IMST Information Security & Risk Management 1 — Questions and Answers
Question 1: What does the CIA triad stand for in information security?
- Cryptography, Integrity, Authorization
- Confidentiality, Integrity, Availability (Correct answer)
- Compliance, Investigation, Authentication
- Control, Identification, Accountability
Correct answer: Confidentiality, Integrity, Availability
The CIA triad is the foundational model of information security: Confidentiality (limiting access to authorized users), Integrity (ensuring data accuracy), and Availability (ensuring authorized access when needed).
Question 2: What is 'information risk management'?
- The process of eliminating all risks to information assets
- The systematic process of identifying, assessing, and treating risks to organizational information assets (Correct answer)
- A financial insurance program for data loss events
- The practice of classifying information by sensitivity level
Correct answer: The systematic process of identifying, assessing, and treating risks to organizational information assets
Information risk management involves identifying threats and vulnerabilities, assessing their likelihood and impact, and applying controls to reduce risk to an acceptable level.
Question 3: What is a 'data classification' scheme in information security?
- A method for organizing files into folders on a server
- A framework that categorizes information by sensitivity level to determine appropriate access controls and handling requirements (Correct answer)
- A database index for improving query performance
- A compliance checklist for data privacy regulations
Correct answer: A framework that categorizes information by sensitivity level to determine appropriate access controls and handling requirements
Data classification assigns labels (such as Public, Internal, Confidential, Restricted) to information based on sensitivity, guiding how data should be stored, transmitted, and shared.
Question 4: In information security risk assessment, what does 'vulnerability' refer to?
- The potential negative consequence of a security incident
- A weakness in a system, process, or control that could be exploited by a threat (Correct answer)
- An intentional attack on an information system
- The likelihood that a specific threat will materialize
Correct answer: A weakness in a system, process, or control that could be exploited by a threat
A vulnerability is a flaw or weakness (in software, hardware, processes, or people) that a threat actor could exploit to cause harm to information assets.
Question 5: Which US law specifically regulates the protection of health information?
- Sarbanes-Oxley Act (SOX)
- Health Insurance Portability and Accountability Act (HIPAA) (Correct answer)
- Gramm-Leach-Bliley Act (GLBA)
- Federal Information Security Management Act (FISMA)
Correct answer: Health Insurance Portability and Accountability Act (HIPAA)
HIPAA establishes national standards for protecting sensitive patient health information from being disclosed without the patient's consent or knowledge.
Question 6: What is 'access control' in information security?
- Physically locking server room doors
- The mechanisms and policies that regulate who can access information resources and what they can do with them (Correct answer)
- Monitoring employee internet usage
- Encrypting all data stored on organizational servers
Correct answer: The mechanisms and policies that regulate who can access information resources and what they can do with them
Access control encompasses the policies, procedures, and technical mechanisms that restrict access to information to authorized users based on their identity and role.
IMST Information Security & Risk Management 1
What does the CIA triad stand for in information security?