Information Systems MCQs with Answers
Practice important Information Systems MCQs with answers and explanations.
Chapter: 36
Q641:
In threat identification, _______ vary from human threats to natural threats.
A. threat sources
B. system functions
C. security measures
D. vulnerability sources
Correct Answer:
A
Chapter: 36
Q642:
The likelihood that a threat will exploit a vulnerability is determined in which phase?
A. Impact Analysis
B. Control Analysis
C. Likelihood Determination
D. System Characterization
Correct Answer:
C
Chapter: 36
Q643:
_______ assessment identifies potential flaws that could be exploited by threat sources in a system.
A. Risk
B. Threat
C. Vulnerability
D. Control
Correct Answer:
C
Chapter: 36
Q644:
Which of the following steps is NOT part of the SDLC phases in risk management?
A. System Characterization
B. Threat Elimination
C. Impact Analysis
D. Control Recommendation
Correct Answer:
B
Chapter: 36
Q645:
The _______ step in threat identification focuses on understanding why someone might initiate a threat against a system.
A. threat motivation
B. system characterization
C. vulnerability assessment
D. likelihood determination
Correct Answer:
A
Chapter: 36
Q646:
During system characterization, additional information that may help in characterizing includes functional requirements and _______.
A. system users
B. attack history
C. system location
D. hardware specifications
Correct Answer:
A
Chapter: 36
Q647:
_______ is the phase where potential impacts of identified risks on the system are analyzed.
A. System Characterization
B. Impact Analysis
C. Vulnerability Identification
D. Control Analysis
Correct Answer:
B
Chapter: 36
Q648:
Information on prior risk assessments and security test results is typically used as input in which phase?
A. Vulnerability Assessment
B. Control Analysis
C. Impact Analysis
D. System Characterization
Correct Answer:
A
Chapter: 36
Q649:
The _______ phase in SDLC risk management involves assessing each phase of the life cycle for potential risks.
A. system development
B. monitoring
C. implementation
D. iterative
Correct Answer:
D
Chapter: 36
Q650:
Which is NOT typically a part of System Characterization?
A. Documenting system interface
B. Identifying system hardware
C. Describing system mission
D. Conducting system attack tests
Correct Answer:
D
Chapter: 36
Q651:
What document would help identify the scope, resources, and functions of an IT system as part of risk management?
A. System Security Policy
B. System Characterization Report
C. System Configuration
D. Threat Source Report
Correct Answer:
B
Chapter: 37
Q652:
What is the purpose of Control Analysis in risk management?
A. To create new controls
B. To assess current or planned controls
C. To remove all risks
D. To increase risk impact
Correct Answer:
B
Chapter: 37
Q653:
Which type of controls includes management controls?
A. Non-technical controls
B. Technical controls
C. Hardware controls
D. Financial controls
Correct Answer:
A
Chapter: 37
Q654:
Likelihood Determination assesses the potential of what happening?
A. Threat elimination
B. Threat execution on a vulnerability
C. System upgrade
D. Security audit completion
Correct Answer:
B
Chapter: 37
Q655:
What is an example of a high likelihood scenario?
A. Controls are in place to prevent threats
B. The threat lacks motivation
C. Controls are ineffective, and the threat source is motivated
D. Threat source is neutralized
Correct Answer:
C
Chapter: 37
Q656:
In Impact Analysis, which of the following is NOT a factor?
A. System mission
B. Data criticality
C. User preferences
D. Data sensitivity
Correct Answer:
C
Chapter: 37
Q657:
The output of the Impact Analysis phase is a/an:
A. Impact rating
B. Risk report
C. Control list
D. Security audit
Correct Answer:
A
Chapter: 37
Q658:
Which phase determines the likelihood of a threat source exploiting a vulnerability?
A. Control Analysis
B. Risk Determination
C. Likelihood Determination
D. Impact Analysis
Correct Answer:
C
Chapter: 37
Q659:
Which output is expected from the Risk Determination phase?
A. Impact rating
B. Likelihood rating
C. Risk level
D. Control recommendations
Correct Answer:
C
Chapter: 37
Q660:
What factor contributes to the determination of a risk level?
A. Likelihood of threat
B. System downtime
C. Cost of controls
D. Employee training
Correct Answer:
A