Security and Risk Management Flashcards
This domain represents 15% of the CISSP exam and covers fundamental security concepts and principles, as well as compliance, ethics, governance, security policies and procedures, business continuity planning, risk management, and security education, training, and awareness.
Q.Q. 1 A statement that specifies security technologies or products is known as a(n)
Product guideline
Informative policy
Security standard
Safeguard
Security standard
Note
Security standards define specific (or minimum) products or technologies required to protect information.
Q.Q. 2 Information warfare is BEST known as a
Potential loss
Vulnerability
Threat
Risk
Vulnerability
Q.Q. 3 A suspect has been apprehended and charged with breaking into a database containing medical records. Under which of the following U.S. laws is the suspect most likely to be charged? Drag and drop the correct answer(s) from top to bottom.
PCI DSS HIPAA Data Protection Act Federal Privacy Act Computer Fraud and Abuse Act
Computer Fraud and Abuse
note
The suspect would most likely be charged with a violation of the Computer Fraud and Abuse Act, which pertains to the unlawful or unauthorized access to a computer system. The Health Insurance Portability and Accountability Act (HIPAA), Payment Card Industry Data Security Standard (PCI DSS), Data Protection Act, and Federal Privacy Act of 1974 all address what an organization must do to protect information.
Q.Q. 4 The name of the U.S. law requiring protection of personal medical information is
PIPEDA
GLBA
HIPAA
HIPPA
HIPAA
note
[Security and Risk Management] The Health Insurance Portability and Accountability Act (HIPAA) addresses health care information privacy in the U.S. HIPPA is a common misspelling of the HIPAA acronym. The Personal Information Protection and Electronic Documents Act (PIPEDA) is a Canadian law relating to data privacy in the private sector. The Gramm-Leach-Bliley Act (GLBA) relates to data privacy in the financial sector.
Q.Q. 5 What’s meant by the term risk mitigation?
Elimination of risk
Reduction of risk to an acceptable level
Calculating vulnerabilities multiplied by threats
Ranking risks in order of likelihood
Reduction of risk to an acceptable level
Q.Q. 6 Using social skills to acquire critical information about computer systems is known as
Social espionage
Social engineering
Online dating
Eavesdropping
Social engineering
Note
Social engineering describes the activity carried out by individuals who claim to be someone they’re not in order to elicit information from unsuspecting individual in order to facilitate an intrusion.
Q. 7 Audit trails and security cameras are examples of
Detective controls Preventive controls Corrective controls Trust controls
Detective controls
Note
Detective controls, such as audit trails and security cameras, are designed to discover a security incident that is occurring or has already occurred.
Q. 8 It’s difficult to determine that theft of information has occurred because
It’s not a crime unless someone posts the information on the Internet Most sites have inadequate audit logs More often than not, the information is still there Most law enforcement personnel don’t understand information technology
More often than not, the information is still there
Note
When information is stolen, it’s most often copied, which means that the original information is still on the original system, unlike in the case of theft of physical property.
Q. 9 What’s the greatest source of loss when a corporate laptop is lost or stolen?
Self esteem of the laptop owner Licensed software installed on the laptop Information stored on the laptop Street value of the laptop
Information stored on the laptop
Q. 10 The purpose of a security control is to
Contain and deliver a specific security policy Record recipients of classified documents Properly release data to comply with a court order Reduce threats and vulnerabilities to an acceptable level
Reduce threats and vulnerabilities to an acceptable level
Note
Security controls are used to address threats and vulnerabilities.
Q. 11 Under what circumstance can evidence be seized without a warrant?
If it’s in the public domain If it’s believed that its destruction is imminent In international incidents If it’s on a computer
If it’s believed that its destruction is imminent
Note
Evidence may be seized without a warrant under exigent circumstances; that is, if law enforcement reasonably believes it is about to be destroyed.
Q. 12 Motive, means, and opportunity
Are required prior to the commission of a crime Are the required three pieces of evidence in any criminal trial Are the three factors that determine whether someone may have committed a crime Are the usual ingredients in a sting operation
Are the three factors that determine whether someone may have committed a crime
Note
Motive, means, and opportunity are the standard criteria used when considering a possible suspect in a crime.
Q. 13 What’s the purpose of a senior management statement of security policy?
It defines who’s responsible for carrying out a security policy It states that senior management doesn’t need to follow a security policy It emphasizes the importance of security throughout an organization It states that senior management must also follow a security policy
It emphasizes the importance of security throughout an organization
Note
A senior management statement of security policy underscores the importance of (and senior management’s commitment to) security within the organization.
Q. 14 The primary goal of information privacy laws is to
Require organizations to ask for permission each time they share information Discourage the abuse of individuals’ private information Require the use of government-operated databases, rather than private databases Prevent individuals from falsifying information about themselves
Discourage the abuse of individuals’ private information
Note
Privacy laws seek to curb the abuses of an individual’s private information by organizations and individuals who misuse that information.
Q. 15 The loss of competitive advantage and market share due to a disaster is an example of
Ineffective strategic planning A qualitative loss A quantitative loss Profiteering
A qualitative loss
Note
Competitive advantage and market share are examples of qualitative losses that an organization may suffer in the event of a disaster or security incident, because they cannot be objectively valued.
Q. 16 The deliberate misuse of information is prohibited by
The U.S. Federal Trade Commission The Heisenberg Principle The Fourth Amendment of the U.S. Constitution The (ISC)2 Code of Ethics
The (ISC)2 Code of Ethics
Note
The (ISC)2 Code of Ethics prohibits the deliberate misuse of information.
Q. 17 The most cost-effective way to make employees aware of security policies is to
Use email and Web sites to communicate the importance of security Enroll all employees in a security awareness class Send a hardcopy set of security policies to each employee Purchase a good book on security for each employee
Use email and Web sites to communicate the importance of security
Note
Using existing tools, such as email and websites, is a cost-effective way to communicate security information within an organization.
Q. 18 The illegal acquisition of funds through intimidation is known as
Embezzlement Conspiracy Blackmail Extortion
Extortion
Q. 19 The only way to be absolutely sure that a hard disk hasn’t been tampered with is to
Write-protect the hard disk Remove the hard disk from the computer Create a digital signature based on the hard disk’s entire contents Back up the hard disk to tape and make comparisons later, as needed
Create a digital signature based on the hard disk’s entire contents
Note
A digital signature is the most reliable way of determining whether a hard disk has been tampered with. Write protection can be defeated and alters the attributes of files on the hard disk, removing the hard disk from the computer doesn’t assure that it can’t be changed, and backing up a hard disk alters the attributes of files on the hard disk.
Q. 20 Reboot instructions and file restore procedures are examples of
Detective controls Preventive controls Corrective controls Trust controls
Corrective controls
Note
Corrective controls, such as reboot instructions and file restore procedures, are designed to restore normal operations after a security incident has occurred.
Q. 21 In the context of data processing continuity planning, subscription services refers to
Contracts to have replacement computer hardware within 72 hours Contracts to have replacement computer hardware within 24 hours Commercial services providing hot sites, warm sites, and cold sites The quarterly journal Continuity Planning
Commercial services providing hot sites, warm sites, and cold sites
Q. 22 The chain of evidence ensures
That evidence links the alleged perpetrator to the crime That those who collected it will be available to testify in court That it’s relevant and reliable The integrity of evidence, from collection through safekeeping
The integrity of evidence, from collection through safekeeping
Q. 23 Access controls and card-key systems are examples of
Detective controls Preventive controls Corrective controls Trust controls
Preventive controls
Note
Preventive controls, such as access controls and card-key systems, are designed to prevent a security incident from occurring.
