CSCB433 (Information Security Assurance) section 01

 Q1: Which of these statements are used to determine the value of information assets?
a. Which information asset is the most expensive to protect?
b. Which information asset is the most expensive to protect?
c. Which information asset generates the highest profitability?
d. Which information asset is the most critical to the success of the organization? 

Solution: Which information asset is the most critical to the success of the organization?
Which information asset is the most expensive to protect?
Which information asset generates the highest profitability?
Which information asset is the most expensive to protect? 

Q2: The final step in the risk identification process is to list the assets in order of importance. Which tool is used to achieve this goal?
a. weighted factor analysis
b. Cost Benefit Analysis
c. Thread vulnerabilities assessment
d. Quality Risk Analysis

Solution: weighted factor analysis

Q3: Which of these define Mitigation Risk control strategies
a. Applying safeguards that eliminate or reduce the remaining uncontrolled risk
b. Reducing the impact if the vulnerability is exploited
c. Understanding the consequences of and accepting the risk without control
d. Shifting risks to other areas or to outside entities

Solution: Reducing the impact if the vulnerability is exploited

Q4: Which of the Risk Control Strategy selection should be chosen when we manage risk -to limit the extent of the attack
a. When the attacker’s potential gain is greater than the costs of an attack
b. When potential loss is large
c. When a vulnerability can be exploited
d. When a vulnerability exists

Solution: When potential loss is large

Q5: Which of this statement define Single loss expectancy
a. is based on the value of the asset and the expected percentage of loss that would occur from a particular attack
b. Evaluating the worth of the information assets to be protected and the loss in value if those information assets are compromised
c. is the process of comparing the projected or estimated costs and benefits
d. the probability of a threat occurring is the probability of loss from an attack within a given time frame

Solution: is based on the value of the asset and the expected percentage of loss that would occur from a particular attack

Q6: Which of the following is NOT a task in Work Breakdown Structure (WBS)
a. estimated capital and noncapital expenses
b. Identify risk
c. identification of dependencies between/among tasks
d. start and end dates

Solution: Identify risk

Q7: Which of these define the goals of project wrap-up?
You may select more than one answer.
a. draw conclusions about how to improve process
b. resolve any pending issues
c. Patching
d. critique overall project effort

Solution: resolve any pending issues,
critique overall project effort,
draw conclusions about how to improve process

Q8: Which of the following is NOT TRUE  about the Chief Information Security Officer (CISO or CSO)
a. Drafts or approves information security policies
b. Works with the CIO on strategic plans
c. Manages the overall information security program
d. Accountable for day-to-day operation of information security program

Solution: Accountable for day-to-day operation of information security program

Q9: The ISO management model is a five-layer approach that provides structure to the administration and management of networks and systems. The core ISO model addresses management and operation through five topics:
• Fault management
• Configuration and name management
• Accounting management
• Performance management
• Security management
Which of these statements define the Fault management
a. involves the physical and logical assessment of the vulnerabilities present in information systems. This is most often accomplished with penetration testing.
b. is process of reviewing use of a system, not to check performance, but to determine misuse or malfeasance; automated tools can assist
c. is the administration of the configuration of the components of the security program.
d. the process of identifying, tracking, diagnosing, and resolving faults in the system.

Solution: the process of identifying, tracking, diagnosing, and resolving faults in the system.

Q10: Which of these statements is NOT a primary deliverable of the Monitoring Process?
a. Building and maintaining an inventory of network devices and channels, IT infrastructure and applications, and information security infrastructure elements
b. Detailed intelligence on highest risk warnings
c. Periodic summaries of external information
d. Specific warning bulletins issued when developing threats and specific attacks pose measurable risk to organization

Solution: Building and maintaining an inventory of network devices and channels, IT infrastructure and applications, and information security infrastructure elements

Q11: Most audit reports contain at least three broad sections: findings, recommendation, and follow-up. Explain each section in the audit reports.

Solution: - Findings are organised according to how closely they correspond to the standard benchmark.
- Recommendations: Make recommendations on how to mitigate the risks that have been identified.
• Implementation timeline, amount of risk, and management reaction are all important considerations.
When it is essential, auditors should plan a follow-up to confirm that suggestions have been implemented by the company.

Q12: An organization needs clearly documented personnel security policies and procedures in order to facilitate the use and protection of information. For example, the organization should conduct background checks and formal termination procedures.
(a) Describe TWO (2) reasons why background checks and verifying application information for all potential employees and contractors are important.
(b) Formal termination procedures should be implemented to help protect the organization from potential lawsuits, property theft, and destruction, unauthorized access, or workplace violence. Explain THREE (3) termination procedures that should be considered by the organization.

Solution: a. Background checks may assist in reducing the likelihood of engaging in criminal activity such as assault, abuse, and theft. They may also check the facts included in an applicant's résumé or job application, and they can aid your business in determining whether or not a certain individual is the best candidate for the position.
b. 1. All logical and keycard access is cancelled before the employee is even aware of it.
2. The employee gathers all of his or her personal things and returns all keys, keycards, and other business property to the office.
3. The employee is then escorted out of the building.

Q13: List FOUR (4) essential security testing tips and explain why it is crucial to an organization's security consideration.

Solution: 1-Choose the right tool: As if you dont use the correct tool the results might be different and misleading sometimes
2-Tools make mistake : Sometimes the tools give false positives as well
3-Protect your system: The system should be updated and must be using antivirus to protect against attacks
4-Tests should be as “real” as possible , Real Attacks: The real should be as real so that the real environment can be mimicked

Q14: (a)         Calculate the risk assessment weighted score for each of the information assets.
Table 1: Information Asset Risk Assessment
Information Asset
Criterion l:
Impact on Revenue Criterion 2:
Impact on profitability
Criterion 3:
Impact on    Public Image    Weighted Score
Criterion weight    50    20    30
Alpha    0.8    0.9    0.5
Beta    0.8    0.9    0.6
Omega    0.4    0.5    0.3
Delta    1    0.6    0.4
Gamma    0.4    0.4    0.9

Solution: Alpha = (50 * 0.8) + (20*0.9) + (30 *0.5) = 40 + 18 + 15 = 73
Beta = (50 * 0.8) + (20*0.9 + (30 *0.6) = 40 + 18 + 18 = 76
Omega = (50 * 0.4) + (20*0.5) + (30 *0.3) = 20 + 10 + 9 = 39
Delta = (50 * 1) + (20*0.6) + (30 *0,4) = 50 + 12 + 12 = 74
Gamma = (50 * 0.4) + (20*0.4) + (30 *0.9) =20 + 8 + 27 =55
 

CSCB433 (Information Security Assurance) section 01 Quiz

 Q1: The access control mechanism that requires the validation and verification of an unauthenticated entity's purported identity is known as -------------------------

a. authentication
b. accountability
c. confidentiality
d. authorization

Solution: authentication 

Q2: An attribute of information that describes how data is protected from disclosure or exposure to unauthorized individuals or systems is known as ___________________

a. Privacy
b. Integrity
c. disclosure
d. Confidentiality
 

Solution: Confidentiality

Q3: Which of these statements define threat?
a. A potential weakness in an asset or its defensive control system(s).
b. An intentional or unintentional act that can damage or otherwise compromise information and the systems that support it.
c. Any event or circumstance that has the potential to adversely affect operations and assets.
d. A single instance of an information asset suffering damage or destruction, unintended or unauthorized modification or disclosure, or denial of use.

Solution: Any event or circumstance that has the potential to adversely affect operations and assets.  

Q4: ________________responsible for the security and use of a particular set of information
a. Data user
b. Data Subject
c. Data Custodian
d. Data owner
 

Solution: Data owner 

Q5: Recently, a ransomware incident was announced in the local news that could infect similar Operating Systems that are being used by your company.

 Identify THREE (3) most important assets in your company that could be affected by this malware threat.

Solution:  1. Bussiness Documents and Excel Sheets
2. Websites images and other resources 
3. Back up server files

 Q6: Explain why those assets are considered important.

Solution: 1. Bussiness Documents and Excel Sheets: All the business corresponding and financial data of the organization is stored in these documents
2. Websites images and other resources: This will damage the reputation of the company as the notice of the ransomware will be shown on the website
3. Back up server files: The backup data of the company will also not be available and nothing will be available for employees to do work on.

Q7: List at least TWO (2) vulnerabilities for each of the assets in (a) that are relevant to the malware threat. 

Solution: 1. Bussiness Documents and Excel Sheets:
+ Using Microsoft office macros.
+ By clicking links of downloaded word file
2. Websites images and other resources:
+ By SQL injection Attack
+ By OS command injection Attack
3. Back up server files:
+ Malware spreading from network
+ SMB protocol (Eternal Blue)

Q8: Identify ONE (1) possible RISK for each of the asset you listed

Solution: 1. Bussiness Documents and Excel Sheets:
Unavailability of the resources
2. Websites images and other resources:
Damage to the reputation of the company
3. Back up server files:
Unavailability of the resources 

System Security Defense Quiz

Question 1: What is the MOST IMPORTANT reason to have detailed documentation of what happens during an incident?
a. To improve the security posture of the organization
b. To know which member of the response team is the most valuable contributor
c. To provide proof that can be taken to court
d. To identify where the attack is coming from

Solution:  To improve the security posture of the organization

Question 2:  The most likely reason humans are considered the weakest link is:
a. Humans are stubborn
b. Humans have emotion
c. Humans talk too much
d. Human can't be trusted

Solution: Humans have emotion

Question 3: The success factor of an attacker could be of the following, EXCEPT
a. They use the victim's red team
b. They patiently studied their target
c. They breach and observe
d. They are persistent

Solution: They use the victim's red team

Question 4: The following could be the cause for failure in detection of threats and incidents, EXCEPT:
a. Unpatched hosts
b. Untrained users
c. Zero-day attack
d. Hiring external consultant as incident responders

Solution: Hiring external consultant as incident responders

Question 5: If an incident has happened, and you need to bring the criminal to justice, which of the following is most important for your response team?
a. The user credential of the witness or victim
b. The availability of the jury
c. The confidentiality of the court's hearing date
d. The integrity of the incident's data

Solution: The integrity of the incident's data

Question 6: The following are good location to place sensors or detectors of intrusion EXCEPT
a. The users
b. The internal network
c. The external network
d. The hosts

Solution: The users

Question 7: Why is it important to perform self assessment before defining the incident response process?
a. Threats could be stopped before it happens
b. Critical asset and resources could be defined
c. Zero-day could be prevented
d. Estimation of the time of attack could be made

Solution: Critical asset and resources could be defined

Question 8: After knowing which assets to protect, a requirement that could assist us to identify breach or incident is:
a. Knowing how much those assets costs
b. Identifying the baseline and normal occurrences of those assets
c. Installing security control that could protect the assets from risks
d. Hiring consultants to assess the assets to get a second opinion

Solution: Identifying the baseline and normal occurrences of those assets 

Question 9: The best practice if we adopt the ASSUME BREACH approach in handling security incident means:
a. Form the purple team to manage the red and blue team
b. We are ready, learn and adapt for security incident
c. We use cloud computing services to distribute the security team
d. We constantly attack and defend our organization's security control

Solution: We are ready, learn and adapt for security incident

Question 10: Which of the following is an example of defense in depth implementation?
a. Defense is embedded deep within the OSI layers and technology
b. Considering security implementation from the users, hosts and systems perspective
c. Protection and defense is so strong that the asset is impenetrable to risk and threats
d. Situation where the attacker can't penetrate and harm the asset because of the layers of security defense

Solution: Considering security implementation from the users, hosts and systems perspective

Buddhism Quiz

Q1: The following statements are correct about Shinto EXCEPT
a. the belief in sacred spirits of nature
b. the indigenous faith of the Japanese people
c. Propaganda and preaching are not common
d. It has a founder and sacred scripture

Solution: It has a founder and sacred scripture

Q2: The twin concepts of jen and li are often said to constitute the basis of Confucianism
Select one:
True
False

Solution: True

Q3: Those are the basic doctrines of Buddha teachings EXCEPT
a. nothing is fixed or permanent
b. actions have consequences
c. emphasis on devotion rather than sacrifice
d. change is possible

Solution: emphasis on devotion rather than sacrifice

Q4: Which of the following statement is NOT TRUE about Theravada, one of schools of Buddhism.
a. Theravada monks follow the practices that have been passed down by the senior monks from the Buddha's time, such as living in the forests and meditating.
b. Theravada is practiced mainly in southern Asian countries such as Sri Lanka, Thailand and Myanmar
c. Theravada means 'the teaching of the Elders'.
d. The goal in Theravada Buddhism is to become an 'Bodhisattva'

Solution: The goal in Theravada Buddhism is to become an 'Bodhisattva'

Q5: What is the purpose of most Shinto rituals?
a. to keep away evil spirit
b. to get blessing from God
c. to show the kami the outside world
d. to gain good life

Solution: to keep away evil spirit

Q6: Who is Buddha mother's name?
a. Śuddhodana
b. Māyādevī
c. Kapilavastu
d. Gautama

Solution: Māyādevī

Q7: The word Confucianism seems to be the creation of European Christians who entered Korea about 1860 CE and was originally used to label their notion of the non-Christian religions they came across in Korea.
Select one:
True
False

Solution: False

Q8: Which of the following is NOT the meaning of Jen (wren)?
Select one:
a. benefit
b. human heartedness
c. benevolence
d. goodness

Solution: benefit

Q9: One of the concept of Confucius is Hsiao. Which of the following is NOT TRUE on the meaning of reverence in Confucianism?
a. bring honor to the family since they have sacrificed much for you
b. Parents are revered because they are the source of your life
c. One should do well and make the family name known and respected
d. revered someone you love who you admire most among the outsiders

Solution: revered someone you love who you admire most among the outsiders

Q10: There are few instruments used in Buddhism ceremonies and meditation. Below are the list, EXCEPT
Select one:
a. bowls
b. Drums
c. Gongs
d. Wooden fish

Solution: bowls

Q11: During Meiji Period, Shinto is considered as state officials religion. Which of the following is NOT TRUE on this statement.
a. important shrines receive governmental funding
b. Shinto priests became state officials
c. The Shinto governor must be from man
d. Japan's creation myths were used to foster a national identity with the Emperor at its center

Solution: The governor must be from man

Q12: The Buddha explained that people live in a sea of suffering because of
Select one:
a. Perception and arrogant
b. Pleasures and happiness
c. Ignorance and greed
d. Desire and courage

Solution: Ignorance and greed

What effect does a binding minimum wage have on a monopsony labor market?

 Question: What effect does a binding minimum wage have on a monopsony labor market?

Solution: A monopsony labor market is a type of market structure where there is one employer and many laborers looking for work with that employer.

Minimum wage rate in a monopsony labor market will cause firms to still operate at the point marginal factor cost curve equals marginal revenue product curve.

When firms are forced to pay a set minimum wage, MRP increases because of increased output along with increase in costs. This will result in increased employment.

Unlike competitive firms, where employment falls due to minimum wage, in case of monopsony, it increases.

When is a firm’s shutdown point equal to the minimum point on its average cost curve?

 Question: When is a firm’s shutdown point equal to the minimum point on its average cost curve?

Solution: A firm’s shutdown point is equal to the minimum point on its average cost curve in the short run. This is because the average cost comprises of the sum of average fixed cost and the average variable cost. The average fixed cost has to be incurred by the firm even if the firm makes no business. Thus when a firm shuts down in the short run it will equal to the minimum point on its average cost curve.

Cybersecurity Awareness Training Quiz

Question 1: Cyber criminals only target big businesses.
True
False

Solution: False

Question 2: Cybersecurity awareness is only for IT and technical people.
True
False

Solution: False

Question 3: Technology alone can protect me from internet dangers.
True
False

Solution: False

Question 4: Backups are an important part of cybersecurity.
True
False

Solution: True

Question 5: Operating systems are the only updates I need to worry about.
True
False

Solution: False

Question 6: Microsoft recommends using Internet Explorer to browse the internet.
True
False

Solution: False

Question 7: Password managers can store difficult to remember passwords.
True
False

Solution: True

Question 8: I should use a separate password for every account I have.
True
False

Solution: True

 Question 9: The name of your pet or child makes a great password.
True
False

Solution: False

Question 10: I only need to worry about links sent through email.
True
False

Solution: False

Question 11: I can open attachments because my anti-virus will catch anything malicious.
True
False

Solution: False

 Question 12: Attackers will often use...
Select all answers that apply (more than one)
spoofed phone numbers
a sense of urgency
hacked accounts or devices of people you know
none of these

Solution: spoofed phone numbers
a sense of urgency
hacked accounts or devices of people you know

Question 13: I can safely plug in a USB drive I found in the parking lot.
True
False

Solution:  False

Question 14: Encryption can be used by both the good guys and the bad guys.
True
False

Solution: True

Question 15: A green padlock means a website is legitimate and safe to input your user credentials.
True
False

Solution: False

Question 16: Sharing photos while on vacation can tip off criminals that you are not home.
True
False

Solution: True

Question 17: Microsoft or Apple might call you in extreme circumstances when your computer is compromised.
True
False

Solution: False

Question 18: A caller's phone number (called ID) is a great way to verify who they are.
True
False

Solution: False