MISY 5325 QUESTIONS & ANSWERS | 2026
Which of the following is a law that ensures that federal agencies protect their systems
and data, comply with all elements of the law, and integrate security in all processes? -
Answers - Federal Information Security Modernization Act (FISMA)
What is the purpose of a mandatory vacation? - Answers - To reduce fraud and
embezzlement
True or False? Most organizations use proxy servers as gateways to access the
Internet. - Answers - True
Which of the following allows one person to act for another for legal issues and
sometimes is used if someone becomes mentally incapacitated? - Answers - Power of
Attorney
True or False? Title I of the Health Insurance Portability and Accountability Act (HIPAA)
addresses requirements and standards for information technology. - Answers - False
True or False? In a plan of action and milestones (POAM), an action is a scheduled
event that indicates the completion of a task or group of tasks. - Answers - False
Lin is writing a risk management report. Of the major categories of reporting
requirements, which one becomes the actual risk response plan? - Answers -
Documenting and tracking implementation of accepted recommendations
Which formula is used to determine the cost-benefit of a control, such as antivirus
software? - Answers - Loss before control implementation - Loss after control
implementation - Cost of control
POAM stands for: - Answers - plan of action and milestones.
You are creating objectives for your risk management plan. What do you NOT include at
this stage? - Answers - A plan of action and milestones (POAM)
All of the following terms have the same meaning, except: - Answers - internal network
zone.
Hajar is a security professional for a government contractor. Her company recently hired
three new employees for a special project, all of whom have a security clearance for
Secret data. Rather than granting the employees access to all files and folders in the
data repository, she is granting them access only to the data they need for the project.
What principle is Hajar following? - Answers - Principle of need to know
Which of the following is a law that ensures that federal agencies protect their systems
and data, comply with all elements of the law, and integrate security in all processes? -
Answers - Federal Information Security Modernization Act (FISMA)
What is the purpose of a mandatory vacation? - Answers - To reduce fraud and
embezzlement
True or False? Most organizations use proxy servers as gateways to access the
Internet. - Answers - True
Which of the following allows one person to act for another for legal issues and
sometimes is used if someone becomes mentally incapacitated? - Answers - Power of
Attorney
True or False? Title I of the Health Insurance Portability and Accountability Act (HIPAA)
addresses requirements and standards for information technology. - Answers - False
True or False? In a plan of action and milestones (POAM), an action is a scheduled
event that indicates the completion of a task or group of tasks. - Answers - False
Lin is writing a risk management report. Of the major categories of reporting
requirements, which one becomes the actual risk response plan? - Answers -
Documenting and tracking implementation of accepted recommendations
Which formula is used to determine the cost-benefit of a control, such as antivirus
software? - Answers - Loss before control implementation - Loss after control
implementation - Cost of control
POAM stands for: - Answers - plan of action and milestones.
You are creating objectives for your risk management plan. What do you NOT include at
this stage? - Answers - A plan of action and milestones (POAM)
All of the following terms have the same meaning, except: - Answers - internal network
zone.
Hajar is a security professional for a government contractor. Her company recently hired
three new employees for a special project, all of whom have a security clearance for
Secret data. Rather than granting the employees access to all files and folders in the
data repository, she is granting them access only to the data they need for the project.
What principle is Hajar following? - Answers - Principle of need to know
