Information Security Management Flashcards

Question 1

What does the confidentiality principle require in information security?

Accepted Answer

Confidentiality requires that information be accessible only to authorized people, processes, or systems. Organizations protect it with measures such as access controls, encryption, and classification labels. A breach occurs when sensitive data reaches someone who should not see it, such as a customer list exposed publicly.

Question 2

How do integrity and availability differ from confidentiality in the CIA triad?

Accepted Answer

Integrity means data is accurate, complete, and unaltered except by authorized changes, while availability means authorized users can reach systems and data when needed. Confidentiality concerns who can read information. Integrity concerns whether information can be trusted, and availability concerns whether it can be used. Together these three properties form the CIA triad.

Question 3

What is the difference between a threat, a vulnerability, and a risk?

Accepted Answer

A threat is any potential cause of harm, such as an attacker, malware, or a natural disaster. A vulnerability is a weakness that a threat could exploit, such as an unpatched server. Risk is the likelihood that a threat exploits a vulnerability, multiplied by the impact if it does.

Question 4

Why is the principle of least privilege considered a foundational security practice?

Accepted Answer

The principle of least privilege means each user, program, or process receives only the minimum access needed to perform its legitimate function. This limits the damage from mistakes, compromised accounts, and malicious insiders. Access should be reviewed regularly, and temporary elevated rights should be removed when the task ends.

Question 5

What is defense in depth, and why do security professionals use it?

Accepted Answer

Defense in depth is a strategy that layers multiple independent security controls so that if one control fails, others still protect the asset. Layers may include locks, firewalls, encryption, and training. Professionals use it because no single control is perfect, and attackers who bypass one layer must still overcome the next.

Question 6

What does the term authentication mean, and how does it differ from authorization?

Accepted Answer

Authentication is the process of verifying that a person or system is who or what it claims to be, such as through a password or fingerprint. Authorization happens afterward and determines which actions that verified identity is allowed to perform. A user may be authenticated yet denied access to a restricted file.

Question 7

What are the three main categories of security controls, and what does each do?

Accepted Answer

The three main categories are administrative, technical, and physical controls. Administrative controls include policies, training, and procedures that guide behavior. Technical controls use hardware or software, such as firewalls, encryption, and access systems, to enforce protection. Physical controls, such as locks, guards, and cameras, protect facilities and equipment from direct access.

Question 8

What is social engineering, and why does it target people rather than systems?

Accepted Answer

Social engineering is the manipulation of people into revealing information or performing actions that weaken security, such as sharing a password or opening a malicious attachment. It targets people because human judgment can be influenced by urgency, trust, and authority. Training and clear verification steps reduce its success.

Question 9

What are the main steps in a basic risk management process?

Accepted Answer

A basic risk management process identifies assets, threats, and vulnerabilities, analyzes the likelihood and impact of each risk, evaluates risks against tolerance levels, and treats them through mitigation, transfer, acceptance, or avoidance. The process then continues through monitoring and review, because risks change as systems, threats, and business needs evolve.

Question 10

What is the difference between qualitative and quantitative risk analysis?

Accepted Answer

Qualitative risk analysis rates risks using descriptive categories such as low, medium, and high, based on expert judgment. Quantitative risk analysis assigns numeric values, such as estimated financial loss or annual probability, to produce calculated figures. Teams often combine both, using quantitative estimates for high-priority risks.

Question 11

What are the four common ways an organization can treat a risk?

Accepted Answer

The four risk treatment options are mitigation, transfer, acceptance, and avoidance. Mitigation lowers likelihood or impact through controls. Transfer shifts part of the burden to another party, such as an insurer. Acceptance means keeping a risk because treatment would cost more than the potential loss. Avoidance eliminates the risk by not performing the activity.

Question 12

What does a risk register contain, and why do organizations maintain one?

Accepted Answer

A risk register is a central record that lists each identified risk, its owner, its likelihood and impact ratings, the current controls, and the planned treatment. Organizations maintain one so that risks are tracked, prioritized, and reviewed over time instead of being forgotten after a single assessment.

Question 13

What is residual risk, and how is it different from inherent risk?

Accepted Answer

Residual risk is the level of risk that remains after controls have been applied. Inherent risk is the level that exists before any controls are added. Organizations compare residual risk against their risk tolerance to decide whether the remaining exposure is acceptable or needs further treatment.

Question 14

What is a risk appetite statement, and how does it relate to risk tolerance?

Accepted Answer

A risk appetite statement describes, at a high level, how much risk an organization is willing to pursue in order to achieve its objectives. Risk tolerance is more specific, defining the acceptable variation around a particular objective or metric, such as the maximum downtime allowed for a critical service.

Question 15

What is a risk assessment matrix, and how do teams use it?

Accepted Answer

A risk assessment matrix is a grid that plots likelihood on one axis and impact on the other, producing a rating for each risk, often labeled low, medium, or high. Teams use it to compare risks side by side and decide which ones need attention first. Its ratings depend on well-defined scales.

Question 16

What is a vulnerability scan, and how does it differ from a penetration test?

Accepted Answer

A vulnerability scan is an automated check that identifies known weaknesses in systems, software, and configurations. A penetration test is an authorized, hands-on attempt by a tester to exploit weaknesses and show what an attacker could actually achieve. Scans are broad and repeatable, while penetration tests are deeper and more targeted.

Question 17

What is the difference between a security policy, a standard, and a procedure?

Accepted Answer

A security policy is a high-level statement that defines what the organization requires and why. A standard sets specific, mandatory requirements, such as a minimum password length, that support the policy. A procedure is a step-by-step set of instructions that people follow to carry out a task in line with those standards.

Question 18

Why does effective security governance require support from senior leadership?

Accepted Answer

Senior leadership sets the direction, provides funding, and assigns accountability. Without executive backing, policies are often ignored, budgets are cut, and security teams lack the influence to enforce requirements across business units. Governance works only when leaders treat security as a business risk rather than a purely technical task.

Question 19

What are the main elements that a clear acceptable use policy should address?

Accepted Answer

An acceptable use policy should state which systems and data users may access, what activities are permitted or prohibited, and how personal use of company resources is handled. It should also explain user responsibilities for protecting credentials, reporting incidents, and handling sensitive information. Finally, it should describe consequences for violations.

Question 20

What is the purpose of a data classification scheme?

Accepted Answer

A data classification scheme groups information into levels, such as public, internal, confidential, and restricted, based on how sensitive it is and how much harm disclosure would cause. Each level then determines required handling rules, including storage, sharing, and disposal methods. Classification helps staff apply protection consistently.

Question 21

Why do organizations need a formal process for policy exceptions?

Accepted Answer

Organizations need a formal exception process because some business needs cannot meet every policy requirement immediately or at all. The process requires a documented justification, a stated risk, a named approver, a compensating control, and an expiration date. This keeps deviations visible and controlled, instead of letting unofficial workarounds accumulate unnoticed.

Question 22

What is separation of duties, and why does it reduce fraud and error?

Accepted Answer

Separation of duties divides a critical task among two or more people so that no single individual can complete it alone. For example, the person who approves a payment should not also be the person who releases it. Because no one person controls the whole process, fraud and errors are harder to hide.

Question 23

What role does a security awareness program play in governance?

Accepted Answer

A security awareness program communicates policies and teaches employees to recognize common threats, such as phishing, unsafe file sharing, and weak passwords. It turns written policy into everyday behavior, which governance depends on. Programs work best when they are repeated, role-specific, and measured, so leaders can see whether behavior is actually changing.

Question 24

What is the purpose of a security audit, and who usually performs one?

Accepted Answer

A security audit independently examines whether controls, policies, and processes exist, operate as designed, and meet stated requirements. Internal audit teams often perform audits for management, while external auditors may be engaged to provide an impartial opinion. Audit findings lead to corrective action plans with assigned owners and deadlines.

Question 25

What is the difference between preventive, detective, and corrective controls?

Accepted Answer

Preventive controls stop an incident before it occurs, such as a firewall rule or a locked door. Detective controls identify that an incident is happening or has happened, such as log monitoring or an intrusion alert. Corrective controls restore systems and reduce damage after an incident, such as restoring from backup.

Question 26

Why should organizations use change management for security-relevant system changes?

Accepted Answer

Change management provides a documented, reviewed process for proposing, approving, testing, and recording changes, so that unauthorized or poorly tested changes do not weaken security. Documentation also helps responders trace what changed when a problem appears. Reviews also catch mistakes before they reach production systems.

Question 27

What is a security baseline, and why do organizations apply one to new systems?

Accepted Answer

A security baseline is a documented set of minimum configuration settings for an operating system, application, or device, such as disabling unused services and requiring strong authentication. Organizations apply baselines to new systems so that every deployment starts from a known, hardened state rather than default settings that may be insecure.

Question 28

What is a security control framework, and what problem does it solve?

Accepted Answer

A security control framework is a structured collection of recommended or required safeguards, organized by objective. It helps organizations decide which safeguards to adopt and how to show coverage, instead of building an ad hoc list. Common examples include the NIST Cybersecurity Framework and the CIS Controls.

Question 29

What is an attack surface, and how can an organization reduce it?

Accepted Answer

An attack surface is the set of points where an unauthorized user could try to enter or extract data from a system, including open network ports, exposed applications, user accounts, and physical access points. An organization reduces it by removing unused services, closing unnecessary ports, limiting exposure to the internet, and minimizing who holds administrative rights.

Question 30

What is encryption at rest, and how does it differ from encryption in transit?

Accepted Answer

Encryption at rest protects stored data on disks, databases, backups, and removable media so that it is unreadable without the proper key. Encryption in transit protects data as it moves across networks, typically through protocols such as TLS. Both are needed because data can be exposed while stored and while moving between systems.

Question 31

What is multifactor authentication, and why is it stronger than a password alone?

Accepted Answer

Multifactor authentication requires two or more different types of evidence before granting access, such as something you know, something you have, or something you are. It is stronger than a password alone because an attacker who steals or guesses one factor still lacks the others.

Question 32

What is the purpose of logging and log review in a security program?

Accepted Answer

Logging records events such as logins, configuration changes, and access to sensitive data, creating evidence that supports detection and investigation. Log review means someone or something examines those records regularly to spot unusual or unauthorized activity. Logs are only useful if they are protected from tampering and reviewed in time to act.

Question 33

What are the main phases of an incident response lifecycle?

Accepted Answer

A common incident response lifecycle includes preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Preparation builds the people, tools, and procedures needed before an event occurs. Each later phase depends on that groundwork, and the final lessons learned step feeds improvements back into preparation.

Question 34

What is the difference between an event and an incident?

Accepted Answer

An event is any observable occurrence in a system or network, such as a login attempt or a file change. An incident is an event, or a series of events, that actually or potentially harms the confidentiality, integrity, or availability of information. Triage sorts events to find incidents.

Question 35

Why is containment important during an active security incident?

Accepted Answer

Containment limits the spread of an incident so that attackers cannot move further into the environment or cause additional damage. Short-term containment might isolate an infected host, while long-term containment could involve rebuilding systems or blocking malicious addresses. Responders must balance speed with preserving evidence needed for later investigation.

Question 36

What is the purpose of an incident response plan, and what should it include?

Accepted Answer

An incident response plan is a documented guide that tells staff how to detect, report, assess, and respond to security incidents in an orderly way. It should name roles and contact information, define severity levels and escalation paths, list communication requirements, and describe how evidence is collected.

Question 37

What does digital forensics preserve, and why does chain of custody matter?

Accepted Answer

Digital forensics preserves and analyzes electronic evidence, such as disk images, memory captures, and logs, in a way that keeps the data unaltered. Chain of custody is a documented record of who handled evidence, when, and for what purpose. It matters because evidence is more credible when its handling can be fully accounted for.

Question 38

What is a business continuity plan, and how does it differ from a disaster recovery plan?

Accepted Answer

A business continuity plan describes how an organization keeps critical functions running during and after a disruption, covering people, processes, facilities, and suppliers. A disaster recovery plan focuses more narrowly on restoring IT systems and data to an acceptable state after a disruption. Disaster recovery is typically one component within the broader continuity effort.

Question 39

What are recovery time objective and recovery point objective, and how do they differ?

Accepted Answer

Recovery time objective is the maximum acceptable length of time a system can be down before service must be restored. Recovery point objective is the maximum acceptable amount of data loss, measured as the time between the last usable backup and the disruption. Together they guide decisions about backup frequency and recovery investments.

Question 40

What should happen during the lessons learned review after an incident?

Accepted Answer

The team reviews what happened, how it was detected, what worked, what failed, and what changes would prevent or speed up a similar response. The review should focus on processes and systems rather than assigning blame to individuals. Agreed actions need named owners and deadlines, and their completion should be tracked.

Information Security Management Flashcards

1Foundations of Information Security

2Risk Assessment and Treatment

3Policies and Governance

4Controls and Security Frameworks

5Incident Response and Continuity

Learning Resources