IT 462 - QUIZ 1 QUESTIONS WITH CORRECT ANSWERS LATEST UPDATE 2026
bash: D. a command line shell for Linux
"ls" command: E. lists directory contents
"grep" command: B. searches for the text string in a file
"netstat -a": C. shows all ports
"ps": A. shows running processes - Answers
This role is assigned to the user who is responsible for the tasks of implementing the prescribed
protection defined by the security policy and senior management. - Answers Data Custodian
A zero day exploit takes advantage of a publicly known vulnerability. - Answers false
In a series configuration, failure of a single security control does not render the entire solution
ineffective, as opposed to parallel configurations. - Answers True
Microsoft developed a threat categorization scheme known as the STRIDE threat model. Which of the
following words or phrases is not a part of that threat model? - Answers information security
The DREAD rating system is designed to provide a flexible rating solution that is based on the answers
to five main questions about each threat: Damage potential, Reproducibility, Exploitability, Affected
users, and __________. - Answers discoverability
An/a ___________ is the security role responsible for providing oversight within an organization to
ensure policy compliance. - Answers auditor
In Reduction Analysis or Decomposition, which of the following are key concepts? - Answers Input
Points
Data Flow Paths
Trust Boundaries
Processor Operations
The person responsible for the management of data or an asset. - Answers Data Custodian
The process by which the goals of risk management are achieved is known as risk analysis. - Answers
true
An issue-specific security policy focuses on issues relevant to every aspect of an organization. -
Answers False
If a company uses and outside organization to handle some business functions and for security
governance it is called: - Answers third-party goverance
What is the collection of practices related to supporting, defining, and directing the security efforts of
an organization? - Answers security goverance
Apple should not perform ongoing security monitoring of their supply chain since they are planning to
be 100% carbon neutral by 2030. - Answers false
Hosted by MITRE, the ______________________ database is a public repository that catalogs all
publicly known vulnerabilities for software solutions and provides them with a corresponding number
and severity level.These numbers, are, in turn, used by software vendors to reference when issuing a
security patch to remedy the issue. - Answers Common Vulnerabilities and Exposures
Asset: G. IT infrastructure
Asset Valuation: D. $100,000
Threats: A. Hurricane
Vulnerability: C. Flaw in source code
Exposure: B. The IT infrastructure room might flood.
Risk: E. The malicious actor might leverage the loophole in the source code to get in.
Safeguards: H. Patch the source code and place sandbags around the building.
Attack: F. The malicious actor exploited the weakness in the firewall to get in. - Answers
This level of commercial business sector classification is used for all data that does not fit in one of the
higher classifications and its disclosure does not have a serious negative impact on the organization. -
Answers Public
It is recommended that employees be terminated during which day of the week: - Answers
Wednesday
Recently, we have seen an uptick in the amount of cyber attacks targeting different platforms that
have had real world effects, to include affecting life-critical hospital care, cause localized power
outages, and temporarily degrade core internet infrastructure. - Answers True
bash: D. a command line shell for Linux
"ls" command: E. lists directory contents
"grep" command: B. searches for the text string in a file
"netstat -a": C. shows all ports
"ps": A. shows running processes - Answers
This role is assigned to the user who is responsible for the tasks of implementing the prescribed
protection defined by the security policy and senior management. - Answers Data Custodian
A zero day exploit takes advantage of a publicly known vulnerability. - Answers false
In a series configuration, failure of a single security control does not render the entire solution
ineffective, as opposed to parallel configurations. - Answers True
Microsoft developed a threat categorization scheme known as the STRIDE threat model. Which of the
following words or phrases is not a part of that threat model? - Answers information security
The DREAD rating system is designed to provide a flexible rating solution that is based on the answers
to five main questions about each threat: Damage potential, Reproducibility, Exploitability, Affected
users, and __________. - Answers discoverability
An/a ___________ is the security role responsible for providing oversight within an organization to
ensure policy compliance. - Answers auditor
In Reduction Analysis or Decomposition, which of the following are key concepts? - Answers Input
Points
Data Flow Paths
Trust Boundaries
Processor Operations
The person responsible for the management of data or an asset. - Answers Data Custodian
The process by which the goals of risk management are achieved is known as risk analysis. - Answers
true
An issue-specific security policy focuses on issues relevant to every aspect of an organization. -
Answers False
If a company uses and outside organization to handle some business functions and for security
governance it is called: - Answers third-party goverance
What is the collection of practices related to supporting, defining, and directing the security efforts of
an organization? - Answers security goverance
Apple should not perform ongoing security monitoring of their supply chain since they are planning to
be 100% carbon neutral by 2030. - Answers false
Hosted by MITRE, the ______________________ database is a public repository that catalogs all
publicly known vulnerabilities for software solutions and provides them with a corresponding number
and severity level.These numbers, are, in turn, used by software vendors to reference when issuing a
security patch to remedy the issue. - Answers Common Vulnerabilities and Exposures
Asset: G. IT infrastructure
Asset Valuation: D. $100,000
Threats: A. Hurricane
Vulnerability: C. Flaw in source code
Exposure: B. The IT infrastructure room might flood.
Risk: E. The malicious actor might leverage the loophole in the source code to get in.
Safeguards: H. Patch the source code and place sandbags around the building.
Attack: F. The malicious actor exploited the weakness in the firewall to get in. - Answers
This level of commercial business sector classification is used for all data that does not fit in one of the
higher classifications and its disclosure does not have a serious negative impact on the organization. -
Answers Public
It is recommended that employees be terminated during which day of the week: - Answers
Wednesday
Recently, we have seen an uptick in the amount of cyber attacks targeting different platforms that
have had real world effects, to include affecting life-critical hospital care, cause localized power
outages, and temporarily degrade core internet infrastructure. - Answers True
