MISY 5325 MIDTERM PRACTICE
QUESTIONS AND COMPLETE SOLUTIONS
◉ Carl is a security specialist. He is updating the organization's
hardware inventory in the asset management system. Which of
the following would be least helpful to record?
Answer: A competitor's product
◉ Companies use risk assessment strategies to differentiate
___________ from _________.
Answer: severe risks, minor risks
◉ Email addresses or domains ______________ are automatically
marked as spam.
Answer: on a blacklist
◉ Hajar is a security professional for a government contractor.
Her company recently hired three new employees for a special
project, all of whom have a security clearance for Secret data.
Rather than granting the employees access to all files and folders
in the data repository, she is granting them access only to the data
they need for the project. What principle is Hajar following?
Answer: Principle of need to know
,◉ Hajar is a security specialist. Her organization has about 500
systems that must be tracked for inventory purposes. She is
preparing an email to her manager that describes the benefits of
including specific details about software in the inventory, as well
as the use of an automated asset management system. Which of
the following is not one of those benefits?
Answer: The frequency of operating system upgrades will be
reduced.
◉ Hardening a server refers to:
A. expanding its attack surface.
B. a type of attack that removes the authorization to access a
company's systems from high-level employees in a corporation.
C. the combination of all the steps that it takes to protect a
vulnerable system and make it more secure than the default
installation.
D. a type of attack that deletes vital data from a server.
Answer: the combination of all the steps that it takes to protect a
vulnerable system and make it more secure than the default
installation.
◉ How can you determine the importance of a system?
Answer: By how the system is used
◉ In a quantitative risk assessment, what describes the loss that
will happen to the asset as a result of a threat?
, Answer: Exposure factor (EF)
◉ In a risk assessment, which of the following refers to how
responsibilities are assigned?
Answer: Management Structure
◉ In a risk management plan, how should you complete the step
of describing the procedures and schedules for accomplishment?
A. Create an affinity diagram and a threat-likelihood-impact
matrix; assign the task to a stakeholder; and submit the official
schedule to management.
B. Present stakeholders with a list of vulnerabilities that need
addressing and the steps involved with fixing each vulnerability;
ask them to assess how long it will take them to address each of
those vulnerabilities; and create an official schedule for the
stakeholders based on their estimated timetable.
C. For any threat or vulnerability, recommend a solution that
attempts to mitigate associated risks; justify your
recommendation; list the tasks necessary for addressing the
vulnerability; and provide management with an estimate of how
long it will take to complete the recommendation.
Answer: For any threat or vulnerability, recommend a solution
that attempts to mitigate associated risks; justify your
recommendation; list the tasks necessary for addressing the
vulnerability; and provide management with an estimate of how
long it will take to complete the recommendation.
QUESTIONS AND COMPLETE SOLUTIONS
◉ Carl is a security specialist. He is updating the organization's
hardware inventory in the asset management system. Which of
the following would be least helpful to record?
Answer: A competitor's product
◉ Companies use risk assessment strategies to differentiate
___________ from _________.
Answer: severe risks, minor risks
◉ Email addresses or domains ______________ are automatically
marked as spam.
Answer: on a blacklist
◉ Hajar is a security professional for a government contractor.
Her company recently hired three new employees for a special
project, all of whom have a security clearance for Secret data.
Rather than granting the employees access to all files and folders
in the data repository, she is granting them access only to the data
they need for the project. What principle is Hajar following?
Answer: Principle of need to know
,◉ Hajar is a security specialist. Her organization has about 500
systems that must be tracked for inventory purposes. She is
preparing an email to her manager that describes the benefits of
including specific details about software in the inventory, as well
as the use of an automated asset management system. Which of
the following is not one of those benefits?
Answer: The frequency of operating system upgrades will be
reduced.
◉ Hardening a server refers to:
A. expanding its attack surface.
B. a type of attack that removes the authorization to access a
company's systems from high-level employees in a corporation.
C. the combination of all the steps that it takes to protect a
vulnerable system and make it more secure than the default
installation.
D. a type of attack that deletes vital data from a server.
Answer: the combination of all the steps that it takes to protect a
vulnerable system and make it more secure than the default
installation.
◉ How can you determine the importance of a system?
Answer: By how the system is used
◉ In a quantitative risk assessment, what describes the loss that
will happen to the asset as a result of a threat?
, Answer: Exposure factor (EF)
◉ In a risk assessment, which of the following refers to how
responsibilities are assigned?
Answer: Management Structure
◉ In a risk management plan, how should you complete the step
of describing the procedures and schedules for accomplishment?
A. Create an affinity diagram and a threat-likelihood-impact
matrix; assign the task to a stakeholder; and submit the official
schedule to management.
B. Present stakeholders with a list of vulnerabilities that need
addressing and the steps involved with fixing each vulnerability;
ask them to assess how long it will take them to address each of
those vulnerabilities; and create an official schedule for the
stakeholders based on their estimated timetable.
C. For any threat or vulnerability, recommend a solution that
attempts to mitigate associated risks; justify your
recommendation; list the tasks necessary for addressing the
vulnerability; and provide management with an estimate of how
long it will take to complete the recommendation.
Answer: For any threat or vulnerability, recommend a solution
that attempts to mitigate associated risks; justify your
recommendation; list the tasks necessary for addressing the
vulnerability; and provide management with an estimate of how
long it will take to complete the recommendation.
