Issep

Front 1

IATF document 3.1 lists the following types of attacks

Back 1

Passive

Active

Close-in

Insider

Distribution

Front 2

Which one of the following is not one of the five system life cycle planning phases as defined in NIST SP 800-14?

1. Initiation phase
2. Requirements phase
3. Implementation phase
4. Disposal phase

Back 2

2. requirements phase

IDIOD

Front 3

Acquisition Cycle phases as given in NIST SP 800-64, "Security Considerations in the Information System Development Life Cycle"?

Back 3

Mission and business planning, acquisition planning, contract performance, disposal and contract closeout

Front 4

The IATF document 3.1 stresses that information assurance relies on three critical components. Which one of the following answers correctly lists these components?

Back 4

People, operations, technology

POT

Front 5

Risk management, as defined in NIST SP 800-30, comprises which three processes?

Back 5

Risk assessment, risk mitigation, and evaluation and assessment

Front 6

In the system development life cycle (SDLC), or system life cycle as it is sometimes called, in which one of the of the five phases are the system security features configured, enabled, tested, and verified?

1. Operation/maintenance
2. Development/acquisition
3. Implementation
4. Initiation

Back 6

Implementation

Front 7

Which one of he following activities is performed in the Development/Acquisition phase of the SDLC?

1. The scope of the IT system is documented.
2. The IT system is developed, programmed, or otherwise constructed.
3. The system performs its function.
4. Information, hardware, or software is disposed of.

Back 7

Answer: b

Answer a refers to the Initiation phase, answer c refers to the Operation/Maintenance phase, and answer d refers to the Disposal phase.

Front 8

In NIST SP 800-30, risk is defined as a function of which set of the following items?

1. Threat likelihood, vulnerabilities, and impact
2. Threat likelihood, mission, and impact
3. Vulnerabilities, mission and impact
4. Threat likelihood, sensitivity, and impact

Back 8

Answer: a

Answers b, c, and d are distracters.

Front 9

The risk assessment methodology described in NIST SP 800-30 comprises nine primary steps. Which one of the following is not one of these steps?

1. System characterization
2. Control analysis
3. Impact analysis
4. Accreditation boundaries

Back 9

Answer: d

Delineating accreditation boundaries is a subset of system characterization (answer a).

Front 10

Which one of the following items is not one of the activities of the generic systems engineering (SE) process?

1. Discover needs
2. Define system requirements
3. Obtain accreditation
4. Assess effectiveness

Back 10

Answer: c

Obtaining accreditation is not one of the SE process activities. The other SE process activities are to design system architecture, develop detailed design, and implement system.

Front 11

The elements Discover information protection needs, Develop detailed security design, and Assess information protection effectiveness are part of what process?

1. The systems engineering (SE) process
2. The information systems security engineering process (ISSE)
3. The system development life cycle (SDLC)
4. The risk management process

Back 11

The information systems security engineering process (ISSE)

Front 12

In the ISSE process, information domains are defined under the Discover Information Protection Needs process. Which one of the following tasks is not associated the information domain?

1. Identify the members of the domain.
2. List the information entities that are under control in the domain.
3. Identify the applicable privileges, roles, rules, and responsibilities of the users in the domain.
4. Map security mechanisms to security design elements in the domain.

Back 12

Map security mechanisms to security design elements in the domain.

This task is performed under the Develop Detailed Security Design activity.