Chapter 15 Flashcards
The goal of what type of threat evaluation is to better understand who the attackers are, why they
attack, and what types of attacks might occur?
Threat modeling
What is the name of the process that takes a snapshot of the current security of an organization?
vulnerability appraisal
Which item below is an imaginary line by which an element is measured or compared, and can be seen
as the standard?
Baseline
The comparison of the present state of a system to its baseline is known as what?
Baseline reporting
In order to minimize vulnerabilities in software, code should be subject to and analyzed while it is
being written in what option below?
code review
What is the name for the code that can be executed by unauthorized users within a software product?
attack surface
During a vulnerability assessment, what type of software can be used to search a system for port
vulnerabilities?
Port scanner
A port in what state below implies that an application or service assigned to that port is listening for
any instructions?
Open
An administrator running a port scan wants to ensure that no processes are listening on port 23. What
state should the port be in?
Closed port
An administrator needs to view packets and decode and analyze their contents. What type of
application should the administrator use?
protocol analyzer
Which is the term for a computer typically located in an area with limited security and loaded with
software and data files that appear to be authentic, yet they are actually imitations of real data files?
Honeypot
What is the term for a network set up with intentional vulnerabilities?
Honeynet
What is another term used for a security weakness?
vulnerability
Which scan examines the current security, in a passive method?
vulnerability scan
What is the end result of a penetration test?
penetration test report
Which tester has an in-depth knowledge of the network and systems being tested, including network
diagrams, IP addresses, and even the source code of custom applications?
white box
A service contract between a vendor and a client that specifies what services will be provided, the
responsibilities of each party, and any guarantees of service, is known as a:
Service Level Agreement (SLA)
What term below describes a prearranged purchase or sale agreement between a government agency
and a business?
Blanket Purchase Agreement (BPA)
What security goal do the following common controls address: hashing, digital signatures,
certificates, nonrepudiation tools?
Integrity
What term below describes the start-up relationship between partners?
On-boarding
