Information Security and Risk Management

Nail bed structure identification is an emerging biometric technology still in research and development phases. Iris matching and retina scans are mature, widely-implemented technologies with established accuracy. Face recognition, while still improving, is already commercially deployed and operational.

WAPs are vulnerable to multiple attacks: Cafe Latte (exploits WEP to generate packets), Man-in-the-Middle (intercepts communications), and various replay/forgery attacks. Lexicographer attack is not a recognized WAP vulnerability - it's either a distractor or refers to something unrelated to wireless security.

IEEE 802.11 is the standard family for Wireless LANs (Wi-Fi). 802.3 is for Ethernet wired networks, 802.1 covers network architecture and bridging, and 802.5 is for Token Ring networks.

3G networks support voice calls, video calls, and wireless data simultaneously. The third generation of mobile technology enables multimedia communication through high-speed packet-switched networks.

Vulnerability Management protects reputation by preventing security breaches, ensures business continuity by minimizing disruption, and safeguards IT infrastructure and data from exploitation. It is a foundational cybersecurity practice.

The Vulnerability Management Lifecycle begins with identifying vulnerabilities, then analyzing their severity and exploitability, mitigating through patching or other controls, and ongoing management. Monitoring is continuous but not a sequential step.

Patch Management is only one component of Vulnerability Management, which also includes discovery, prioritization, risk assessment, and continuous monitoring. Vulnerability Management is broader and more strategic.

Risk assessment fundamentally combines the likelihood of threats occurring, the presence of vulnerabilities that can be exploited, and the potential business impact if exploitation occurs. This is the standard risk formula in cybersecurity.

The four risk treatment strategies are: transfer (insurance, outsourcing), retention (accept risk), avoidance (discontinue activity), and reduction (mitigate controls). These are the standard options identified in risk management frameworks like ISO 27001.

Software is categorized into Application Software (end-user programs), System Software (OS, utilities), and Programming Software (compilers, IDEs). This three-tier classification covers all software types.

The three main software license categories are Proprietary (commercial, restricted), Freeware (free but closed-source), and Open Source (free with source access). Options A, B, and D mix non-standard or obsolete categories like cardware.

A software license agreement defines the legal framework between creator and user. It specifies permissions (what you can do), restrictions (limitations on use), and warranty terms (guarantees and disclaimers). All three components are essential.

Identity theft encompasses various fraudulent activities where someone uses another person's personal information without authorization. Credit card fraud involves using stolen card details for purchases, bank fraud includes unauthorized access to accounts or loans, and employment fraud occurs when someone uses another's identity to secure employment or government benefits.

Identity and Access Management (IAM) systems provide comprehensive benefits including automated account provisioning/deprovisioning, granular control over privileged access through delegation mechanisms, and enforcement of strong multi-factor authentication. All options represent valid IAM capabilities.

Cyber law encompasses multiple domains including criminalizing cyber offenses, protecting intellectual property in digital formats, regulating electronic and digital signatures for transactions, and establishing data protection and privacy frameworks. All listed domains fall under cyber law.

ISO 27001 is the primary standard in the ISO 27000 series that specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It includes the requirements for risk assessment and treatment.