CISSP Prep Quiz: Domain 1

Answer c:
Integrity is the protection of system information or processes from intentional or accidental unauthorized changes. Data analysis would usually be associated with confidentiality.

Answer b:
Pretending to be the authorized user.

Answer a:
This factor represents a measure of the magnitude of loss or
impact on the value of an asset. It is expressed as a percent, ranging from 0% to 100%, of asset value loss arising from a threat event. This factor is used in the calculation of single loss expectancy (SLE).

Answer a:
All employees must understand their basic security responsibilities.

Answer a:
Social engineering deals with individual dynamics as opposed to group dynamics, as the primary targets are help desks and/or administrative or technical support people.

Answer a:
No single employee has control of a transaction from beginning to end; two or more people should be responsible for performing it.

Answer c:
The goals of a well-prepared incident response team are to detect potential information security breaches and provide an effective and efficient means of dealing with the situation in a manner that reduces the potential impact to the corporation.

A security program focuses on protecting an organization's assets, information, and resources from unauthorized access, threats, and vulnerabilities. While user expectations are important for overall user satisfaction and experience, they are not directly addressed by a security program. The other options (A, B, and D) are all aspects that a security program can address to varying degrees.

Answer d:
Integrity depends on access controls; therefore, it is necessary to positively and uniquely identify and authorize all persons who attempt access.
Answers a and b are good but not thorough enough on their own — they are portions of a complete access control system.

Answer d:
The processes of identifying, analyzing, and assessing, mitigating, or transferring risk is generally characterized as risk management.

Answer c:
Data classification is intended to lower the cost of overprotecting all data.

Answer c:
This term characterizes the absence or weakness of a risk-reducing safeguard.

Answer c:
Ensure record retention requirements are met based on the information owner’s analysis.

Answer a:
Fundamental applications of risk assessment to be addressed
include (1) determining the current status of information security in the target environment(s) and ensuring that associated risk is managed (accepted, mitigated, or transferred) according to policy, and (2) assessing risk strategically.

Answer d:
The business units, not IT (information technology), own the
data. Decisions regarding who has what access, what classification the data should be assigned, etc., are decisions that rest solely with the business data owner and based on organization policy.

Answer b:
Policy is written at a very high level and is intended to describe the “whats” of information security. Procedures, standards, baselines, and guidelines are the “hows” for implementation of the policy.

Answer a:
The best automated tools currently available include a well researched threat population and associated statistics. Using one of these tools virtually assures that no relevant threat is overlooked.

Social engineering is a manipulation tactic used to deceive individuals into divulging confidential information or taking certain actions. While it can involve tactics like dumpster diving (searching through trash for information), coercion, or sympathy, eavesdropping typically refers to the act of secretly listening to conversations, which is a different method of information gathering rather than manipulation.