Question 1

A breach of possession always results in a breach of confidentiality.

Accepted Answer

False

Question 2

During the early years, information security was a straightforward process composed predominantly of ____________________ security and simple document classification schemes.

Accepted Answer

Physical

Question 3

Which of the following is a valid type of data ownership?

Accepted Answer

Data Users, Data Owners and Data Custodians

Question 4

____ is the predecessor to the Internet.

Accepted Answer

Arpanet

Question 5

A(n) ____ attack is a hacker using a personal computer to break into a system.

Accepted Answer

Direct

Question 6

In an organization, the value of ____________________ of information is especially high when it involves personal information about employees, customers, or patients.

Accepted Answer

Confidentiality

Question 7

The ____ model consists of six general phases.

Accepted Answer

Waterfall

Question 8

Key end users should be assigned to a developmental team, known as the united application development team.

Accepted Answer

False

Question 9

A(n) _________________________ is a group of individuals who are united by similar interests or values within an organization and who share a common goal of helping the organization to meet its objectives.

Accepted Answer

Community of Interest

Question 10

The primary threats to security during the early years of computers were physical theft of equipment, espionage against the products of the systems, and sabotage.

Accepted Answer

True

Question 11

A data custodian works directly with data owners and is responsible for the storage, maintenance, and protection of the information.

Accepted Answer

True

Question 12

The physical design is the blueprint for the desired solution.

Accepted Answer

False

Question 13

The ____________________ of information is the quality or state of ownership or control of some object or item.

Accepted Answer

Possession

Question 14

The Internet brought connectivity to virtually all computers that could reach a phone line or an Internet-connected local area ____________________.

Accepted Answer

Network

Question 15

The history of information security begins with the history of ____________________ security.

Accepted Answer

Computer

Question 16

MULTICS stands for Multiple Information and Computing Service.

Accepted Answer

False

Question 17

During the ____________________ War, many mainframes were brought online to accomplish more complex and sophisticated tasks so it became necessary to enable the mainframes to communicate via a less cumbersome process than mailing magnetic tapes between computer centers.

Accepted Answer

Cold

Question 18

Recently, many states have implemented legislation making certain computer-related activities illegal.

Accepted Answer

True

Question 19

Information security can begin as a grassroots effort in which systems administrators attempt to improve the security of their systems, which is often referred to as a bottom-up approach.

Accepted Answer

True

Question 20

A famous study entitled \"Protection Analysis: Final Report\" was published in ____.

Accepted Answer

1978

Question 21

Risk evaluation is the process of identifying, assessing, and evaluating the levels of risk facing the organization, specifically the threats to the organization\'s security and to the information stored and processed by the organization.

Accepted Answer

False

Question 22

The implementation phase is the longest and most expensive phase of the systems development life cycle (SDLC).

Accepted Answer

False

Question 23

Of the two approaches to information security implementation, the top-down approach has a higher probability of success.

Accepted Answer

True

Question 24

____ presents a comprehensive information security model and has become a widely accepted evaluation standard for the security of information systems.

Accepted Answer

NSTISSI No. 4011

Question 25

An e-mail virus involves sending an e-mail message with a modified field.

Accepted Answer

False

Question 26

Organizations are moving toward more ____-focused development approaches, seeking to improve not only the functionality of the systems they have in place, but consumer confidence in their product.

Accepted Answer

Security

Question 27

____ of information is the quality or state of being genuine or original.

Accepted Answer

Authenticity

Question 28

In the ____________________ approach, the project is initiated by upper-level managers who issue policy, procedures and processes, dictate the goals and expected outcomes, and determine accountability for each required action.

Accepted Answer

Top-Down

Question 29

Hardware is the physical technology that houses and executes the software, stores and transports the data, and provides interfaces for the entry and removal of information from the system.

Accepted Answer

True

Question 30

The ____________________ component of the IS comprises applications, operating systems, and assorted command utilities.

Accepted Answer

Software

Question 31

People with the primary responsibility for administering the systems that house the information used by the organization perform the ____ role.

Accepted Answer

System Administrator

Question 32

Information has redundancy when it is free from mistakes or errors and it has the value that the end user expects.

Accepted Answer

False

Question 33

The most successful kind of top-down approach involves a formal development strategy referred to as a ____.

Accepted Answer

Systems Development life cycle

Question 34

____ was the first operating system to integrate security as its core functions.

Accepted Answer

MULTICS

Question 35

Hardware is often the most valuable asset possessed by an organization and it is the main target of intentional attacks.

Accepted Answer

False

Question 36

____ security addresses the issues necessary to protect the tangible items, objects, or areas of an organization from unauthorized access and misuse.

Accepted Answer

Physical

Question 37

Part of the logical design phase of the SecSDLC is planning for partial or catastrophic loss. ____ dictates what steps are taken when an attack occurs.

Accepted Answer

Incidence Response

Question 38

A frequently overlooked component of an IS, ____________________ are written instructions for accomplishing a specific task.

Accepted Answer

Procedures

Question 39

The investigation phase of the SecSDLC begins with a directive from upper management.

Accepted Answer

True

Question 40

Policies are written instructions for accomplishing a specific task.

Accepted Answer

False

Question 41

____________________ enables authorized users â persons or computer systems â to access information without interference or obstruction and to receive it in the required format.

Accepted Answer

Availability

Question 42

The ____ is the individual primarily responsible for the assessment, management, and implementation of information security in the organization.

Accepted Answer

CISO

Question 43

The ____________________ phase consists primarily of assessments of the organization, its current systems, and its capability to support the proposed systems.

Accepted Answer

Analysis

Question 44

____________________ of information is the quality or state of being genuine or original, rather than a reproduction or fabrication.

Accepted Answer

Authenticity

Question 45

A computer is the ____________________ of an attack when it is the target entity.

Accepted Answer

Object

Question 46

The possession of information is the quality or state of having value for some purpose or end.

Accepted Answer

False

Question 47

In file hashing, a file is read by a special algorithm that uses the value of the bits in the file to compute a single large number called a ____ value.

Accepted Answer

Hash

Question 48

During the ____ phase, specific technologies are selected to support the alternatives identified and evaluated in the logical design.

Accepted Answer

Physical Design

Question 49

Direct attacks originate from a compromised system or resource that is malfunctioning or working under the control of a threat.

Accepted Answer

False

Question 50

The CNSS model of information security evolved from a concept developed by the computer security industry known as the ____________________ triangle.

Accepted Answer

CIA

Question 51

The roles of information security professionals are aligned with the goals and mission of the information security community of interest.

Accepted Answer

True

Question 52

Using a methodology increases the probability of success.

Accepted Answer

True

Question 53

Confidentiality ensures that only those with the rights and privileges to access information are able to do so.

Accepted Answer

True

Question 54

An information system is the entire set of ____, people, procedures, and networks that make possible the use of information resources in the organization.

Accepted Answer

Hardware, Software, Data

Question 55

The senior technology officer is typically the chief ____________________ officer.

Accepted Answer

Information

Question 56

A(n) ____________________ is a formal approach to solving a problem by means of a structured sequence of procedures.

Accepted Answer

Methodology

Question 57

A(n) ____________________ information security policy outlines the implementation of a security program within the organization.

Accepted Answer

Enterprise

Question 58

Which of the following phases is the longest and most expensive phase of the systems development life cycle?

Accepted Answer

Maintenance and Change

Question 59

In general, protection is \"the quality or state of being secureâto be free from danger.\"

Accepted Answer

False

Question 60

____________________ carries the lifeblood of information through an organization.

Accepted Answer

Software

Question 61

To achieve balance â that is, to operate an information system that satisfies the user and the security professional â the security level must allow reasonable access, yet protect against threats.

Accepted Answer

True

Question 62

A champion is a project manager, who may be a departmental line manager or staff unit manager, and understands project management, personnel management, and information security technical requirements.

Accepted Answer

False

Question 63

The Analysis phase of the SecSDLC begins with a directive from upper management.

Accepted Answer

False

Question 64

A computer is the ____ of an attack when it is used to conduct the attack.

Accepted Answer

Subject

Information Security Chapter 1 – Flashcards

Unlock all answers in this set

Haven't found what you were looking for?

Search for samples, answers to your questions and flashcards