Information Security Quiz & Flashcards

Confidentiality ensures that information is accessible only to those authorized to have access, while the others focus on different aspects of information security.

Ransomware specifically encrypts files and demands payment for the decryption key; the other options refer to different types of malware.

Phishing is primarily about deceiving individuals to reveal sensitive information, unlike the other options which describe other forms of attacks or methods.

A firewall specifically monitors and controls incoming and outgoing traffic based on security rules, while the others serve different networking functions.

DDoS stands for Distributed Denial of Service, which involves overwhelming a service with traffic; the other options are incorrect terms.

The main goal is to educate employees to recognize and prevent security threats, while the other options do not directly address security awareness.

Security cameras are a physical measure for security, while the others are software-based solutions.

A vulnerability scan specifically identifies security weaknesses, unlike the other options which describe different functions.

BYOD stands for Bring Your Own Device, which refers to employees using personal devices for work purposes; the other options are incorrect expansions.

Data encryption primarily protects information from unauthorized access, while the others do not directly relate to its purpose.

A digital signature verifies both the identity of the sender and the integrity of the message, while others describe different security functions.

Phishing emails are a direct method of social engineering, while the others relate to different types of security measures or threats.

The CISO is responsible for the organization's information security strategy, while the others pertain to different roles.

An insider threat arises from individuals within the organization, whereas the others refer to different threats or methods.

Regularly backing up data is a crucial practice to prevent data loss, while the others can increase vulnerability.

Public Wi-Fi networks are susceptible to data interception by attackers, unlike the other options which do not pose significant security risks.

A honeypot is intentionally designed to attract cyber attackers to study their methods, while the others describe different security functions.

A data breach specifically refers to unauthorized access to sensitive data, while the others do not relate to this definition.

Asymmetric encryption uses a public and a private key, while symmetric encryption uses just one key.

A security policy outlines the measures and procedures for protecting information, while the others do not relate to security.

Phishing is a method of attack, not a form of malware; the others are types of malware.

A VPN enhances security for online activities by encrypting data, while the others do not specifically relate to security.

Digital forensics focuses on investigating and recovering evidence from digital devices related to cyber incidents.

A common misconception is that antivirus software can remove all malware, whereas no single solution is sufficient for total security.

Documenting the incident is essential for understanding and addressing the breach, while the other options are inappropriate actions.

GDPR mandates stricter data protection measures to ensure user privacy and security, unlike the other options.

Penetration testing aims to identify and exploit vulnerabilities to improve security measures; the others do not address this goal.

Not updating software can expose systems to vulnerabilities that attackers can exploit, while the others do not relate to security risks.

A security audit evaluates security policies and controls to identify gaps, while the others focus on different aspects.

A DLP strategy is specifically designed to monitor and protect sensitive data from unauthorized access or loss.

A brute-force attack involves systematically guessing passwords or keys; the others describe different types of attacks.

ACLs define permissions for users and groups, ensuring that only authorized individuals can access certain resources.

The zero trust model assumes that breaches can happen and verifies every user and device, while others do not encompass this principle.

An incident response team's objective is to manage and mitigate the effects of security incidents.

Integrity refers to the accuracy and trustworthiness of data, while the other options relate to different aspects of the CIA triad.