IS4550 CHAPTER 9

Question 1

A leading technique, methodology, or technology that through experience has proved to be very reliable and tends to produce consistent and quality results is called ___.

Answer 1

BEST PRACTICE

Question 2

Temporary workers who can be assigned to any role is called ___.

Answer 2

CONTRACTORS

Question 3

Assets that are essential for the society and economy to function is called ___.

Answer 3

CRITICAL INFRASTRUCTURE

Question 4

In the context of information security, this refers to a process by which senior leaders through a chain of command are apprised of a risk. This continues one level of organizational structure at a time until the issue is addressed or has reached the highest level of the organization is called ___.

Answer 4

ESCALATION

Question 5

Granting elevated rights temporarily to enable a person to resolve a problem quickly and provides emergency access to unprivileged users is called ___.

Answer 5

FIRECALL-ID PROCESS

Question 6

To eliminate as many security risks as possible by reducing access rights to the minimum needed to perform any task, ensuring access is authenticated to unique individuals, removing all nonessential software, and other configuration steps that eliminate opportunities for unauthorized access is called ___.

Answer 6

HARDEN

Question 7

An employee, consultant, contractor, or vendor; the ___ may even be the IT technical people who designed the system, application, or security that is being hacked. The ___ know the organization and the applications.

Answer 7

INSIDER

Question 8

An ___ is when two or more audit disciplines are combined to conduct a single audit

Answer 8

INTEGRATED AUDIT

Question 9

Captures the keystrokes of a user is called ___.

Answer 9

KEYLOGGER SOFTWARE

Question 10

___ is a separate platform used to collect logs from platforms throughout the network.

Answer 10

LOG SERVER

Question 11

When a hacker outlines a story in which the employee is asked to reveal information that weakens the security is called ___.

Answer 11

PRETEXTING

Question 12

Designed to heighten the awareness and accountability of those users with administrator rights is called ___.

Answer 12

PRIVILEGED-LEVEL ACCESS AGREEMENT (PAA)

Question 13

Individuals responsible for designing and implementing a security program within an organization is called ___.

Answer 13

SECURITY PERSONNEL

Question 14

.Manipulating or tricking a person into weakening the security of an organization is called ___.

Answer 14

SOCIAL ENGINEERING

Question 15

A type of attack in which the hacker adds this code to a Web or application input box to gain access to or alter data in the database is called ___.

Answer 15

STRUCTURE QUERY LANGUAGE (SQL) INJECTION

Question 16

Hardware and software that collects critical information to keep a facility operating is called ___.

Answer 16

SUPERVISORY CONTROL AND DATA ACQUISITION (SCADA) SYSTEM

Question 17

A complete record of what access was granted and the business reason behind it in order to resolve a problem is called ___.

Answer 17

TROUBLE TICKET

Question 18

1. Pretexting is when a hacker breaks into a firewall.

TRUE OR FALSE

Answer 18

FALSE

Question 19

2. What can key logger software capture?
3. Usernames
4. Passwords
5. Websites visited
6. All the above

Answer 19

Usernames
Passwords
Websites visited

Question 20

3. You can use a ___ process to grant temporary elevated rights.

Answer 20

Firecall-ID

Question 21

4. Security awareness is required by which of the following?
5. Law
6. Customers
7. Shareholders
8. All the above

Answer 21

Law

Question 22

5. A(n) ___ looks at risk and issues an independent opinion.

Answer 22

Auditor

Question 23

6. A privileged-level access agreement (pas) prevents an administrator from abusing elevated rights.
   TRUE OR FALSE

Answer 23

FALSE

Question 24

7. which of the following does an acceptable use policy relate to?
8. Server to server communication
9. Users accessing the Internet
10. Encryption when transmitting files
11. 1 and 2

Answer 24

Users accessing the Internet

Question 25

8. A(n) ___ has inside information on how an organization operates.

Answer 25

Insider

Question 26

9. Social engineering occurs when a hacker posts her victories on s social Web site.
   TRUE OR FALSE

Answer 26

FALSE

Question 27

10. Typically in large organizations all administrators have the same level of authority.
    TRUE OR FALSE

Answer 27

FALSE

Question 28

11. A CISO must ___ risks if the business unit is not responsive.

Answer 28

Escalate