying the process, outcomes, and goals of the project as well as itsbudget and other constraints.

A

Investigation

48
Q

The __________ phase of the SecSDLChas team members create and develop the blueprint for security and develop critical contingency plans for incident response.

A

Justification

49
Q

The first priority of the CISO and the InfoSec management team should be the __________.

A

structure of a strategic plan

50
Q

The individual accountable for ensuringthe day-to-day operation of the InfoSec program, accomplishing the objectives identified by the CISO, and resolving issues identified by technicians is known as a(n) ____________.

A

security manager.

51
Q

The letters GRC represent an approach to information security strategic guidance from a board of directors or senior management perspective. The letters stand for __________, __________, and __________.

A

Governance, risk management, and compliance.

52
Q

The process of integrating the governance of the physical security and information security efforts is known in the industryas __________.

A

convergence

53
Q

The set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately, and verifying that the enterprise’s resources are used responsibly is known as __________.

A

Governance

54
Q

What is the first phase of the SecSDLC?

A

investigation

55
Q

When creating a __________, each level of each division translates its goals into more specific goals for the level below it.

A

strategic plan

56
Q

Whenusing the Governing for Enterprise Security (GES) program, an Enterprise Security Program (ESP) should be structured so that governance activities are driven by the organization’s executive management, and so that it selects key stakeholders as well as the ____________.

A

Board Risk Committee.

57
Q

“GGG security” is a term commonly used to describe which aspect of security?

A

Physical.

58
Q

A specialized security administrator responsible for performing systems development life cycle (SDLC) activities in the development of a security system is known as __________.

A

security analyst.

59
Q

An (ISC) 2 program geared toward individuals who want to take any of its certification exams before obtaining the requisite experience for certification is the __________.

A

Associate of (ISC)2.

60
Q

An ISACA certification targeted at upper-level executives, including CISOs and CIOs, directors, and consultants with knowledge and experience in IT governance, is known as the __________.

A

CGEIT

61
Q

An ISACA certification targeted at IT professionals who are in careers that link IT risk management with enterprise risk management is known as the __________.

A

CRISC

62
Q

In large organizations, the InfoSec department is often located within a(n) _________ division headed by the _________, who reports directly to the _________

A

IT, CISO, CIO

63
Q

Larger organizations tend to spend approximately __________ percent of the total IT budget on security.

A

5

64
Q

Medium-sized organizations tend to spend approximately __________ percent of the total IT budget on security.

A

11

65
Q

Smaller organizations tend to spend approximately __________ percent of the total IT budget on security.

A

20

66
Q

Organizations classified as __________ may still be large enough to implement the multitier approach to security, though perhaps with fewer dedicated groups and more functions assigned to each group.

A

Medium-sized

67
Q

The __________ certification, considered to be one of the most prestigious certifications for security managers and CISOs, recognizes mastery of an internationally identified common body of knowledge (CBK) in InfoSec and is considered to be vendor neutral .

A

CISSP

68
Q

There are anumber of methods for customizing training for users; two of the most common involve customizing by __________ and by __________.

A

functional background, skill level.

69
Q

This person would be responsible for some aspect of information security and report to the CISO; in smaller organizations, this title may be assigned to the only or senior security administrator.

A

security manager

70
Q

What is the SETA program designed to do?

A

reduce the occurrence of accidental security breaches

71
Q

Deterrence is the best method for preventing an illegal or unethical activity. TRUE

A

TRUE

72
Q

Due diligence requires that an organization make a valid and ongoing effort to protect others.

A

TRUE

73
Q

A(n) compromise law specifies a requirement for organizations to notify affected parties when they have experienced a specified type of loss of information.

A

FALSE

74
Q

Ethics carry the sanction of a governing authority.

A

FALSE

75
Q

ISACA is a professional association with a focus on authorization, control, and security.

A

FALSE

76
Q

6.Information ambiguation occurs when pieces of nonprivate data are combined to create information that violates privacy.

A

FALSE

77
Q

InfraGard began as a cooperative effort between the FBI’s Cleveland field office and local intelligence professionals.

A

FALSE

78
Q

It is the responsibility of InfoSec professionals to understand state laws and bills.

A

FALSE

79
Q

The Gramm-Leach-Bliley (GLB) Act, also known as the Financial Services Modernization Act of 1999, contains a number of provisions that affect banks, securities firms, and insurance companies

A

TRUE

80
Q

The Secret Service is charged with the detection and arrest of any person who commits a U.S. federal offense relating to computer fraud, as well as false identification crimes.

A

TRUE

81
Q

To protect intellectual property and competitive advantage, Congress passed the Entrepreneur Espionage Act (EEA) in 1996.

A

FALSE

82
Q

Information security policies are designed to provide structure in the workplace and explain the will of the organization’s management.

A

TRUE

83
Q

Access control lists regulate who, what, when, where, and why authorized users can access a system.

A

TRUE

84
Q

Because most policies are drafted by a single person and then reviewed by a higher-level manager, employee input should not be considered because it makes the process too complex.

A

FALSE

85
Q

Examples of actions that illustrate compliance with policies are known as laws.

A

FALSE

86
Q

Nonmandatory recommendations that the employee may use as a reference in complying with a policy are known as regulations.

A

FALSE

87
Q

One of the goals of an issue-specific security policy is to indemnify the organization against liability for an employee’s inappropriate or illegal use of the system.

A

TRUE

88
Q

18.Policies must specify penalties for unacceptable behavior and define an appeals process.

A

TRUE

89
Q

Technology is the essential foundation of an effective information security program.

A

FALSE

90
Q

The “Authorized Uses” section of an ISSP specifies what the identified technology cannot be used for.

A

FALSE

91
Q

The need for effective policy management has led to the emergence of a class of software tools that supports policy development, implementation, and decentralization.

A

FALSE

InfoSec. Mngmt (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions