Font size
WorksheetsFINAL EXAM MANAGEMENT OF INFORMATION SECURITY FLASHCARDS
Total questions: 75
Worksheet time: 40mins
A manager asks why we need a cybersecurity program if we already have a firewall. Choose the statement that correctly explains the program's definition to correct them.
It is mainly about buying more technology like firewalls.
It is a coordinated set of policies, people, and processes designed to protect information assets.
It focuses on a single tool that blocks all cyber threats.
It is an ad‑hoc set of fixes aligned only to technical goals.
A hospital patient's record is altered by a hacker. Which CIA principle is violated?
Confidentiality
Integrity
Availability
A website crashes during a sale. Which CIA principle is violated?
Availability
Integrity
Confidentiality
A password database is leaked. Which CIA principle is violated?
Integrity
Availability
Confidentiality
Classify the control: Background checks. Choose Administrative, Technical, or Physical.
Administrative
Technical
Physical
Classify the control: Smart card reader at the door. Choose Administrative, Technical, or Physical.
Administrative
Technical
Physical
Classify the control: Firewall software. Choose Administrative, Technical, or Physical.
Administrative
Technical
Physical
Classify the control: An "Acceptable Use Policy" document. Choose Administrative, Technical, or Physical.
Administrative
Technical
Physical
You are adopting the NIST Cybersecurity Framework. Which sequence correctly orders the core functions?
Identify, Protect, Detect, Respond, Recover
Identify, Detect, Protect, Respond, Recover
Protect, Identify, Detect, Respond, Recover
Identify, Protect, Respond, Detect, Recover
In the NIST Cybersecurity Framework, what does Detect mean?
Prevent the occurrence of a cybersecurity event.
Identify the occurrence of a cybersecurity event.
Restore business operations after an incident.
Erase logs after an incident to maintain privacy.
Match the NIST Special Publication to its topic: What is the topic of SP 800‑34?
Risk Management Framework
Security Controls
Incident Handling Guide
Contingency Planning (IR/DR/BC)
Match the NIST Special Publication to its topic: What is the topic of SP 800‑37?
Risk Management Framework
Security Controls
Incident Handling Guide
Contingency Planning (IR/DR/BC)
Match the NIST Special Publication to its topic: What is the topic of SP 800‑61?
Contingency Planning (IR/DR/BC)
Incident Handling Guide
Security Controls
Risk Management Framework
Match the NIST Special Publication to its topic: What is the topic of SP 800‑53?
Risk Management Framework
Incident Handling Guide
Security Controls
Contingency Planning (IR/DR/BC)
Why isn't a single strong firewall enough? Choose the best explanation using the "Defense in Depth" concept.
Because users often forget passwords.
Because multiple layers of security ensure that if one layer fails, the next layer still protects the asset.
Because firewalls always slow down the network.
Because encryption alone replaces the need for other security layers.
"All employees must change passwords every 90 days" versus "Go to Settings > Account > Change Password." Which is the Policy and which is the Practice/Procedure?
Both are Policy.
Both are Practice/Procedure.
"Must change passwords every 90 days" is Policy; "Go to Settings..." is Practice/Procedure.
"Go to Settings..." is Policy; "Must change passwords every 90 days" is Practice/Procedure.
Identify the risk strategy for this scenario: Buying cyber insurance.
Avoid
Transfer
Mitigate
Accept
Identify the risk strategy for this scenario: Installing antivirus software.
Avoid
Transfer
Mitigate
Accept
Identify the risk strategy for this scenario: Deciding not to launch a risky new website feature.
Avoid
Transfer
Mitigate
Accept
Identify the risk strategy for this scenario: Knowing a server is old but doing nothing because it holds no valuable data.
Avoid
Transfer
Mitigate
Accept
Which statement best describes Due Care?
Adopting the minimum standards required (e.g., installing firewalls required by law).
Maintaining and verifying every day that controls continue to work.
Purchasing security beyond any requirement to gain competitive advantage.
Ignoring legacy systems because they hold no valuable data.
Which statement best describes Due Diligence?
Installing the minimum controls required by law.
Maintaining and ensuring those standards continue to work (e.g., checking firewall logs daily).
Transferring risk to an insurer.
Accepting risk when the asset is not valuable.
Scenario A: You can afford to be offline for 4 hours, but cannot lose more than 15 minutes of data. Assign the correct RTO and RPO.
RTO 4 hours, RPO 15 minutes
RTO 15 minutes, RPO 4 hours
RTO 4 hours, RPO 24 hours
RTO 10 minutes, RPO 15 minutes
Scenario B: You can lose a whole day of data, but the system must be back up in 10 minutes. Assign the correct RTO and RPO.
RTO 10 minutes, RPO 24 hours
RTO 24 hours, RPO 10 minutes
RTO 4 hours, RPO 15 minutes
RTO 10 minutes, RPO 15 minutes
Match the plan to the event: A hacker is currently scanning your network. Which plan applies?
BC Plan (Business Continuity)
DR Plan (Disaster Recovery)
IR Plan (Incident Response)
Match the plan to the event: A flood destroys the server room. Which plan applies?
DR Plan (Disaster Recovery)
IR Plan (Incident Response)
BC Plan (Business Continuity)
Match the plan to the event: The server room is destroyed, and staff must move to a new office to keep selling products. Which plan applies?
IR Plan (Incident Response)
BC Plan (Business Continuity)
DR Plan (Disaster Recovery)
Define WRT (Work Recovery Time). Choose the best description.
Time to restore IT systems at the primary site.
Time needed to verify systems/data are correct after technical recovery but before business resumes.
Time to detect and contain an incident.
Time to move people and processes to an alternate site.
Select the correct formula for Maximum Tolerable Downtime.
MTD=RTO+WRT
MTD=RPO+RTO
MTD=WRT−RTO
MTD=RPO−WRT
Select all domains of the Cybersecurity Maintenance Model.
External Monitoring
Internal Monitoring
Planning & Risk Assessment
Vulnerability Assessment & Remediation
Readiness & Review
Which statement correctly contrasts a Vulnerability Assessment with a Penetration Test?
Vulnerability Assessment simulates attacks; Penetration Testing only documents findings.
Vulnerability Assessment passively identifies and documents flaws; Penetration Testing actively attempts to exploit flaws to validate them.
Both are passive identification methods with no exploitation.
Penetration Testing and Vulnerability Assessment are identical in scope and method.
Which biometric error is worse for security?
False Reject (Type I)
False Accept (Type II)
Both are equally severe
Neither affects security
Why is a Stateful Packet Inspection (SPI) firewall generally more secure than a basic Packet Filtering firewall?
SPI inspects only IP addresses and ports, just like packet filters.
SPI tracks the state of connections so it knows whether a packet belongs to an existing conversation, while packet filters only check headers in isolation.
Packet filtering encrypts packets while SPI does not.
Packet filters monitor application behavior across sessions.
In Kerberos, what is the role of the KDC (Key Distribution Center)?
Verifies the user's identity.
Issues the ticket that allows access to services.
Acts as the central hub for key distribution.
In Kerberos, what is the role of the AS (Authentication Server)?
Verifies the user's identity.
Issues the ticket that allows access to services.
Serves as a database of user passwords.
In Kerberos, what is the role of the TGS (Ticket Granting Service)?
Stores encryption keys centrally.
Verifies the user's identity.
Issues the "ticket" allowing access to services.
Differentiate symmetric vs asymmetric encryption regarding keys and speed. Which option correctly pairs the type with its key usage and relative speed?
Symmetric uses 1 shared key and is generally faster; Asymmetric uses 2 keys and is generally slower.
Symmetric uses 2 keys and is generally slower; Asymmetric uses 1 shared key and is generally faster.
Symmetric and Asymmetric both use 2 keys and run at the same speed.
Symmetric and Asymmetric both use 1 shared key; speed depends only on hardware.
Identify the correct Focus and Timing for Incident Response (IR).
Focus on immediate threats/IT with short-term timing (start of event).
Focus on business operations/people with long-term timing (during extended outage).
Focus on IT systems/data with medium-term timing (after an incident escalates).
Identify the correct Focus and Timing for Disaster Recovery (DR).
Focus on business operations/people with long-term timing (during extended outage).
Focus on IT systems/data with medium-term timing (after an incident escalates).
Focus on immediate threats/IT with short-term timing (start of event).
Identify the correct Focus and Timing for Business Continuity (BC).
Focus on business operations/people with long-term timing (during extended outage).
Focus on IT systems/data with medium-term timing (after an incident escalates).
Focus on immediate threats/IT with short-term timing (start of event).
A manager wants to finish the security upgrade faster but without spending more money. According to the Project Management Triangle, what must happen to the scope?
(a)
You are tasked with implementing a new firewall. Why is it a mistake to just list "Install Firewall" as the only step, and what tool fixes this?
A security program is launched and never checked again. Why does this fail the "Cybernetic Loop" principle?
It lacks a feedback mechanism to measure results and compare them to goals to steer the program.
It uses asymmetric encryption instead of symmetric.
It prioritizes DR over IR.
It assigns too many resources to physical security.
Which ISO standard is for certification (requirements), and which is for implementation (code of practice)?
ISO 27001 is for certification (requirements); ISO 27002 is for implementation (code of practice).
ISO 27002 is for certification (requirements); ISO 27001 is for implementation (code of practice).
Both ISO 27001 and ISO 27002 are certification standards.
Neither ISO 27001 nor ISO 27002 is used for implementation.
Scenario A: A military base needs to ensure secrets do not leak to lower clearance levels. Which access control model fits?
Bell-LaPadula (focus on confidentiality; "No Read Up, No Write Down").
Biba (focus on integrity; "No Write Up, No Read Down").
Discretionary Access Control.
Role-Based Access Control.
Scenario B: A bank needs to ensure account balances are not changed by unauthorized staff. Which access control model fits?
Bell-LaPadula (focus on confidentiality).
Biba (focus on integrity; "No Write Up, No Read Down").
Mandatory Access Control.
Attribute-Based Access Control.
If a user has a "Secret" clearance, but the document is labeled "Top Secret," which model automatically blocks access based on these labels?
Role-Based Access Control (RBAC).
Lattice-Based Access Control.
Discretionary Access Control (DAC).
Bell-LaPadula.
Case 1: Alice approves the invoice, Bob signs the check. Which control is this?
Two-Person Control.
Separation of Duties.
Dual Control with encryption keys.
Compensating Control.
Case 2: Both Alice and Bob must turn their keys at the same time to launch the missile. Which control is this?
Separation of Duties.
Two-Person Control.
Delegation of Authority.
Security Awareness Control.
An intern needs to access the printer network, but the admin gives them administrator rights because it is easier. Which principle is violated?
Least Privilege.
Defense in Depth.
Need to Know.
Change Management.
Your CEO wants to copy a competitor's security measures exactly. Why might this be dangerous?
Benchmarking shows what others are doing, but their risk profile, budget, and infrastructure may differ from yours.
Competitors always use outdated controls.
It violates copyright laws on security configurations.
It guarantees higher costs without benefits.
Match the backup strategy to its pro/con: Full Backup. Choose the correct pro/con description.
Slowest to backup, fastest to restore.
Fast backup, slowest to restore (needs all tapes).
Backs up everything since the last full backup.
Match the backup strategy to its pro/con: Differential Backup. Choose the correct pro/con description.
Slowest to backup, fastest to restore.
Fast backup, slowest to restore (needs all tapes).
Backs up everything since the last full backup.
Match the backup strategy to its pro/con: Incremental Backup. Choose the correct pro/con description.
Slowest to backup, fastest to restore.
Fast backup, slowest to restore (needs all tapes).
Backs up everything since the last full backup.
A server room fire is put out. The IT team is restoring servers. Who handles the reporters outside asking if data was lost and the families of injured employees?
Incident Response.
Disaster Recovery.
Crisis Management.
Business Continuity.
Before deciding how much money to spend on recovery, which analysis must you perform to know which business processes are most critical and to calculate downtime cost?
Risk Register Review.
Business Impact Analysis (BIA).
Qualitative Risk Assessment.
Root Cause Analysis.
You find a hacked hard drive, take it home to analyze, then bring it to the police. Why will the evidence be thrown out of court?
Broken chain of custody because handling was undocumented and could be tampered with.
Improper encryption standards.
Violation of export controls.
It was analyzed by a certified examiner.
Scenario A: You leave a "Secret_Salaries.xls" file on a honeypot to see if a hacker takes it. Is this legal or illegal?
Illegal entrapment.
Legal enticement.
Illegal surveillance.
Legal consent.
Scenario B: You email a hacker saying "Click here to steal our data" and then arrest them. Is this legal or illegal?
Legal enticement.
Illegal entrapment.
Legal consent.
Legal monitoring.
What is the functional difference between an IDS (Intrusion Detection System) and an IPS (Intrusion Prevention System)?
IDS is active and blocks attacks; IPS is passive and only logs.
IDS is passive and alerts/logs; IPS is active and attempts to block attacks.
Both IDS and IPS are passive.
Both IDS and IPS are active and block attacks.
Mode A encrypts only the data (payload) but leaves the IP header visible. Which VPN mode is this?
Tunnel Mode.
Transport Mode.
Split Tunnel.
Encapsulating Security Payload only.
Mode B encrypts the data and the original IP header (wrapping it in a new packet). Which VPN mode is this?
Transport Mode.
Tunnel Mode.
L2TP only.
GRE only.
If you want to detect an attack before it reaches the server, should you use NIDPS or HIDPS?
HIDPS (host-based).
NIDPS (network-based).
Neither; only antivirus works.
Both are identical.
The asset is worth RM 10,000. The firewall to protect it costs RM 15,000. Should you buy the firewall? Why or why not?
Yes, because any control is better than none.
No, because the cost of the control exceeds the value of the asset; accept the risk or find a cheaper control.
Yes, because firewalls always reduce total cost of ownership.
No, because the asset value is unknown.
You are a security admin and see the CEO downloading pirated movies on the company laptop. The policy says "Zero Tolerance." What is the ethical dilemma?
Balancing policy enforcement with organizational hierarchy and ensuring consistent application regardless of rank.
Choosing the best encryption algorithm for videos.
Determining which antivirus to deploy.
Resolving a software licensing conflict unrelated to policy.
Why is it bad to have the IT Security team and the Physical Security (guards) team completely separated?
They use incompatible radios.
Cyberattacks and physical attacks often intersect and require shared intelligence.
Physical security never interacts with IT systems.
It violates the Bell-LaPadula model.
Classify the Multi-Factor Authentication method: Password. Choose the factor type.
Something you Know
Something you Are
Something you Have
Classify the Multi-Factor Authentication method: Fingerprint. Choose the factor type.
Something you Know
Something you Are
Something you Have
Classify the Multi-Factor Authentication method: Smart Card. Choose the factor type.
Something you Know
Something you Are
Something you Have
A Digital Signature provides non-repudiation. What does this mean?
It proves the sender actually sent the message and cannot deny it later, and it also proves the message wasn’t changed.
It hides the sender’s identity but allows them to deny sending the message.
It encrypts the message so only the intended recipient can read it, without verifying the sender.
It confirms delivery of the message without verifying integrity or authorship.
Why might setting up a Honey Pot be dangerous for a beginner admin?
If not isolated correctly, an attacker could use the Honey Pot as a stepping stone into the real network.
Attackers will ignore it completely, so it wastes storage but poses no risk.
A Honey Pot automatically blocks all traffic, which can crash the network.
It always replaces the firewall, leaving no perimeter defenses.
In a SETA program, why do you give different training to Executives versus System Admins?
Executives need training on risk, budget, and legal liability, while Admins need technical training on configuration, logs, and patching.
Executives need training only on password policies, while Admins focus on budgeting and legal compliance.
Executives and Admins require identical deep-dive technical labs to maintain standardization.
Admins focus solely on legal liability, while Executives configure systems and review logs.
In the NIST SP 800-37 Risk Management Framework cycle, what happens after you authorize the system?
Monitor the security controls continuously to ensure they remain effective.
Decommission the system immediately after authorization.
Return to the categorize step and skip monitoring.
Suspend all audits until the next authorization.
You arrive at a hacked computer. What do you capture first: the hard drive data or the data in RAM, and why?
RAM, because of the order of volatility; RAM data is lost if power goes out, whereas hard drive data persists.
Hard drive, because it has the largest capacity and is easier to image than RAM.
Hard drive, because RAM cannot contain evidence.
RAM, because it contains only temporary files and isn’t relevant to investigations.
Exam strategy: The prompt asks “Discuss the Maintenance Model.” You have only five minutes. What is the best way to format your answer?
Draw the five circles (domains), list them with bullet points, and write one sentence for each.
Write a detailed wall of text explaining every domain in long paragraphs.
Skip diagrams and list only two domains to save time.
Provide only a diagram without any labels or sentences.
