Information Security Quiz

Which of the following best describes the primary focus of Information Security?

Within the CIA triad, what does Confidentiality primarily ensure?

Which of the following controls is most directly associated with maintaining the Integrity of data?

What is the primary risk associated with a failure in the 'Availability' aspect of information security?

Which of the following is NOT a direct control for maintaining Confidentiality?

Which of the following best describes the role of the 'AAA' framework in relation to the CIA triad?

Which of these is a key control for ensuring Availability during a system outage?

What does the concept of 'asset' refer to within the scope of Information Security?

Which of the following best describes a vulnerability in the context of IT security?

What is the primary goal of risk management in the context of IT security?

Which of the following is NOT considered a security control?

Which of the following sequences of steps represents the software development life cycle?

What is a key benefit of the Model-View-Controller (MVC) architecture?

In the MVC architecture, what is the main function of the 'Controller'?

Which security principle emphasizes granting users only the necessary level of access?

Which of the following is NOT a characteristic of a secure organization?

What advantage does a manual inspection have over other forms of testing?

What is the 'trust-but-verify' approach associated with?

Which testing method is best done in the later stages of the SDLC?

Which of the following is a drawback of penetration testing?

Which activity provides more information to the reviewers compared to other testing approaches?

Which of these are advantages of source code review?

What is a disadvantage of relying on only source code review for security testing?

What is the primary purpose of authentication?

Which of the following is NOT a form of authentication?

Which method of authentication uses a piece of information known only to the user?

In the context of security, what does authorization refer to?

Which of the following is an example of a biometric authentication method?

Which common authorization scheme uses predefined rules to grant access?

Why are audit trails important in security?

What qualifies as an asset in an organizational context?

What is one of the primary roles of a Threat Identifier in a standard template?

Which approach employs a combination of the probability of an event occurring and its potential impact to evaluate risk?

Why is it important to have security checkpoints in development methodologies?

What does the architectural requirement of reliability aim to prevent?

Which characteristic is essential for an organization to be considered secure?

What is one of the key goals of defining architectural requirements?

Which of the following is NOT a characteristic of secure coding principles?

How does modular design benefit system maintenance?

What is the primary purpose of documentation requirements in software development?

Which of the following are key components that must be validated during security testing?

What is the role of in-code commenting in software development?

Which testing methodology involves ethical hackers attempting to compromise an application?

Why is exception handling important in an application?

What does fuzz testing primarily involve?

What practice should be avoided in in-code comments to maintain security?

Which of the following statements is true regarding documentation requirements?

What is a threat according to threat modeling?

What is the main goal of threat modeling?

Which of the following is NOT a benefit of threat modeling?

Which step is NOT part of the threat modeling process?

In threat modeling, which of the following best describes the term 'attack surface'?

What does the 'Strider/Dread model' provide in threat modeling?

Which group is included in identifying threat agents?

What is an essential prerequisite for effective threat modeling?

What does the process of decomposing the application involve?

What is the initial action in performing threat modeling?

Which of the following factors are considered in prioritizing identified risks?

Which of the following is a common threat identified in threat modeling?

What is true about the iterative nature of threat modeling?