Font size
WorksheetsInformation Security and Risk Management MCQs
Total questions: 100
Worksheet time: 1hrs 7mins
Which three characteristics form the C.I.A. triad in information security?
Control, Inspection, Accuracy
Confidentiality, Integrity, Availability
Configuration, Identification, Authentication
Communication, Integrity, Authorization
According to the CNSS, information security protects which of the following?
Only the information stored in databases
Only the hardware used to process information
Information and its critical elements, including systems and hardware
Only network devices
Which statement best explains why the C.I.A. triad is considered inadequate today?
It lacks technical controls
Modern information environments require models addressing a broader set of evolving threats
It does not include authentication
It cannot be applied to government systems
What is the primary mission of an information security program?
To eliminate all cyber threats
To ensure information assets remain safe and useful
To maximize system performance
To replace manual business processes
Which of the following best describes “data security”?
Protection of hardware and facilities
Protection of data only when stored
Protection of data at rest, in processing, and in transmission
Protection of network infrastructure only
Why is information security considered primarily a management issue rather than a technical issue?
Most attacks are caused by hardware failures
Security tools automatically enforce policies
Risk management, policy, and enforcement are more critical than technology alone
IT departments are not involved in security
What is the primary goal of risk management in information security?
To eliminate all possible threats
To identify risk, assess its magnitude, and reduce it to an acceptable level
To deploy as many security controls as possible
To ensure maximum system performance
Which term describes the recognition and documentation of risks to information assets?
Risk control
Risk assessment
Risk identification
Risk mitigation
Which three major activities make up the risk management process?
Prevention, detection, response
Identification, assessment, control
Planning, implementation, auditing
Classification, encryption, monitoring
What does risk assessment primarily determine?
The identity of attackers
The value of security software
The likelihood and impact of potential losses
The encryption strength of systems
When does an organization choose the risk acceptance strategy?
When threats cannot be identified
When the cost of protection exceeds the potential loss
When management ignores security risks
When laws require acceptance
Which risk control strategy completely removes an asset from service to eliminate risk?
Mitigation
Acceptance
Transfer
Termination
What is the primary purpose of access control?
Encrypt stored data
Restrict access to authorized users only
Detect malware attacks
Monitor network traffic
Which access control model allows the owner of an object to decide who can access it?
Mandatory Access Control (MAC)
Role-Based Access Control (RBAC)
Discretionary Access Control (DAC)
Attribute-Based Access Control (ABAC)
Which technology is primarily used to separate trusted and untrusted networks?
VPN
Firewall
IDS
Router
Which firewall type filters traffic based on IP addresses and port numbers?
Application-layer firewall
Stateful inspection firewall
Packet-filtering firewall
Circuit-level firewall
Which access control model assigns permissions based on organizational roles?
DAC
MAC
RBAC
TBAC
Which VPN protocol operates at the network (IP) layer?
SSL
IPSec
SSH
HTTPS
Which VPN mode encrypts the entire original IP packet, including its header?
Transport mode
Secure mode
Tunnel mode
Hybrid mode
Which access control model is enforced by a central authority and cannot be modified by users?
DAC
RBAC
MAC
ABAC
Which firewall type examines application-level data payloads?
Packet-filtering firewall
Circuit-level firewall
Application-layer firewall
Screening router
Which term best describes a system that can both detect intrusions and actively prevent them?
Firewall
Intrusion Detection System (IDS)
Intrusion Detection and Prevention System (IDPS)
Virtual Private Network (VPN)
Which of the following is considered the most serious failure of an IDPS?
False positive
Alarm clustering
False negative
Noise
Which detection method compares observed traffic against vendor-supplied models of normal protocol behavior?
Signature-based detection
Anomaly-based detection
Stateful protocol analysis
Log file monitoring
Which term refers to the process of converting a plaintext message into an unreadable form to protect it from unauthorized access?
Cryptanalysis
Encryption
Hashing
Steganography
Which cryptographic method uses the same secret key for both encryption and decryption?
Asymmetric encryption
Public-key encryption
Symmetric encryption
Hash-based encryption
Which cryptographic algorithm became the official U.S. federal standard to replace DES and 3DES?
RSA
AES
SHA-1
Diffie–Hellman
Which term refers to the protection of facilities, equipment, and resources from physical threats such as theft, vandalism, or natural disasters?
Network security
Logical security
Physical security
Operational security
Which physical security control is primarily intended to deter unauthorized access rather than detect it?
Motion detectors
Security guards
Surveillance cameras
Alarm systems
Which concept describes a series of concentric protection zones, each increasing in security closer to the asset?
Defense in depth
Physical layering
Security zoning
Perimeter hardening
Which term refers to a potential danger to an information asset?
Attack
Vulnerability
Threat
Exploit
Which type of attack occurs when an attacker pretends to be a legitimate user or system?
Denial-of-service attack
Spoofing attack
Buffer overflow attack
Brute-force attack
Which attack type specifically exploits poor input validation to overwrite memory and execute malicious code?
SQL injection
Cross-site scripting
Buffer overflow
Replay attack
Which two elements below are explicitly listed as part of “information security” defined by the Committee on National Security Systems (CNSS)?
Data security
Physical security
Network security
Environmental security
Which two threats are explicitly mentioned in the chapter as risks to confidentiality, integrity, and availability?
Unauthorized modification
Natural disasters
Theft
Insider recruitment
Which two statements correctly describe the scope of “security” as defined in the chapter?
Security protects individuals and assets from harm
Security is limited only to protection of information
Which two communities of interest share responsibility for information security?
General management
IT management
External auditors
Customers
Which two are examples of threats to information assets discussed in Chapter 2?
Malware attacks
Social networking
Theft of information
Software licensing
Which two statements correctly describe the difference between threats and attacks?
Threats are always present
Attacks only exist when an action is occurring
Attacks do not cause losses
Threats require exploits to exist
Which two elements are evaluated when calculating risk?
Impact
Likelihood
Encryption strength
User satisfaction
Which two factors influence business risk decisions?
Cost of controls
Benefits of secured systems
Brand color
Office location
Which two activities are part of risk identification?
Asset inventory
Threat prioritization
Firewall configuration
Employee training
Which two plans are considered contingency plans in risk mitigation?
Incident response plan
Disaster recovery plan
Marketing plan
Human resources plan
Which two conditions must be met before selecting risk acceptance as a strategy?
Probability of attack assessed
Cost–benefit analysis completed
System fully encrypted
Users notified
Which two risk control strategies actively reduce risk?
Mitigation
Transfer
Acceptance
Termination
Which two elements are fundamental to access control decisions?
Subject
Object
Encryption key
VPN tunnel
Which two are examples of access control mechanisms?
Access Control Lists (ACLs)
Role assignments
Intrusion detection systems
Data backups
Which two technologies are commonly used to enforce perimeter security?
Firewalls
VPN gateways
File encryption
Hash functions
Which two criteria are typically used by packet-filtering firewalls?
Source IP address
Destination port
Which two benefits are provided by VPN technology?
Confidentiality of data
Secure remote access
Increased transmission speed
Removal of all threats
Which two access control models are considered nondiscretionary?
MAC
RBAC
DAC
ABAC
Which two characteristics describe transport-mode VPNs?
Only the payload is encrypted
Original IP header is visible
Entire packet is encrypted
Requires gateway-to-gateway tunneling
Which two firewall types perform deep packet inspection?
Application-layer firewall
Stateful inspection firewall
Packet-filtering firewall
Static router
Which two elements are required for RBAC to function properly?
Defined roles
Role-permission assignments
Individual encryption keys
Network tunnels
Which two activities are examples of intrusion prevention rather than intrusion detection?
Writing and enforcing enterprise security policies
Logging network packets for later analysis
Installing firewalls and IDPSs
Sending e-mail alerts after an attack
Which TWO capabilities are typical advantages of a host-based IDPS (HIDPS)?
Ability to analyze encrypted traffic
Ability to detect multihost scanning
Monitoring of system configuration files
No performance impact on the host
Which TWO attack-related activities can a Network Behavior Analysis (NBA) IDPS most commonly detect?
Distributed denial-of-service attacks
Unauthorized file modification on a host
Worm propagation
Kernel-level rootkits
Which TWO terms are correctly associated with cryptology?
Cryptography
Cryptanalysis
Steganography only
Network forensics
Which TWO statements correctly describe hash functions?
They generate a fixed-length message digest
They require a secret key for normal operation
They are one-way operations
They produce reversible ciphertext
Which TWO characteristics are advantages of asymmetric (public-key) encryption?
Solves the key distribution problem
Requires only one shared secret key
Uses a public and a private key pair
Is computationally faster than symmetric encryption
Which TWO of the following are examples of natural threats to physical security?
Floods
Earthquakes
Espionage
Theft
Which TWO controls are commonly used to detect unauthorized physical access? Select two.
Closed-circuit television (CCTV)
Biometric authentication
Fences
Lighting
Which TWO physical security measures are most effective for protecting data centers against environmental threats? Select two.
Fire suppression systems
Redundant power supplies
Smart cards
Turnstiles
Which TWO of the following are considered human threats? Select two.
Earthquake
Fire
Espionage
Sabotage
Which TWO attacks primarily target availability of information systems? Select two.
Denial-of-service
Distributed denial-of-service
Phishing
Password guessing
Which TWO attacks are classified as technical attacks rather than social engineering attacks? Select two.
Phishing
Pretexting
Buffer overflow
Malware
The three foundational characteristics of information security are known as the (a) .
According to CNSS, information security protects information and its (a) elements.
One major threat category discussed in the chapter includes unintended or unauthorized (a) of information.
Information that has value to an organization and must be protected is called an (a) .
An interruption in service from a provider that affects organizational operations is known as (a) disruption.
Unauthorized duplication or distribution of copyrighted software is known as (a) .
The process of determining how exposed information assets are to risk is called (a) .
The application of controls to reduce risk to an acceptable level is known as (a) .
Risk is calculated using the combination of impact and (a) .
Risk management decisions are based on balancing security costs and (a) .
Choosing to do nothing further to protect an asset is called (a) risk control strategy.
Eliminating risk by removing an information asset from service is known as (a) .
The process of determining who may access a system resource is called (a) .
A list that specifies permissions attached to an object is called an (a) .
Fill the suitable words in the blank: A firewall is primarily used to control (a) traffic between networks.
Fill the suitable words in the blank: A VPN creates an encrypted (a) over an untrusted network.
Fill the suitable words in the blank: Firewalls that track the state of active connections are called (a) firewalls.
Fill the suitable words in the blank: In RBAC, users obtain permissions by being assigned to (a) .
Fill the suitable words in the blank: MAC systems enforce security labels based on centrally defined (a) .
Fill the suitable words in the blank: In tunnel mode VPNs, the entire original IP (a) is encrypted.
Fill the suitable words in the blank: Firewalls that act as intermediaries between clients and servers are known as (a) firewalls.
Fill the suitable words in the blank: An (a) occurs when an attacker attempts to gain unauthorized access to an information system or disrupt its normal operations.
Fill the suitable words in the blank: The process of grouping similar IDPS alerts that occur close together in time is called (a) .
Fill the suitable words in the blank: An IDPS detection method that establishes a baseline of normal activity during a training period is known as (a) detection.
Fill the suitable words in the blank: The original unencrypted message before encryption is known as (a) .
Fill the suitable words in the blank: A cryptographic technique that uses a key only once and then discards it is known as the (a) cipher.
Fill the suitable words in the blank: The strength of a cryptographic algorithm against brute-force attacks is largely determined by the size of its (a) .
Fill the suitable words in the blank: A (a) is the outermost boundary used to protect a facility from unauthorized physical access.
Fill the suitable words in the blank: Physical security controls intended to discourage violations before they occur are known as (a) controls.
Fill the suitable words in the blank: The principle of placing critical assets at the center of multiple layers of protection is known as (a) .
Fill the suitable words in the blank: A (a) is a weakness or flaw that can be exploited by a threat.
Fill the suitable words in the blank: An attack that relies on manipulating people rather than technology is known as (a) engineering.
Fill the suitable words in the blank: An attack that captures authentication data and later reuses it to gain unauthorized access is called a (a) attack.
Which is the corresponding ciphertext of the plaintext “KHOAHOCXAHOINHANVAN” using Vigenere cipher with the key “HANOI” (use the alphabet including only Latin character from A --> Z)?
LHQNPBJYJABQAOBNXNV
RHWHHJXIOOCUHIUVVU
RHBOPVCKOPVIAVIUVNB
RBBGFSPEUUUGRUHHIGL
