Information Systems MCQs with Answers
Practice important Information Systems MCQs with answers and explanations.
Chapter: 29
Q521:
Fill in the blank: The primary step in determining what needs to be protected is _______.
A. Threat analysis
B. Identifying assets
C. Policy development
D. Risk assessment
Correct Answer:
B
Chapter: 29
Q522:
Which of the following defines a threat?
A. An unauthorized access attempt
B. A potential loss
C. A security breach
D. A virus
Correct Answer:
B
Chapter: 29
Q523:
The ranking of assets helps to determine what?
A. Their usability
B. Their importance
C. Their cost
D. Their age
Correct Answer:
B
Chapter: 30
Q524:
What is the purpose of threat identification in information security?
A. Minimize hardware cost
B. Identify potential threats
C. Install new software
D. Increase database speed
Correct Answer:
B
Chapter: 30
Q525:
Physical threats to information systems can include which of the following?
A. Fire
B. Viruses
C. Logical intrusion
D. Unauthorized access
Correct Answer:
A
Chapter: 30
Q526:
Which type of threat refers to damage caused to software and data without physical presence?
A. Physical threat
B. Logical threat
C. Environmental threat
D. Structural threat
Correct Answer:
B
Chapter: 30
Q527:
Which of the following is a preventive control in information security?
A. Audit trails
B. Encryption
C. Intrusion detection
D. All of the above
Correct Answer:
B
Chapter: 30
Q528:
What does a risk assumption entail in risk mitigation?
A. Avoiding risk
B. Accepting risk
C. Transferring risk
D. Increasing controls
Correct Answer:
B
Chapter: 30
Q529:
________ controls inhibit attempts to violate security policy and include access control enforcement and encryption.
A. Detective
B. Preventive
C. Corrective
D. Reactive
Correct Answer:
B
Chapter: 30
Q530:
Which step involves analyzing controls that have been implemented to minimize or eliminate threat likelihood?
A. Threat Identification
B. Control Analysis
C. Risk Exposure Analysis
D. Control Adjustment
Correct Answer:
B
Chapter: 30
Q531:
Which of the following describes a loss of data confidentiality?
A. Data corruption
B. Unauthorized data access
C. Data modification
D. Data deletion
Correct Answer:
B
Chapter: 30
Q532:
What factor does NOT influence the computation of expected loss in exposure analysis?
A. Threat occurrence chance
B. Probability of threat success
C. Potential impact of loss
D. Current staff size
Correct Answer:
D
Chapter: 30
Q533:
Which formula component represents the percentage chance of threat occurrence?
A. A
B. B
C. C
D. D
Correct Answer:
B
Chapter: 30
Q534:
What does an impact analysis report assess in a business setting?
A. Data sensitivity
B. Potential adverse effects
C. Probability of threat occurrence
D. System reliability
Correct Answer:
B
Chapter: 30
Q535:
Which control method includes techniques like encryption and authentication?
A. Preventive
B. Detective
C. Reactive
D. Responsive
Correct Answer:
A
Chapter: 30
Q536:
Risk transference as a mitigation strategy is best achieved through which option?
A. Encryption
B. Insurance
C. Access control enforcement
D. Avoiding software risks
Correct Answer:
B
Chapter: 30
Q537:
Which step in exposure analysis involves interviewing employees?
A. Impact analysis
B. Risk assessment
C. Control adjustment
D. Exposure analysis
Correct Answer:
D
Chapter: 30
Q538:
Which type of control helps warn of potential security policy violations?
A. Preventive
B. Detective
C. Inhibitive
D. Corrective
Correct Answer:
B
Chapter: 30
Q539:
What is an example of non-technical control in security?
A. Firewalls
B. Intrusion detection software
C. Security policy enforcement
D. Encryption
Correct Answer:
C
Chapter: 30
Q540:
What is the primary goal of control adjustment?
A. Reduce threat probability
B. Increase system access
C. Strengthen user access
D. None of the above
Correct Answer:
A