IT 462 Midterm Review 2024 Questions and Answers

IT 462 Midterm Review 2024 Questions and Answers What is the difference between a standard and a guideline? - Correct Answer ️️ - Standards are requirements; guidelines are recommendations. Which of the following describes a duty of the Data Owner? - Correct Answer ️️ - Ensure that data has proper security labels A policy that a user must have a business requirement to view data before attempting to do so is an example of enforcing what? - Correct Answer ️️ -Need to know The delay between access approval and actual access can create what type of security concern? - Correct Answer ️️ -Time of check, to time of use Which security model allows subjects to read less secure objects and write more secure objects? - Correct Answer ️️ -Bell La-Padula The Orange Book defined what evaluation method? - Correct Answer ️️ -Trusted Computer System Evaluation Criteria Which of the following access control models was one of the first to be based on integrity? - Correct Answer ️️ -Biba Integrity Model Which mediates a subject's request for access to an object? - Correct Answer ️️ - Reference monitor What is the correct approach for addressing security and organization objectives? - Correct Answer ️️ -Security should support organization objectives The statement, "Promote professionalism among information system security practitioners through the provisioning of professional certification and training." is an example of a/an: - Correct Answer ️️ -Mission statement The two components of risk management are: - Correct Answer ️️ -Risk assessment and risk treatment A security manager needs to perform a risk assessment on a critical business application, in order to determine what additional controls may be needed to protect the application and its databases. The best approach to performing this risk assessment is: - Correct Answer ️️ -Perform a qualitative risk assessment first, then perform a quantitative risk assessment A qualitative risk assessment is used to identify: - Correct Answer ️️ -Vulnerabilities, threats, threat probabilities, and countermeasures The impact of a specific threat is defined as: - Correct Answer ️️ -The effect of the threat if it is realized Exposure factor is defined as: - Correct Answer ️️ -The part of an asset's value that is likely to be lost by a particular threat A security manager is performing a quantitative risk assessment on a particular asset. The security manager wants to determine the quantitative loss for a single loss based on a particular threat. The correct way to calculate this is: - Correct Answer ️️ -Multiply the asset's value times the exposure factor A risk manager has completed a risk analysis for an asset valued at $4000. Two threats were identified; the ALE for one threat is $400, and the ALE for the second threat is $500. What is the amount of loss that the organization should estimate for an entire year? - Correct Answer ️️ -$900 After completing a risk assessment, an organization was able to reduce the risk through the addition of detective and preventive controls. However, these controls did not remove all risk. What options does the organization have for treating the remaining risk? - Correct Answer ️️ -Accept, avoid, reduce, or transfer The statement, "Information systems should be configured to require strong passwords", is an example of a/an: - Correct Answer ️️ -Security policy A security manager is developing a data classification policy. What elements need to be in the policy? - Correct Answer ️️ -Sensitivity levels, marking procedures, access procedures, and handling procedures Authentication, encryption, and ACL's are examples of: - Correct Ans