IAS GFORMSV2

Which specific individual is credited with the founding of the Internet through the development of ARPANET in the 1960s?

Larry Roberts

In the context of power quality, how is a 'surge' distinguished from a 'spike'?

A surge is a long-term increase in power, while a spike is a short-term increase.

Regarding the critical characteristics of information, which statement accurately describes the relationship between 'possession' and 'confidentiality'?

A breach of confidentiality always results in a breach of possession.

During which phase of the Systems Development Life Cycle (SDLC) is a 'make-or-buy' decision typically finalized?

Physical Design

Which security design principle suggests that every access to a resource should be checked for permissions, rather than relying on a single initial check?

Complete mediation

Which professional role is primarily responsible for the strategic planning that affects information management and advises the CEO on technology goals?

Chief Information Officer

How does 'pharming' differ from traditional 'phishing' attacks?

Pharming redirects legitimate traffic to an illegitimate site, often via browser or DNS manipulation.

A system administrator notices that several users are accessing a shared database using the same administrative account. Which software design principle is being violated?

Least common mechanism

Which of the following describes a 'timing attack' in the context of web security?

An attack that measures the response time of a system or explores the browser cache to steal information.

What was the significance of the 'Rand Report R-609' in the history of information security?

It marked the start of information security by defining controls for multi-level computer systems.

Which component of an information system is cited as the most difficult to secure?

People

A security professional is evaluating a vulnerability that occurs when a developer fails to validate user input before passing it to a compiler. What type of problem is this?

Command Injection

What is the primary objective of 'Software Assurance'?

To create software that is securable and more able to be deployed in a secure fashion.

In information security terms, what defines 'exposure'?

A condition where a vulnerability known to an attacker is present.

Which approach to information security implementation involves system administrators attempting to improve security at the local level without broad management support?

Bottom-up approach

Information is said to have 'utility' when it possesses which of the following qualities?

It serves a particular purpose and is in a format meaningful to the end-user.

Which role on the information security project team is primarily responsible for understanding the value of assets and financial assessment techniques?

Risk assessment specialists

What is the primary function of a 'Data Custodian'?

The storage, maintenance, and protection of information assets.

In the SecSDLC, which phase involves the creation of supporting documentation and the training of users?

Implementation

Which term describes a virus or worm that changes its appearance over time to evade signature-based detection?

Polymorphic Threat

An attacker uses social skills to convince an employee to reveal their network credentials. What is the name of this technique?

Social Engineering

Which power condition is defined as a 'long-term decrease in the quality' of electrical power availability?

Brownout

A 'dictionary attack' is a specific variation of which type of broader attack?

Brute Force

In the 'Security as Social Science' view, how can security administrators reduce risk caused by end users?

By understanding behavioral aspects of organizational science and change management.

What occurs during a 'buffer overrun' (or buffer overflow) attack?

More data is sent to a program buffer than it is designed to handle, potentially allowing instruction execution.

The 'Software Assurance Initiative' was launched in 2003 by which organization?

Department of Homeland Security

Which term describes a specific instance of a threat, such as a particular hacker like Kevin Mitnick or a specific lightning strike during a storm?

Threat Agent

In the context of information characteristics, if a user receives information that is available and uncorrupted but is not in a format meaningful to the end-user, which characteristic is missing?

Utility

During which phase of the Security Systems Development Life Cycle (SecSDLC) are the project scope, goals, and feasibility analysis first specified?

Investigation

Which specific form of espionage involves an individual viewing unauthorized information by looking over another person's shoulder in public or semipublic settings?

Shoulder Surfing

What is the primary underlying cause of SQL injection vulnerabilities in software development?

Failure to validate user input

Under the military data classification scheme, which level is defined as information whose unauthorized disclosure could reasonably be expected to cause 'serious damage' to national security?

Secret

Which community of interest is primarily focused on system creation costs, ease of use, timeliness, and transaction response time?

Information Technology Management

What does a 'timing attack' explore within a target's system?

Web Browser Cache

Statement 1: The first mainframes were developed during World War II primarily to facilitate complex computations for ballistic weapon trajectories. Statement 2: Early physical security for sensitive military locations relied on badges, keys, and facial recognition by security guards.

Statement 1 is false and statement 2 is true

Statement 1: Larry Roberts is recognized as the founder of the internet for his development of ARPANET. Statement 2: In December 1973, Robert M. Metcalfe identified fundamental security problems with ARPANET.

Both statements are true

Statement 1: Rand Report R-609 was sponsored by the Department of Commerce to define mechanisms for multi-level computer systems. Statement 2: This report marked the formal beginning of the field of Information Security.

Statement 1 is false and statement 2 is true

Statement 1: A breach of confidentiality always results in a breach of possession. Statement 2: A breach of possession always results in a breach of confidentiality.

Statement 1 is true and statement 2 is false

Statement 1: Risk analysis and the examination of legal issues are primary activities during the Logical Design phase. Statement 2: The Physical Design phase involves designing physical security measures to support technological solution.

Both statements are false

Statement 1: A virus is designed to spread from host to host and possesses the ability to replicate itself. Statement 2: A computer worm requires human interaction or a host file to spread copies of itself between computers.

Statement 1 is true and statement 2 is false

Statement 1: A 'brownout' is characterized as a short-term decrease in the quality of electrical power availability. Statement 2: A 'sag' is defined as a long-term decrease in electrical power availability.

Both statements are false

Statement 1: A Denial-of-Service (DoS) attack is primarily a breach of the integrity characteristic of information. Statement 2: In a Man-in-the-Middle (MITM) attack, the attacker can change, delete, or divert data packets.

Statement 1 is false and statement 2 is true

Statement 1: The 'transfer' control strategy involves shifting the risk to other areas or outside entities, such as through insurance or outsourcing. Statement 2: The 'mitigate' control strategy aims to reduce the impact of a successful attack through planning and preparation.

Both statements are true

Statement 1: For a policy to be legally enforceable, the organization must be able to demonstrate that employees understood its contents. Statement 2: An Issue-Specific Security Policy (ISSP) addresses the particular use of certain systems, such as firewall configurations.

Statement 1 is true and statement 2 is false

Statement 1: The Digital Millennium Copyright Act (DMCA) prohibits the altering of information attached or embedded into copyrighted material. Statement 2: The DMCA makes Internet service providers liable for all forms of copyright infringement committed by their users.

Statement 1 is true and statement 2 is false

Statement 1: Data is considered the 'lifeblood' of an organization and is the most common target of intentional attacks. Statement 2: Procedures are written instructions that, if obtained by unauthorized users, can threaten the integrity of information.

Both statements are true

Statement 1: 'Economy of mechanism' dictates that systems should be kept as simple as possible to minimize potential errors. Statement 2: 'Complete mediation' requires that access permissions are checked only during the initial login session.

Statement 1 is true and statement 2 is false

Statement 1: Pharming exploits the Domain Name System (DNS) to transform a legitimate host name into a fraudulent IP address. Statement 2: Phishing typically involves purely technical methods like Trojans and worms to modify browser address bars.

Statement 1 is true and statement 2 is false

Statement 1: Thou shalt not copy or use proprietary software for which you have not paid. Statement 2: Thou shalt not use other people's computer resources unless you can prove it causes no financial harm to them.

Statement 1 is true and statement 2 is false

Statement 1: Crisis management differs from incident response because it focuses first and foremost on the technology involved. Statement 2: A disaster recovery (DR) plan is used to enable the organization to continue operations with minimal disruption after a catastrophic event.

Statement 1 is false and statement 2 is true

A financial analyst notices that a database record for a client's portfolio shows a value of 1,250,000.50, but based on the daily transactions, the value should be exactly 1,250,000.00. While the data is whole and uncorrupted, which specific characteristic of information has been compromised?

Accuracy

During a hot summer afternoon, a data center experiences a sustained decrease in voltage that lasts for several hours. The equipment continues to run but operates at a lower efficiency, risking long-term hardware damage. How should this condition be classified?

Brownout

An employee's encrypted company laptop is stolen from a locked vehicle. The thief is unable to bypass the encryption to view the files, but the company no longer has physical control of the hardware. Which statement best describes the resulting security state?

A breach of possession has occurred, but confidentiality may remain intact.

A software developer creates an application that allows users to search for books. An attacker enters a specific string into the search bar that forces the application to reveal the entire user database. What type of software development problem does this represent?

SQL Injection

An organization determines that the cost of fully securing a legacy server against a specific vulnerability outweighs the value of the server itself. They decide to purchase a comprehensive cyber-insurance policy to cover potential losses instead. Which risk control strategy are they employing?

Transfer

A company requires all new hires to sign an acknowledgement form after attending a mandatory training session on data protection policies. This session specifically outlines what constitutes acceptable behavior and the penalties for violations. Which concept is the company fulfilling?

Due Care

An attacker notices that a web application creates a temporary file to store session data. By rapidly replacing that file with a malicious version in the milliseconds between the application's 'create' and 'read' commands, the attacker gains system access. What is this attack called?

Race Condition

Which historical development marked the official transition of computer security from simple physical access control to a sophisticated multi-level system involving organization-wide personnel and data safety?

The Rand Report R-609

A hacker uses 'pretexting' to call a help desk clerk, pretending to be a high-ranking executive who has forgotten their password. The clerk, wanting to be helpful to their superior, resets the password over the phone. Which component of the information system was exploited here?

People

An organization issues a new policy regarding the use of personal mobile devices. However, many employees continue to violate the policy because the document used overly technical legal jargon that they could not interpret. Which criteria for policy enforceability has failed?

Comprehension