IMST Information Security & Risk Management

Question 1

What does the CIA triad stand for in information security?

Accepted Answer

Confidentiality, Integrity, Availability

Answer

Cryptography, Integrity, Authorization

Answer

Compliance, Investigation, Authentication

Answer

Control, Identification, Accountability

Question 2

What is 'information risk management'?

Accepted Answer

The systematic process of identifying, assessing, and treating risks to organizational information assets

Answer

The process of eliminating all risks to information assets

Answer

A financial insurance program for data loss events

Answer

The practice of classifying information by sensitivity level

Question 3

What is a 'data classification' scheme in information security?

Accepted Answer

A framework that categorizes information by sensitivity level to determine appropriate access controls and handling requirements

Answer

A method for organizing files into folders on a server

Answer

A database index for improving query performance

Answer

A compliance checklist for data privacy regulations

Question 4

In information security risk assessment, what does 'vulnerability' refer to?

Accepted Answer

A weakness in a system, process, or control that could be exploited by a threat

Answer

The potential negative consequence of a security incident

Answer

An intentional attack on an information system

Answer

The likelihood that a specific threat will materialize

Question 5

Which US law specifically regulates the protection of health information?

Accepted Answer

Health Insurance Portability and Accountability Act (HIPAA)

Answer

Sarbanes-Oxley Act (SOX)

Answer

Gramm-Leach-Bliley Act (GLBA)

Answer

Federal Information Security Management Act (FISMA)

Question 6

What is 'access control' in information security?

Accepted Answer

The mechanisms and policies that regulate who can access information resources and what they can do with them

Answer

Physically locking server room doors

Answer

Monitoring employee internet usage

Answer

Encrypting all data stored on organizational servers