BUS-A 460 - INFORMATION SYSTEMS SECURITY ASSURANCE
VERIFIED EXAM QUESTIONS AND ANSWERS - LATEST VERSION
1. What is information security?
CORRECT ANSWER : Information security is the protection of
information and information systems from unauthorized access, use,
disclosure, disruption, modification, or destruction.
2. What are the three components of the CIA triad?
CORRECT ANSWER : Confidentiality, integrity, and availability.
3. What is confidentiality?
CORRECT ANSWER : Confidentiality ensures that information is
accessible only to authorized individuals, systems, or processes.
4. What is integrity?
CORRECT ANSWER : Integrity ensures that information remains
accurate, complete, consistent, and protected from unauthorized
modification.
5. What is availability?
CORRECT ANSWER : Availability ensures that authorized users can
access systems and information when needed.
6. What is information assurance?
CORRECT ANSWER : Information assurance is the practice of
managing risks to information and information systems so that
confidentiality, integrity, availability, authenticity, and accountability
are maintained.
7. What is an information asset?
CORRECT ANSWER : An information asset is data or a resource
used to create, store, process, transmit, or protect information.
,8. What is an information system?
CORRECT ANSWER : An information system is a combination of
people, processes, technology, data, and procedures used to collect,
process, store, and distribute information.
9. What is a security control?
CORRECT ANSWER : A security control is a safeguard or
countermeasure designed to reduce security risks.
10. What is a security policy?
CORRECT ANSWER : A security policy is a formal statement
describing an organization's security requirements, expectations,
responsibilities, and acceptable practices.
11. What is a threat?
CORRECT ANSWER : A threat is a potential event, actor, or
circumstance capable of causing harm to an information system or
organization.
12. What is a vulnerability?
CORRECT ANSWER : A vulnerability is a weakness that could be
exploited by a threat.
13. What is risk?
CORRECT ANSWER : Risk is the possibility that a threat will
exploit a vulnerability and cause adverse consequences.
14. What is risk management?
CORRECT ANSWER : Risk management is the process of
identifying, assessing, responding to, and monitoring risks.
15. What is risk assessment?
CORRECT ANSWER : Risk assessment identifies threats and
vulnerabilities and evaluates their potential likelihood and impact.
16. What is risk appetite?
CORRECT ANSWER : Risk appetite is the amount and type of risk
an organization is willing to accept in pursuit of its objectives.
17. What is risk tolerance?
CORRECT ANSWER : Risk tolerance is the acceptable level of
variation or exposure within an organization's risk appetite.
,18. What is residual risk?
CORRECT ANSWER : Residual risk is the risk remaining after
security controls have been implemented.
19. What is inherent risk?
CORRECT ANSWER : Inherent risk is the level of risk that exists
before controls or mitigating measures are applied.
20. What is a threat actor?
CORRECT ANSWER : A threat actor is an individual, group,
organization, or system that intentionally or unintentionally creates
a security threat.
21. What is an attack?
CORRECT ANSWER : An attack is an intentional action designed to
compromise the confidentiality, integrity, or availability of an
information system or asset.
22. What is an exploit?
CORRECT ANSWER : An exploit is a technique, code, or method
used to take advantage of a vulnerability.
23. What is attack surface?
CORRECT ANSWER : Attack surface is the collection of points
through which an unauthorized party could attempt to gain access
to a system or environment.
24. What is defense in depth?
CORRECT ANSWER : Defense in depth uses multiple layers of
security controls so that failure of one control does not necessarily
compromise the entire system.
25. What is least privilege?
CORRECT ANSWER : Least privilege gives users, applications, and
systems only the access necessary to perform their authorized
functions.
26. What is separation of duties?
CORRECT ANSWER : Separation of duties divides critical
responsibilities among multiple people so that one individual cannot
independently complete an entire sensitive process.
, 27. What is need-to-know?
CORRECT ANSWER : Need-to-know limits access to information to
individuals who require it to perform authorized responsibilities.
28. What is accountability in information security?
CORRECT ANSWER : Accountability means actions can be traced to
the individuals, systems, or processes responsible for them.
29. What is nonrepudiation?
CORRECT ANSWER : Nonrepudiation provides evidence that a
particular party performed or approved a specific action and cannot
reasonably deny it.
30. What is authentication?
CORRECT ANSWER : Authentication verifies the identity of a user,
device, application, or other entity.
31. What is authorization?
CORRECT ANSWER : Authorization determines what an
authenticated entity is permitted to access or perform.
32. What is identification?
CORRECT ANSWER : Identification is the process by which an
entity claims an identity.
33. What is auditing?
CORRECT ANSWER : Auditing is the systematic examination of
activities, records, controls, and processes to determine whether
requirements are being met.
34. What is monitoring?
CORRECT ANSWER : Monitoring involves continuously or
periodically observing systems, activities, and controls for security-
relevant events or changes.
35. What is a security baseline?
CORRECT ANSWER : A security baseline is a defined minimum set
of security configurations or requirements that systems are
expected to meet.
36. What is a control objective?
CORRECT ANSWER : A control objective describes what a security
or business control is intended to accomplish.
VERIFIED EXAM QUESTIONS AND ANSWERS - LATEST VERSION
1. What is information security?
CORRECT ANSWER : Information security is the protection of
information and information systems from unauthorized access, use,
disclosure, disruption, modification, or destruction.
2. What are the three components of the CIA triad?
CORRECT ANSWER : Confidentiality, integrity, and availability.
3. What is confidentiality?
CORRECT ANSWER : Confidentiality ensures that information is
accessible only to authorized individuals, systems, or processes.
4. What is integrity?
CORRECT ANSWER : Integrity ensures that information remains
accurate, complete, consistent, and protected from unauthorized
modification.
5. What is availability?
CORRECT ANSWER : Availability ensures that authorized users can
access systems and information when needed.
6. What is information assurance?
CORRECT ANSWER : Information assurance is the practice of
managing risks to information and information systems so that
confidentiality, integrity, availability, authenticity, and accountability
are maintained.
7. What is an information asset?
CORRECT ANSWER : An information asset is data or a resource
used to create, store, process, transmit, or protect information.
,8. What is an information system?
CORRECT ANSWER : An information system is a combination of
people, processes, technology, data, and procedures used to collect,
process, store, and distribute information.
9. What is a security control?
CORRECT ANSWER : A security control is a safeguard or
countermeasure designed to reduce security risks.
10. What is a security policy?
CORRECT ANSWER : A security policy is a formal statement
describing an organization's security requirements, expectations,
responsibilities, and acceptable practices.
11. What is a threat?
CORRECT ANSWER : A threat is a potential event, actor, or
circumstance capable of causing harm to an information system or
organization.
12. What is a vulnerability?
CORRECT ANSWER : A vulnerability is a weakness that could be
exploited by a threat.
13. What is risk?
CORRECT ANSWER : Risk is the possibility that a threat will
exploit a vulnerability and cause adverse consequences.
14. What is risk management?
CORRECT ANSWER : Risk management is the process of
identifying, assessing, responding to, and monitoring risks.
15. What is risk assessment?
CORRECT ANSWER : Risk assessment identifies threats and
vulnerabilities and evaluates their potential likelihood and impact.
16. What is risk appetite?
CORRECT ANSWER : Risk appetite is the amount and type of risk
an organization is willing to accept in pursuit of its objectives.
17. What is risk tolerance?
CORRECT ANSWER : Risk tolerance is the acceptable level of
variation or exposure within an organization's risk appetite.
,18. What is residual risk?
CORRECT ANSWER : Residual risk is the risk remaining after
security controls have been implemented.
19. What is inherent risk?
CORRECT ANSWER : Inherent risk is the level of risk that exists
before controls or mitigating measures are applied.
20. What is a threat actor?
CORRECT ANSWER : A threat actor is an individual, group,
organization, or system that intentionally or unintentionally creates
a security threat.
21. What is an attack?
CORRECT ANSWER : An attack is an intentional action designed to
compromise the confidentiality, integrity, or availability of an
information system or asset.
22. What is an exploit?
CORRECT ANSWER : An exploit is a technique, code, or method
used to take advantage of a vulnerability.
23. What is attack surface?
CORRECT ANSWER : Attack surface is the collection of points
through which an unauthorized party could attempt to gain access
to a system or environment.
24. What is defense in depth?
CORRECT ANSWER : Defense in depth uses multiple layers of
security controls so that failure of one control does not necessarily
compromise the entire system.
25. What is least privilege?
CORRECT ANSWER : Least privilege gives users, applications, and
systems only the access necessary to perform their authorized
functions.
26. What is separation of duties?
CORRECT ANSWER : Separation of duties divides critical
responsibilities among multiple people so that one individual cannot
independently complete an entire sensitive process.
, 27. What is need-to-know?
CORRECT ANSWER : Need-to-know limits access to information to
individuals who require it to perform authorized responsibilities.
28. What is accountability in information security?
CORRECT ANSWER : Accountability means actions can be traced to
the individuals, systems, or processes responsible for them.
29. What is nonrepudiation?
CORRECT ANSWER : Nonrepudiation provides evidence that a
particular party performed or approved a specific action and cannot
reasonably deny it.
30. What is authentication?
CORRECT ANSWER : Authentication verifies the identity of a user,
device, application, or other entity.
31. What is authorization?
CORRECT ANSWER : Authorization determines what an
authenticated entity is permitted to access or perform.
32. What is identification?
CORRECT ANSWER : Identification is the process by which an
entity claims an identity.
33. What is auditing?
CORRECT ANSWER : Auditing is the systematic examination of
activities, records, controls, and processes to determine whether
requirements are being met.
34. What is monitoring?
CORRECT ANSWER : Monitoring involves continuously or
periodically observing systems, activities, and controls for security-
relevant events or changes.
35. What is a security baseline?
CORRECT ANSWER : A security baseline is a defined minimum set
of security configurations or requirements that systems are
expected to meet.
36. What is a control objective?
CORRECT ANSWER : A control objective describes what a security
or business control is intended to accomplish.
