What is Information Security

Question 1

What are the three elements of the CIA Triad?

Answer 1

Confidentiality, Integrity, and Availability

Question 2

Define “Information Security”.

Answer 2

Information security is the protection of information and systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

Question 3

What is the primary goal of Information Security?

Answer 3

The primary goal of information security is to ensure the confidentiality, integrity, and availability of information.

Question 4

What is a threat in Information Security?

Answer 4

A threat is any potential danger that can exploit a vulnerability to breach security and cause harm.

Question 5

Define a vulnerability in the context of Information Security.

Answer 5

A vulnerability is a weakness in a system that can be exploited by a threat to gain unauthorized access or cause harm.

Question 6

What is Confidentiality in the CIA Triad?

Answer 6

Ensures that only authorized users can access sensitive data.

Question 7

What is Integrity in the CIA Triad?

Answer 7

Ensures that data is accurate and unaltered unless changed by authorized users

Question 8

What is availability in the CIA Triad?

Answer 8

Ensures that data and systems are accessible when needed by authorized users.

Question 9

What Are the six elements of the Parkerian Hexad?

Answer 9

Confidentiality, Integrity, Availability, Possession/Control, Authenticity, Utility

Question 10

What is Possession/Control in the Parkerian Hexad?

Answer 10

Ensures that an entity physically or digitally controls data, even if confidentiality is maintained.

Question 11

What is Authenticity in the Parkerian Hexad?

Answer 11

Ensures that data and identities are genuine and not forged.

Question 12

What is Utility in the Parkerian Hexad?

Answer 12

Ensures that data is useful and in a readable format when accessed.

Question 13

What are the four types of attacks?

Answer 13

Interception, Interruption, Modification, Fabrication,

Question 14

What is a risk in Information Security?

Answer 14

The likelihood and impact of a threat exploiting a vulnerability.

Question 15

What is an impact in Information security

Answer 15

The consequence or damage if a threat successfully exploits a vulnerability.

Question 16

What are the steps of the Risk Management process?

Answer 16

Identify assets
Identify threats
Assess vulnerabilities
Assess risk
Mitigate risk
Monitor and Review

Question 17

What are the six steps of the Incident Response Process?

Answer 17

Preparation
Detection & Analysis
Containment
Eradication
Recovery
Post-Incident Activity

Question 18

What is the goal of Risk Management?

Answer 18

To identify, assess, and mitigate risks to minimize potential security threats.

Question 19

What is a risk assessment?

Answer 19

A detailed evaluation of threats, vulnerabilities, and impacts to determine risk levels.

Question 20

What is a Business Impact Analysis (BIA)?

Answer 20

A process to determine how risks affect business operations.

Question 21

What is the difference between qualitative and quantitative risk analysis?

Answer 21

Qualitative = Subjective ranking of risks (e.g., low, medium, high).
Quantitative = Numerical risk measurement (e.g., financial loss in dollars).

Question 22

What is the goal of the Incident Response Process?

Answer 22

To detect, contain, and recover from security incidents efficiently to minimize damage.

Question 23

What are the three main types of security controls?

Answer 23

Administrative Controls – Policies and procedures.
Technical Controls – Security technologies (firewalls, encryption).
Physical Controls – Security measures for physical assets (locks, cameras).

Question 24

What is Defense in Depth (DiD)?

Answer 24

A layered security approach that uses multiple security controls to protect systems so that if one control fails, others remain in place.

Question 25

What are the layers of the Defense in Depth?

Answer 25

Data Layer – Protects sensitive data itself. Application Layer – Secures software applications. Host Layer – Protects endpoints like servers and workstations. Internal Network Layer – Monitors and controls internal network traffic. Perimeter Layer – Secures the boundary between internal and external networks. External Network Layer – Protects against external threats (internet-facing defenses).

Question 26

Which type of attack only affects Confidentiality?

Answer 26

Interception.

Question 27

What type of attack affects Integrity and Availbility?

Answer 27

Interruption Modification Fabrication

Question 28

What is a Fabrication attack? Give some examples

Answer 28

An attack where false or counterfeit data is inserted into a system. Example: Email spoofing, generating fake log entries.

Question 29

What is a Modification attack? Give some examples.

Answer 29

A: An attack where data is altered, tampered with, or changed without authorization. Example: Unauthorized file editing, SQL injection.

Question 30

What is an Interruption attack? Give some examples.

Answer 30

An attack that makes assets unavailable or unusable. Example: Denial-of-Service (DoS) attack, ransomware.

Question 31

What is an Interception attack? Give some examples

Answer 31

an attack where an unauthorized party gains access to data, applications, or systems. Example: Eavesdropping on network traffic, Man-in-the-Middle (MitM) attack.