Information Security MCQs with Answers
Practice important Information Security MCQs with answers and explanations.
Chapter: 26
Q501:
Which type of policy addresses specific implementations like email usage?
A. General security policy
B. Program security policy
C. Issue-specific policy
D. Systems-specific policy
Correct Answer:
C
Chapter: 26
Q502:
What is an example of a systems-specific policy?
A. Email use policy
B. Firewall configuration policy
C. Internet access policy
D. General security guidelines
Correct Answer:
B
Chapter: 26
Q503:
What does documenting the results of risk assessment involve?
A. Ranking vulnerabilities by their likelihood
B. Identifying threats only
C. Recording information asset values only
D. Preparing a ranked vulnerability risk worksheet
Correct Answer:
D
Chapter: 26
Q504:
What should be included in the ranked vulnerability risk worksheet?
A. Asset, Asset Impact, Vulnerability, Vulnerability Likelihood, Risk-Rating Factor
B. Asset Impact only
C. Controls and safeguards only
D. Vulnerability categories only
Correct Answer:
A
Chapter: 26
Q505:
Which worksheet provides details on asset impact and vulnerability likelihood?
A. Risk assessment worksheet
B. Ranked vulnerability risk worksheet
C. Control measures worksheet
D. Threat analysis worksheet
Correct Answer:
B
Chapter: 26
Q506:
How should a risk assessment document be used after completion?
A. For initial risk identification
B. For creating security policies
C. As a basis for risk management and control
D. For asset inventory only
Correct Answer:
C
Chapter: 26
Q507:
What does a risk-rating factor represent?
A. The calculated figure from asset impact multiplied by likelihood
B. The number of vulnerabilities assessed
C. The overall asset value
D. The total number of controls implemented
Correct Answer:
A
Chapter: 26
Q508:
Which type of control involves security education and training programs?
A. Policies
B. Programs
C. Technologies
D. Procedures
Correct Answer:
B
Chapter: 26
Q509:
What is the recommended likelihood rating for very high-risk scenarios?
A. 0.1
B. 0.5
C. 0.8
D. 1
Correct Answer:
D
Chapter: 26
Q510:
How should likelihood values be selected for risk assessment?
A. Based on historical data and external references
B. Using arbitrary numbers
C. From standard risk tables
D. By guessing based on experience
Correct Answer:
A
Chapter: 27
Q511:
What are the five basic strategies for controlling risks?
A. Defend, Transfer, Mitigate, Accept, Terminate
B. Assess, Control, Avoid, Monitor, Terminate
C. Defend, Monitor, Evaluate, Accept, Transfer
D. Defend, Avoid, Transfer, Evaluate, Mitigate
Correct Answer:
A
Chapter: 27
Q512:
What strategy involves shifting risk to other processes or organizations?
A. Defend
B. Transfer
C. Mitigate
D. Accept
Correct Answer:
B
Chapter: 27
Q513:
Which control strategy aims to reduce the impact of vulnerability exploitation?
A. Defend
B. Transfer
C. Mitigate
D. Terminate
Correct Answer:
C
Chapter: 27
Q514:
What does the acceptance strategy involve?
A. Reducing the impact of vulnerabilities
B. Avoiding risky activities
C. Understanding consequences and accepting the risk
D. Transferring risk to another entity
Correct Answer:
C
Chapter: 27
Q515:
Which strategy would involve implementing security controls to prevent exploitation?
A. Defend
B. Transfer
C. Mitigate
D. Accept
Correct Answer:
A
Chapter: 27
Q516:
What is the primary goal of the terminate strategy?
A. To accept risks without controls
B. To avoid business activities with uncontrollable risks
C. To transfer risk to an outside party
D. To reduce the impact of vulnerabilities
Correct Answer:
B
Chapter: 27
Q517:
What are the common methods used in the defend strategy?
A. Policy, Education, Technology
B. Insurance, Outsourcing, Contracts
C. Training, Outsourcing, Risk Management
D. Policies, Risk Analysis, Insurance
Correct Answer:
A
Chapter: 27
Q518:
What is a common method used in the mitigation strategy?
A. Incident Response Plan
B. Outsourcing
C. Insurance
D. Transference
Correct Answer:
A
Chapter: 27
Q519:
What does the cost benefit analysis (CBA) formula measure?
A. Cost avoidance and control effectiveness
B. The cost of implementing security measures
C. The annualized loss expectancy and safeguard cost
D. The impact of vulnerability on asset value
Correct Answer:
C
Chapter: 27
Q520:
What should be included in the risk control strategy selection process?
A. Assessing risk appetite
B. Choosing a technology solution
C. Selecting between defend, transfer, mitigate, accept, terminate
D. Outsourcing decision criteria
Correct Answer:
C