MISSOURI STATE UNIVERSITY — CIS 560: INFORMATION SYSTEMS SECURITY 2026-2027 UPDATE EXAM
PART I: COMPREHENSIVE RESOURCE ANALYSIS
CIS 560: INFORMATION SYSTEMS SECURITY — 2026-2027 UPDATE EXAM
1. Course & Resource Overview
Course: CIS 560: Information Systems Security
Institution: Missouri State University, Springfield
Subject: Comprehensive Information Systems Security, Network Security, and Compliance Frameworks.
Source Material: CIS_560_all_quizes_and_exams_2023 UPDATED.docx
Target Audience: Advanced undergraduate and graduate students in Computer Information Systems and Cybersecurity.
2. Core Chapters & Topic Distribution
Chapter Major Topics Covered Key Core Concepts
Chapter 1: Security The C-I-A Triad, Access Control Models (MAC, Defense in Depth, Principle of Least Privilege,
Tenets & Access DAC, RBAC, VBAC), Authentication Types Need-to-Know, Separation of Duties, Temporal
Control Models (Knowledge, Ownership, Characteristics / Isolation.
Biometrics), Two-Factor Authentication,
Multi-tenancy, and Data Classification.
Chapter 2: Risks, Risk Management Lifecycle, Risk Analysis ALE, SLE, ARO, EF, RTO, RPO, Hot site, SOC 1, SOC
Threats, & (Quantitative vs. Qualitative), Risk Responses 2, SOC 3, SSAE 16.
Vulnerabilities (Mitigation, Assignment, Acceptance, Avoidance),
Business Continuity Management (BCP vs. DRP,
BIA), and Auditing.
Chapter 3: Network The Seven Domains of IT Infrastructure, Network Packet Filtering vs. Stateful Inspection, OS
Security, Protocols, Protocols (TCP/IP, UDP, ICMP, SIP, DHCP, IPSec, Fingerprinting, Port Scanning, DMZ, SSL-VPN,
& Infrastructure PPTP, SSL/TLS), and Security Devices (Firewalls, Segmenting Voice/Data.
IDS/IPS, SIEM).
Chapter 4: Malicious Types of Malware (Viruses, Worms, Trojans, FISMA, FERPA, GLBA, HIPAA/HITECH, CIPA, SOX,
Code (Malware) & Rootkits, Logic Bombs, Spyware, Adware), Attack NIST Standards.
Compliance Laws vectors (SYN flood, DoS/DDoS, Smurf, MitM,
Phishing, Pharming), and U.S. Federal Security
Laws.
STUDY MATERIAL & EXAM PREP WORKBOOK Page 1
,MISSOURI STATE UNIVERSITY — CIS 560: INFORMATION SYSTEMS SECURITY 2026-2027 UPDATE EXAM
3. Core Learning Objectives
• Synthesize and Apply Core Security Tenets: Differentiate and enforce Confidentiality, Integrity, and Availability controls
across enterprise network domains.
• Evaluate and Select Access Control Models: Analyze security requirements to recommend MAC, DAC, RBAC, or
VBAC, and configure multi-factor authentication systems.
• Conduct Quantitative & Qualitative Risk Analysis: Calculate risk metrics (SLE, ARO, ALE, RTO, RPO) and
recommend cost-effective risk-response strategies.
• Design Resilient Business Continuity and Disaster Recovery Plans: Perform Business Impact Analyses (BIA) and
select appropriate DRP testing methodologies (checklist, simulation, parallel, full-interruption).
• Analyze and Mitigate Cyber Attacks & Malicious Code: Detect and defend against complex threat vectors, including
worms, Trojans, stealth/polymorphic viruses, and DDoS attacks.
• Enforce Regulatory Compliance Frameworks: Master federal privacy and security regulations (FISMA, FERPA, GLBA,
HIPAA/HITECH, CIPA, SOX) and auditing standards (SSAE 16, SOC 1/2/3).
4. Key Terminology & Concepts
• Clipping Level: A threshold value used in security monitoring that instructs system controls to ignore normal, low-level
baseline activities, reducing alert noise.
• Separation of Duties: The practice of dividing a high-risk task into sequential activities performed by different people to
prevent fraud and collusion.
• Due Diligence: The continuous, proactive evaluation of whether implemented security countermeasures and safeguards
are performing as expected.
• Asynchronous Token: A challenge-response remote authentication device that takes a server's random challenge value
and calculates a response using its internal cryptographic key.
• False Negative: The critical security failure where an intrusion detection system (IDS) or monitoring control incorrectly
identifies abnormal or malicious activity as normal.
• Operating System Fingerprinting: A reconnaissance technique where an attacker probes a target system via port
mapping to identify the OS type, version, and patch level.
5. Critical Security Procedures & Applications
• Gap Analysis: The systematic procedure of comparing an organization's existing security controls against the controls
required to mitigate all identified threats.
• Business Impact Analysis (BIA): A procedural assessment that determines the operational and financial impact of a
disaster over time, identifying critical business functions and establishing recovery objectives (RTO, RPO).
• Change Control Board (CCB): The administrative procedure of reviewing, testing, documenting, and formally approving
all modifications to a production system to prevent the introduction of security gaps or instability.
• Voice & Data Segmentation: In modern LAN upgrades (GigE/10GigE), segmenting real-time voice (VoIP) and data traffic
on separate fiber-optic trunks to optimize performance and prevent dropouts.
STUDY MATERIAL & EXAM PREP WORKBOOK Page 2
,MISSOURI STATE UNIVERSITY — CIS 560: INFORMATION SYSTEMS SECURITY 2026-2027 UPDATE EXAM
6. Commonly Confused Concepts
• Symmetric vs. Asymmetric Cryptography: Symmetric cryptography uses a single shared secret key for encryption and
decryption, offering rapid bulk data encryption but presenting key distribution challenges. Asymmetric cryptography uses a
public/private key pair, is computationally slow and ill-suited for bulk data, but simplifies key distribution and supports digital
signatures and nonrepudiation.
• Virus vs. Worm vs. Trojan: A virus requires a host file and human intervention (such as opening a program) to execute
and replicate. A worm is a standalone program that self-replicates across network connections automatically, consuming
bandwidth. A Trojan masquerades as legitimate software to deceive users into executing it, carrying hidden malicious
payloads.
• Phishing vs. Pharming: Phishing utilizes deceptive emails or messages to trick users into clicking links or revealing
information. Pharming utilizes DNS spoofing or poisoning to automatically redirect users to fraudulent websites, even if the
user typed the correct, legitimate Web address.
• SOC 1 vs. SOC 2 vs. SOC 3 Audits: SOC 1 reports focus on internal controls over financial reporting (supporting
SOX/GLBA). SOC 2 reports are detailed, technical documents focusing on security, availability, confidentiality, and privacy,
restricted to internal audiences. SOC 3 reports are high-level, simplified summaries of SOC 2 controls intended for public
consumption.
STUDY MATERIAL & EXAM PREP WORKBOOK Page 3
, MISSOURI STATE UNIVERSITY — CIS 560: INFORMATION SYSTEMS SECURITY 2026-2027 UPDATE EXAM
PART II: HIGH-YIELD PRACTICE EXAM
110 REALISTIC PRACTICE QUESTIONS & DETAILED RATIONALES
Question 1: What name is given to a method of developing software that is based on small project iterations,
or sprints, instead of long project schedules?
A. Baseline waterfall model
B. Agile development
C. Sprint
D. Rapid prototyping model
ANSWER : Agile development
Explanation: Agile development is a software development methodology based on small, iterative cycles called sprints, allowing
for flexibility and rapid response to changes, as opposed to the linear, sequential approach of the Waterfall model. A sprint is the
term for a single iteration within agile, not the method itself.
Question 2: Which of the following is the correct definition of the term 'cloud computing'?
A. The practice of running all server applications locally on individual workstations.
B. A decentralized computing model that eliminates the use of any wide area networks.
C. The practice of using computing services that are delivered over a network.
D. A software testing methodology based on limited application design knowledge.
ANSWER : The practice of using computing services that are delivered over a network.
Explanation: Cloud computing refers to the practice of using computing services, including servers, storage, databases,
networking, software, and analytics, that are delivered over a network (most commonly the Internet). This model enables
organizations to reduce infrastructure costs and scale resources dynamically.
Question 3: In information systems security, which of the following represents the correct relationship
between threat, vulnerability, and disaster?
A. Disaster refers to the amount of harm a threat can cause by exploiting a vulnerability.
B. A disaster is a sudden event causing severe disruption, while threat is a potential danger and vulnerability is a weakness.
C. Vulnerability is the active exploitation of a threat, which always results in an immediate disaster.
D. Threat and disaster are synonymous terms describing the financial loss suffered due to a system vulnerability.
ANSWER : A disaster is a sudden event causing severe disruption, while threat is a potential danger and
vulnerability is a weakness.
Explanation: A vulnerability is a flaw or weakness in a system's procedures, design, implementation, or internal controls. A threat
is a potential force or event that might exploit that vulnerability. The 'amount of harm a threat can cause' is defined as impact, not
disaster. Disaster recovery plans (DRP) are invoked when a sudden, catastrophic event causes major disruption to operations.
STUDY MATERIAL & EXAM PREP WORKBOOK Page 4
PART I: COMPREHENSIVE RESOURCE ANALYSIS
CIS 560: INFORMATION SYSTEMS SECURITY — 2026-2027 UPDATE EXAM
1. Course & Resource Overview
Course: CIS 560: Information Systems Security
Institution: Missouri State University, Springfield
Subject: Comprehensive Information Systems Security, Network Security, and Compliance Frameworks.
Source Material: CIS_560_all_quizes_and_exams_2023 UPDATED.docx
Target Audience: Advanced undergraduate and graduate students in Computer Information Systems and Cybersecurity.
2. Core Chapters & Topic Distribution
Chapter Major Topics Covered Key Core Concepts
Chapter 1: Security The C-I-A Triad, Access Control Models (MAC, Defense in Depth, Principle of Least Privilege,
Tenets & Access DAC, RBAC, VBAC), Authentication Types Need-to-Know, Separation of Duties, Temporal
Control Models (Knowledge, Ownership, Characteristics / Isolation.
Biometrics), Two-Factor Authentication,
Multi-tenancy, and Data Classification.
Chapter 2: Risks, Risk Management Lifecycle, Risk Analysis ALE, SLE, ARO, EF, RTO, RPO, Hot site, SOC 1, SOC
Threats, & (Quantitative vs. Qualitative), Risk Responses 2, SOC 3, SSAE 16.
Vulnerabilities (Mitigation, Assignment, Acceptance, Avoidance),
Business Continuity Management (BCP vs. DRP,
BIA), and Auditing.
Chapter 3: Network The Seven Domains of IT Infrastructure, Network Packet Filtering vs. Stateful Inspection, OS
Security, Protocols, Protocols (TCP/IP, UDP, ICMP, SIP, DHCP, IPSec, Fingerprinting, Port Scanning, DMZ, SSL-VPN,
& Infrastructure PPTP, SSL/TLS), and Security Devices (Firewalls, Segmenting Voice/Data.
IDS/IPS, SIEM).
Chapter 4: Malicious Types of Malware (Viruses, Worms, Trojans, FISMA, FERPA, GLBA, HIPAA/HITECH, CIPA, SOX,
Code (Malware) & Rootkits, Logic Bombs, Spyware, Adware), Attack NIST Standards.
Compliance Laws vectors (SYN flood, DoS/DDoS, Smurf, MitM,
Phishing, Pharming), and U.S. Federal Security
Laws.
STUDY MATERIAL & EXAM PREP WORKBOOK Page 1
,MISSOURI STATE UNIVERSITY — CIS 560: INFORMATION SYSTEMS SECURITY 2026-2027 UPDATE EXAM
3. Core Learning Objectives
• Synthesize and Apply Core Security Tenets: Differentiate and enforce Confidentiality, Integrity, and Availability controls
across enterprise network domains.
• Evaluate and Select Access Control Models: Analyze security requirements to recommend MAC, DAC, RBAC, or
VBAC, and configure multi-factor authentication systems.
• Conduct Quantitative & Qualitative Risk Analysis: Calculate risk metrics (SLE, ARO, ALE, RTO, RPO) and
recommend cost-effective risk-response strategies.
• Design Resilient Business Continuity and Disaster Recovery Plans: Perform Business Impact Analyses (BIA) and
select appropriate DRP testing methodologies (checklist, simulation, parallel, full-interruption).
• Analyze and Mitigate Cyber Attacks & Malicious Code: Detect and defend against complex threat vectors, including
worms, Trojans, stealth/polymorphic viruses, and DDoS attacks.
• Enforce Regulatory Compliance Frameworks: Master federal privacy and security regulations (FISMA, FERPA, GLBA,
HIPAA/HITECH, CIPA, SOX) and auditing standards (SSAE 16, SOC 1/2/3).
4. Key Terminology & Concepts
• Clipping Level: A threshold value used in security monitoring that instructs system controls to ignore normal, low-level
baseline activities, reducing alert noise.
• Separation of Duties: The practice of dividing a high-risk task into sequential activities performed by different people to
prevent fraud and collusion.
• Due Diligence: The continuous, proactive evaluation of whether implemented security countermeasures and safeguards
are performing as expected.
• Asynchronous Token: A challenge-response remote authentication device that takes a server's random challenge value
and calculates a response using its internal cryptographic key.
• False Negative: The critical security failure where an intrusion detection system (IDS) or monitoring control incorrectly
identifies abnormal or malicious activity as normal.
• Operating System Fingerprinting: A reconnaissance technique where an attacker probes a target system via port
mapping to identify the OS type, version, and patch level.
5. Critical Security Procedures & Applications
• Gap Analysis: The systematic procedure of comparing an organization's existing security controls against the controls
required to mitigate all identified threats.
• Business Impact Analysis (BIA): A procedural assessment that determines the operational and financial impact of a
disaster over time, identifying critical business functions and establishing recovery objectives (RTO, RPO).
• Change Control Board (CCB): The administrative procedure of reviewing, testing, documenting, and formally approving
all modifications to a production system to prevent the introduction of security gaps or instability.
• Voice & Data Segmentation: In modern LAN upgrades (GigE/10GigE), segmenting real-time voice (VoIP) and data traffic
on separate fiber-optic trunks to optimize performance and prevent dropouts.
STUDY MATERIAL & EXAM PREP WORKBOOK Page 2
,MISSOURI STATE UNIVERSITY — CIS 560: INFORMATION SYSTEMS SECURITY 2026-2027 UPDATE EXAM
6. Commonly Confused Concepts
• Symmetric vs. Asymmetric Cryptography: Symmetric cryptography uses a single shared secret key for encryption and
decryption, offering rapid bulk data encryption but presenting key distribution challenges. Asymmetric cryptography uses a
public/private key pair, is computationally slow and ill-suited for bulk data, but simplifies key distribution and supports digital
signatures and nonrepudiation.
• Virus vs. Worm vs. Trojan: A virus requires a host file and human intervention (such as opening a program) to execute
and replicate. A worm is a standalone program that self-replicates across network connections automatically, consuming
bandwidth. A Trojan masquerades as legitimate software to deceive users into executing it, carrying hidden malicious
payloads.
• Phishing vs. Pharming: Phishing utilizes deceptive emails or messages to trick users into clicking links or revealing
information. Pharming utilizes DNS spoofing or poisoning to automatically redirect users to fraudulent websites, even if the
user typed the correct, legitimate Web address.
• SOC 1 vs. SOC 2 vs. SOC 3 Audits: SOC 1 reports focus on internal controls over financial reporting (supporting
SOX/GLBA). SOC 2 reports are detailed, technical documents focusing on security, availability, confidentiality, and privacy,
restricted to internal audiences. SOC 3 reports are high-level, simplified summaries of SOC 2 controls intended for public
consumption.
STUDY MATERIAL & EXAM PREP WORKBOOK Page 3
, MISSOURI STATE UNIVERSITY — CIS 560: INFORMATION SYSTEMS SECURITY 2026-2027 UPDATE EXAM
PART II: HIGH-YIELD PRACTICE EXAM
110 REALISTIC PRACTICE QUESTIONS & DETAILED RATIONALES
Question 1: What name is given to a method of developing software that is based on small project iterations,
or sprints, instead of long project schedules?
A. Baseline waterfall model
B. Agile development
C. Sprint
D. Rapid prototyping model
ANSWER : Agile development
Explanation: Agile development is a software development methodology based on small, iterative cycles called sprints, allowing
for flexibility and rapid response to changes, as opposed to the linear, sequential approach of the Waterfall model. A sprint is the
term for a single iteration within agile, not the method itself.
Question 2: Which of the following is the correct definition of the term 'cloud computing'?
A. The practice of running all server applications locally on individual workstations.
B. A decentralized computing model that eliminates the use of any wide area networks.
C. The practice of using computing services that are delivered over a network.
D. A software testing methodology based on limited application design knowledge.
ANSWER : The practice of using computing services that are delivered over a network.
Explanation: Cloud computing refers to the practice of using computing services, including servers, storage, databases,
networking, software, and analytics, that are delivered over a network (most commonly the Internet). This model enables
organizations to reduce infrastructure costs and scale resources dynamically.
Question 3: In information systems security, which of the following represents the correct relationship
between threat, vulnerability, and disaster?
A. Disaster refers to the amount of harm a threat can cause by exploiting a vulnerability.
B. A disaster is a sudden event causing severe disruption, while threat is a potential danger and vulnerability is a weakness.
C. Vulnerability is the active exploitation of a threat, which always results in an immediate disaster.
D. Threat and disaster are synonymous terms describing the financial loss suffered due to a system vulnerability.
ANSWER : A disaster is a sudden event causing severe disruption, while threat is a potential danger and
vulnerability is a weakness.
Explanation: A vulnerability is a flaw or weakness in a system's procedures, design, implementation, or internal controls. A threat
is a potential force or event that might exploit that vulnerability. The 'amount of harm a threat can cause' is defined as impact, not
disaster. Disaster recovery plans (DRP) are invoked when a sudden, catastrophic event causes major disruption to operations.
STUDY MATERIAL & EXAM PREP WORKBOOK Page 4
