Question 1

When a web site mimics a legitimate site for the purpose of misleading or defrauding an Internet user,it is called:

Accepted Answer

A)  identity theft. 
B)  illegal spam e-mail 
C)  spoofing. 
D)  phishing. 
A)  identity theft. 
B)  illegal spam e-mail 
C)  spoofing. 
D)  phishing.

Question 2

Which of the following is not one of the rules that the GLBA gives federal agencies and states the ability to enforce?

Accepted Answer

A)  Financial Privacy Rule 
B)  Credit Information Rule 
C)  Safeguards Rule 
D)  none of the above 
A)  Financial Privacy Rule 
B)  Credit Information Rule 
C)  Safeguards Rule 
D)  none of the above

Question 3

What is just beginning to be addressed in organizations' acceptable-use policies?

Accepted Answer

A)  usage of social media 
B)  usage of emails 
C)  usage of external websites 
D)  none of the above 
A)  usage of social media 
B)  usage of emails 
C)  usage of external websites 
D)  none of the above

Question 4

Which of the following is the recommended means for disseminating an organization's information security policy?

Accepted Answer

A)  hardcopy distributions to all employees, not just new employees 
B)  email distributions 
C)  posting the policy on the organization's intranet 
D)  all of the above 
A)  hardcopy distributions to all employees, not just new employees 
B)  email distributions 
C)  posting the policy on the organization's intranet 
D)  all of the above

Question 5

Due to several recent laws regarding information security,it is a good practice to provide existing civil and criminal laws rather than have a company-specific information security policy.

Accepted Answer

A) True 
 B)False

Question 6

Determining a Return Benefit for a specific security action is based on which of the following?

Accepted Answer

A)  annualized Expected Losses and Annualized Cost of Actions 
B)  benefits of remote PC access 
C)  electronic records management 
D)  none of the above 
A)  annualized Expected Losses and Annualized Cost of Actions 
B)  benefits of remote PC access 
C)  electronic records management 
D)  none of the above

Question 7

What are sources to use to calculate a single loss expectancy as part of a risk assessment?

Accepted Answer

A)  historical experiences of the organization 
B)  industry averages 
C)  recent incidents only (typically the past 6 months) 
D)  both A and B 
A)  historical experiences of the organization 
B)  industry averages 
C)  recent incidents only (typically the past 6 months) 
D)  both A and B

Question 8

What should an ERM manager (or an ERM committee)be responsible for?

Accepted Answer

A)  defining what constitutes an electronic transaction 
B)  classifying specific records based upon their importance, regulatory requirements, and duration. 
C)  formulating and managing SOX compliance 
D)  all of the above 
A)  defining what constitutes an electronic transaction 
B)  classifying specific records based upon their importance, regulatory requirements, and duration. 
C)  formulating and managing SOX compliance 
D)  all of the above

Question 9

What is the approximate total business loss (in U.S.dollars)resulting from the largest reported customer data security breach to date involving retailers or financial institutions as of 2010?

Accepted Answer

A)  876,000 
B)  4.2 million 
C)  16.7 million 
D)  1 billion 
A)  876,000 
B)  4.2 million 
C)  16.7 million 
D)  1 billion

Question 10

Which position is responsible for continually assessing an organization's information security risks and developing and implementing effective countermeasures?

Accepted Answer

A)  CSO or CISO 
B)  CEO 
C)  COSO 
D)  all of the above 
A)  CSO or CISO 
B)  CEO 
C)  COSO 
D)  all of the above

Question 11

Which statement about computer crimes is not true?

Accepted Answer

A)  Crackers have successfully used hacking techniques to wipe out hard drives, steal information, and disrupt government activities. 
B)  Hackers have helped to point out security vulnerabilities in computer software. 
C)  Data and application encryption are not considered robust security approaches. 
D)  Common civilian targets include power grids and financial networks. 
A)  Crackers have successfully used hacking techniques to wipe out hard drives, steal information, and disrupt government activities. 
B)  Hackers have helped to point out security vulnerabilities in computer software. 
C)  Data and application encryption are not considered robust security approaches. 
D)  Common civilian targets include power grids and financial networks.

Question 12

Which of the following must an organization's management do if HIPAA applies to its activities?

Accepted Answer

A)  assign a person or persons to be responsible for HIPAA compliance 
B)  decide whether or not to comply with HIPAA 
C)  take out HIPAA compliance insurance 
D)  all of the above 
A)  assign a person or persons to be responsible for HIPAA compliance 
B)  decide whether or not to comply with HIPAA 
C)  take out HIPAA compliance insurance 
D)  all of the above

Question 13

Which type of employee does not need to be aware of basic types of information security technologies?

Accepted Answer

A)  business managers 
B)  managers who only work on IT applications 
C)  the CSO 
D)  none of the above 
A)  business managers 
B)  managers who only work on IT applications 
C)  the CSO 
D)  none of the above

When a web site mimics a legitimate site for the purpose of misleading or defrauding an Internet user,it is called:

Which of the following is not one of the rules that the GLBA gives federal agencies and states the ability to enforce?

What is just beginning to be addressed in organizations' acceptable-use policies?

Which of the following is the recommended means for disseminating an organization's information security policy?

Due to several recent laws regarding information security,it is a good practice to provide existing civil and criminal laws rather than have a company-specific information security policy.

Determining a Return Benefit for a specific security action is based on which of the following?

What are sources to use to calculate a single loss expectancy as part of a risk assessment?

What should an ERM manager (or an ERM committee)be responsible for?

What is the approximate total business loss (in U.S.dollars)resulting from the largest reported customer data security breach to date involving retailers or financial institutions as of 2010?

Which position is responsible for continually assessing an organization's information security risks and developing and implementing effective countermeasures?

Which statement about computer crimes is not true?

Which of the following must an organization's management do if HIPAA applies to its activities?

Which type of employee does not need to be aware of basic types of information security technologies?

Managing IT in a Digital World

Computer Systems

Telecommunications and Networking

The Data Resource

Enterprise Systems

Managerial Support Systems

E-Business Systems

Basic Systems Concepts and Tools

Methodologies for Custom Software Development

Methodologies for Purchased Software Packages

IT Project Management

Planning Information Systems Resources

Leading the Information Systems Function

Social, Ethical, and Legal Issues

Filters

Exam 14: Information Security

When a web site mimics a legitimate site for the purpose of misleading or defrauding an Internet user,it is called:

Which of the following is not one of the rules that the GLBA gives federal agencies and states the ability to enforce?

What is just beginning to be addressed in organizations' acceptable-use policies?

Which of the following is the recommended means for disseminating an organization's information security policy?

Due to several recent laws regarding information security,it is a good practice to provide existing civil and criminal laws rather than have a company-specific information security policy.

Determining a Return Benefit for a specific security action is based on which of the following?

What are sources to use to calculate a single loss expectancy as part of a risk assessment?

What should an ERM manager (or an ERM committee)be responsible for?

What is the approximate total business loss (in U.S.dollars)resulting from the largest reported customer data security breach to date involving retailers or financial institutions as of 2010?

Which position is responsible for continually assessing an organization's information security risks and developing and implementing effective countermeasures?

Which statement about computer crimes is not true?

Which of the following must an organization's management do if HIPAA applies to its activities?

Which type of employee does not need to be aware of basic types of information security technologies?

Managing IT in a Digital World

Computer Systems

Telecommunications and Networking

The Data Resource

Enterprise Systems

Managerial Support Systems

E-Business Systems

Basic Systems Concepts and Tools

Methodologies for Custom Software Development

Methodologies for Purchased Software Packages

IT Project Management

Planning Information Systems Resources

Leading the Information Systems Function

Social, Ethical, and Legal Issues

Filters