Quiz: Information Security and Continuity Planning — 32 questions

1. What is the primary purpose of information security within an organization?

A. To eliminate every security issue before it can affect resources

B. To evaluate business decisions that remain after controls are applied

C. To protect valuable resources and keep them available when needed

D. To assign operational tasks to users who access organizational systems

Answer: (C)

Explanation

Information security protects an organization’s valuable resources and helps ensure that they are available when needed. Risk management, rather than information security itself, addresses security issues that cannot be completely eliminated.

2. Which set correctly identifies the three basic requirements of information security?

A. Classification, custody, and regulatory compliance

B. Availability, integrity, and confidentiality

C. Identification, authentication, and authorization

D. Privacy, accountability, and risk management

Answer: (B)

Explanation

The core requirements are availability, integrity, and confidentiality. Identification, authentication, and authorization are related security functions but are not the three basic requirements.

3. A company ensures that authorized employees can reach a required system during working hours; which security requirement is being addressed?

A. Availability

B. Accountability

C. Integrity

D. Confidentiality

Answer: (A)

Explanation

Availability means that a computer system can be accessed by authorized users whenever it is needed. Confidentiality would instead address preventing unauthorized people from viewing protected information.

4. Which control objective is concerned with preventing intentional or accidental unauthorized changes to system information?

A. Availability

B. Identification

C. Confidentiality

D. Integrity

Answer: (D)

Explanation

Integrity protects information from unauthorized modification, whether the change is deliberate or accidental. Availability concerns access to systems, while confidentiality concerns unauthorized disclosure.

5. Why does an organization classify information instead of applying identical protection to every data set?

A. Classification directs stronger controls toward information with greater value or risk

B. Classification replaces privacy and regulatory obligations with internal labels

C. Classification assigns every data set the same level of protection for consistency

D. Classification allows users to determine controls without owner or supervisor involvement

Answer: (A)

Explanation

Classification focuses protection and control on data that needs it most because information does not have equal organizational value. Treating every data set as equally important is the uniform-protection approach that classification avoids.

6. Which description best distinguishes private information from confidential information in a private-sector classification scheme?

A. Private information concerns regulatory records, while confidential information describes employee identity claims

B. Private information supports company use, while confidential information is highly sensitive and harmful if disclosed

C. Private information requires the strongest controls, while confidential information has limited business value

D. Private information is available publicly, while confidential information is intended for routine company use

Answer: (B)

Explanation

Private information is intended for company use, such as salary levels, whereas confidential information is highly sensitive and unauthorized disclosure could seriously harm the company. Public information is the category associated with broad availability.

7. Which activity belongs in a complete information-classification procedure?

A. Assigning protection duties to custodians without identifying information owners

B. Applying one control set to all information and omitting exception records

C. Defining controls for each classification level and procedures for declassification or custody transfer

D. Allowing each user to choose a label and changing it whenever the data is accessed

Answer: (C)

Explanation

A complete procedure specifies controls for each level and defines declassification or custody-transfer processes, along with ownership, labeling, exceptions, and awareness. Letting users freely choose labels would undermine consistent classification governance.

8. Who determines the required classification of information and delegates protection duties to the custodian?

A. The information owner

B. The routine information user

C. The information custodian

D. The enterprise awareness coordinator

Answer: (A)

Explanation

The information owner determines the required classification and delegates protection responsibilities to the custodian. The custodian carries out protection, while the user typically accesses the information for work.

9. What is the defining role of a security policy in an organization’s documentation hierarchy?

A. It gives detailed steps for completing a particular operational task

B. It provides high-level direction and serves as the basis for security implementation

C. It recommends optional technologies that departments may adopt independently

D. It records audit events generated by users and system administrators

Answer: (B)

Explanation

A security policy is generally the first and highest level of security documentation and contains broad statements that guide implementation. Detailed task instructions belong in procedures rather than policies.

10. What does a senior management statement of policy primarily demonstrate?

A. Flexible recommendations that departments may follow according to local preferences

B. Detailed instructions for configuring systems and completing daily security tasks

C. Enterprise-wide commitment to information security and oversight of lower-level documents

D. Technical requirements that mandate uniform technologies across every system

Answer: (C)

Explanation

The senior management statement recognizes the importance of computing resources, supports security across the enterprise, and commits management to authorizing and overseeing lower-level documents. Detailed implementation instructions belong in standards, procedures, or guidelines.

11. Which pairing correctly distinguishes standards, guidelines, and procedures?

A. Standards give task instructions, guidelines establish mandatory technologies, and procedures document optional practices

B. Standards state broad direction, guidelines record audit trails, and procedures assign information classifications

C. Standards offer flexible advice, guidelines mandate technologies, and procedures state broad management commitments

D. Standards mandate uniform technologies, guidelines offer flexible advice, and procedures give detailed task steps

Answer: (D)

Explanation

Standards specify compulsory technologies uniformly, guidelines provide flexible non-compulsory recommendations, and procedures describe detailed steps for a task. Broad management direction belongs to policy rather than to these lower-level document types.

12. Which role determines how organizational data should be classified?

A. The data owner

B. The security auditor

C. The system operator

D. The information custodian

Answer: (A)

Explanation

The owner decides the classification assigned to data, such as its sensitivity or required protection level. The custodian is responsible for preserving confidentiality, integrity, and availability rather than setting the classification.

13. Why are both security awareness and role-specific training important in an organization?

A. Awareness assigns data classifications, while training audits security controls

B. Awareness explains protection responsibilities, while training develops secure job skills

C. Awareness calculates annual losses, while training selects insurance coverage

D. Awareness approves access privileges, while training determines business impact

Answer: (B)

Explanation

Awareness helps employees understand why enterprise information must be protected, while training builds the skills needed to perform duties securely. The other choices assign unrelated security-management tasks to awareness and training.

14. What is the proper relationship between risk analysis and risk assessment?

A. Analysis examines risk conditions, while assessment assigns values to them

B. Analysis assigns asset values, while assessment identifies vulnerable systems

C. Analysis transfers risk, while assessment eliminates every identified threat

D. Analysis approves safeguards, while assessment performs security operations

Answer: (A)

Explanation

Risk analysis examines conditions such as vulnerabilities, affected assets, and possible consequences, whereas risk assessment assigns values to those elements. Assigning asset values is therefore part of assessment rather than the defining role of analysis.

15. During risk analysis, what should an analyst do after identifying vulnerabilities in a target environment?

A. Convert them directly into annualized monetary losses

B. Associate them with affected assets and determine undesirable results

C. Classify every affected asset according to business ownership

D. Assign each vulnerability a personnel training requirement

Answer: (B)

Explanation

Risk analysis links vulnerabilities to affected assets, determines potential undesirable results, and evaluates countermeasures that could reduce risk. Converting findings into annualized monetary losses belongs to quantitative assessment rather than this analysis step.

16. Which activity is characteristic of risk assessment rather than risk analysis?

A. Identifying vulnerabilities in the target environment

B. Linking vulnerabilities to the assets they could affect

C. Assigning values to assets, threat frequencies, and consequences

D. Evaluating countermeasures that could reduce identified risk

Answer: (C)

Explanation

Risk assessment assigns values to assets, threat frequency, consequences, and other chance-related elements to characterize risk. Identifying vulnerabilities and linking them to assets are activities performed during risk analysis.

17. A threatened event could cause a $200,000 asset to lose 30% of its value in one occurrence. What is the Single Loss Expectancy?

A. $170{,}000$

B. $600{,}000$

C. $60{,}000$

D. $6{,}000$

Answer: (C)

Explanation

Single Loss Expectancy is calculated as asset value multiplied by exposure factor, so $200{,}000 \times 0.30 = 60{,}000$. The exposure factor is the percentage loss, whereas SLE is the resulting monetary loss for one occurrence.

18. A threat is expected to occur once every ten years. What is its Annualized Rate of Occurrence?

A. $1$

B. $0.1$

C. $10$

D. $100$

Answer: (B)

Explanation

An occurrence once every ten years corresponds to an annualized frequency of $1 \div 10 = 0.1$. An ARO of $1$ would represent one expected occurrence per year, not one per decade.

19. An asset has a Single Loss Expectancy of $40{,}000$ and an Annualized Rate of Occurrence of $0.25$. What is its Annualized Loss Expectancy?

A. $40{,}025$

B. $10{,}000$

C. $160{,}000$

D. $39{,}750$

Answer: (B)

Explanation

Annualized Loss Expectancy equals Single Loss Expectancy multiplied by Annualized Rate of Occurrence, giving $40{,}000 \times 0.25 = 10{,}000$. The SLE represents one event, while ALE incorporates the expected frequency across a year.

20. A safeguard reduces annualized loss expectancy from $75{,}000$ to $25{,}000$ and costs $15{,}000$ annually. What is its value?

A. $40{,}000$

B. $50{,}000$

C. $65{,}000$

D. $35{,}000$

Answer: (D)

Explanation

The safeguard value is calculated as $ALE_{before} - ALE_{after} - annual\ safeguard\ cost$, so $75{,}000 - 25{,}000 - 15{,}000 = 35{,}000$. Subtracting the safeguard cost is necessary because the reduction in expected loss is not the net value by itself.

21. What is the primary purpose of Business Continuity Planning during an emergency?

A. To analyze threats and vulnerabilities affecting organizational assets

B. To maintain business operations through a structured continuity framework

C. To authorize the use of a newly developed recovery plan

D. To restore damaged facilities after the emergency has ended

Answer: (B)

Explanation

Business Continuity Planning establishes a framework for keeping the business operating during an emergency. Disaster Recovery Planning is more specifically concerned with restoring operations after disruption, making the second option a related but incorrect distinction.

22. Which activity is a stated objective of Business Continuity Planning?

A. Identifying threats, vulnerabilities, and countermeasures

B. Approving enterprise-wide recovery procedures

C. Determining the longest tolerable interruption for critical processes

D. Reducing financial loss caused by disruptive events

Answer: (D)

Explanation

BCP aims to reduce financial loss, prevent interruptions, resume processes, and limit the costs of disruptive events. Determining tolerable interruption periods belongs to Business Impact Analysis, not the objective list of BCP.

23. Which event is classified as a man-made disruption rather than a natural disruption?

A. A flood that damages the organization’s facilities

B. An earthquake that interrupts regional operations

C. A strike that makes employees unavailable for work

D. A storm that causes extended power failures

Answer: (C)

Explanation

Strikes and employee unavailability are identified as man-made disruptive events. Floods, earthquakes, and storms are natural events, even when they produce similar operational consequences.

24. What is the main purpose of a Business Impact Analysis?

A. To authorize recovery capabilities for enterprise-wide deployment

B. To document the effects a disruptive event could have on the business

C. To identify threats, vulnerabilities, assets, and countermeasures

D. To define the parameters and management practices of the continuity plan

Answer: (B)

Explanation

A Business Impact Analysis produces a document describing the potential business impact of a disruptive event. The third option describes risk analysis, while defining plan parameters belongs to scope and plan initiation.

25. What does Maximum Tolerable Downtime describe for a critical business process?

A. The longest interruption period before the company can no longer recover

B. The period needed to complete regular audits of the process

C. The time required to identify resources supporting the process

D. The interval during which management approves recovery priorities

Answer: (A)

Explanation

Maximum Tolerable Downtime is the longest period a critical process may remain interrupted before recovery becomes impossible for the company. Identifying resources and setting recovery priorities are activities associated with Business Impact Analysis rather than the definition of this measure.

26. Which task belongs to BCP scope and plan initiation rather than to measuring disruption impacts?

A. Recommending recovery priorities to senior management

B. Recording the quantitative and qualitative effects of a disruption

C. Determining acceptable interruption periods for critical processes

D. Creating a detailed account of required work and available resources

Answer: (D)

Explanation

Scope and plan initiation examines operations and support services, details required work, lists resources, and defines management practices. Recording impacts, determining interruption periods, and recommending priorities are BIA activities.

27. How does continuity plan development use Business Impact Analysis information?

A. It grants senior management authority to implement the completed plan

B. It identifies organizational threats before evaluating business consequences

C. It creates and documents recovery strategies for critical business functions

D. It maintains one approved version through audits and assigned responsibilities

Answer: (C)

Explanation

Continuity plan development uses BIA findings to create recovery strategies covering functions, computing, facilities, people, supplies, and equipment. Approval and maintenance activities authorize and control the plan rather than create its recovery strategy.

28. Which requirement belongs to plan approval and implementation?

A. A measurement of quantitative and qualitative disruption impacts

B. Senior management approval combined with training and regular audits

C. A determination of the longest tolerable interruption for each process

D. A detailed account of required work and supporting organizational resources

Answer: (B)

Explanation

Plan approval and implementation requires senior management approval, personnel training, maintenance responsibilities, regular audits, and enterprise-wide awareness. The other activities belong to scope initiation or Business Impact Analysis rather than plan authorization and implementation.

29. What is the primary purpose of maintaining a data recovery plan after it has been developed?

A. To verify that personnel can perform emergency duties

B. To transfer backup data to an off-site storage facility

C. To keep the plan current and relevant as conditions change

D. To restore the damaged primary site after a disaster

Answer: (C)

Explanation

Plan maintenance keeps the data recovery plan current and relevant over time. Off-site backup transfer is electronic vaulting, while restoring the primary site is a salvage-team responsibility.

30. Which alternate-site type is fully configured and available for immediate operation?

A. A cold site

B. A salvage site

C. A hot site

D. A warm site

Answer: (C)

Explanation

A hot site is a fully configured facility that can be used immediately after a disruption. A cold site provides space and utilities but requires equipment to be brought in, while a warm site may require application or workstation setup.

31. Which recovery technique processes transactions in parallel at an alternate site?

A. Remote journaling

B. Electronic vaulting

C. Structured walk-through testing

D. Database shadowing

Answer: (A)

Explanation

Remote journaling processes transactions in parallel at an alternate site. Electronic vaulting transfers backup data off-site, whereas database shadowing duplicates database sets across multiple servers.

32. What is a central purpose of testing a disaster recovery plan?

A. To verify procedures and reveal deficiencies before an emergency

B. To eliminate the need for personnel training during a disaster

C. To replace the primary facility with a permanently new site

D. To transfer every transaction to an alternate site during normal operations

Answer: (A)

Explanation

DRP testing checks the accuracy of recovery procedures, exposes deficiencies, trains personnel, and verifies alternate-site capability. It does not permanently replace the primary facility or remove the need for emergency training.