More MCQs
HOME
Categories
Management Information System
» Emerging Technology in E-Business MCQs
» Infrastructure and Operations MCQs
» Information and Database MCQs
» System Development Lifecycle & Software Development Models MCQs
» Project Management MCQs
» The Process of Auditing Information Systems MCQs
» Governance and Management of IT MCQs
» Auditing Infrastructure and Operations MCQs
» Business Continuity and Disaster Recovery MCQs
Information Security Management MCQs
The key components of an information systems security policy include Management support and commitment, Access Authorization and Security Awareness. Here on MCQs.club we have written useful Multiple-Choice Questions on Information Security Management that fully cover MCQs on Cyber Security Multiple Choice Questions & Answers, Information Security Technologies Questions and Answers, Information Security mcq & quiz, Information Security Management System (ISMS) Quiz, network security quiz answers, application security mcq. These MCQs are useful for Competitive exams, Business management exams and Professional accountancy exams.
- To retain a competitive advantage and to meet basic business requirements organizations must:
- Ensure the integrity of the information stored on their computer systems
- Preserve the confidentiality pf sensitive data
- Ensure the continued availability of their information systems
- Ensure conformity to laws, regulations and standards
- All of the above
- The key components of an information systems security policy include:
- Management support and commitment
- Access Authorization
- Security Awareness
- All of the above
- A number of different mechanisms are available for raising security awareness including:
- Distribution of a written security policy
- Training on a regular basis of new employees, users
- Both A&B
- None
- Data classification as a control measure should define:
- Who has access rights
- Who is responsible for determining the access rights and access levels
- What approvals are needed for access
- Computer crime issues and exposures
- All of the above
- Threats to businesses include:
- Financial loss, Legal repercussions
- Loss or credibility or competitive edge
- Disclosure of confidential, sensitive or embarrassing information, Industrial espionage
- All of the above
- Logical access controls are one of the primary safeguards for securing software and data within an information processing facility.
- True
- False
- Technical exposures are the unauthorized implementation or modification of data and software at the network, platform, database or application level. They include:
- Data diddling involves changing data before or as they are entered into the computer.
- Trojan horses involve hiding malicious, fraudulent code in an authorized computer program.
- Wire-tapping involves eaves dropping on information being transmitted over telecommunications lines
- All of the above
- To protect an organization’s information resources, access control software has become even more critical in assuring the confidentially, integrity and availability of information resources.
- True
- False
- Operating systems access control functions include:
- Apply user identification and authentication mechanisms
- Restrict logon IDs to specific terminals/workstations and specific times
- Both A&B
- None
- Database and Application-level access control functions include:
- Create or change data files and data base profiles
- Verify user authorization at the application and transaction level
- Log database/ data communications access activities for monitoring access violation
- All of the above
- The password syntax rules include:
- Passwords should be five to eight characters in length.
- Passwords should allow for a combination of alpha, numeric, upper and lower case and special characters
- The system should not permit previous password(s) to be used after being changed
- All of the above
- Access restrictions at the file level include:
- Read, inquiry or copy only
- Write, create, update or delete only and Execute
- Both A&B
- None
- Biometrics –
- Biometric access controls are the best means of authenticating a user identify based on a unique, measurable attribute or trait fo4 verifying the identity of a human being.
- This restricts computer access, based on a physical or behavioral characteristic of the user.
- Both A&B
- None
- Which parts of the computer viruses generally attack?
- Executable program files
- The file directory system, which tracks the location of all computer’s files
- Boot and system areas, which are needed to start the computer
- Data files
- All of the above
- What management procedure controls should be in place to prevent viruses attack?
- Update virus software scanning definition frequently
- Write-protect all diskettes with .EXE or .COM extensions
- Build any system from original, clean master copies.
- All of the above
- Technical methods of preventing viruses can be implemented through hardware and software means. What are the hardware tactics that can reduce the risk of infection?
- Use workstations without floppy disks
- Use remote booting
- Use a hardware-based password
- All of the above
- Types of antivirus software are:
- Scanners
- Virus masks or signatures
- Heuristic scanners
- All of the above
- Media sanitization – is a process in which an organization’s data is removed from media irrevocably or else the media is destroyed permanently.
- True
- False
- Storage media may be sanitized using methods such as:
- Data overwriting applications
- Magnetic Degaussing
- CD Data Destroyer
- All of the above
- Access standards should be reviewed by the IS auditor to ensure that they meet organizational objectives for separating duties, that they prevent fraud or error and that they meet policy requirements for minimizing the risk of unauthorized access. Standards for security may be defined:
- At a generic level
- On a 30-day password change basis
- For specific application
- All of the above
- When evaluating logical access controls, the IS auditor should:
- Obtain a general understanding of the security risk facing information processing through a review of relevant documentation, inquiry, risk assessment
- Test controls over access paths to determine that they are functioning and effective by applying appropriate audit techniques
- Both A&B
- None
- There are various basic categories of controlling access to sensitive areas. These include:
- Security guards
- Physically lock able working areas
- Safes and lock able cabinets
- All of the above
- Security in the computer department itself is likely to be very tightly controlled. Some of the controls that may be operated are:
- The computer department being sited in a secure part of the building
- Access past a separate reception or security desk
- Access being via locked doors which may be opened in one of a number of different ways
- All of the above
- Risk that may eventuate if network infrastructure is not managed properly include:
- Loss of data confidentiality
- Loss of data integrity
- System compromise
- All of the above
- Encryption – is the process of encoding messages in such a way that eavesdroppers or hackers cannot read it, but that authorized parties can.
- True
- False
- Type of encryption include:
- Symmetric key
- Public key
- Both A&B
- None
- Symmetric key encryption –
- Encryption algorithms that use the same key for encrypting and for decrypting information. It is also called a secret key because it is kept as a shared secret between the sender and receiver of information.
- Encryption algorithms that use different keys for encrypting and decrypting information.
- Both A&B
- None
- Public key or Asymmetric key encryption –
- Encryption algorithms that use the same key for encrypting and for decrypting information. It is also called a secret key because it is kept as a shared secret between the sender and receiver of information.
- Encryption algorithms that use different keys for encrypting and decrypting information. It is also called asymmetric key algorithms.
- Both A&B
- None
- Which functions Public key encryption is commonly used to perform?
- Encrypt symmetric secret keys to protect the symmetric leys during exchange over the network
- Create digital signatures to provide authentication and no repudiation for online entities
- Create digital signatures to provide data integrity for electronic files and documents
- All of the above
- Honey pots and honey nets – is a network set up with intentional vulnerabilities, its purpose is to invite attack, so that an attacker’s activities and methods can be studied and that information used to increase network security.
- The above is correct
- The above is incorrect
- Wireless security is the prevention of unauthorized access or damage to computers using wireless networks. The most common types of wireless security are:
- Wired Equivalent Privacy (WEP)
- Wi-Fi Protected Access (WPA)
- Both A&B
- None
- Wired Equivalent Privacy (WEP) –
- WEP is a notoriously weak security standard.
- The password WEP uses can often be cracked in a few minutes
- It is an old IEEE 802 11 standard.
- All of the above
- Wi-Fi Protected Access (WPA) –
- WPA is a quick alternative to improve security over WEP.
- Its current standard is WPA 2
- It uses an encryption device which encrypts the network with a 256-bit key
- All of the above
- The principle ways to secure a wireless network are:
- Configure access restrictions in the access points including encryption and checks on MAC address, disable ESSID broadcasting
- For commercial providers, hotspots and large organizations the preferred solution is often to have an open and unencrypted but completely isolated wireless network.
- Both A&B
- None
- Wi-Fi Protected Access version 2 (WPA 2) –
- Is based on 802.11i wireless security standard
- The most significant enhancement to WPA 2 over WPA is the use of the Advanced Encryption Standard (AES) for encryption
- Both A&B
- None
- Intrusion detection system – is a type of security management system for computers and networks. An ID system gathers and analyzes information from various areas within a computer or a network to identify possible security breaches.
- The above is correct
- The above is incorrect
- Intrusion detection system functions include:
- Monitoring and analyzing both user and system activities
- Analyzing system configurations and vulnerabilities
- Assessing system and file integrity
- All of the above
- Single Sign-On (SSO) –
- Is a session/user authentication process that permits a user to enter one name and password in order to access multiple applications.
- It authenticates the user for all the applications they have been given rights to and eliminates further prompts when they switch applications during a particular session
- Both A&B
- None
- ALL of the following are correct for an Audit trail EXCEPT?
- Audit trail are a substitute for good preventative security measures
- Audit trails are stored separately from the input data, documents and records
- Audit trail data has its own restrictions on use
- None
- Benefits of an audit trail include:
- It provides a means to help accomplish several security-related objectives
- Intrusion detection
- Problem analysis
- All of the above
- Computer forensics – involves the preservation, identification, extraction, documentation and interpretation of computer media for evidentiary and cause analysis.
- True
- False
- Examples of Computer forensics include:
- Recovering thousands of deleted emails
- Performing investigation post-employment termination
- Recovering evidence post formatting hard drive
- Performing investigation after multiple users had taken over the system
- All of the above
- Who uses computer forensics?
- Criminal Prosecutors
- Civil Litigations
- Insurance Companies
- Private Corporations
- All of the above
- The types of Penetration Variations are:
- Black box
- White box
- Grey box
- All of the above
—More to come soon—
2 Responses
I am preparing for DISA
Good Luck.