ISTM- 209 EXAM 2 QUESTIONS | 2026 |
GUARANTEED PASS
Ethics - Answers -the principles and standards that guide our behavior toward other
people
Information ethics - Answers --govern the ethical and moral issues arising from the
development and use of information technologies as well as the creation, collection,
duplication, distribution, and processing of information itself (with or without the aid of
computer technologies)
-Ethical dilemmas in this area usually arise not as simple, clear-cut situations but as
clashes among competing goals, responsibilities, and loyalties. Inevitably, there will be
more than one socially acceptable or correct decision.
-The protection of customers' privacy is one of the largest and murkiest ethical issues
facing organizations today.
Privacy - Answers -is the right to be left alone when you want to be, to have control
over your personal possessions, and not to be observed without your consent.
Confidentiality - Answers -is the assurance that messages and information remain
available only to those authorized to view them.
Copyright - Answers --is the legal protection afforded an expression of an idea, such as
a song, book, or video game.
-As it becomes easier for people to copy everything from words and data to music and
video, the ethical issues surrounding copyright infringement and the violation of
intellectual property rights are consuming the ebusiness world.
Counterfeit software - Answers -is software that is manufactured to look like the real
thing and sold as such
Digital right management - Answers -is a technological solution that allows publishers
to control their digital media to discourage, limit, or prevent illegal copying and
distribution.
Intellectual property: - Answers -is intangible creative work that is embodied in physical
form and includes copyrights, trademarks, and patents
Patent - Answers -is an exclusive right to make, use, and sell an invention and is
granted by a government to the inventor
Pirated software - Answers -is the unauthorized use, duplication, distribution, or sale of
copyrighted software
,Rule 41: is the part of the U.S. Federal Rules of Criminal Procedure that covers the
search and seizure of physical and digital evidence - Answers --Rule 41 originally
granted a federal magistrate judge the authority to issue a warrant to search and seize a
person or property located within that judge's district if the person or property is part of a
criminal investigation or trial.
-In April 2016, the Judicial Conference of the United States proposed an amendment to
Rule 41 that allows a federal magistrate judge to issue a warrant that allows an
investigator to gain remote access to a digital device suspected in a crime, even if the
device is located outside of the geographic jurisdiction of the judge issuing the warrant
Digital trusts - Answers -is the measure of consumer, partner, and employee
confidence in an organizations ability to protect and secure data and the privacy of
individuals
E-discovery: (electronic discovery) - Answers -refers to the ability of a company to
identify, search, gather, seize or export digital information in responding to litigation,
audit, investigation, or information inquiry.
Child online protection act (COPA) - Answers -was passed to protect minors from
accessing inappropriate material on the internet.
Automated security tools - Answers -Is it ethical to release into the wild tools that can
automate attacks on a broad array of systems?
Cybersecurity incident response - Answers -How much time and energy should be
spent investigating a breach? What is an appropriate level of incident detail to share
with customers and other stakeholders? How thick is the line between satisfying
organizational obligations and finding the complete truth behind an incident?
Encryption - Answers -What should companies do in response to legal law enforcement
requests for encrypted data? Should known vulnerabilities in systems be used to
comply with requests that would otherwise be impossible? Should law enforcement
agencies use such vulnerabilities themselves if they suspect a formal legal request will
not bear fruit?
Research - Answers -How should researchers balance the use of potentially
aggressive penetration testing techniques against the legal rights of the owners of
systems they are researching? Does that balance change in cases in which those
system owners are not implementing reasonably strong security methods?
Sale restrictions - Answers -What (if any) is the responsibility of cybersecurity
professionals to try to prevent the sale of products they have developed to autocratic
governments that would use them to harm their citizens.
Role of CSO (Chief Security Officer) - Answers -What kinds of personal risk should a
chief security officer or manager-level security officer accept on behalf of an
, organization? It is not uncommon for CSOs to be fired or forced out when a
cybersecurity breach occurs; should organizations offer CSOs employment agreements
that include provisions for relief from personal legal liability or other protections? How
should organizational deficiencies (underinvestment, bad practices, etc.) factor in this
analysis?
Vulnerability disclosure - Answers -When and how should researchers inform the public
about vulnerabilities in widely used products? What steps should be taken before any
such notification?
Capability Maturity Model Integration (CMMI) method - Answers --Capability Maturity
Model Integration (CMMI) method: is a process improvement approach that contains 22
process areas.
-It is divided into appraisal, evaluation, and structure.
-particularly well suited to organizations that need help with application development,
life cycle issues, and improving the delivery of products throughout the life cycle.
control objectives for information and related technologies (COBIT) - Answers -is a set
of best practices that helps an organization to maximize the benefits of an information
system, while at the same time establishing appropriate controls to ensure minimum
errors.
Committee of Sponsoring Organizations (COSO) - Answers -is key for evaluating
internal controls such as human resources, logistics, information technology, risk, legal,
marketing and sales, operations, financial functions, procurement, and reporting.
This is a more business-general framework that is less technically specific.
Information Systems Audit and Control Association (ISACA) - Answers -is a set of
guidelines and supporting tools for IT governance that is accepted worldwide and
generally used by auditors and companies as a way to integrate technology to
implement controls and meet specific business objectives.
- Answers -Information Technology Infrastructure Library (ITIL): is a framework
provided by the government of the United Kingdom and offers eight sets of
management procedures:
(1) service delivery,
(2) service support,
(3) service management,
(4) information and communication technology (ICT) infrastructure management,
(5) software asset management,
(6) business perspective,
(7) security management, and
(8) application management.
-a good fit for organizations concerned about operations.
down time - Answers -refers to a period of time when a system is unavailable
GUARANTEED PASS
Ethics - Answers -the principles and standards that guide our behavior toward other
people
Information ethics - Answers --govern the ethical and moral issues arising from the
development and use of information technologies as well as the creation, collection,
duplication, distribution, and processing of information itself (with or without the aid of
computer technologies)
-Ethical dilemmas in this area usually arise not as simple, clear-cut situations but as
clashes among competing goals, responsibilities, and loyalties. Inevitably, there will be
more than one socially acceptable or correct decision.
-The protection of customers' privacy is one of the largest and murkiest ethical issues
facing organizations today.
Privacy - Answers -is the right to be left alone when you want to be, to have control
over your personal possessions, and not to be observed without your consent.
Confidentiality - Answers -is the assurance that messages and information remain
available only to those authorized to view them.
Copyright - Answers --is the legal protection afforded an expression of an idea, such as
a song, book, or video game.
-As it becomes easier for people to copy everything from words and data to music and
video, the ethical issues surrounding copyright infringement and the violation of
intellectual property rights are consuming the ebusiness world.
Counterfeit software - Answers -is software that is manufactured to look like the real
thing and sold as such
Digital right management - Answers -is a technological solution that allows publishers
to control their digital media to discourage, limit, or prevent illegal copying and
distribution.
Intellectual property: - Answers -is intangible creative work that is embodied in physical
form and includes copyrights, trademarks, and patents
Patent - Answers -is an exclusive right to make, use, and sell an invention and is
granted by a government to the inventor
Pirated software - Answers -is the unauthorized use, duplication, distribution, or sale of
copyrighted software
,Rule 41: is the part of the U.S. Federal Rules of Criminal Procedure that covers the
search and seizure of physical and digital evidence - Answers --Rule 41 originally
granted a federal magistrate judge the authority to issue a warrant to search and seize a
person or property located within that judge's district if the person or property is part of a
criminal investigation or trial.
-In April 2016, the Judicial Conference of the United States proposed an amendment to
Rule 41 that allows a federal magistrate judge to issue a warrant that allows an
investigator to gain remote access to a digital device suspected in a crime, even if the
device is located outside of the geographic jurisdiction of the judge issuing the warrant
Digital trusts - Answers -is the measure of consumer, partner, and employee
confidence in an organizations ability to protect and secure data and the privacy of
individuals
E-discovery: (electronic discovery) - Answers -refers to the ability of a company to
identify, search, gather, seize or export digital information in responding to litigation,
audit, investigation, or information inquiry.
Child online protection act (COPA) - Answers -was passed to protect minors from
accessing inappropriate material on the internet.
Automated security tools - Answers -Is it ethical to release into the wild tools that can
automate attacks on a broad array of systems?
Cybersecurity incident response - Answers -How much time and energy should be
spent investigating a breach? What is an appropriate level of incident detail to share
with customers and other stakeholders? How thick is the line between satisfying
organizational obligations and finding the complete truth behind an incident?
Encryption - Answers -What should companies do in response to legal law enforcement
requests for encrypted data? Should known vulnerabilities in systems be used to
comply with requests that would otherwise be impossible? Should law enforcement
agencies use such vulnerabilities themselves if they suspect a formal legal request will
not bear fruit?
Research - Answers -How should researchers balance the use of potentially
aggressive penetration testing techniques against the legal rights of the owners of
systems they are researching? Does that balance change in cases in which those
system owners are not implementing reasonably strong security methods?
Sale restrictions - Answers -What (if any) is the responsibility of cybersecurity
professionals to try to prevent the sale of products they have developed to autocratic
governments that would use them to harm their citizens.
Role of CSO (Chief Security Officer) - Answers -What kinds of personal risk should a
chief security officer or manager-level security officer accept on behalf of an
, organization? It is not uncommon for CSOs to be fired or forced out when a
cybersecurity breach occurs; should organizations offer CSOs employment agreements
that include provisions for relief from personal legal liability or other protections? How
should organizational deficiencies (underinvestment, bad practices, etc.) factor in this
analysis?
Vulnerability disclosure - Answers -When and how should researchers inform the public
about vulnerabilities in widely used products? What steps should be taken before any
such notification?
Capability Maturity Model Integration (CMMI) method - Answers --Capability Maturity
Model Integration (CMMI) method: is a process improvement approach that contains 22
process areas.
-It is divided into appraisal, evaluation, and structure.
-particularly well suited to organizations that need help with application development,
life cycle issues, and improving the delivery of products throughout the life cycle.
control objectives for information and related technologies (COBIT) - Answers -is a set
of best practices that helps an organization to maximize the benefits of an information
system, while at the same time establishing appropriate controls to ensure minimum
errors.
Committee of Sponsoring Organizations (COSO) - Answers -is key for evaluating
internal controls such as human resources, logistics, information technology, risk, legal,
marketing and sales, operations, financial functions, procurement, and reporting.
This is a more business-general framework that is less technically specific.
Information Systems Audit and Control Association (ISACA) - Answers -is a set of
guidelines and supporting tools for IT governance that is accepted worldwide and
generally used by auditors and companies as a way to integrate technology to
implement controls and meet specific business objectives.
- Answers -Information Technology Infrastructure Library (ITIL): is a framework
provided by the government of the United Kingdom and offers eight sets of
management procedures:
(1) service delivery,
(2) service support,
(3) service management,
(4) information and communication technology (ICT) infrastructure management,
(5) software asset management,
(6) business perspective,
(7) security management, and
(8) application management.
-a good fit for organizations concerned about operations.
down time - Answers -refers to a period of time when a system is unavailable
