Question No: 2

We can acquire and supply information in various ways. The value of the information depends on

whether it is reliable. What are the reliability aspects of information?

A. Availability, Information Value and Confidentiality

B. Availability, Integrity and Confidentiality

C. Availability, Integrity and Completeness

D. Timeliness, Accuracy and Completeness

View Answer

Question No: 3

My user profile specifies which network drives I can read and write to. What is the name of the

type of logical access management wherein my access and rights are determined centrally?

A. Discretionary Access Control (DAC)

B. Mandatory Access Control (MAC)

C. Public Key Infrastructure (PKI)

View Answer

Question No: 4

A couple of years ago you started your company which has now grown from 1 to 20 employees.

Your companys information is worth more and more and gone are the days when you could keep

it all in hand yourself. You are aware that you have to take measures, but what should they be?

You hire a consultant who advises you to start with a qualitative risk analysis. What is a qualitative risk analysis?

A. This analysis follows a precise statistical probability calculation in order to calculate exact loss

caused by damage.

B. This analysis is based on scenarios and situations and produces a subjective view of the possible threats.

View Answer

Question No: 5

The act of taking organizational security measures is inextricably linked with all other measures that have to be taken. What is the name of the system that guarantees the coherence of information security in the organization?

A. Information Security Management System (ISMS)

B. Rootkit

C. Security regulations for special information for the government

View Answer

Question No: 6

At Midwest Insurance, all information is classified. What is the goal of this classification of information?

A. To create a manual about how to handle mobile devices

B. Applying labels making the information easier to recognize

C. Structuring information according to its sensitivity

View Answer

Question No: 7

You apply for a position in another company and get the job. Along with your contract, you are asked to sign a code of conduct. What is a code of conduct?

A. A code of conduct specifies how employees are expected to conduct themselves and is the same for all companies.

B. A code of conduct is a standard part of a labor contract.

C. A code of conduct differs from company to company and specifies, among other things, the

rules of behavior with regard to the usage of information systems.

View Answer

Question No: 8

What is a human threat to the reliability of the information on your company website?

A. One of your employees commits an error in the price of a product on your website.

B. The computer hosting your website is overloaded and crashes. Your website is offline.

C. Because of a lack of maintenance, a fire hydrant springs a leak and floods the premises.

Your employees cannot come into the office and therefore can not keep the information on the website up to date.

View Answer

Question No: 9

What is a risk analysis used for?

A. A risk analysis is used to express the value of information for an organization in monetary terms.

B. A risk analysis is used to clarify to management their responsibilities.

C. A risk analysis is used in conjunction with security measures to reduce risks to an acceptable level.

D. A risk analysis is used to ensure that security measures are deployed in a cost-effective and timely fashion.

View Answer

Question No: 10

The consultants at Smith Consultants Inc. work on laptops that are protected by asymmetrical cryptography. To keep the management of the keys cheap, all consultants use the same key pair.

What is the companys risk if they operate in this manner?

A. If the private key becomes known all laptops must be supplied with new keys.

B. If the Public Key Infrastructure (PKI) becomes known all laptops must be supplied with new keys.

C. If the public key becomes known all laptops must be supplied with new keys.

View Answer

Question No: 11

In the organization where you work, information of a very sensitive nature is processed.

Management is legally obliged to implement the highest-level security measures. What is this kind of risk strategy called?

A. Risk bearing

B. Risk avoiding

C. Risk neutral

View Answer