Fichas
SCIA 370 Chapter 3
Fichas del conjunto (20)
- 1_______________ refers to an attempt to cause fear or major disruptions in a society through hacking computers. Such attacks target government computers, major companies, or key areas of the economy. A. Cyberterrorism B. Globalization C. Nation-state attack D. Sovereign warA. Cyberterrorism
- 2Federal and state governments in the United States establish laws that define how to control, handle, share, and process the sensitive information that the new economy relies on. ___________________ are then added to these laws, which are typically written by civil servants to implement the authority of the law. A. Risk assessments B. Stakeholder reports C. Regulations D. Data privacy reportsC. Regulations
- 3The term critical infrastructure refers to key elements of the country’s transportation, energy, communications, and banking systems. Which of the following is not an example of critical infrastructure? A. power companies B. oil and gas pipelines C. large banks D. public universitiesD. public universities
- 4_____________________ in e-commerce broadly deals with creating rules on how to handle a consumer’s transaction and other information. A. Security controls B. Consumer rights C. Personal privacy D. Shareholder rightsB. Consumer rights
- 5Which of the following agencies is responsible for developing information security standards and procedures that adhere to federal law? A. The National Institute of Standards and Technology (NIST) B. The Federal Information Security Management Act (FISMA) C. Office of Management and Budget (OMB) D. Information Technology and Infrastructure Library (ITIL)A. The National Institute of Standards and Technology (NIST)
- 6In U.S. compliance laws affecting information security policies, there exists a number of concepts with matching objectives. What is the matching objective for the concept of full disclosure? A. The practice of asking permission on how personal information can be used beyond its original purpose. For example, a real estate company might ask permission of someone who sold their home if their information can be shared with a moving company. B. The concept that an organization has an obligation to the general public beyond its self-interest. It’s not unusual for regulators to look at the impact an organization has on the industry or the economy in general. C. The key idea is that the company can use information collected only for the immediate service provided, or transaction made, such as a purchase. For example, assume a bank just approved your credit card purchase of ski equipment. In most states the bank could not then share that information with someone who will try to sell you a ski vacation. D. The concept that individuals should know what information about them is being collectD. The concept that individuals should know what information about them is being collected. A company must give written notice on how it plans to use your information.
- 7To be compliant with the security standards and processes outlined in NIST publications, policies must include key security control requirements. Which of the following is not one of the key requirements? A. inventory B. data privacy C. categorize by risk level D. security controlsB. data privacy
- 8In 1999, the ___________________ is a law that came into being to repeal existing laws so that banks, investment companies, and other financial services companies could merge. A. The Health Insurance Portability and Accountability Act (HIPAA) B. The Federal Information Security Management Act (FISMA) C. The Gramm-Leach-Bliley Act (GLBA) D. The Sarbanes-Oxley (SOX) ActC. The Gramm-Leach-Bliley Act (GLBA)
- 9Which of the following is one of the challenges of the Sarbanes-Oxley (SOX) Act? A. It is difficult to require top executives to sign off on a quarterly basis that security controls meet SOX 404 requirements. B. It is very expensive and nearly impossible to test all of a company’s controls. C. The government changes the rules for SOX almost every year. D. It is difficult to write security policies that highlight key controls.B. It is very expensive and nearly impossible to test all of a company’s controls.
- 10The SOX act created the ______________________, which sets accounting and auditing standards. A. Public Company Accounting Oversight Board (PCAOB) B. Committee of Sponsoring Organizations (COSO) C. Control Objectives for Information and related Technology (COBIT) D. The Family Educational Rights and Privacy Act (FERPA)A. Public Company Accounting Oversight Board (PCAOB)
- 11The Family Educational Rights and Privacy Act (FERPA) was put into law in 1974, and contains several key elements. Which of the key elements states that schools can share information without permission for legitimate education evaluation reasons as well as for health and safety reasons? A. unblocking B. permission C. exclusions D. awarenessC. exclusions
- 12Which of the following statements best captures the reason why U.S. compliance laws came about? A. These laws recognize the power of information. B. When everyone has to follow the same rules, the playing field is level. C. These laws holds an organization accountable when breaches occur. D. The misuse and abuse of information is has major impact on the lives of individuals and their privacy.D. The misuse and abuse of information is has major impact on the lives of individuals and their privacy.
- 13Of the types of U.S. compliance laws, there are a number of laws that are designed to provide confidence in the markets. _______________ are the beneficiaries of these laws. A. Individuals B. Shareholders C. Public interest groups D. National security organizationsB. Shareholders
- 14There are many factors one must consider to ensure security policies and controls align with regulations. Which of the following is not one of the factors? A. inventory B. business requirements C. security framework D. risk assessmentD. risk assessment
- 15Of the many factors one must consider to ensure security policies and controls align with regulations; ________________________ is/are important to demonstrate coverage of regulatory requirements because they show the importance of each security control. A. evidence B. inventories C. security control mappings D. business requirementsC. security control mappings
- 16In order to be compliant with Payment Card Industry Data Security Standard (PCI DSS), one of the control objectives that should be included in one’s security policies and controls is building and maintaining a secure network. The reason for this is as follows: A. to require monitoring access to cardholder and periodic penetration testing of the network B. to specify how to maintain secure systems and applications, including the required use of antivirus software C. to require that security policies reflect the PCI DSS requirements, and that these policies are kept current and an awareness program is implemented D. to have a specific firewall, system password, and other security network layer controlsD. to have a specific firewall, system password, and other security network layer controls
- 17The Information Technology Infrastructure Library (ITIL) is a series of books that describes IT practices and procedures, and it has five core books called volumes. Which of the following is not one of the five volumes? A. service strategy B. service assessment C. service transition D. continual service improvementB. service assessment
- 18In January 2013, two important changes were made to ___________________. First, it became easier to share records with child welfare agencies. Second, the change eliminates some requirements to notify parents when school records are being released. A. the Federal Communications Commission (FCC) B. the Health Insurance Portability and Accountability Act (HIPAA) C. the Family Educational Rights and Privacy Act (FERPA) D. the Children’s Internet Protection Act (CIPA)C. the Family Educational Rights and Privacy Act (FERPA)
- 19As a result of a U.S. Supreme Court ruling challenging the restriction of access to information in libraries, the ________________ was declared constitutional. However, the courts do require schools and libraries to unblock sites when requested by an adult. A. Sarbanes-Oxley (SOX) Act B. Gramm-Leach-Bliley Act (GLBA) C. Federal Information Security Management Act (FISMA) D. Children’s Internet Protection Act (CIPA)D. Children’s Internet Protection Act (CIPA)
- 20An organization’s _________________ is a good source for determining what should be in security policies to meet regulatory requirements. A. chief information officer (CIO) B. privacy officer C. chief information security officer (CISO) D. human resources managerB. privacy officer