IS4550 CHAPTER 3

Question 1

Established rules on how consumers and their information should be handled during an e-commerce transaction is called ___.

Answer 1

CONSUMER RIGHTS

Question 2

The laws that set expectations on how your personal information should be protected and limits place on how the data should be shared is called ___.

Answer 2

DATA PRIVACY

Question 3

___ is defined as 1. Information that supports a conclusion or 2. Material presented to a regulator to show compliance.

Answer 3

EVIDENCE

Question 4

A formal process to identify threats, potential attacks, and impacts to an an organization is called ___.

Answer 4

INFORMATION SECURITY RISK ASSESSMENT

Question 5

A framework that contains a comprehensive list of concepts, practices, and processes for managing IT services is called ___.

Answer 5

INFORMATION TECHNOLOGY AND INFRASTRUCTURE LIBRARY (ITIL)

Question 6

Software that blocks access to specific sites on the Internet is called ___.

Answer 6

INTERNET FILTERS

Question 7

The practice of agreeing to use of personal information beyond its original purpose is called ___.

Answer 7

OPT-IN

Question 8

The practice of declining persuasion to use personal information beyond its original purpose is called ___.

Answer 8

OPT-OUT

Question 9

A worldwide information security standard that describes how to protect credit card information is called ___.

Answer 9

PAYMENT CARD INDUSTRY DATA SECURITY STANDARD (PCI DSS)

Question 10

In e-commerce, broadly deals with how personal information is handled and what it is used for is called ___.

Answer 10

PERSONAL PRIVACY

Question 11

A formal process to identify threats, potential attacks, and impacts to an organization is called ___.

Answer 11

RISK ASSESSMENT

Question 12

When related to compliance, it’s the mapping of regulatory requirements to policies and controls is called ___.

Answer 12

SECURITY CONTROL MAPPING

Question 13

A person who buys stock in a company (investor) is called ___.

Answer 13

SHAREHOLDER

Question 14

A widely accepted auditing standard created by the American Institute of Certified Public Accountants and examines an organizations control environment is called ___.

Answer 14

STATEMENT ON AUDITING STANDARD 70 (SAS 70)

Question 15

1. When creating laws and regulations, the government’s sole concern is the privacy of the individual.
   TRUE OR FALSE

Answer 15

FALSE

Question 16

2. Which of the following are pressures on creating security policies?
3. Shareholder value
4. Regulations
5. Technology vulnerabilities and limitations
6. 2 and 3 only
7. All the above

Answer 16

Shareholder value
Regulations
Technology vulnerabilities and limitations

All the above

Question 17

3. Which of the following laws require proper security controls for handling privacy data?
4. HIPAA
5. GLBA
6. FERPA
7. 2 & 3 only
8. All the above

Answer 17

HIPAA
GLBA
FERPA
All the above

Question 18

4. Which of the following are control objectives for PCI DSS?
5. Maintain an information security policy
6. Protect cardholder data
7. Alert when credit cards are illegally used
8. 1 & 2 only
9. None of the above

Answer 18

Maintain an information security policy
Protect cardholder data

1 & 2 only

Question 19

5. A SAS 70 audit is popular because it allows a service auditor to review an organization’s ___ and issue an independent opinion.

Answer 19

Control environment

Question 20

6. Health care providers are those that process and facilitate billing.
   TRUE OR FALSE

Answer 20

FALSE

Question 21

7. The law that attempts to limit children’s exposure to sexually explicit material is ___.

Answer 21

CIPA

Question 22

8. It is easier to quantify leading practices than best practices.
   TRUE OR FALSE

Answer 22

TRUE

Question 23

9. You should always write new security policies each time a new regulation is issued.
   TRUE OR FALSE

Answer 23

FALSE

Question 24

10. What should you ask for to gain confidence that a vendor’s security controls are adequate?
11. A SAS 70 Type I audit
12. A SAS 70 Type II audit
13. A list of all internal audits
14. All the above

Answer 24

A SAS 70 Type II audit

Question 25

11. Why is it important to map regulatory requirements to policies and controls? 1. To demonstrate compliance to regulators 2. To ensure regulatory requirements are covered 3. To demonstrate the importance of a security control 4. All the above

Answer 25

To demonstrate compliance to regulators To ensure regulatory requirements are covered To demonstrate the importance of a security control All the above