Security Management Practices

Question 1

QUESTION NO: 1 All of the following are basic components of a security policy EXCEPT the

A. definition of the issue and statement of relevant terms.
B. statement of roles and responsibilities
C. statement of applicability and compliance requirements.
D. statement of performance of characteristics and requirements.

Answer 1

Answer: D Explanation: Policies are considered the first and highest level of documentation, from which the lower level elements of standards, procedures, and guidelines flow.

This order, however, does not mean that policies are more important than the lower elements. These higher-level policies, which are the more general policies and statements, should be created first in the process for strategic reasons, and then the more tactical elements can follow.

Question 2

QUESTION NO: 2 A security policy would include all of the following EXCEPT

A. Background
B. Scope statement
C. Audit requirements
D. Enforcement

Answer 2

Answer: B

Question 3

QUESTION NO: 3 Which one of the following is an important characteristic of an information security policy?

A. Identifies major functional areas of information.
B. Quantifies the effect of the loss of the information.
C. Requires the identification of information owners.
D. Lists applications that support the business function.

Answer 3

Answer: A Explanation: Information security policies area high-level plans that describe the goals of the procedures. Policies are not guidelines or standards, nor are they procedures or controls. Policies describe security in general terms, not specifics. They provide the blueprints for an overall security program just as a specification defines your next product

Question 4

QUESTION NO: 4 Ensuring the integrity of business information is the PRIMARY concern of

A. Encryption Security
B. Procedural Security.
C. Logical Security
D. On-line Security

Answer 4

Answer: B Explanation: Procedures are looked at as the lowest level in the policy chain because they are closest to the computers and provide detailed steps for configuration and installation issues.

They provide the steps to actually implement the statements in the policies, standards, and guidelines…Security procedures, standards, measures, practices, and policies cover a number of different subject areas

Question 5

QUESTION NO: 5 Which of the following would be the first step in establishing an information security program?

A. Adoption of a corporate information security policy statement
B. Development and implementation of an information security standards manual
C. Development of a security awareness-training program
D. Purchase of security access control software

Answer 5

Answer: A

Question 6

QUESTION NO: 6 Which of the following department managers would be best suited to oversee the development of an information security policy?

A. Information Systems
B. Human Resources
C. Business operations
D. Security administration

Answer 6

Answer: C

Question 7

QUESTION NO: 7 What is the function of a corporate information security policy? A. Issue corporate standard to be used when addressing specific security problems. B. Issue guidelines in selecting equipment, configuration, design, and secure operations. C. Define the specific assets to be protected and identify the specific tasks which must be completed to secure them. D. Define the main security objectives which must be achieved and the security framework to meet business objectives.

Answer 7

Answer: D Explanation: Information security policies are high-level plans that describe the goals of the procedures or controls. Policies describe security in general, not specifics. They provide the blueprint fro an overall security program just as a specification defines your next product.

Question 8

QUESTION NO: 8 Why must senior management endorse a security policy? A. So that they will accept ownership for security within the organization. B. So that employees will follow the policy directives. C. So that external bodies will recognize the organizations commitment to security. D. So that they can be held legally accountable.

Answer 8

Answer: A Explanation: Ownership is the correct answer in this statement. However, here is a reference. “Fundamentally important to any security program’s success us the senior management’s high-level statement of commitment to the information security policy process and a senior management’s understanding of how important security controls and protections are to the enterprise’s continuity.

Question 9

QUESTION NO: 9 In which one of the following documents is the assignment of individual roles and responsibilities MOST appropriately defined? A. Security policy B. Enforcement guidelines C. Acceptable use policy D. Program manual

Answer 9

Answer: C Explanation: An acceptable use policy is a document that the employee signs in which the expectations, roles and responsibilities are outlined. Issue -specific policies address specific security issues that management feels need more detailed explanation and attention to make sure a comprehensive structure is built and all employees understand how they are to comply to these security issues.

Question 10

QUESTION NO: 10 Which of the following defines the intent of a system security policy? A. A definition of the particular settings that have been determined to provide optimum security. B. A brief, high-level statement defining what is and is not permitted during the operation of the system. C. A definition of those items that must be excluded on the system. D. A listing of tools and applications that will be used to protect the system.

Answer 10

Answer: A Explanation: “A system-specific policy presents the management’s decisions that are closer to the actual computers, networks, applications, and data. This type of policy can provide an approved software list, which contains a list of applications that can be installed on individual workstations. This policy can describe how databases are to be protected, how computers are to be locked down, and how firewall, intrusion diction systems, and scanners are to be employed.”

Question 11

QUESTION NO: 11 When developing an information security policy, what is the FIRST step that should be taken? A. Obtain copies of mandatory regulations. B. Gain management approval. C. Seek acceptance from other departments. D. Ensure policy is compliant with current working practices.

Answer 11

Answer: B

Question 12

QUESTION NO: 12 Which one of the following should NOT be contained within a computer policy? A. Definition of management expectations. B. Responsibilities of individuals and groups for protected information. C. Statement of senior executive support. D. Definition of legal and regulatory controls.

Answer 12

Answer: B

Question 13

QUESTION NO: 13 Which one of the following is NOT a fundamental component of a Regulatory Security Policy? A. What is to be done. B. When it is to be done. C. Who is to do it. D. Why is it to be done

Answer 13

Answer: C Explanation: Regulatory Security policies are mandated to the organization but it up to them to implement it. “Regulatory - This policy is written to ensure that the organization is following standards set by a specific industry and is regulated by law. The policy type is detailed in nature and specific to a type of industry. This is used in financial institutions, health care facilities, and public utilities.”

Question 14

QUESTION NO: 14 Which one of the following statements describes management controls that are instituted to implement a security policy? A. They prevent users from accessing any control function. B. They eliminate the need for most auditing functions. C. They may be administrative, procedural, or technical. D. They are generally inexpensive to implement.

Answer 14

Answer: C Explanation: Administrative, physical, and technical controls should be utilized to achieve the management’s directives.

Question 15

QUESTION NO: 15 Which must bear the primary responsibility for determining the level of protection needed for information systems resources? A. IS security specialists B. Senior Management C. Seniors security analysts

Answer 15

Answer: B

Question 16

QUESTION NO: 16 Which of the following choices is NOT part of a security policy? A. definition of overall steps of information security and the importance of security B. statement of management intend, supporting the goals and principles of information security C. definition of general and specific responsibilities for information security management D. description of specific technologies used in the field of information security

Answer 16

Answer: D

Question 17

QUESTION NO: 17 In an organization, an Information Technology security function should: A. Be a function within the information systems functions of an organization B. Report directly to a specialized business unit such as legal, corporate security or insurance C. Be lead by a Chief Security Officer and report directly to the CEO D. Be independent but report to the Information Systems function

Answer 17

Answer: C

Question 18

QUESTION NO: 18 Which of the following embodies all the detailed actions that personnel are required to follow? A. Standards B. Guidelines C. Procedures D. Baselines

Answer 18

Answer: C

Question 19

QUESTION NO: 19 A significant action has a state that enables actions on an ADP system to be traced to individuals who may then be held responsible. The action does NOT include: A. Violations of security policy. B. Attempted violations of security policy. C. Non-violations of security policy. D. Attempted violations of allowed actions.

Answer 19

Answer: C

Question 20

QUESTION NO: 20 Network Security is a A. Product B. protocols C. ever evolving process D. quick-fix solution

Answer 20

Answer: C

Question 21

QUESTION NO: 21 Security is a process that is: A. Continuous B. Indicative C. Examined D. Abnormal

Answer 21

Answer: A Explanation: Security is a continuous process; as such you must closely monitor your systems on a regular basis. Log files are usually a good way to find an indication of abnormal activities. However some care must be exercise as to what will be logged and how the logs are protected. Having corrupted logs is about as good as not having logs at all.

Question 22

QUESTION NO: 22 What are the three fundamental principles of security? A. Accountability, confidentiality, and integrity B. Confidentiality, integrity, and availability C. Integrity, availability, and accountability D. Availability, accountability, and confidentiality

Answer 22

Answer: B

Question 23

QUESTION NO: 23 Which of the following prevents, detects, and corrects errors so that the integrity, availability, and confidentiality of transactions over networks may be maintained? A. Communications security management and techniques B. Networks security management and techniques C. Clients security management and techniques D. Servers security management and techniques

Answer 23

Answer: A

Question 24

QUESTION NO: 24 Making sure that the data is accessible when and where it is needed is which of the following? A. Confidentiality B. integrity C. acceptability D. availability

Answer 24

Answer: D

Question 25

QUESTION NO: 25 Which of the following describes elements that create reliability and stability in networks and systems and which assures that connectivity is accessible when needed? A. Availability B. Acceptability C. Confidentiality D. Integrity

Answer 25

Answer: A

Question 26

QUESTION NO: 26 Most computer attacks result in violation of which of the following security properties? A. Availability B. Confidentiality C. Integrity and control D. All of the choices.

Answer 26

Answer: D Explanation: Most computer attacks only corrupt a system’s security in very specific ways. For example, certain attacks may enable a hacker to read specific files but don’t allow alteration of any system components. Another attack may allow a hacker to shut down certain system components but doesn’t allow access to any files. Despite the varied capabilities of computer attacks, they usually result in violation of only four different security properties: availability, confidentiality, integrity, and control.

Question 27

QUESTION NO: 27 Which of the following are objectives of an information systems security program? A. Threats, vulnerabilities, and risks B. Security, information value, and threats C. Integrity, confidentiality, and availability. D. Authenticity, vulnerabilities, and costs.

Answer 27

Answer: C Explanation: There are several small and large objectives of a security program, but the main three principles in all programs are confidentiality, integrity, and availability. These are referred to as the CIA triad.

Question 28

QUESTION NO: 28 An area of the Telecommunications and Network Security domain that directly affects the Information Systems Security tenet of Availability can be defined as: A. Netware availability B. Network availability C. Network acceptability D. Network accountability

Answer 28

Answer: B

Question 29

QUESTION NO: 29 The Structures, transmission methods, transport formats, and security measures that are used to provide integrity, availability, and authentication, and confidentiality for transmissions over private and public communications networks and media includes: A. The Telecommunications and Network Security domain B. The Telecommunications and Netware Security domain C. The Technical communications and Network Security domain D. The Telnet and Security domain

Answer 29

Answer: A Explanation: The Telecommunications, Network, and Internet Security Domain encompasses the structures, transmission methods, transport formats, and security measures used to provide integrity, availability, authentication, and confidentiality for transmissions over private and public communications networks and media.”

Question 30

QUESTION NO: 30 Which one of the following is the MOST crucial link in the computer security chain? A. Access controls B. People C. Management D. Awareness programs

Answer 30

Answer: C

Question 31

QUESTION NO: 31 The security planning process must define how security will be managed, who will be responsible, and A. Who practices are reasonable and prudent for the enterprise. B. Who will work in the security department. C. What impact security will have on the intrinsic value of data. D. How security measures will be tested for effectiveness.

Answer 31

Answer: D

Question 32

QUESTION NO: 32 Information security is the protection of data. Information will be protected mainly based on: A. Its sensitivity to the company. B. Its confidentiality. C. Its value. D. All of the choices.

Answer 32

Answer: D Explanation: Information security is the protection of data against accidental or malicious disclosure, modification, or destruction. Information will be protected based on its value, confidentiality, and/or sensitivity to the company, and the risk of loss or compromise. At a minimum, information will be update-protected so that only authorized individuals can modify or erase the information.

Question 33

QUESTION NO: 33 Organizations develop change control procedures to ensure that A. All changes are authorized, tested, and recorded. B. Changes are controlled by the Policy Control Board (PCB). C. All changes are requested, scheduled, and completed on time. D. Management is advised of changes made to systems.

Answer 33

Answer: A Explanation: “Change Control: Changes must be authorized, tested, and recorded. Changed systems may require re-certification and re-accreditation.”

Question 34

QUESTION NO: 34 Within the organizational environment, the security function should report to an organizational level that A. Has information technology oversight. B. Has autonomy from other levels. C. Is an external operation. D. Provides the internal audit function.

Answer 34

Answer: B

Question 35

QUESTION NO: 35 What is the MAIN purpose of a change control/management system? A. Notify all interested parties of the completion of the change. B. Ensure that the change meets user specifications. C. Document the change for audit and management review. D. Ensure the orderly processing of a change request.

Answer 35

Answer: C

Question 36

QUESTION NO: 36 Which of the following is most relevant to determining the maximum effective cost of access control? A. the value of information that is protected B. management’s perceptions regarding data importance C. budget planning related to base versus incremental spending. D. the cost to replace lost data

Answer 36

Answer: A

Question 37

QUESTION NO: 37 Which one of the following is the MAIN goal of a security awareness program when addressing senior management? A. Provide a vehicle for communicating security procedures. B. Provide a clear understanding of potential risk and exposure. C. Provide a forum for disclosing exposure and risk analysis. D. Provide a forum to communicate user responsibilities.

Answer 37

Answer: B Explanation: When the Security Officer is addressing Senior Management, the focus would not be on user responsibilities, it would be on making sure the Senior Management have a clear understanding of the risk and potential liability is Not D: Item D would be correct in a situation where Senior Management is addressing organizational staff.

Question 38

QUESTION NO: 38 In developing a security awareness program, it is MOST important to A. Understand the corporate culture and how it will affect security. B. Understand employees preferences for information security. C. Know what security awareness products are available. D. Identify weakness in line management support.

Answer 38

Answer: A Explanation: The controls and procedures of a security program should reflect the nature of the data being processed…These different types of companies would also have very different cultures. For a security awareness program to be effective, these considerations must be understood and the program should be developed in a fashion that makes sense per environment

Question 39

QUESTION NO: 39 Which of the following would be best suited to provide information during a review of the controls over the process of defining IT service levels? A. Systems programmer B. Legal stuff C. Business unit manager D. Programmer

Answer 39

Answer: C

Question 40

QUESTION NO: 40 Which of the following best explains why computerized information systems frequently fail to meet the needs of users? A. Inadequate quality assurance (QA) tools B. Constantly changing user needs C. Inadequate user participation in defining the system’s requirements D. Inadequate project management.

Answer 40

Answer: C

Question 41

QUESTION NO: 41 Which of the following is not a compensating measure for access violations? A. Backups B. Business continuity planning C. Insurance D. Security awareness

Answer 41

Answer: D

Question 42

QUESTION NO: 42 Risk analysis is MOST useful when applied during which phase of the system development process? A. Project identification B. Requirements definition C. System construction D. Implementation planning

Answer 42

Answer: A

Question 43

QUESTION NO: 43 Which one of the following is not one of the outcomes of a vulnerability analysis? A. Quantative loss assessment B. Qualitative loss assessment C. Formal approval of BCP scope and initiation document D. Defining critical support areas

Answer 43

Answer: C

Question 44

QUESTION NO: 44 Which of the following is not a part of risk analysis? A. Identify risks B. Quantify the impact of potential threats C. Provide an economic balance between the impact of the risk and the cost of the associated countermeasures D. Choose the best countermeasure

Answer 44

Answer: D

Question 45

QUESTION NO: 45 A new worm has been released on the Internet. After investigation, you have not been able to determine if you are at risk of exposure. Management is concerned as they have heard that a number of their counterparts are being affected by the worm. How could you determine if you are at risk? A. Evaluate evolving environment. B. Contact your anti-virus vendor. C. Discuss threat with a peer in another organization. D. Wait for notification from an anti-virus vendor.

Answer 45

Answer: B

Question 46

QUESTION NO: 46 When conducting a risk assessment, which one of the following is NOT an acceptable social engineering practice? A. Shoulder surfing B. Misrepresentation C. Subversion D. Dumpster diving

Answer 46

Answer: A Explanation: Shoulder Surfing: Attackers can thwart confidentiality mechanisms by network monitoring, shoulder surfing, stealing password files, and social engineering. These topics will be address more in-depth in later chapters, but shoulder surfing is when a person looks over another person’s shoulder and watches keystrokes or data as it appears on the screen. Social engineering is tricking another person into sharing confidential information by posing as an authorized individual to that information.

Question 47

QUESTION NO: 47 Which one of the following risk analysis terms characterizes the absence or weakness of a riskreducing safegaurd? A. Threat B. Probability C. Vulnerability D. Loss expectancy

Answer 47

Answer: C Explanation: A weakness in system security procedures, system design, implementation, internal controls, and so on that could be exploited to violate system security policy.

Question 48

QUESTION NO: 48 Risk is commonly expressed as a function of the A. Systems vulnerabilities and the cost to mitigate. B. Types of countermeasures needed and the system’s vulnerabilities. C. Likelihood that the harm will occur and its potential impact. D. Computer system-related assets and their costs.

Answer 48

Answer: C Explanation: The likelihood of a threat agent taking advantage of a vulnerability. A risk is the loss potential, or probability, that a threat will exploit a vulnerability.

Question 49

QUESTION NO: 49 How should a risk be handled when the cost of the countermeasures outweighs the cost of the risk? A. Reject the risk B. Perform another risk analysis C. Accept the risk D. Reduce the risk

Answer 49

Answer: C

Question 50

QUESTION NO: 50 Which of the following is an advantage of a qualitative over quantitative risk analysis? A. It prioritizes the risks and identifies areas for immediate improvement in addressing the vulnerabilities. B. It provides specific quantifiable measurements of the magnitude of the impacts C. It makes cost-benefit analysis of recommended controls easier

Answer 50

Answer: A

Question 51

QUESTION NO: 51 The absence or weakness in a system that may possibly be exploited is called a(n)? A. Threat B. Exposure C. Vulnerability D. Risk

Answer 51

Answer: C

Question 52

QUESTION NO: 52 What tool do you use to determine whether a host is vulnerable to known attacks? A. Padded Cells B. Vulnerability analysis C. Honey Pots D. IDS

Answer 52

Answer: B Explanation: Vulnerability analysis (also known as vulnerability assessment) tools test to determine whether a network or host is vulnerable to known attacks. Vulnerability assessment represents a special case of the intrusion detection process. The information sources used are system state attributes and outcomes of attempted attacks. The information sources are collected by a part of the assessment engine. The timing of analysis is interval-based or batch-mode, and the type of analysis is misuse detection. This means that vulnerability assessment systems are essentially batch mode misuse detectors that operate on system state information and results of specified test routines.

Question 53

QUESTION NO: 53 Which of the following statements pertaining to ethical hacking is incorrect? A. An organization should use ethical hackers who do not sell auditing, consulting, hardware, software, firewall, hosting, and/or networking services B. Testing should be done remotely C. Ethical hacking should not involve writing to or modifying the target systems D. Ethical hackers should never use tools that have potential of exploiting vulnerabilities in the organizations IT system.

Answer 53

Answer: D

Question 54

QUESTION NO: 54 Why would an information security policy require that communications test equipment be controlled? A. The equipment is susceptible to damage B. The equipment can be used to browse information passing on a network C. The equipment must always be available for replacement if necessary D. The equipment can be used to reconfigure the network multiplexers

Answer 54

Answer: B

Question 55

QUESTION NO: 55 Management can expect penetration tests to provide all of the following EXCEPT A. identification of security flaws B. demonstration of the effects of the flaws C. a method to correct the security flaws. D. verification of the levels of existing infiltration resistance

Answer 55

Answer: C Explanation: Not B: It is not the objective of the pen tester to supply a method on how to correct the flaws. In fact management may decide to accept the risk and not repair the flaw. They may be able to demonstrate the effects of a flaw – especially if they manage to clobber a system! Penetration testing is a set of procedures designed to test and possibly bypass security controls of a system. Its goal is to measure an organization’s resistance to an attack and to uncover any weaknesses within the environment…The result of a penetration test is a report given to management describing the list of vulnerabilities that were identified and the severity of those vulnerabilities. From here, it is up to management to determine how the vulnerabilities are dealt with and what countermeasures are implemented.

Question 56

QUESTION NO: 56 Which one of the following is a characteristic of a penetration testing project? A. The project is open-ended until all known vulnerabilities are identified. B. The project schedule is plotted to produce a critical path. C. The project tasks are to break into a targeted system. D. The project plan is reviewed with the target audience.

Answer 56

Answer: C Explanation: “One common method to test the strength of your security measures is to perform penetration testing. Penetration testing is a vigorous attempt to break into a protected network using any means necessary.”

Question 57

QUESTION NO: 57 Which one of the following is the PRIMARY objective of penetration testing? A. Assessment B. Correction C. Detection D. Protection

Answer 57

Answer: C Explanation: Its goal is to measure an organization’s resistance to an attack and to uncover any weakness within the environment…The result of a penetration test is a report given to management describing the list of vulnerabilities that were identified and the severity of those vulnerabilities. - Not A: Assessment would imply management deciding whether they can live with a given vulnerability.

Question 58

QUESTION NO: 58 Open box testing, in the Flaw Hypothesis Methodology of Penetration Testing applies to the analysis of A. Routers and firewalls B. Host-based IDS systems C. Network-based IDS systems D. General purpose operating systems

Answer 58

Answer: D Explanation: Flaw Hypothesis Methodology - A system analysis and penetration technique where specifications and documentation for the system are analyzed and then flaws in the system are hypothesized. The list of hypothesized flaws is then prioritized on the basis of the estimated probability that a flaw actually exists and, assuming a flaw does exist, on the ease of exploiting it and on the extent of control or compromise it would provide. The prioritized list is used to direct the actual testing of the system.

Question 59

QUESTION NO: 59 What is the FIRST step that should be considered in a penetration test? A. The approval of change control management. B. The development of a detailed test plan. C. The formulation of specific management objectives. D. The communication process among team members.

Answer 59

Answer: C Explanation: The type of penetration test depends on the organization, its security objectives, and the management’s goals.

Question 60

QUESTION NO: 60 Penetration testing will typically include A. Generally accepted auditing practices. B. Review of Public Key Infrastructure (PKI) digital certificate, and encryption. C. Social engineering, configuration review, and vulnerability assessment. D. Computer Emergency Response Team (CERT) procedures.

Answer 60

Answer: C

Question 61

QUESTION NO: 61 Which of the following is not a valid reason to use external penetration service firms rather than corporate resources? A. They are more cost-effective B. They offer a lack of corporate bias C. They use highly talented ex-hackers D. They insure a more complete reporting

Answer 61

Answer: C

Question 62

QUESTION NO: 62 Which of the following tools can you use to assess your networks vulnerability? A. ISS B. All of the choices. C. SATAN D. Ballista

Answer 62

Answer: B Explanation: ISS, Ballista and SATAN are all penetration tools.

Question 63

QUESTION NO: 63 Annualized Loss Expectancy (ALE) value is derived from an algorithm of the product of annual rate of occurrence and A. Cost of all losses expected. B. Previous year’s actual loss. C. Average of previous losses. D. Single loss expectancy.

Answer 63

Answer: D Explanation: Single Loss Expectancy (SLE) x Annualized Rate of Occurance (ARO) = ALE

Question 64

QUESTION NO: 64 If your property insurance has Actual Cost Evaluation (ACV) clause your damaged property will be compensated: A. Based on the value of the item on the date of loss B. Based on new item for old regardless of condition of lost item C. Based on value of item one month before loss D. Based on value of item on the date of loss plus 10 percent

Answer 64

Answer: D

Question 65

QUESTION NO: 65 How is Annualized Loss Expectancy (ALE) derived from a threat? A. ARO x (SLE – EF) B. SLE x ARO C. SLE/EF D. AV x EF

Answer 65

Answer: B Explanation: “SLE x annualized rate of occurrence (ARO) = ALE”

Question 66

QUESTION NO: 66 Qualitative loss resulting from the business interruption does not include: A. Loss of revenue B. Loss of competitive advantage or market share C. Loss of public confidence and credibility D. Public embarrassment

Answer 66

Answer: A Explanation: “Another method of risk analysis is qualitative, which does not assign numbers and monetary valu8es to components and losses.”

Question 67

QUESTION NO: 67 Which risk management methodology uses the exposure factor multiplied by the asset value to determine its outcome? A. Annualized Loss Expectancy B. Single Loss Expectancy C. Annualized Rate of Occurrence D. Information Risk Management

Answer 67

Answer: B Explanation: Single Loss Expectancy (SLE) AN SLE is the dollar figure that is assigned to a single event. It represents an organization’s loss from a single threat and is derived from the following formula: Asset Value ($) X Exposure Factor (EF) = SLE

Question 68

QUESTION NO: 68 Valuable paper insurance coverage does not cover damage to which of the following? A. Inscribed, printed and written documents B. Manuscripts C. Records D. Money and Securities

Answer 68

Answer: D

Question 69

QUESTION NO: 69 What is the window of time for recovery of information processing capabilities based on? A. Quality of the data to be processed B. Nature of the disaster C. Criticality of the operations affected D. Applications that are mainframe based

Answer 69

Answer: C

Question 70

QUESTION NO: 70 What is the Maximum Tolerable Downtime (MTD): A. Maximum elapsed time required to complete recovery of application data B. Minimum elapsed time required to complete recovery of application data C. Maximum elapsed time required to move back to primary site a major disruption D. It is maximum delay businesses that can tolerate and still remain viable

Answer 70

Answer: D Explanation: “The MTD is the period of time a business function or process can remain interrupted before its ability to recover becomes questionable.”

Question 71

QUESTION NO: 71 A “critical application” is one that MUST A. Remain operational for the organization to survive. B. Be subject to continual program maintenance. C. Undergo continual risk assessments. D. Be constantly monitored by operations management.

Answer 71

Answer: A Explanation: “A BIA is performed at the beginning of disaster recovery and continuity planning to identify the areas that would suffer the greatest financial or operational loss in the event of a disaster or disruption. It identifies the company’s critical systems needed for survival and estimates the outage time that can be tolerated by the company as a result of disaster or disruption.”

Question 72

QUESTION NO: 72 Which of the following questions is less likely to help in assessing physical and environmental protection? A. Are entry codes changed periodically? B. Are appropriate fire suppression and prevention devices installed and working? C. Are there processes to ensure that unauthorized individuals cannot read, copy, alter, or steal printed or electronic information? D. Is physical access to data transmission lines controlled?

Answer 72

Answer: C

Question 73

QUESTION NO: 73 A common Limitation of information classification systems is the INABILITY to A. Limit the number of classifications. B. Generate internal labels on diskettes. C. Declassify information when appropriate. D. Establish information ownership.

Answer 73

Answer: C Explanation: I could not find a reference for this. However I do agree that declassifying information is harder to do the classifying, but use your best judgment based on experience and knowledge.

Question 74

QUESTION NO: 74 The purpose of information classification is to A. Assign access controls. B. Apply different protective measures. C. Define the parameters required for security labels. D. Ensure separation of duties.

Answer 74

Answer: B

Question 75

QUESTION NO: 75 Who should determine the appropriate access control of information? A. Owner B. User C. Administrator D. Server

Answer 75

Answer: A Explanation: All information generated, or used must have a designated owner. The owner must determine appropriate sensitivity classifications, and access controls. The owner must also take steps to ensure the appropriate controls for the storage, handling, distribution, and use of the information in a secure manner.

Question 76

QUESTION NO: 76 What is the main responsibility of the information owner? A. making the determination to decide what level of classification the information requires B. running regular backups C. audit the users when they require access to the information D. periodically checking the validity and accuracy for all data in the information system

Answer 76

Answer: A

Question 77

QUESTION NO: 77 What process determines who is trusted for a given purpose? A. Identification B. Authorization C. Authentication D. Accounting

Answer 77

Answer: B Explanation: Authorization determines who is trusted for a given purpose. More precisely, it determines whether a particular principal, who has been authenticated as the source of a request to do something, is trusted for that operation. Authorization may also include controls on the time at which something can be done (e.g. only during working hours) or the computer terminal from which it can be requested (e.g. only the one on the system administrator desk).

Question 78

QUESTION NO: 78 The intent of least privilege is to enforce the most restrictive user rights required A. To execute system processes. B. By their job description. C. To execute authorized tasks. D. By their security role.

Answer 78

Answer: C Explanation: Least Privilege; the security principle that requires each subject to be granted the most restrictive set of privileges needed for the performance of authorized tasks. The application of this principle limits the damage that can result from accident, error, or unauthorized.

Question 79

QUESTION NO: 79 What principle requires that a user be given no more privilege then necessary to perform a job? A. Principle of aggregate privilege. B. Principle of most privilege. C. Principle of effective privilege. D. Principle of least privilege.

Answer 79

Answer: D Explanation: As described at http://hissa.nist.gov/rbac/paper/node5.html, the principle of least privilege has been described as important for meeting integrity objectives. The principle of least privilege requires that a user be given no more privilege than necessary to perform a job.

Question 80

QUESTION NO: 80 To ensure least privilege requires that __________ is identified. A. what the users privilege owns B. what the users job is C. what the users cost is D. what the users group is

Answer 80

Answer: B Explanation: Ensuring least privilege requires identifying what the user’s job is, determining the minimum set of privileges required to perform that job, and restricting the user to a domain with those privileges and nothing more. By denying to subjects transactions that are not necessary for the performance of their duties, those denied privileges couldn’t be used to circumvent the organizational security policy. Although the concept of least privilege currently exists within the context of the TCSEC, requirements restrict those privileges of the system administrator. Through the use of RBAC, enforced minimum privileges for general system users can be easily achieved.

Question 81

QUESTION NO: 81 The concept of least privilege currently exists within the context of: A. ISO B. TCSEC C. OSI D. IEFT

Answer 81

Answer: B Explanation: Ensuring least privilege requires identifying what the user’s job is, determining the minimum set of privileges required to perform that job, and restricting the user to a domain with those privileges and nothing more. By denying to subjects transactions that are not necessary for the performance of their duties, those denied privileges couldn’t be used to circumvent the organizational security policy. Although the concept of least privilege currently exists within the context of the TCSEC, requirements restrict those privileges of the system administrator. Through the use of RBAC, enforced minimum privileges for general system users can be easily achieved.

Question 82

QUESTION NO: 82 Which of the following rules is less likely to support the concept of least privilege? A. The number of administrative accounts should be kept to a minimum B. Administrators should use regular accounts when performing routing operations like reading mail C. Permissions on tools that are likely to be used by hackers should be as restrictive as possible D. Only data to and from critical systems and applications should be allowed through the firewall

Answer 82

Answer: D

Question 83

QUESTION NO: 83 Which level of “least privilege” enables operators the right to modify data directly in it’s original location, in addition to data copied from the original location? A. Access Change B. Read/Write C. Access Rewrite D. Access modify

Answer 83

Answer: A

Question 84

QUESTION NO: 84 This is a common security issue that is extremely hard to control in large environments. It occurs when a user has more computer rights, permissions, and privileges that what is required for the tasks the user needs to fulfill. What best describes this scenario? A. Excessive Rights B. Excessive Access C. Excessive Permissions D. Excessive Privileges

Answer 84

Answer: D Reference: “Excessive Privileges: This is a common security issue that is extremely hard to control in vast, complex environments. It occurs when a user has more computer rights, permissions, and privileges than what is required for the tasks she needs to fulfill.”

Question 85

QUESTION NO: 85 One method to simplify the administration of access controls is to group A. Capabilities and privileges B. Objects and subjects C. Programs and transactions D. Administrators and managers

Answer 85

Answer: B

Question 86

QUESTION NO: 86 Cryptography does not concern itself with: A. Availability B. Integrity C. Confidentiality D. Authenticity

Answer 86

Answer: A

Question 87

QUESTION NO: 87 Which of the following measures would be the BEST deterrent to the theft of corporate information from a laptop which was left in a hotel room? A. Store all data on disks and lock them in an in-room safe B. Remove the batteries and power supply from the laptop and store them separately from the computer C. Install a cable lock on the laptop when it is unattended D. Encrypt the data on the hard drive

Answer 87

Answer: D

Question 88

QUESTION NO: 88 To support legacy applications that rely on risky protocols (e.g,, plain text passwords), which one of the following can be implemented to mitigate the risks on a corporate network? A. Implement strong centrally generated passwords to control use of the vulnerable applications. B. Implement a virtual private network (VPN) with controls on workstations joining the VPN. C. Ensure that only authorized trained users have access to workstations through physical access control. D. Ensure audit logging is enabled on all hosts and applications with associated frequent log reviews.

Answer 88

Answer: B Explanation: It makes more sense to provide VPN client to workstations opposed to physically securing workstations.

Question 89

QUESTION NO: 89 Which of the following computer crime is more often associated with insiders? A. IP spoofing B. Password sniffing C. Data diddling D. Denial of Service (DOS)

Answer 89

Answer: C

Question 90

QUESTION NO: 90 The technique of skimming small amounts of money from multiple transactions is called the A. Scavenger technique B. Salami technique C. Synchronous attack technique D. Leakage technique

Answer 90

Answer: B

Question 91

QUESTION NO: 91 What best describes a scenario when an employee has been shaving off pennies from multiple accounts and depositing the funds into his own bank account? A. Data fiddling B. Data diddling C. Salami techniques D. Trojan horses

Answer 91

Answer: C

Question 92

QUESTION NO: 92 What is the act of willfully changing data, using fraudulent input or removal of controls called? A. Data diddling B. Data contaminating C. Data capturing D. Data trashing

Answer 92

Answer: A Explanation: Data-diddling - the modification of data

Question 93

QUESTION NO: 93 In the context of computer security, “scavenging” refers to searching A. A user list to find a name. B. Through storage to acquire information. C. Through data for information content. D. Through log files for trusted path information.

Answer 93

Answer: C Explanation: Scavenging is a form of dumpster diving performed electronically. Online scavenging searches for useful information in the remnants of data left over after processes or tasks are completed. This could include audit trails, logs files, memory dumps, variable settings, port mappings, and cached data.

Question 94

QUESTION NO: 94 Which security program exists if a user accessing low-level data is able to draw conclusions about high-level information? A. Interference B. Inference C. Polyinstatiation D. Under-classification

Answer 94

Answer: B Explanation: Main Entry: in*fer*ence Function: noun Date: 1594 1 : the act or process of inferring : as a : the act of passing from one proposition, statement, or judgment considered as true to another whose truth is believed to follow from that of the former b : the act of passing from statistical sample data to generalizations (as of the value of population parameters) usually with calculated degrees of certainty 2 : something that is inferred; especially : a proposition arrived at by inference 3 : the premises and conclusion of a process of inferring

Question 95

QUESTION NO: 95 Which of the following is not a form of a passive attack? A. Scavenging B. Data diddling C. Shoulder surfing D. Sniffing

Answer 95

Answer: B Explanation: Data diddling is an active attack opposed to a passive attack. Reference: “Data Diddling occurs when an attacker gains access to a system and makes small, random, or incremental changes to data rather than obviously altering file contents or damaging or deleting entire files.”

Question 96

QUESTION NO: 96 An example of an individual point of verification in a computerized application is A. An inference check. B. A boundary protection. C. A sensitive transaction. D. A check digit.

Answer 96

Answer: D Explanation: Checkdigit: A one-digit checksum. Checksum: A computed value which depends on the contents of a block of data and which is transmitted or stored along with the data in order to detect corruption of the data. The receiving system recomputes the checksum based upon the received data and compares this value with the one sent with the data. If the two values are the same, the receiver has some confidence that the data was received correctly. The checksum may be 8 bits (modulo 256 sum), 16, 32, or some other size. It is computed by summing the bytes or words of the data block ignoring overflow. The checksum may be negated so that the total of the data words plus the checksum is zero.

Question 97

QUESTION NO: 97 Data inference violations can be reduced using A. Polyinstantiation technique. B. Rules based meditation. C. Multi-level data classification. D. Correct-state transformation.

Answer 97

Answer: A Explanation: “Polyinstantiation is the development of a detailed version of an object from another object using different values in the new object. In the database information security, this term is concerned with the same primary key for different relations at different classification levels being stored in the same database. For example, in a relational database, the same of a military unit may be classified Secret in the database and may have an identification number as the primary key. If another user at a lower classification level attempts to create a confidential entry for another military unit using the same identification number as a primary key, a rejection of this attempt would imply to the lower level user that the same identification number existed at a higher level of classification. To avoid this inference channel of information, the lower level user would be issued the same identification number for their unit and the database management system would manage this situation where the same primary key was used for different units.”