CISSP Flash Cards
(689 cards)
1
Q
- What are some examples of detective access controls?
A
Security guards, supervising users, incident investigations, and intrusion detection systems
2
Q
- What are some examples of physical access controls?
A
Guards, fences, motion detectors, locked doors, sealed windows, lights, backups, cable protection, laptop locks, swipe cards, dogs, CCTV, mantraps, and alarms
3
Q
- What are the three commonly recognized authentication factors?
A
Something you know, something you have, and something you are
4
Q
- What is a cognitive password?
A
A series of questions about facts or predefined responses that only the subject should know (for example, what is your birth date? What is your mother’s maiden name?)
5
Q
- Name at least eight biometric factors.
A
Fingerprints, face scans, iris scans, retina scans palm topography, palm geography, heart/pulse pattern, voice patter, signature dynamics, keystroke patterns
6
Q
- What are the issues related to user acceptance of biometric enrollment and throughput rate?
A
Enrollment times longer than 2 minutes are unacceptable; subjects will typically accept a throughput rate of about 6 seconds or faster.
7
Q
- What access control technique employs security labels?
A
Mandatory access controls. Subjects are labeled as to their level of clearance. Objects are labeled as to their level of classification or sensitivity.
8
Q
- The Bell-LaPadula, Biba, and Clark-Wilson access control models were all designed to protect a single aspect of security. Name the corresponding aspect for each model.
A
Bell-Lapadula: Protects confidentiality
Biba and Clark-Wilson: protect integrity
9
Q
Name the three types of subjects and their roles in a security environment.
A
The user accesses objects on a system to perform a work task; the owner is liable for protection of data; the data custodian is assigned to classify and protect data.
10
Q
- Explain why the separation of duties and responsibilities is a common security practice.
A
It prevents any single subject from being able to circumvent or disable security mechanisms.
11
Q
- What is the principle of least privilege?
A
Subjects should be granted only the amount of access to objects that is required to accomplish their assigned work tasks.
12
Q
- Name the four key principles upon which access control relies.
A
Identification, authentication, authorization, accountability
13
Q
- How are domains related to decentralized access control?
A
A domain is a realm of trust that shares a common security policy. This is a form of decentralized access control.
14
Q
- Why is monitoring an important part of a security policy?
A
Monitoring is used to watch for security policy violations and to detect unauthorized or abnormal activities.
15
Q
- What are the functions of an intrusion detection system (IDS)?
A
An IDS automates the inspection of audit logs and real-time system events, detects intrusion attempts, and watched for violations of confidentiality, integrity, and availability.
16
Q
- What are the pros and cons of a host-based IDS?
A
It can pinpoint resources compromised by a malicious user. It can’t detect network-only attacks or attacks on other systems, has difficulty detecting DoS attacks, and can be detected by intruders.
17
Q
- What are the pros and cons of a network-based IDS?
A
It can monitor a large network and can be hardened against attack. It may be unable to handle large data flows, requires a central view of traffic, and can’t pinpoint compromised resources.
18
Q
- What are the differences between knowledge-based and behavior-based detection methods used by IDS?
A
Knowledge-based uses a signature database and tries to match monitored events to that database. Behavior-based learns about the normal activities on your system through watching and learning.
19
Q
- What is a honeynet, and what is it used for?
A
Honeynets are fake networks used to lure intruders in order to create sufficient audit trails for tracking them down and prosecuting. Honeynets contain no real or sensitive data.
20
Q
- How does penetration testing improve your system’s security?
A
Penetration testing is a good way to accurately judge the security mechanisms deployed by an organization.
21
Q
- What is a denial-of-service attack?
A
An attack that prevents the system from receiving, processing, or responding to legitimate traffic or requests for resources and objects.
22
Q
- What is a spoofing attack?
A
The attacker pretends to be someone or something other than whom or what they are. They can spoof identities, IP addresses email addresses, and phone numbers. They often replace the valid source and/or destination IP address and node numbers with false ones.
23
Q
- What are countermeasures to spoofing attacks?
A
Countermeasures to spoofing attacks include patching the OS and software, enabling source/destination verification on routers, and employing an IDS to detect and block attacks.
24
Q
- What is a man-in-the-middle attack?
A
An attack in which a malicious user is positioned between the two endpoints of a communication’s link
25
25. What is a replay or Playback attack?
A malicious user records the traffic between a client and a server and then retransmits them to the server with slight variations of the timestamp and source IP address. It is similar to hijacking.
26
26. What is a sniffer attack?
Any activity that results in a malicious user obtaining information about a network or the traffic over that network. Data is captured using a sniffer or protocol analyzer.
27
27. What is a spamming attack?
Directing floods of messages to a victim's email inbox or other messaging system. Such attacks cause DoS issues y filling up storage space and preventing legitimate messages from being delivered.
28
28. What are some countermeasures to common attack methods?
Patching software, reconfiguring security, employing firewalls, updating filters, using IDSs/IPSs, improving security policy, using traffic filters, improving physical access control, using system monitoring/auditing
29
29. Name the seven layers of the OSI model by their layer name and layer number.
```
7 - Application
6 - Presentation
5 - Session
4 - Transport
3 - Network
2 - Data Link
1 - Physical
```
30
30. List the security features offered by the Network layer of the OSI model.
The Network layer (layer 3) offers confidentiality, authentication, and integrity.
31
31. What is the maximum throughput rate and maximum usable distance for 10Base2 cable?
10Base2 cable has a throughput of 10 Mbps and can be run up to distances of 185 meters.
32
32. Name the common network topologies.
Ring, bus, star, and mesh
33
33. What are the four layers of the TCP/IP protocols, and how do they relate to the OSI model layers?
The four layers of TCP/IP are Application (layers 5-7 of OSI), Transport (layer 4 of OSI), internet (layer 3 of OSI), and Link (layers 1 and 2 of OSI).
34
34. What are the five generation types of firewalls?
Static packet filtering, application- level gateway, stateful inspection, dynamic packet filtering, and kernel proxy
35
35. Name at least five networking device types other than firewalls
Routers, switches, hubs, repeaters, bridges, gateways, proxies.
36
36. What is a proxy, and what is it used for?
Any system that performs a function or requests a service on behalf of another system. Proxies are most often used to provide clients with Internet access while protecting their identity.
37
37. Name at least 10 network and protocol security mechanisms.
IPsec, SKIP, SWIPE, SSL, S/MIME, SET, PEM, PGP, PPP, SLIP, PPTP, L2TP, CHAP, PAP, RADIUS, TACACS, S-RPC
38
38. Name at least six protocol services used to connect to LAN and WAN communication technologies.
Frame Relay, SMDS, X.25, ATM, HSSI, SDLC, HDLC, ISDN
39
39. How are PVC, SVC, DTE, and DCE used in a Frame Relay network?
Frame Relay requires the use of a DTE and a DCE at each connection point, PVC is always available; SVC is established using the best paths currently available.
40
What are three remote access authentication mechanisms?
RADIUS, DIAMETER, and TACACS
41
41. What is tunneling, and why is it used?
A process that protects the contents of packets by encapsulating them in another protocol. This creates the logical illusion of a communications tunnel through an untrusted intermediary network.
42
What is a VPN?
A Virtual Private Network (VPN) is a communication tunnel that provides point-to-point transmission of both authentication and data traffic over an intermediary network.
43
43. What are the four primary VPN protocols?
PPTP, L2F, L2TP, and IPsec (Note: SSL/TLS is a valid VPN protocol as well, but it's not necessarily recognized on the exam as such.
44
44. What are the two modes available through IPsec, and what do they do?
In transport mode, the IP packet data is encrypted, but the header is not. In tunnel mode, the entire IP packet is encrypted, and a new header is added to govern transmission through the tunnel.
45
45. What is NAT?
Network Address Translation (NAT) allows the private IP addresses defined in RFC 1918 to be used in a private network while still being able to communicate with the internet.
46
46. What is transparency?
A characteristic of a service, security control, or access mechanism that ensures it is unseen by users
47
47. What are some important aspects to consider when designing email security?
Nonrepudiation, access control, message integrity, source authentication, verified delivery, acceptable use policies, privacy, management, and backup and retention policies.
48
48. What is the most serious threat of email?
Email is a common delivery mechanism for viruses, worms, Trojan horses, documents with destructive macros, and other malicious code.
49
49. What are possible mechanisms for adding security to email?
S/MIME, MOSS, PEM, and PGP
50
50. What are elements of effective user training against social-engineering attacks?
Always error on the side of caution whenever communications are odd or unexpected. Always request proof of identity. Identify what information can be conveyed via voice communications by classifying the information. Never change passwords over the phone.
51
51. What are the most common threats against communication systems?
Denial of service, eavesdropping, impersonation, replay, and modification
52
52. What are some countermeasures to eavesdropping?
Maintaining physical access security, using encryption, employing one-time authentication methods
53
53. What is an ARP attack?
The modification of ARP mappings. When ARP mappings are falsified, packets are not sent to their proper destination. ARP mappings can be attacked through spoofing. Spoofing provides false MAC addresses for requested IP addressed systems to redirect traffic to alternate destinations.
54
54. What is privacy?
Prevention of unauthorized intrusion, knowledge that information deemed personal or confidential won't be shared with unauthorized entities, freedom from being observed without consent
55
55. What are the requirements for accountability?
Identification, authentication, authorization, and auditing
56
What is nonrepudiation?
Nonrepudiation prevents a subject from claiming not to have sent a message, not to have performed an action, or not to have been the cause of an event.
57
What is layering?
Layering is the use of multiple controls in a series. The use of a multilayered solution allows for numerous controls to be brought to bear against whatever threats occur.
58
58. How is abstraction used?
Abstraction is used to collect similar elements into groups, classes, or roles that are assigned security controls, restrictions, or permissions.
59
59. What is data hiding?
Data hiding is preventing data from being known by a subject. Keeping a database from being accessed by unauthorized visitors is a form of data hiding.
60
60. What is change control or change management?
A mechanism used to systematically manage change. Typically, it involves extensive logging, auditing, and monitoring of activities related to security controls and security solutions.
61
61. What are the goals of change management?
Implementation of changes in an orderly manner, formalized testing, ability to reverse changes, ability to inform users of changes, systematical analysis of changes minimization of negative impact of changes
62
62. What is data classification?
Data classification is the primary means by which data is protected based on categories of secrecy, sensitivity, or confidentiality.
63
63. What criteria are used to classify data?
Usefulness, timeliness, value or cost, maturity or age, lifetime or expiration period, disclosure damage assessment, modification damage assessment, national or business security implications, storage
64
64. What is the government/military data classification scheme?
Top secret, Secret, Confidential, Sensitive, and Unclassified
65
65. What is the commercial business/private sector classification scheme?
Confidential, Private, Sensitive, and Public
66
Name at least seven security management concepts and principles.
CIA Triad, confidentiality, Integrity, Availability, privacy, identification, authentication, authorization, auditing, accountability, and nonrepudiation
67
67. What are the elements of a termination procedure policy?
Have at least one witness; escort terminated employee off the premises immediately; collect identification, access, or security devices; perform exit interview; disable network account.
68
68. What is the function of the data owner security role?
The data owner is responsible for classifying information for protection within the security solution.
69
69. What is the data custodian security role?
The data custodian is assigned the tasks of implementing the prescribed protection defined by the security policy and upper management.
70
70. What is the function of the auditor security role?
The auditor is responsible for testing and verifying that the security policy is properly implemented and the derived security solutions are adequate.
71
71. What should the documents that make up a formalized security structure include?
Policies, standards, baselines, guidelines, and procedures
72
72. What is generally involved in the processes of risk management?
Analyzing an environment for risks, evaluating each risk as to its likelihood and damage, assessing the cost of countermeasures, and creating a cost/benefit report to present to upper management
73
73. What should be considered when establishing the value of an asset?
Cost of purchase, development, maintenance, acquisition, and protection; value to owners/users/competitors; equity value; market valuation; liability of asset loss; and usefulness.
74
74. Name at least five possible threats that should be evaluated when performing a risk analysis.
Viruses; buffer overflows; coding errors; user errors; intruders (physical and logical); natural disasters; equipment failure; misuse of data, resources, or services; loss of data; physical theft; denial of service
75
75. What is single loss expectancy, and how is it calculated?
The cost associated with a single realized risk against a specific asset. SLE = asset value (AV) * Exposure Factor (EF). The SLE is expressed in a dollar value.
76
76. What is annualized loss expectancy, and how is it calculated?
The possible yearly cost of all instances of a specific realized threat against a specific asset. ALE = Single Loss Expectancy (SLE) * annualized rate of occurrence (ARO).
77
77. What are the basic distinctions between qualitative and quantitative risk analysis?
Quantitative risk analysis assigns real dollar figures to the loss of an asset. Qualitative risk analysis assigns subjective and intangible values to the loss of an asset.
78
78. What are the four possible responses by upper/senior management to risk?
Reduce/mitigate, assign/transfer, accept, or reject/deny
79
79. What is residual risk?
Once countermeasures are implemented, the risk that remains is known as residual risk. Residual risk is the risk that management has chosen to accept rather than mitigate.
80
80. What is total risk?
The amount of risk an organization would face if no safeguards were implemented. A formula for total risk is threats*vulnerabilities* asset value = total risk.
81
81. What is the controls gap?
The difference between total risk and residual risk. The controls gap is the amount of risk that is reduced by implementing safeguards.
82
82. What are the three learning levels of security?
Awareness, training, and education
83
83. What are the three types of plans employed in security management planning?
A strategic plan is a long-term plan that is fairly stable. The tactical plan is a midterm plan that provides more details. Operational plans are short term and highly detailed.
84
84. How many primary keys may each dataase table have?
One
85
85. What type of malicious code spreads through the sharing of infected media?
Viruses
86
86. What term is used to describe intelligent code objects that perform actions on behalf of a user?
Agent
87
87. What term is used to describe code sent by a server to a client for execution on the client machine?
Applet
88
88. What language developed by Sun Microsystems, owned by Oracle, is often used for applet programming and development?
Java
89
89. What type of database key enforces relationships between tables?
Foreign key
90
90. What security principle ensures that multiple records are created in a database table for viewing at different security levels?
Polyinstantiation
91
91. What process evaluates the technical and nontechnical security features of an IT system?
Certification and accreditation
92
92. What type of accreditation evaluates the systems and applications at a specific, self-contained location?
Site accreditation
93
93. In which phase of the Software Capability Maturity Model do you often find hardworking people charging ahead in a disorganized fashion?
Initial
94
94. In which layer of the ring protection scheme do user applications reside?
Layer 3
95
95. What system mode requires that the system process only one classification level at a time and all system users have a clearance and need to know that information?
Dedicated security mode
96
96. What is another term for the Master boot record?
Boot sector
97
97. What type of virus embeds itself in application documents?
Macro virus
98
98. What can antivirus programs do when they encounter a virus infection?
Delete the file, disinfect the file, or quarantine the file.
99
99. What type of virus modifies itself each time it infects a new system in an attempt to avoid detection?
Polymorphic virus
100
100. What type of malicious code launches itself when certain conditions (such as a specific date) are met?
Logic bomb
101
101. What were the mechanisms of action used by Robert T. Morris's Internet worm of 1988?
The worm exploited vulnerabilities in the Sendmail debug mode and finger daemon, launched password attacks, and exploited trust relationships between systems.
102
102. Where are passwords stored in a Unix system?
In the /etc/passwd or /etc/shadow file.
103
103. What term is used to describe hackers rooting through trash looking for useful information?
Dumpster diving
104
104. What is the cornerstone of computer security?
Education
105
105. What are the three phases of the three-way handshake used by TCP/IP?
SYN, SYN/ACK, ACK
106
106. How does the teardrop attack operate?
It sends overlapping packet fragments to the victim machine.
107
107. What is the term used to describe a secret method used by a programmer to gain access to the system?
Trap door (or back door)
108
108. When is the XOR function true?
When only one of the input bits is true
109
109. What term describes a mathematical function that easily produces output values for each possible combination of inputs but makes it impossible to retrieve the input values?
One-way function
110
110. True or false? All ciphers are meant to obscure the meaning of a message.
True
111
111. True or false? All codes are meant to obscure the meaning of a message.
False
112
112. What occurs when a change in the plain text results in multiple changes spread through the cipher text?
Diffusion
113
113. What type of cipher is the Caesar cipher?
Simple substitution
114
114. True or false? Modern cryptosystems rely on the secrecy of the encryption algorithm.
False
115
115. What is the length of the key used by the standard DES algorithm?
56 bits
116
116. How many rounds of encryption does DES utilize
16
117
117. True or false? The IDEA algorithm is available free for noncommercial use.
True
118
118. What encryption algorithm was selected for the advanced Encryption Standard (AES)?
Rijndael
119
119. What is the Diffie-Hellman algorithm most commonly used for?
Key exchange
120
120. True or false? The Hashed Message Authentication Code (HMAC) provides nonrepudiation.
False
121
121. What are the three encryption algorithms supported by the Digital Signature Standard?
DSA, RSA, and ECDSA
122
122. What ITU standard describes the contents of a digital certificate?
X.509
123
123. What is the process by which you are issued a digital certificate?
Enrollment
124
124. Who issues digital certificates?
Certificate authorities (CAs)
125
125. True or false? PEM provides protection against replay attacks.
False
126
126. What protocol uses the RSA encryption algorithm to provide encrypted mail support for a number of common commercial email packages?
S/MIME
127
127. True or false? S-HTTP secures individual messages between a client and a server
True
128
128. What cryptographic methods are used by the Secure Electronic Transaction (SET) protocol
RSA Public key cryptography and DES private key cryptography in connection with digital certificates.
129
129. What are the four components of IPSec?
Authentication Header (AH), Encapsulating Security Payload (ESP), IP Payload Compression Protocol (IPComp), and Internet Key Exchange (IKE)
130
130. What type of cryptographic attack is used against algorithms that don't incorporate temporal protections?
Replay attack
131
131. What are some common reasons a certificate might need to be revoked?
The certificate was compromised, the certificate was erroneously issued, the certificate details changed, the private key was exposed, or there was a change of security association.
132
132. What type of cryptography relies on the use of public and private keys?
Asymmetric
133
133. What technology allows multiple users to make use of the same process without interfering with each other?
Multithreading
134
134. What are some of the terms used to describe the CPU mode that gives access to the full range of supported instructions?
System mode, privileged mode, supervisory mode, and kernel mode
135
135. What is the greatest security risk to RAM modules?
Theft
136
136. What addressing scheme supplies the CPU with the actual address of the memory location to be accessed?
Direct addressing
137
137. Magnetic/optical media devices are classified as what type of memory?
Secondary
138
138. Memory devices designed to retain their data when power is removed are known as ___________.
nonvolatile
139
139. What two ways can storage devices be accessed?
Randomly and sequentially
140
140. What is the greatest security risk to computer monitors?
TEMPEST technology
141
141. What is another term often used for firmware?
Microcode
142
142. Where are the operating system-independent primitive instructions that a computer needs to start and load the operating system stored?
BIOS
143
143. What concept ensures that data existing at one level of security is not visible to processes running at different security levels?
Data hiding
144
144. What are the important factors in personnel management?
Hiring practices, ongoing job performance reviews, and termination procedures
145
145. What security mechanisms are countermeasures to collusion?
Job rotation, separation of duties, mandatory vacations, workstation change
146
146. Why is antivirus protection important?
Viruses are the most common form of security breach in the IT world. Any communications pathway can and is being exploited as a delivery mechanism for a virus or other malicious code.
147
147. What is need to know?
Need to know is the requirement to have access to, knowledge of, or possession of data or a resource in order to perform specific work tasks.
148
148. What principle states that users should be granted the minimum amount of access to the secure environment as possible for them to be able to complete their work tasks?
Principle of least privilege
149
149. What are due care and due diligence?
Due care is using reasonable care to protect the interest of an organization. Due diligence is practicing the activities that maintain the due care effort.
150
150. How are security and illegal activities related?
A secure environment should provide mechanisms to prevent the committal of illegal activities, which are actions that violate a legal restriction, regulation, or requirement.
151
151. With what level of security precautions should backup media be treated?
Backup media should be handled with the same security precautions as any other asset with the same data classification.
152
152. What are the goals of managing backup media?
Preventing disclosure, destruction, or alteration of data
153
153. What are the processes that can be applied to used media in order to prepare the media for reuse in various environments?
Erasing, clearing, and overwriting media that will be used in the same classification environments; purging, sanitizing, and degaussing if media is used in different classification environments
154
154. What are the classifications of security control types?
Preventive, deterrent, detective, corrective, recovery, compensation, directive
155
155. What is the purpose of auditing?
To ensure compliance with security policy and to detect abnormalities, unauthorized occurrences, or outright crimes.
156
156. What types of activities are labeled as auditing?
Recording of event/occurrence data, examination of data, data reduction, use of event/occurrence alarm triggers, log analysis, logging, monitoring, using alerts, intrusion detection
157
157. What is the purpose of compliance testing?
To ensure that all of the necessary and required elements of a security solution are properly deployed and functioning as expected
158
158. How are audit trails used?
To reconstruct an event, to extract information about an incident, to prove or disprove culpability
159
159. What types of activities can be used as penetration tests?
War dialing, sniffing, eavesdropping, radiation monitoring, dumpster diving, social engineering, port scanning, ping scanning, vulnerability scanning, and actual compromise activities
160
160. What are some ways to keep inappropriate content to a minimum?
Address the issue in the security policy, perform awareness training, use content filtering tools to filter source or word content.
161
161. Why is it important to protect against resource waste?
If the storage space, computing power, or networking bandwidth capacity is consumed y inappropriate or non-work-related (non-profit-producing) data, the organization loses money.
162
162. Why is it important to protect against privilege abuse?
It can cause the disclosure of sensitive information, violating the principle of confidentiality.
163
163. What countermeasures are moderately effective against errors and omissions?
Input validators and user training
164
164. How can you protect data against fraud and theft?
The use of access controls (auditing and monitoring, for example) reduce fraud and theft.
165
165. What are some safeguards against sabotage?
Intensive auditing, monitoring for abnormal or unauthorized activity, keeping lines of communication open between employees and managers, and compensating and recognizing employees for excellence
166
166. Why isn't there an effective direct countermeasure against the threat of malicious hackers or crackers?
Most safeguards and countermeasures protect against one specific threat or another, but it is not possible to protect against all possible threats that a cracker represents.
167
167. What is malicious code?
Malicious code is any script or program that performs an unwanted, unauthorized, or unknown activity on a computer system.
168
168. True or false? Senior management should be included in the BCP process from the beginning.
True
169
What resource is in greatest demand during the BCP testing, training, and maintenance process?
Manpower
170
170. What type of decision making is mainly concerned with metrics such as dollar values and downtime?
Quantitative
171
171. What Business Impact Analysis/Assessment variable is used to describe the longest period of time a resource can be unavailable without causing irreparable harm to the business?
Maximum tolerable downtime (MTD)
172
172. What is the formula for computing single loss expectancy?
SLE= AV*EF [Single Loss Expectancy = Asset Value * Exposure Factor]
173
173. What is the formula for computing annualized loss expectancy?
ALE = SLE*ARO [Annualized Loss Expectancy = Single Loss Expectancy * Annual Rate of Occurrence]
174
174. What are some of the qualitative factors that must e taken into account when assessing the cost of a disaster?
Loss of goodwill among client base, loss of employees after prolonged downtime, social/ethical responsibilities to the community, and negative publicity
175
175. What is the first thing you should do when a disaster strikes?
Ensure that people are safe.
176
176. What are the two possible responses to a risk?
Acceptance and mitigation
177
177. Provide two examples of devices that might be used to harden a system.
Computer-safe fire suppression systems and uninterruptible power supplies
178
178. What is the goal of business continuity planning (BCP)?
To ensure the continuous operation of a business in the face of an emergency situation
179
179. What are some of the elements that should be included in emergency response guidelines?
Immediate response procedures, notification procedures, and secondary response procedures
180
180. What are the five steps of the business impact assessment process?
Identification of priorities, risk identification, likelihood assessment, impact assessment, and resource prioritization
181
181. What process brings order to the chaotic events surrounding the interruption of an organization's normal activities by an emergency?
Disaster Recovery Planning (DRP)
182
182. Name some common natural disasters.
Earthquakes, floods, storms, tornadoes, and fires
183
183. What organization sponsors the National Flood Insurance Program and is a good source of historical flood information?
Federal Emergency Management Agency (FEMA)
184
184. What disaster recovery system is often highly dependent on the public water supply?
Fire suppression system
185
185. What type of disaster recover separates recovery sites by business teams?
Workgroup recovery
186
186. What are the three major options for alternative processing sites?
Hot sites, warm sites, and cold sites
187
187. What type of recovery site is particularly suited to workgroup recovery options?
Mobile site
188
188. True or false? Organizations participating in a mutual assistance agreement are typically located in the same geographic region.
True
189
189. True or false? There is an accepted standards document defining the requirements for an electronic vaulting solution.
False
190
190. What is the most common document type used for emergency response plans?
Checklists
191
191. What are the three major types of filesystem backups?
Full backups, Incremental backups, and Differential backups
192
192. What can be used to protect a company against the failure of a developer to provide adequate support?
Software escrow agreements
193
193. It is sometimes useful to separate disaster _____________tasks from disaster_____________tasks.
Recovery, restoration (in either order)
194
194. True or false? In most circumstances, it is illegal for an employer to monitor an employee's email.
False
195
195. If a witness is not able to uniquely identify an object, how else may it be authenticated in court?
By establishing a chain of evidence
196
196. What type of evidence is an authenticated computer log?
Documentary evidence
197
197. What are the three major evidence admissibility requirements?
Evidence must be relevant, material, and competent.
198
198. What law created the category of mission-critical computer systems?
Government Information Security Reform Act
199
199. What are the two requirements for acceptance of a trademark application?
The trademark must not be confusingly similar to another trademark, and it must not be descriptive.
200
200. What are the three requirements for acceptance of a patent application?
The invention must be new, useful, and nonobvious.
201
201. How long does trade secret protection last?
Indefinitely
202
202. What type of license agreements are written on the outside of software packaging and require no action from the user other than opening the package?
Shrink-wrap
203
203. What amendment to the US Constitution forms the basis for privacy rights?
Fourth Amendment
204
204. What law requires that websites provide parents with the opportunity to review any information collected from their children?
Children's Online Privacy Protection Act
205
205. What law grants privacy rights to students enrolled in educational institutions that accept government funding?
Family Educational Rights and Privacy Act
206
206. Which type of computer crime attacks an organization's computer system to extract confidential information?
Business attack
207
207. Which type of computer crime would likely be timed to occur simultaneously with a physical attack to reduce the ability to effectively respond to the physical attack?
Terrorist attack
208
208. What term refers to any hardware, software, or data that can be used to prove the identity and actions of an attacker?
Evidence
209
209. What term describes any violation or threatened violation of a security policy?
Incident
210
210. Which type of incident generally does not cause direct damage to the victim?
Scanning. The purpose of a scanning attack is to collect information. The real damage to the system occurs in later attacks.
211
211. How do you protect your system from a malicious code incident?
Make sure your security policy restricts the introduction of untested files to your computer system. Have a good scanner with an up-to-date signature database. Frequently scan all files. Implement whitelisting of applications.
212
212. Which two types of incidents are the easiest to stop by dynamically altering filtering rules?
Scanning and denial of service. They can both potentially be stopped by filtering out the offending packets.
213
213. What must you do to make sure evidence is kept viable for use in a trial?
You must ensure that the evidence has not changed, and you must be able to validate its integrity.
214
214. Where should you begin looking to find information about an incident that occurred in the recent past?
The first place to look is in the system and network log files.
215
215. If an incident has occurred that has violated no laws or regulations, how do you determine whether to report it?
The incident reporting guidelines should be in your security policy.
216
216. Is adherence to the (ISC)2 Code of Ethics recommended, mandatory, or optional for CISSPs?
Adherence to the (ISC)2 Code of Ethics is mandatory, and acceptance of the Code of Ethics is a condition of certification.
217
217. What is the leading reason many incidents are not reported?
Because they are not recognized as incidents
218
218. What are the three main types of physical security controls?
Administrative physical security controls, technical physical security controls, physical controls for physical security.
219
219. What is the primary purpose of lighting as a physical security device?
To discourage casual intruders, trespassers, prowlers, and would-be thieves.
220
220. What are the benefits of security guards?
They are able to adapt and react to any condition or situation, are able to learn and recognize attack patterns, can adjust to a changing environment, and are able to make decisions and judgment calls.
221
221. What are the disadvantages of security guards?
Not all environments support them; prescreening, bonding, and training is not always effective; they are expensive, subject to illness, take vacations, and are vulnerable to social engineering.
222
222. What are the benefits and disadvantages of guard dogs?
They can be deployed as a perimeter security control and as detection and deterrent agents, they are costly and require high maintenance, and their use involves insurance and liability issues.
223
223. What are the 11 electrical terms and definitions you should be aware of?
Fault, blackout, sag, brownout, spike, surge, inrush, noise, transient, clean, ground
224
224. What are the types of noise or interference and their sources?
Common mode noise is generated by the difference in power between the hot and ground wires. Traverse mode noise is generated by the difference in power between the hot and neutral wires.
225
225. What are the typical HVAC requirements for a computer room?
A computer room should be kept at 60 to 75 degrees Fahrenheit (15 to 23 degrees Celsius). Humidity in a computer room should be maintained at between 40 and 60 percent.
226
226. What type of damage occurs when static electricity discharges exceed 40 volts?
Destruction of sensitive circuits
227
227. What is a Type C fire extinguisher used for, and what is it made of?
A Type C fire extinguisher is for use on electrical devices thus the extinguishing agent is non-conductive, so the devices might use CO2, halon, or various alternatives.
228
228. What are the four types of water-based fire suppression systems?
Wet pipe system, dry pipe system, deluge system, preaction system
229
229. What are the alternatives for halon?
FM-200 (HFC-227ea), CEA-410 or CEA 308, NAF-S-III (HCFC Blend A), FE-13 (HCFC-23), Aragon (IG55) or Argonite (IG01), Intergen (IG541), and low-pressure water mists
230
230. Which security vulnerability conveys information by altering the performance of a system component or modifying as resource's timing in a predictable manner?
Covert timing channel
231
231. What is a separate object that is associated with a resource and describes its security attributes?
Security token
232
232. In the Clark-Wilson security model, what is a procedure that scans data items and confirms their integrity
Integrity verification procedure (IVP)
233
233. In the Biba integrity model, what is the Simple Integrity Axiom, which states that a subject cannot read an object of a lower integrity, also called?
No read down
234
234. Which organization developed the Bell-LaPadula security model?
The US Department of Defense
235
235. What is the collection of TCB components that work together to implement the reference monitor functions?
Security kernel
236
236. What does ITSEC call the system that is being evaluated?
the Target Of Evaluation (TOE)
237
237. What TCSEC category is reserved for systems that have been evaluated but do not meet the requirements of any other category?
Category D (minimal protection)
238
238. Which IPsec protocol provides integrity, authentication, and nonrepudiation to the secure message exchange?
Authentication Header (AH)
239
239. Which type of controls considers static attributes of the subject and the object to determine the permissibility of an access?
Mandatory access controls
240
240. What term is used to refer to the user or process that makes a request to access a resource?
Subject
241
241. What is the imaginary boundary that separates the TCB from the rest of the system?
Security perimeter
242
242. What term describes the technical evaluation of each part of a computer system to assess its concordance with security standards?
Certification
243
243. What is the difference between analog and digital signals?
Analog communications occur with a continuous signal that varies in frequency, amplitude, and so on. Digital communications occur through the use of a state change of on-off pulses.
244
244. What is the difference between synchronous and asynchronous communications?
Synchronous communications rely on a timing or clocking mechanism. Asynchronous communications rely on a stop and start delimiter bit to manage transmission of data.
245
245. What is the difference between baseband and broadband communications?
Baseband technology uses a direct current to support a single communication channel. Broadband technology uses frequency modulation to support multiple simultaneous signals.
246
246. Describe broadcast, multicast, and unicast communications
A broadcast supports communications to all possible recipients. A multicast supports communications to multiple specific recipients. A unicast supports only a single communication to one recipient.
247
247. What is the difference between packet switching and circuit switching?
In circuit switching, a dedicated physical pathway is created between the two parties. Packet switching occurs when the message is broken up into segments and sent across the intermediary network.
248
248. What are the characteristics of PPP?
The Point-to-Point Protocol (PPP) is an encapsulation protocol designed to support the transmission of IP traffic over dial-up or point-to-point links. PPP supports CHAP and PAP for authentication.
249
249. What are the characteristics of SLIP?
Serial Line Internet Protocol (SLIP) offers no authentication, supports only half-duplex communications, has no error-detection capabilities, and requires manual link establishment and teardown.
250
250. What is CORBA?
Common Object Request Broker Architecture (CORBA) is an international standard (sanctioned by the International Organization for Standardization [ISO]) for distributed computing.
251
251. What's the most desirable default setting for access control?
Denial. When access is not specifically granted, it should be denied by default. This is also known as implicit deny.
252
252. What type of approach to security is considered better than a fortress mentality approach?
Defense in depth, multiple layers of security, concentric circles of security.
253
253. What form of password attack consists first of a dictionary attack and then a bruteforce attack based on the dictionary list?
A hybrid attack. Sometimes called a one-upped password attack.
254
254. What is the most acceptable form of biometrics to end users?
Iris scans
255
255. What is the most unacceptable form of biometric control to end users?
Retina scans
256
256. What is the stored sample of a biometric factor called?
A reference profile or a reference template
257
257. With what other forms of single sign-on can Kerberos be combined?
Any or all of them, including SESAME, KryptoKnight, NetSP, thin clients, directory services, and scripted access.
258
258. How is the ticket-granting ticket used by Kerberos generated?
The user's password is hashed, and a timestamp is added.
259
259. What is a centralized database of resources available to the network?
A directory service
260
260. What are examples of rule-based access control?
MAC, RBAC, TBAC
261
261. What form of access control can combine levels of security domains with compartments of additional control and isolation?
MAC (Specifically, a hybrid MAC environment
262
262. What form of access control is best suited to those organizations with a high rate of employee turnover?
RBAC
263
263. When an intrusion is detected, what should be the first response?
Contain or constrain the intrusion.
264
264. Once an intrusion has occurred, what is the most secure process for restoring the environment?
Format and reinstall from scratch.
265
265. What form of IDS is easier for an intruder to discover and disable?
Host-based IDS
266
266. What network device works primarily at the Application layer?
Gateway
267
267. What are the most common causes of network failure?
Cable failures and misconfigurations
268
268. What type of cabling must be used to comply with building code safety requirements?
Plenum-rated cable
269
269. How many sockets does TCP have?
65,536 (2^16) sockets (aka ports), numbered from 0 to 65,535
270
270. What is the IP header protocol field value for TCP? UDP? ICMP? IGMP?
TCP: 6
UDP: 17
ICMP: 1
IGMP: 2
271
271. What protocol is used by ping, pathping, and traceroute?
ICMP
272
272. What is the APIPA range?
169.254.0.1 to 169.254.255.254 along with the default Class B subnet mas of 255.255.0.0
273
273. What port is used by IMAP
143
274
274. What port is used by DHCP?
Port 68 for client request broadcast and port 67 for server point-to-point response
275
275. Network devices at what layer and above separate collision domains?
Layer 2
276
276. Network devices at what layer and above separate broadcast domains?
Layer 3
277
277. Which VPN protocol supports multiple simultaneous connections?
IPSec
278
278. What is the primary weakness of satellite communications?
Large terrestrial footprint
279
279. What makes the usable throughput of ISDN less than the stated bandwidth?
The D channel is used only for call management, not data.
280
280. What type of system is a common target of attackers who want to disseminate email spam?
Open relay SMTP servers
281
281. What is the primary method to improve fax security?
Disable automatic printing of received faxes.
282
282. What is the form of new system deployment testing called when the new system and the old system are run simultaneously?
Parallel run
283
283. When an asset no longer needs or warrants a high security sensitivity label, what should occur?
Declassification
284
284. What is the name of the security management approach in which senior management calls the shots?
Top-down approach
285
285. What is the cost/benefit analysis equation for countermeasures?
(ALE before safeguard - ALE after implementing the safeguard) - annual cost of safeguard = value of the safeguard to the company
286
286. What type of relationships can be established with relational databases? With hierarchical databases? With distributed databases?
One-to-one, on-to=many, and many-to-many
287
287. What are the six basic SQL commands?
Select, Update, Delete, Insert, Grant, and Revoke
288
288. What is a placeholder for SGL literal values such as numbers or character strings?
Bind variable
289
289. What database security feature uses locking to prevent simultaneous write access to cells?
Concurrency
290
290. What database security feature can be used to subvert aggregation, inferencing, and contamination vulnerabilities?
Database partitioning
291
291. What feature of databases allows two or more rows in the same table to appear to have identical primary key elements but contain different data for use at differing classification levels?
Polyinstantiation
292
292. What acts as an interface between back-end database systems and user applications?
ODBC
293
293. What attack collects numerous low-level security items or low-value items and combines them to create something of a higher security level or value?
Aggregation
294
294. What is more secure than a data warehouse and designed to store metadata?
Data mart
295
295. What type of application analyzes business data and presents it in such a way as to make business decisions easier for users?
Decision support system
296
296. What security problem cannot be prevented or compensated for by environmental controls or hardware devices?
Bad coding
297
297. What is a valid security response when an application violates OS-imposed security, such as interfering with other processes or accessing hardware directly?
Stopping the environment, a STOP error, a BSOD
298
298. What is it called when programmers decompile vendor code in order to understand the intricate details of its functionality?
Reverse engineering
299
299. What is the communication to or input of an object?
Message
300
300. What is the internal code that defines the actions an object performs in response to a message?
Method
301
301. What are the results or output exhibited by an object based on processing a message through a method?
Behavior
302
302. What is the collection of the common methods from a set of objects that is used to define the behavior of those objects?
Class
303
303. What is it called when an object is an example of a class because the object contains a method from that class?
Instance
304
304. What characteristic describes an object that exhibits different behaviors based on the same message and methods because of variances in external conditions?
Polymorphism
305
305. Highly_______objects are not as dependent on other objects.
cohesive
306
306. Lower _________provides better software design because objects are more independent.
coupling
307
307. What is a type of bar chart that shows the interrelationships over time between projects and schedules?
Gantt chart
308
308. What is a project-scheduling tool that is used to judge the size of a software product in development and calculate the standard deviation for risk assessment?
Program Evaluation Review Technique (PERT)
309
309. What form of testing examines the internal logical structures of a program?
White-box testing
310
310. What form of testing examines the input and output of a program without focusing on the internal logical structures?
Black-box testing
311
311. What form of testing examines the extent of the system testing in order to locate untested program logic?
Test data method
312
312. Which form of antivirus response not only removes the virus from the system but also repairs any related damage?
Cleaning
313
313. What is the name of the assumption that all algorithms should be public but all keys should remain private?
Kerchoff principle
314
314. What is the range of valid values of keys for an algorithm called?
Key space
315
315. What defines the hardware and software requirements of cryptographic modules in use by the federal government?
Federal Information Processing Standards (FIPS-140)
316
316. What acts as a placeholder variable in mathematical functions and is used in random number generation?
Nonce
317
317. What is a random bit string (a nonce) that is the same length as the block size that is XORed with the message and adds strength to cryptography systems?
Initialization Vector (IV)
318
318. What is the most significant bit in a string?
The leftmost bit
319
319. What is it called when a plain-text message generates identical cipher-text messages using the same algorithm but different keys?
Clustering or key clustering
320
320. What is a concept of communication whereby a specific type of information is exchanged but no real data is exchanged?
Zero-knowledge proof
321
321. What is the basic idea that the information or privilege required to perform an operation is divided among multiple users (it is an application of separation of duties)?
Split knowledge
322
322. What is an example of split knowledge employed to protect key escrow?
M of N control
323
323. What is a way of measuring the strength of a cryptography system by measuring the effort in terms of cost and/or time?
Work function or work factor
324
324. What is an example of a polyalphabetic substitution cipher?
Vigenere cipher
325
325. What attack is often successful against substitution ciphers?
Frequency analysis
326
326. What attack is often successful against polyalphabetic substitution ciphers?
Period analysis
327
327. What form of encryption is used to protect communications that occur in real time?
Stream ciphers
328
328. What form of encryption can provide secure communications between two parties when they have no prior method of communicating securely?
Asymmetric cryptography
329
329. What modes of DES employ an IV?
CBC, CFB, OFB
330
330. What are the valid key sizes for RC5?
0 to 2,048 bits
331
331. If a message is signed and encrypted, what security services are you providing?
Confidentiality, integrity, authenticity/access control, and nonrepudiation
332
332. Who has the responsibility to ensure that communications are secured?
The sender
333
333. Historically, what custom protocol was used to provide cryptographically secure wireless network access for mobile devices?
Wireless Application Protocol (WAP)
334
334. What is the standard that wireless networking technology is based on?
802.11
335
335. What cryptographic attack attempts to find a weakness in the algorithm?
Analytic attack
336
336. What cryptographic attack attempts to find a weakness in the software code?
Implementation attack
337
337. What cryptographic attack attempts to exploit weaknesses in the computer hardware or operating system?
Statistical attack
338
338. A_________ system is one in which all protection mechanisms work together to process sensitive data for many types of users while maintaining a stable and secure computing environment.
trusted
339
339. ________ is simply defined as the degree of confidence in satisfaction of security needs.
Assurance
340
340. What are the security requests of a client called under Common Criteria?
Protection profile
341
341. What are the security features of a designed system called under Common Criteria?
Security target
342
342. What method of verifying or establishing a trusted label of system security requires a DAA.
Accreditation
343
343. What is the name of the accreditation process of the Department of Defense?
Defense Information Technology Security Certification and Accreditation Process (DITSCAP) / DoD Information Assurance Certification and Accreditation Process (DIACAP) / Risk Management Framework (RMF)
344
344. What are the three forms of accreditation offered y National Information Assurance Certification and Accreditation Process (NIACAP)?
Site, type, system
345
345. What are often added to passwords under Linux to make their resultant hash even more secure?
Salts
346
346. When a disaster strikes but your ability to perform work tasks is only threatened, not actually interrupted, what response should be used?
BCP
347
347. What is always your top priority when dealing with a disaster of any type or significance?
Safety of personnel
348
348. What feature of insurance can improve your ability to replace lost or damaged assets?
Actual Cost Value (ACV)
349
349. What is the most common cause of unplanned downtime?
Hardware failures
350
350. What are some examples of alternate processing facilities that should be considered when designing a DRP?
Hot, warm, and cold sites; mobile sites; service bureaus; multiple sites; and reciprocal agreements
351
351. What forms of backup always set the archive bit to 0?
Full and incremental
352
352. What backup media may be appropriate for personal backups but not for network backups?
Writable CDs and DVDs
353
353. What form of backup, when used to restore data, will always result in some amount of data loss?
Periodic backups
354
354. What law requires all communications carriers to make wiretaps possible for law enforcement with an appropriate court order regardless of the technology in use?
Communications Assistance for Law Enforcement Act (CALEA) of 1994.
355
355. What law extends the definition of property to include proprietary economic information so that the theft of this information can be considered industrial or corporate espionage?
Economic and Protection of Proprietary Information Act of 1996.
356
356. ________ controls are your first line of defense, while ________ are your last line of defense.
Physical, People
357
357. What is the functional order of controls when deployed for physical security?
Deterrence, then denial, then detection, then delay
358
358. What type of lock consists of three elements: an electromagnet, a credential reader, and a door-closed sensor?
Electronic access control (EAC)
359
359. Reviewing the recorded images from CCTV is what type of security control?
Detective
360
360. What is the primary difference between memory cards and smart cards?
Processing capability
361
361. At what stage of a fire is flame visible?
Stage 3: Flame
362
362. What is the most common cause of fires in a data center?
Overloaded electrical distribution outlets
363
363. Where should fire detectors be placed?
In dropped ceilings, raised floors, server rooms, private offices and public areas, HVAC vents, elevator shafts, the basement, and so on
364
364. What is the most common cause of failure of water-based suppression system?
Human error
365
365. Name one or more examples of vector routing protocol
RIP, IGRP, BGP
366
366. Name an example of a link state routing protocol.
OSPF
367
367. At what layer does SSL and TLS function?
Transport layer (OSI layer 4)
368
368. Name at least four technologies commonly called wireless.
802.11 networking, Bluetooth (802.15), mobile phones, and cordless phones
369
369. What are the three unlicensed frequencies (at least in the United States as designated by the FCC)?
900 MHz, 2.4 GHz, and 5 GHz
370
370. Name three wireless frequency access technologies.
FHSS, DSSS, and OFDM
371
371. What protocol can be used to enable mobile phone access to Internet resources?
Wireless Application Protocol (WAP)
372
372. What is the IEEE standard for Bluetooth?
802.15
373
373. What is the IEEE standard for WiMax
802.16
374
374. What is another name for the area of Bluetooth connectivity?
Personal area network (PAN)
375
What is the primary security feature of Bluetooth pairing?
A four-digit PIN
376
376. What two items are required for infrastructure mode wireless networking?
Wireless access points and wireless clients
377
377. What mode is used when a wireless network link is established without the use of an access point?
Ad hoc or peer-to-peer
378
378. What is the minimum amount of information needed by a wireless client to connect to a network hosted by a wireless access point?
SSID
379
379. Name four examples of infrastructure mode wireless networking.
Stand-alone, wired extension, enterprise extended, and bridge
380
380. How many wireless networking channels exist on devices in the United States? In Europe? in Japan?
United States: 11
Europe: 13
Japan: 17
381
381. What is the native authentication and encryption scheme of 802.11
Wired Equivalent Privacy (WEP)
382
382. Name two alternatives to WEP for 802.11.
WPA and WPA-2 (802.11i)
383
383. What two forms of authentication are supported by 902.11?
Open System Authentication (OSA) and Shared Key Authentication (SKA)
384
384. What is the minimum length of a TCP header?
20 bytes
385
385. How long is a UDP header?
8 bytes
386
386. What are the four TCP header flags that are used in virtual circuit setup and teardown?
SYN, ACK, FIN, and RES (or RST)
387
387. What two ICMP type field values are employed in a successful ping activity?
8: echo request, 0: echo reply
388
388. What is Control Objectives for Information and Related Technology (COBIT)?
A security concept infrastructure used to organize the complex security solution of companies.
389
389. What form of testing examines the internal logical structures of a program from a developer's perspective?
White-box testing
390
390. What form of testing examines the input and output of a program without access to the internal logical structures?
Black-box testing
391
391. What form of testing examines the input and output of a program with access to the internal logical structures?
Gray-box testing
392
392. What kinds of items qualify as access controls?
Any hardware, software, or organizational administrative policy or procedure that maintains confidentiality, integrity, and/or accountability also counts as an access control.
393
393. What is the proper term for ensuring that information is accessible only to authorized parties?
Confidentiality
394
394. What is the proper term for the assurance that information and security controls used to protect information are accessible and usable when needed?
Availability
395
395. What is it called when an authorized party indicates its intention to fulfill some contractual obligation and forgoes its right to dispute that fulfillment after the fact?
Nonrepudiation
396
396. Items of information used to establish or prove authorized identities are known as what kind of factors?
Authentication
397
397. What kind of access control enforces access policy determined by the owner of the object to which the control applies?
Discretionary access control (DAC)
398
398. What kind of access control is determined by the system in which the object resides rather than its owner?
Mandatory access control (MAC)
399
399. Which access control scheme requires organizational roles to be defined along with various task requirements and applicable object permissions?
Role-based access control (RBAC)
400
400. Which access control scheme requires administrative rules to be defined along with the various conditions under which they apply as well as applicable object permissions?
Rule-based access control
401
401.What is the practice of defense in depth called when it involves a multilayered security infrastructure that includes multiple combined individual applications and processes?
Concentric circle strategy
402
402. What is the term for exercising reasonable care in protecting organizational assets and interests, including development of a formalized security structure consisting of policies procedures, and protocols?
Due care
403
403. When users are granted only the minimum access necessary to complete some task or process, what principle is involved?
The principle of Least Privilege
404
404. What kinds of processes must be applied when confidential storage media is prepared for reuse in questionably secure environments?
Declassification
405
405. What is the name for the demagnetization process used to erase disk drives or tapes to wipe out all previously stored data?
Degaussing
406
406. What kind of control does any security tool provide when it's used to guide the security implementation within an organization?
Directive control
407
407. What kind of control does any mechanism, tool, or practice provide if it deters or mitigates undesirable actions or events?
Preventive control
408
408. What kind of control should be used to verify the effectiveness of other security controls?
Detective control
409
409. What kind of check should be applied to ensure that all necessary elements of a security solution are properly deployed and functioning as expected?
Compliance checking
410
410. What do you call a person who is trained in responsible network security methods, who employs a philosophy of nondestructive and nonintrusive penetration testing, but who may also use underground or "black-hat" tools?
Ethical hacker
411
411. What is the proper name for a criminal act committed against an organization by a current or former employee who exploits knowledge gained on the job in its perpetration?
Sabotage
412
412. What is the proper name for the illegal intent behind obtaining and profiting from sensitive information that belongs to some third party (government, corporation, individual, and so on)?
Espionage
413
413. When a person attempts to deceive an insider within an organization to divulge sensitive information or to perform sensitive actions on their behalf, what might this be called?
Social engineering
414
414. When a penetration test team is privy to detailed information about organizational assets, including hardware and software inventory, but not to other information accounts, users, naming conventions, an so on), how might this team be described?
Partial-knowledge team
415
415. When a penetration test team is privy only to what it itself can learn about the target organizations for the test, how might this team be described?
Zero-knowledge team (performs black-box testing)
416
416. What term identifies the data extraction technique whereby elements of data are extracted from a much larger body of data to construct a meaningful representation of its overall contents?
Sampling
417
417. What governs how long records are kept to substantiate system security assessments and support system analysis?
Record retention
418
418. What does BCP stand for, and what does it mean?
Business Continuity Planning (BCP) is the preventive practice of establishing and planning for threats to business flow, including natural and unnatural risk and threats to daily operations.
419
419. What does DRP stand for, and what does it mean?
Disaster Recovery Planning (DRP) is the practice of establishing and executing recovery actions as part of an emergency response following a disaster.
420
420. What term describes damage from disruptive and irresistible forces of nature (such as earthquakes, floods, storms, and so on)?
Natural disaster
421
421. What term describes damage resulting from arson, human error, acts of terrorism, or power outages and other utility failures?
Man-made disaster
422
422. What kind of strategy drives defining practices, policies, and procedures to restore a business to normal operation in the wake of some kind of outage or disaster?
Recovery strategy
423
423. What label applies to a partial standby facility for which power and other infrastructure elements are available, but for which no operational computing facilities are supplied in advance of a disaster?
Cold site
424
424. What label applies to a standby facility that is ready to take over for a primary facility as soon as notice is received that the primary facility has gone down?
Hot site
425
425.What label applies to a site that is already provisioned with hardware and software to take over for a primary facility but that needs to obtain and install a backup or image of client-specific data before going online?
Warm site
426
426. How might you describe a site housed in self-contained transportable units with all control, hardware, and software elements necessary to establish an operational safe computing environment?
Mobile site
427
427. What roles can a service bureau play in disaster recovery?
Service bureaus lease computer time via contractual agreements and can meet an organization's entire IT needs in the event of disaster or catastrophic failure.
428
428. What is critical path analysis?
A systematic effort to identify relationships between mission-critical applications, processes, and operations and all of the necessary supporting elements
429
429. Name three examples of administrative physical security controls.
Facility construction and selection, site management, personnel controls, security awareness training, emergency response, and procedures
430
430. Name three examples of technical physical security controls.
Access controls; intrusion detection; alarm systems; closed-circuit television (CCTV); monitoring systems; heating, ventilation, and air conditioning (HVAC) systems; power supplies; fire detection and suppression systems
431
431. Name three physical controls for physical security.
Fencing, lighting, locks, construction materials, mantraps, watchdogs, guards
432
432. What term describes the act of gathering information about a system by observing the display or watching an operator at the keyboard?
Shoulder surfing
433
433. What term describes the act of using another person's security ID to gain unauthorized entry into a facility?
Masquerading
434
434. When one person follows another through a secured gate or doorway without presenting identification or otherwise being authenticated, what is this entry technique called?
Piggybacking
435
435. What kind of system is designed to detect intrusions, breaches, or attack attempts as they are underway or after the fact?
Intrusion Detection System (IDS)
436
436. What does UPS stand for, and what does it mean?
An Uninterruptible Power Supply (UPS) is a type of self-charging batter that can be used to supply consistent clean power to sensitive equipment.
437
437. What does EMI stand for, and what does it mean?
Electromagnetic interference refers to any noise generated by electric current and can affect any means of data transmission or storage that relies on electromagnetic transport mechanisms.
438
438. Describe the models of systems development.
The waterfall model is a sequential development process that results in the development of a finished product. Developers may step back only one phase in the process if errors are discovered. The spiral model uses several iterations of the waterfall model to produce a number of fully specified and tested prototypes. Agile development models place an emphasis on the needs of the customer and quickly developing new functionality that meets those needs in an iterative fashion.
439
439. Describe the purpose of software development maturity models.
Maturity models help software organizations improve the maturity and quality of their software processes by implementing an evolutionary path from ad hoc, chaotic processes to mature, disciplined software processes.
440
440. What are the important elements of change and configuration management?
The three basic components of change control are request control, change control, and release control.
441
441. What is TEMPEST?
TEMPEST is a standard for the study and control of electronic signals produced by various types of electronic hardware, such as computers, televisions, phones, and so on. Its primary goal is to prevent EMI and RFI radiation from leaving a strictly defined area to eliminate the possibility of external radiation monitoring, eavesdropping, and signal sniffing.
442
442. What is static software testing?
Static testing evaluates the security of software without running it by analyzing either the source code or the compiled application. Static analysis usually involves the use of automated tools designed to detect common software flaws, such as buffer overflows.
443
443. What type of software testing is most appropriate when the tester does not have access to the underlying source code?
Dynamic testing
444
444. What does malicious code often create on an infected system to allow the developers of the malicious code to remotely access the system at a later time?
Back door
445
445. What name is given to the cryptographic concept of making the relationship between the plain text and the key so complex that an attacker can't use known plain text attacks to determine the key?
Confusion
446
446. What types of organizations need to comply with PCI DSS?
Those that store, process, or transmit credit card account information
447
447. What trend makes it especially important to incorporate an assessment of security controls in contracting and procurement reviews?
The increased use of third-party and cloud services
448
448. What are the branches of forensic analysis?
Media analysis, network analysis, software analysis, and hardware/embedded device analysis
449
449. What is it called when a user has more access, privilege, or permission than their assigned work tasks dictate?
Excessive privileges (also known as the violation of least privilege)
450
450. What is it called when a user accumulates privileges over time as their job roles and assigned tasks change but unneeded privileges are not revoked?
Creeping privileges or privilege creep
451
451. Which access control scheme requires administrative rules to be defined along with the various conditions under which they apply as well as applicable object permissions?
Rule-based access control
452
452. Name three physical controls for physical security.
Fencing, lighting, locks, construction materials, mantraps, watchdogs, guards
453
453. What term is used to refer to the user or processing that makes a request to access a resource?
Subject
454
454. What kind of control does any mechanism, tool, or practice provide if it deters or mitigates undesirable actions or events?
Preventive control
455
455. What process identifies the actual value of assets so that assets can be prioritized?
Asset valuation
456
456. What process identifies and categorizes potential threats?
Threat modeling
457
457. What process is used to identify weaknesses?
Vulnerability analysis
458
458. When evaluating access control attacks, what are three primary elements that must be identified?
Assets, threats, and vulnerabilities
459
459. A group of attackers is sponsored by a government. They are highly motivated, skilled, and patient and focused on a single target to gain and retain access over long periods of time. What is this group called?
Advanced Persistent Threat (APT)
460
460. What are often added to passwords to make their resultant hash secure and resistant to rainbow attacks?
Salts
461
461. What is a nonstatistical sampling method that only records or alerts on events that exceed a threshold?
Clipping levels
462
462. What is a group of records from one or more databases or logs that can be used to reconstruct events after an incident?
Audit trail
463
463. What is the purpose of an access review and audit?
Check to ensure that users do not have excessive privileges and that accounts are managed appropriately
464
464. What can a user entitlement review detect?
Violation of the principle of least privilege policy, as incidents of excessive privileges or creeping privileges
465
465. What type of accounts are focused on during a user entitlement review?
Privileged accounts such as administrator or root user accounts
466
466. Who should have access to audit reports?
Only people who have a need to know
467
467. What determines how often an audit should be performed?
Risk
468
468. What policy requires users to spend at least a week away from their jobs on an annual basis to help prevent fraud?
Mandatory vacations
469
469. What method will remove all data with assurances that it cannot be removed using any known methods?
Purging, sanitization, or destruction
470
470. What methods can be used to protect mobile devices such as a smartphone?
Encryption, GPS, password-protected screen locks, and remote wipe
471
471. What can be used to remove data on a lost smartphone?
Remote wipe
472
472. What should be done before disposing of a desktop computer at the end of its life cycle?
Sanitization
473
473. What is the term that identifies data on a disk after the data has supposedly been erased?
Data remanence
474
474. What are the steps of a patch management program?
Evaluate, test, apply, and audit patches
475
475. What can be used to verify patches have been applied?
Vulnerability Scanner or a patch management system
476
476. What should be done to verify patches have been applied?
Audit patches, or use a vulnerability scanner to verify patches have been applied
477
477. What tool can check for weaknesses in systems?
Vulnerability scanner
478
478. What would be completed to check an entire organization for weaknesses?
Vulnerability assessment
479
479. What does imaging provide in relation to configuration management?
Baseline
480
480. What helps prevent outages that can occur from unauthorized modifications?
Change management
481
481. What helps prevent inadvertent weakening of security from unauthorized outages?
Change management
482
482. What are the five steps in incident response quoted in the CISSP CIB
Detection, Response, Reporting, Recovery, and Remediation and Review
483
483. In which stage of incident response should a root cause analysis be conducted?
Remediation and Review
484
484. While containing an incident, what is the next important consideration?
Protection of evidence
485
485. An attack has a negative effect on the confidentiality, integrity, or availability of an organization's assets. What is this called?
Computer security incident
486
486. What is it called when malware is installed on a user's system after visiting a website?
Drive-by download
487
487. What three generic elements can help prevent malware infections?
Education, policies, and tools
488
488. An attacker has launched an attack using a vulnerability known only to him. What is this called?
Zero-day exploit
489
489. What type of attack leverages part of the TCP three-way handshake?
SYN flood attack
490
490. What are computers in a botnet commonly called?
Zombies
491
491. What is the best protection against a computer joining a botnet?
Up-to-date antivirus software
492
492. What type of IDS detects attacks based on known methods?
Knowledge-based (also called signature-based or pattern-matching)
493
493. What type of IDS detects attacks based by comparing it to a baseline?
Behavior-based (also called Statistical-intrusion detection or anomaly detection)
494
494. After a network is upgraded, what must be done with a behavior-based IDS?
Upgrade the baseline
495
495. What is required before starting a penetration test?
Knowledge and consent of management
496
496. When a penetration test team is privy to detailed information about organizational assets, including hardware and software inventory, but not to other information (accounts, users, naming conventions, and so on), how might this team be described?
Partial-knowledge team (performs gray-box testing)
497
497. A penetration testing team has full knowledge about a target. What is this team called
Full-knowledge team (performs white-box testing)
498
498. What is used to provide fault tolerance for a disk subsystem?
Redundant array of independent disks (RAID)
499
499. What is used to provide fault tolerance for a server?
Failover cluster
500
500. What is used to provide short-term fault tolerance for a power failure?
Uninterruptible Power Supply (UPS)
501
501. What is used to provide long-term fault tolerance for a power failure?
Generator
502
502. What are three well-known but legacy non-IP protocols?
NetBIOS, IPX/SPX, and AppleTalk
503
503. What are the six flags from the TCP header that we still commonly use and what is their order in the header?
XXUAPRSF. The X represents two flags no longer used, followed by Urgent, Acknowledgment, Push, Reset, Synchronization, and Finish. You can memorize this flag order using the phrase "Unskilled Attackers Pester Real Security Folk."
504
504. What is VLAN hopping?
An attack using double-encapsulated IEEE 802.1Q VLAN tags to fool a switch into allowing traffic to jump to a different VLAN from which the traffic originated
505
505. What is NAC?
Network Access Control (NAC) is a concept of controlling access to an environment through strict adherence to and implementation of security policy. The goals of NAC are to prevent/reduce zero-day attacks, enforce security policy throughout the network, and use identities to perform access control.
506
506. What is endpoint security?
The concept that each individual device must maintain local security whether or not its network or telecommunications channels provide or offer security. Sometimes this is expressed as the end device that is responsible for its own security.
507
507. On an 802.11 wireless network, what contains the regular announcement of the network name by default?
The beacon frame contains the SSID (i.e., network name) by default. This can be stopped using the Disable SSID Broadcast feature of a wireless access point.
508
508. What are the three standards-based forms of encryption of 802.11 wireless networks and the cryptography protocols related to each?
WEP (RC4), WPA (RC4, TKIP, LEAP), WPA-2 (AES/CCMP)
509
509. What is 802.1x?
Port authentication; basically a mechanism to proxy authentication from the local device to another dedicated authentication service within the network
510
510. What is war driving?
A collection of techniques to discover that a wireless network is present at a given location
511
511. What is a VLAN?
A hardware-imposed network segmentation created by switches used to manage traffic
512
512. What is multimedia collaboration?
The use of various multimedia-supporting communication solutions to enhance distance collaboration. Collaboration occurs when people can work on a project together. Often, collaboration allows workers to work simultaneously as well as across different timeframes.
513
513. What are two common attacks against Internet-based IM (instant messaging)?
Packet sniffing and eavesdropping attacks
514
514. What is screen scraping?
1) Remote control, remote access, or remote desktop-like services. 2) A technology that can allow an automated tool to interact with a human interface, such as extracting information from web pages.
515
515. What is virtualization?
Technology used to host one or more operating systems within the memory of a single host computer. This mechanism allows virtually any OS to operate on any hardware. It also allows multiple operating systems to work simultaneously on the same hardware.
516
516. What are the two main forms of DoS?
The first form exploits a vulnerability in hardware or software. This exploitation of a weakness, error, or standard feature of software to cause a system to hang, freeze, consume all system resources, and so on. The end result is that the victimized computer is unable to process any legitimate tasks. The second form floods the victim's communication pipeline with garage network traffic. Sometimes called a traffic generation or flooding attack.
517
517. What is security management planning?
Security management planning ensures proper creation, implementation, and enforcement of a security policy. Security management is a responsibility of upper management, not of the IT staff, and is considered a business operations issue rather than an IT administration issue.
518
518. What is security governance?
Security governance is the collection of practices related to supporting, defining, and directing the security efforts of an organization. A common goal of organizational governance is to ensure that the organization will continue to exist and will grow or expand over time.
519
519. What is third-party governance?
Third-party governance is the system of oversight that may be mandated by law, regulation, industry standards, or licensing requirements. The actual method of governance may vary but generally involves an outside investigator or auditor.
520
520. What is documentation review?
Documentation review is the process of not just reading the exchange materials but verifying it against standards and expectations. The documentation review is typically performed before any on-site inspection is performed.
521
521. Define the Goguen-Meseguer model.
The Goguen-Meseguer model is an integrity model based on predetermining the set or domain of objects that a subject can access. This model is based on automation theory and domain separation.
522
522. Define the Sutherland model.
The Suterland model is an integrity model focused on preventing interference in support of integrity. It is based on the idea of defining a set of system states, initial states, and state transitions. Through the use of and limitations to only these predetermined secure states, integrity is maintained and interference is prohibited.
523
523. Define the Graham-Denning model.
The Graham-Denning model is focused on the secure creation and deletion of both subjects and objects. Ultimately, it is a collection of eight primary protection rules or actions that define the boundaries of certain secure actions.
524
524. What are some benefits of virtualization?
Being able to launch individual instances of servers or services as needed, real-time scalability, and being able to run the exact needed OS version for the needed application
525
525. What is TPM?
Trusted Platform Module (TPM) is a cryptoprocessor chip on a mainboard used to store and process cryptographic keys for the purposes of a hardware-supported or implemented hard drive encryption system.
526
526. What is the HSM?
A Hardware Security Module (HSM) is a cryptoprocessor used to manage/store digital encryption keys, accelerate crypto operations, support faster digital signatures, and improve authentication.
527
527. What is cloud computing?
A concept of computing where processing and storage are performed elsewhere over a network connection rather than locally
528
528. What are some issues or concerns regarding cloud computing?
Privacy concerns, regulation compliance difficulties, use of open/closed source solutions, adoption of open standards, and whether or not cloud-based data is actually secured (or even securable)
529
529. What is PaaS?
Platform as a Service (PaaS) is the concept of providing a computing platform and software solution stack as a virtual or cloud-based service.
530
530. What is SaaS?
Software as a Service (SaaS) is a derivative of Platform as a Service (PaaS). Software as a Service provides on-demand online access to specific software applications or suites without the need for local installation (or even local hardware and OS requirements in many cases).
531
531. What is IaaS?
Infrastructure as a Service (IaaS) takes the Platform as a Service (PaaS) model another step forward. It provides not just on-demand operating solutions but complete outsourcing options as well. This can include utility or metered computing services, administrative task automation, dynamic scaling, virtualization services, policy implementation and management services, and managed/filtered internet connectivity.
532
532. What is grid computing?
Grid computing is a form of parallel distributed processing that loosely groups a significant number of processing nodes toward the completion of a specific processing goal.
533
533. What is technology convergence?
The tendency for various technologies, solutions, utilities, and systems to evolve and merge over time. Often this results in multiple systems performing similar or redundant tasks or one system taking over the features and abilities of another. While in some instances this can result in improved efficiency and cost savings, it can also be an increased single point of failure and can become a more valuable target for hackers and intruders.
534
534. Define the aspect of confidentiality known as sensitivity.
Sensitivity refers to the quality of information that could cause harm or damage if disclosed. Maintaining confidentiality of sensitive information helps to prevent harm or damage.
535
535. Define the aspect of confidentiality known as discretion.
Discretion is an act of decision whereby an operator can influence or control disclosure in order to minimize harm or damage.
536
536. Define the aspect of confidentiality known as criticality.
The level to which information is mission critical is its measure of criticality. The higher the level of criticality, the more likely the need to maintain the confidentiality of the information. High levels of criticality are essential to the operation or function of an organization.
537
537. Define the aspect of confidentiality known as concealment.
Concealment is the act of hiding or preventing disclosure. Often concealment is viewed as a means of cover, obfuscation, or distraction.
538
538. Define the aspect of confidentiality known as secrecy.
Secrecy is the activity of keeping something a secret or preventing the disclosure of information.
539
539. Define the aspect of confidentiality known as privacy.
Privacy refers to keeping information confidential that is personally identifiable or that might cause harm, embarrassment, or disgrace to someone if revealed.
540
540. Define the aspect of confidentiality known as seclusion.
Seclusion refers to storing something in an out-of-the-way location. This location can also provide strict access controls. Seclusion can help enforce confidentiality protections.
541
541. Define the aspect of confidentiality known as isolation.
Isolation is the act of keeping something separated from others. Isolation can be used to prevent co-mingling of information or disclosure of information.
542
542. What is a business case?
A business case is usually a documented argument or stated position in order to define a need to make a decision or take some form of action. To make a business case is to demonstrate a business-specific need to alter an existing process or choose an approach to a business task. A business case is often made to justify the start of a new project, especially a project related to security. It is also important to consider the budget that can be allocated to a business-need-based security project.
543
543. What is threat modeling?
Threat modeling is the security process whereby potential threats are identified, categorized, and analyzed. Threat modeling can be performed as a proactive measure during design and development or as a reactive measure once a product has been deployed.
544
544. What is SD3+C?
Secure by Design, Secure by Default, Secure in Deployment and Communication
545
545. What are the two goals of SD3+C?
To reduce the number of security-related design and coding defects. To reduce the severity of any remaining defects.
546
546. Define proactive and reactive threat modeling?
A proactive approach to threat modeling takes place during early stages of systems development, specifically during initial design and specifications establishment. This type of threat modeling is also known as a defensive approach. This method is based on predicting threats and designing in specific defenses during the coding and crafting process rather than relying on post-deployment updates and patches.
A reactive approach to threat modeling takes place after a product has been created and deployed. This deployment could be in a test or laboratory environment or to the general marketplace. This type of threat modeling is also known as the adversarial approach. This technique of threat modeling is the core concept behind ethical hacking, penetration testing, source code review, and fuzz testing.
547
547. Name the three common approaches to identifying threats.
Focused on assets, focused on attackers, and focused on software.
548
548.What is STRIDE?
Microsoft developed a threat categorization scheme known as STRIDE. STRIDE is often used in relation to assessing threats against applications or operating systems. However, it can also be used in other contexts as well. STRIDE is an acronym standing for - Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege (STRIDE).
549
549. What is reduction analysis?
Reduction analysis is also known as decomposing the application, system, or environment. The purpose of this task is to gain a greater understanding of the logic of the product as well as its interactions with external elements. Whether an application, a system, or an entire environment, it needs to be divided into smaller containers or compartments.
550
550. Name three methods to rank and prioritize threats.
Probability * Damage Potential, High/medium/low, or DREAD.
551
551. What is DREAD?
DREAD is a threat rating system designed to provide a flexible rating solution that is based on asking five main questions of each threat:
Damage potential: How severe is the damage likely to be if the threat is realized?
Reproducibility: How complicated is it for attackers to reproduce the exploit?
Exploitability: How hard is it to perform the attack?
Affected users: How many users are likely to be affected by the attack (as a percentage)?
Discoverability: How hard is it for an attacker to discover the weakness?
552
552. What is cross-training?
Cross-training is often discussed as an alternative to job rotation. In both cases, workers learn the responsibilities and tasks of multiple job positions. However, in cross-training the workers are just prepared to perform the other job positions; they are not rotated through them on a regular basis. Cross-training enables existing personnel to fill the work gap when the proper employee is unavailable as a type of emergency response procedure.
553
553. What is compliance?
Compliance is the act of conforming to or adhering to rules, policies, regulations, standards, or requirements. Compliance is an important concern to security governance.
554
554. What is a risk framework?
A risk framework is a guideline or recipe for how risk is to be assessed, resolved, and monitored.
555
555. What is FISMA?
The Federal Information Security Management Act (FISMA), passed in 2002, requires that federal agencies implement an information security program that covers the agency's operations. FISMA also requires that government agencies include the activities of contractors in their security management programs.
556
556. What is HITECH?
In 2009, Congress amended HIPAA by passing the Health Information Technology for Economic and Clinical Health (HITECH) Act. This law updated many of HIPAA's privacy and security requirements and was implemented through the HIPAA Omnibus Rule in 2013.
557
557. What are the parameters of the HITECH data breach notification requirements?
Under the HITECH Breach Notification Rule, HIPAA-covered entities that experience a data breach must notify affected individuals of the breach and must also notify both the Secretary of Health and Human Services and the media when the breach affects more than 500 individuals.
558
558. What is an early step in asset security?
Classifying and labeling assets.
559
559. What is sensitive data?
Sensitive data is any information that isn't public or unclassified. It can include confidential, proprietary, protected, or any other type of data that an organization needs to protect due to its value to the organization or to comply with existing laws and regulations.
560
560. What is PII?
Personally Identifiable Information (PII) is any information that can identify an individual.
561
561. What is PHI?
Protected Health Information (PHI) is any health-related information that can be related to a specific person. In the US, the Health Insurance Portability and Accountability Act (HIPAA) mandates the protection of PHI.
562
562. What is proprietary data?
Proprietary data refers to any data that helps an organization maintain a competitive edge. It could be software code it developed, technical plans for products, internal processes, intellectual property, or trade secrets. If competitors are able to access the proprietary data, it can seriously affect the primary mission of an organization.
563
563. What legal protections exist for proprietary data?
Copyrights, patents, and trade secret laws provide protection for proprietary data.
564
564. What are the three data states and their definitions?
Data at rest is any data stored on media such as system hard drives, external USB drives, Storage Area Networks (SANs), and backup tapes. Data in transit (sometimes called data in motion) is any data transmitted over a network. This includes data transmitted over an internal network using wired or wireless methods and data transmitted over public networks such as the internet. Data in use refers to data in temporary storage buffers while an application is using it.
565
565. When sensitive data is no longer needed by an organization, what should be done with it?
When an organization no longer needs sensitive data, personnel should destroy it. Proper destruction ensures that it cannot fall into the wrong hands and result in unauthorized disclosure.
566
566. What is data remanence?
Data remanence is the data that remains on a hard drive as residual magnetic flux. Using system toosl to delete data generally leaves much of the data remaining on the media, and widely available tools can easily undelete it. Even when you use sophisticated tools to overwrite the media, traces of the original data may remain as less-perceptible magnetic fields.
567
567. In relation to storage media, what is erasing?
Erasing media is simply performing a delete operation against a file, a selection of files, or the entire media. In most cases, the deletion or removal process removes only the directory or catalog link to the data. The actual data remains on the drive.
568
568. In relation to storage media, what is clearing?
Clearing, or overwriting, is a process of preparing media for reuse and assuring that the cleared data cannot be recovered using traditional recovery tools. When media is cleared, unclassified data is written over all addressable locations on the media.
569
569. In relation to storage media, what is purging?
Purging is a more intense form of clearing that prepares media for reuse in less-secure environments. It provides a level of assurance that the original data is not recoverable using any known methods. A purging process will repeat the clearing process multiple times and may combine it with another method such as degaussing to completely remove the data. Even though purging is intended to remove all data remnants, it isn't always trusted.
570
570. In relation to storage media, what is declassification?
Declassification involves any process that purges media or a system in preparation for reuse in an unclassified environment. Purging can be used to prepare media for declassification, but often the efforts required to securely declassify media are significantly greater than the cost of new media for a less-secure environment.
571
571. In relation to storage media, what is sanitization?
Sanitization is a combination of processes that removes data from a system or from media. It ensures that data cannot be recovered by any means.
572
572. What is degaussing?
A degausser creates a strong magnetic field that erases data on some media in a process called degaussing. Technicians commonly use degaussing methods to remove data from magnetic tapes with the goal of returning the tape to its original state. While it is possible to degauss hard disks, it is not recommended. Degaussing a hard disk will normally destroy the electronics used to access the data.
573
573. What are some methods of storage media destruction?
Destruction is the final stage in the life cycle of media and is the most secure method of sanitizing media. When destroying media it's important to ensure that the media cannot be reused or repaired and that data cannot be extracted from the destroyed media. Methods of destruction include incineration, crushing, shredding, disintegration, and dissolving using caustic or acidic chemicals. Some organizations remove the platters in highly classified disk drives and destroy them separately.
574
574. What are scoping and tailoring?
Scoping refers to reviewing baseline security controls and selecting only those controls that apply to the IT system you're trying to protect. Tailoring refers to modifying the list of security controls within a baseline so that they align with the mission of the organization.
575
575. In 2012, the committee overseeing the development of SHA-3 made what announcement?
In 2012, the federal government design committee announced that the selection of the Keccak algorithm as the SHA-3 standard. However as of mid-2015, the SHA-3 standard remains in draft form and some technical details still require finalization.
576
576. What is POODLE?
In 2014, an attack known as the Padding Oracle On Downgraded Legacy Encryption (POODLE) demonstrated a significant flaw in the SSL 3.0 fallback mechanism of TLS> In an effort to remediate this vulnerability, many organizations completely dropped SSL support and now rely solely on TLS security.
577
577. What is DRM?
Digital Rights Management (DRM) software uses encryption to enforce copyright restrictions on digital media.
578
578. What is a cryptographic salt and what is it used for?
The cryptographic salt is a random value that is added to the end of the password before the operating system hashes the password. The salt is then stored in the password file along with the hash. It is used to help combat the use of brute-force attacks, including those aided by dictionaries and rainbow tables.
579
579. What is transitive trust?
Transitive trust is the concept that if A trusts B and B trusts C, then A inherits trust of C through the transitive property, which works like it would in a mathematical equation: If A=B, and B=C, Then A=C. In this example, when A requests data from B, then B requests data from C, the data that A receives is essentially from C. Transitive trust is a serious security concern because it may enable bypassing of restrictions or limitations between A and C.
580
580. What is the purpose of memory protection?
Memory protection is used to prevent an active process from interacting with an area of memory that was not specifically assigned or allocated to it. Memory protection is a core security component that must be designed and implemented into an operating system. It must e enforced regardless of the programs executing in the system. Otherwise instability, violation of integrity, denial of service, and disclosure are likely results.
581
581. What is flash memory?
Flash memory is a derivative concept from EEPROM. It is a nonvolatile form of storage media that can be electronically erased and rewritten. The primary difference between EEPROM and flash memory is that EEPROM must be fully erased to be rewritten, while flash memory can be erased and written in blocks or pages.
582
582. What is UEFI?
UEFI (Unified Extensible Firmware Interface) is a more advanced interface (than BIOS) between hardware and the operating system, which maintains support for legacy BIOS services.
583
583. What is a local cache?
A local cache is anything that is temporarily stored on the client for future reuse. There are many local caches on a typical client, including ARP cache, DNS cache, and Internet files cache.
584
584. What are two forms of ARP poisoning?
ARP cache poisoning is caused by an attack responding to ARP broadcast queries in order to send back falsified replies. A second form of ARP cache poisoning is to create static ARP entries.
585
585. What are five examples of DNS poisoning?
HOSTS poisoning, authorized DNS server attack, caching DNS server attack, changing a DNS server address, and DNS query spoofing
586
586. What is data analytics?
Data analytics is the science of raw data examination with the focus of extracting useful information out of the bulk information set. The results of data analytics could focus on important outliers or exceptions to normal or standard items, a summary of all data items, or some focused extraction and organization of interesting information.
587
587. What is big data?
Big data refers to collections of data that have become so large that traditional means of analysis or processing are ineffective, inefficient, and insufficient. Big data involves numerous difficult challenges, including collection, storage, analysis, mining, transfer, distribution, and results presentation.
588
588.What are parallel data systems?
Parallel data systems or parallel computing is a computation system design to perform numerous calculations simultaneously. But parallel data systems often go far beyond basic multiprocessing capabilities. They often include the concept of dividing up a large task into smaller elements, then distributing each subelement to a different processing subsystem for parallel computation. This implementation is based on the idea that some problems can be solved efficiently if they are broken into smaller tasks that can be worked on concurrently.
589
589. What is an ICS?
An Industrial Control System (ICS) is a form of computer-management device that controls industrial processes and machines. ICSs are used across a wide range of industries, including manufacturing, fabrication, electricity generation and distribution, water distribution, sewage processing, and oil refining.
590
590. What are three forms of ICS?
There are several forms of ICS, including Distributed Control Systems (DCS), Programmable Logic Controllers (PLC), and Supervisory Control And Data Acquisition (SCADA).
591
591. Where are DCS systems used and why?
Distributed Control Systems (DCS) units are typically found in industrial process plans where the need to gather data and implement control over a large-scale environment from a single location is essential. An important aspect of DCS is the controlling elements are distributed across the monitored environment, such as a manufacturing floor or a production line, while the centralized monitoring location sends commands out of those localized controllers while gathering status and performance data.
592
592. What is a PLC?
Programmable Logic Controller (PLC) units are effectively single-purpose or focused-purpose digital computers. They are typically deployed for the management and automation of various industrial electromechanical operations, such as controlling systems on an assembly line or a large-scale digital light display.
593
593. What is SCADA?
Supervisory Control And Data Acquisition (SCADA) systems can operate as a standalone device, be networked together with other SCADA systems, or be networked with traditional IT systems. Most SCADA systems are designed with minimal human interfaces. Often, they use mechanical buttons and knobs or simple LCD screen interfaces.
594
594. Name five generic terms that refer to mobile phones, tablets, and other similar devices.
A device owned by an individual can be referenced using any of these terms: Portable device, mobile device, Personal Mobile Device (PMD), Personal Electronic Device or Portable Electronic Device (PED), and Personally Owned Device (POD).
595
595. What is Android (the OS)?
Android is a mobile device OS based on Linux, which was acquired by Google in 2005. The Android source code is made open source through the Apache license, but most devices also include proprietary software. Although it's mostly intended for use on phones and tablets, Android is being used on a wide range of devices, including televisions, game consoles, digital cameras, microwaves, watches, e-readers, cordless phones, and ski goggles.
596
596. What is iOS?
iOS is the mobile device OS from Apple that is available on the iPhone, iPad, iPod, and Apple TV. iOS isn't licensed for use on any non-Apple hardware. Thus, Apple is in full control of the features and capabilities of iOS.
597
597. What is remote wiping?
Remote wipe lets you delete all data and possibly even configuration settings from a device remotely. The wipe process can be triggered over mobile phone service or sometimes over any internet connection.
598
598. What is storage segmentation on a mobile device?
Storage segmentation is used to artificially compartmentalize various types or values of data on a storage medium. On a mobile device, the device manufacturer and/or the service provider may use storage segmentation to isolate the device's OS and preinstalled apps from user-installed apps and user data.
599
599. What is MDM?
Mobile Device Management (MDM) is a software solution to the challenging task of managing the myriad of mobile devices that employees use to access company resources. The goals of MDM are to improve security, provide monitoring, enable remote management, and support troubleshooting. Many MDM solutions support a wide range of devices and can operate across many service providers. You can use MDM to push or remove apps, manage data, and enforce configuration settings both over the air (across a carrier network) and over Wi-Fi connections.
600
600. What is credential management?
The storage of credentials in a central location is referred to as credential management. Given the wide range of Internet sites and services, each with its own particular login requirements, it can be a burden to use unique names and passwords. Credential management solutions offer a means to securely store a plethora of credential sets.
601
601. What is geo-tagging?
Mobile devices with GPS support and enable the embedding of geographical location (geo-tagging) in the form of latitude and longitude as well as date/time information on photos taken with these devices.
602
602. What is application whitelisting?
Application whitelisting is a security option that prohibits unauthorized software from being able to execute. Whitelisting is also know as deny by default or implicit deny. In application security, whitelisting prevents any and all software, including malware, from executing unless it's on the preapproved exception list: the whitelist.
603
603. What is BYOD?
Bring-Your-Own-Device (BYOD) is a policy that allows employees to bring their own personal mobile devices to work and use those devices to connect to (or through) the company network to business resources and/or the internet. Although BYOD may improve employee morale and job satisfaction, it increases security risk to the organization.
604
604. What is an embedded system?
An embedded system is a computer implemented as part of a larger system. The embedded system is typically designed around a limited set of specific functions in relation to the larger product of which it's a component. It may consist of the same components found in a typical computer system, or it may be a microcontroller (an integrated chip with on-board memory and peripheral ports). Examples of embedded systems include network-attached printers, smart TVs, HVAC controls, smart appliances, smart thermostats, Ford SYNC (a Microsoft embedded system in vehicles), and medical devices.
605
605. What is a static system?
A static system or static environment is a set of conditions, events, and surroundings that don't change. In theory, once understood, a static environment doesn't offer new or surprising elements. A static IT environment is any system that is intended to remain unchanged y users and administrators. The goal is to prevent or at least reduce the possibility of a user implementing change that could result in reduced security or functional operation.
606
606. What is a cyber-physical system?
Cyber-physical system is a term used to refer to devices that offer a computational means to control something in the physical world. In the past these might have been referred to as embedded systems, but the category of cyber-physical seems to focus more on the physical world results rather than the computational aspects.
607
607. What is IoT?
Internet of Things (IoT) is the collection of devices that can communicate over the internet with each other or with a control console in order to affect and monitor the real world. IoT devices might be labeled as smart devices or smart home equipment.
608
608. What is DNP3?
DNP3 (Distributed Network Protocol) is a multilayer protocol primarily used in the electric and water utility and management industries. It is used to support communications between data acquisition systems and the system control equipment. DNP3 is an open and public standard. DNP3 is a multilayer protocol that functions similarly to TCP/IP, in that it has link, transport, and transportation layers.
609
609. What are converged protocols?
Converged protocols are the merging of specialty or proprietary protocols with standard protocols, such as those from the TCP/IP suite. The primary benefit of converged protocols is the ability to use existing TCP/IP supporting network infrastructure to host special or proprietary services without the need for unique deployments of alternate networking hardware. Common examples of converged protocols include FCoE, MPLS, iSCSI, and VOIP.
610
610. What is FCoE?
Fibre Channel over Ethernet (FCoE) can be used to support Fibre Channel communications over the existing network infrastructure. FCoE is used to encapsulate Fibre Channel communications over Ethernet networks. It typically requires 10 Gbps Ethernet in order to support the Fibre Channel protocol.
611
611. What is MPLS?
MultiProtocol Label Switching (MPLS) is a high-throughput, high-performance network technology that directs data across a network based on short path labels rather than longer network addresses.
612
612. What is iSCSI?
Internet Small Computer System Interface (iSCSI) is a networking storage standard based on IP. This technology can be used to enable location-independent file storage, transmission, and retrieval over LAN, WAN, or public Internet connections. iSCSI is often viewed as a low-cost alternate to Fibre Channel.
613
613. What is VoIP?
Voice over IP (VoIP) is a tunneling mechanism used to transport voice and/or data over a TCP/IP network. VoIP has the potential to replace or supplant PSTN because it's often less expensive and offers a wider variety of options and features.
614
614. What is SDN?
Software-Defined Network (SDN) is a unique approach to network operation, design, and management. SDN aims at separating the infrastructure layer (i.e., hardware and hardware-based settings) from the control layer (i.e., network services of data transmission management). Furthermore, this also removes the traditional networking concepts of IP addressing, subnets, routing, and so on from needing to be programmed into or be deciphered by hosted applications.
615
615. What is a captive portal?
A captive portal is an authentication technique that redirects a newly connected wireless web client to a portal access control page. The portal page may require the user to input payment information, provide logon credentials, or input an access code.
616
616. What is a site survey?
A site survey is a formal assessment of wireless signal strength, quality, and interference using a RF signal detector. A site survey is performed by placing a wireless base station in a desired location and then collecting signal measurements from the area. The signal measurements are overlaid onto a blueprint of the building to determine whether sufficient signal is present where needed, while minimizing signals outside the desired location.
617
617. What is CDN?
A Content-Distribution Network (CDN) or Content Delivery Network is a collection of resource services deployed in numerous data centers across the Internet in order to provide low-latency, high-performance, high-availability of the hosted content.
618
618. What is port isolation or private ports in relation to VLANs?
These are private VLANs that are configured to use a dedicated or reserved uplink port. The members of a private VLAN or a port isolated VLAN can only interact with each other and over the predetermined exit port or uplink port. A common implementation of port isolation occurs in hotels.
619
619. What is guest OS?
Virtualization technology is used to host one or more operating systems within the memory of a single host computer. This mechanism allows virtually any OS to operate on any hardware. Such an OS is also known as a guest operating system. From the perspective that ther is an original or host OS installed directly on the computer hardware, the additional OSes hosted by the hypervisor system are guests.
620
620. What is OAuth?
OAuth is an open SSO standard designed to work with HTTP, and it allows users to log on with one account. For example, users can log onto their Google account and use the same account to access Facebook and Twitter pages.
621
621. What is OpenID?
OpenID is also an open SSO standard but it is maintained by the OpenID Foundation rather than as an IETF RFC standard. OpenID can be used in conjunction with OAuth or on its own.
622
622. What is IDaaS?
Identity as a Service, or Identity and Access as a Service (IDaaS), is a third-party service that provides identity and access management. IDaas effectively provides SSO for the cloud and is especially useful when internal clients access cloud-based Software as a Service (SaaS) applications.
623
623. What is ABAC?
An advanced implementation of a rule-based Access Control (Rule-BAC) Attribute-Based Access Control (ABAC) model. ABAC models use policies that include multiple attributes for rules. Many software-defined networking applications use ABAC models.
624
624. What is a security test for?
Security tests verify that a control is functioning properly. These test include automated scans, tool-assisted penetration tests, and manual attempts to undermine security.
625
625. What is a security assessment?
Security assessments are comprehensive reviews of the security of a system, application, or other tested environment. During a security assessment, a trained information security professional performs a risk assessment that identifies vulnerabilities in the tested environment that may allow a compromise and makes recommendations for remediation as needed.
626
626. What is a security audit?
Security audits use many of the same techniques followed during security assessments but must be performed by independent auditors.
627
627. What are vulnerability scans?
Vulnerability scans automatically probe systems, applications, and networks looking for weaknesses that may be exploited by an attacker. The scanning tools used in these tests provide quick, point-and-click tests that perform otherwise tedious tasks without requiring manual intervention.
628
628. What is nmap?
The most common tool used for network discovery scanning is an open source tool called nmap. Originally released in 1997, nmap is remarkably still maintained and in general use today. It remains one of the most popular network security tools, and almost every security professional either uses nmap regularly or used it at some point in their career.
629
629. What are network vulnerability scans?
Network vulnerability scans go deeper than discovery scans. They don't stop with detecting open ports but continue on to actually probe a targeted system or network for the presence of known vulnerabilities. These tools contain databases of thousands of known vulnerabilities along with tests they can perform to identify whether a system is susceptible to each vulnerability in the system's database.
630
630. What is a false positive?
When the scanner tests a system for vulnerabilities, it uses the tests in its database to determine whether a system may contain the vulnerability. In some cases, the scanner may not have enough information to conclusively determine that a vulnerability exists and it reports a vulnerability when there really is no problem. This situation is known as a false positive report and is sometimes seen as a nuisance to system administrators.
631
631. What is a false negative?
Far more dangerous than a false positive is when the vulnerability scanner misses a vulnerability and fails to alert the administrator to the presence of a dangerous situation. This error is known as a false negative report.
632
632. What are web vulnerability scanners?
Web vulnerability scanners are special-purpose tools that scour web applications for known vulnerabilities. They play an important role in any security testing program because they may discover flaws not visible to network vulnerability scanners. When an administrator runs a web application scan, the tool probes the web application using automated techniques that manipulate inputs and other parameters to identify web vulnerabilities.
633
633. What is a penetration test?
The penetration test goes beyond vulnerability testing techniques because it actually attempts to exploit systems. Security professionals performing penetration tests actually try to defeat security controls and break into a targeted system or application to demonstrate the flaw.
634
634. What is Nessus?
An example of a vulnerability scanner.
635
635. What is Metasploit?
A penetration testing tool used to automatically execute exploits against targeted systems. Metasploit uses a scripting language to allow the automatic execution of common attacks, saving testers (and hackers!) quite a bit of time by eliminating many of the tedious, routine steps involved in executing an attack.
636
636. What is code review?
Code review is the foundation of software assessment programs. During a code review, also known as a peer review, developers other than the one who wrote the code review it for defects. Code reviews may result in approval of an application's move into a production environment or they may send the code back to the original developer with recommendations for rework of issues detected during the review.
637
637. The Fagan code review process has six steps. Name them.
```
Planning
Overview
Preparation
Inspection
Rework
Follow-up
```
638
638. What is static testing?
Static testing evaluates the security of software without running it by analyzing either the source code or the compiled application. Static analysis usually involves the use of automated tools designed to detect common software flaws, such as buffer overflows.
639
639. What is dynamic testing?
Dynamic testing evaluates the security of software in a runtime environment and is often the only option for organizations deploying applications written by someone else. In those cases, testers often do not have access to the underlying source code.
640
640. What are synthetic transactions?
Dynamic testing may include the use of synthetic transactions to verify system performance. These are scripted transactions with known expected results. The testers run the synthetic transactions against the tested code and then compare the output of the transactions to the expected state.
641
641. What is fuzz testing?
Fuzz testing is a specialized dynamic testing technique that provides many different types of input to software to stress its limits and find previously undetected flaws. Fuzz testing software supplies invalid input to the software, either randomly generated or specially crafted to trigger known software vulnerabilities.
642
642. Name two types of fuzz testing.
Mutation (dumb) fuzzing takes previous input values from actual operation of the software and manipulates (or mutates) it to create fuzzed input. It might alter the characters of the content, append strings to the end of the content, or perform other data manipulation techniques.
Generational (intelligent) fuzzing develops data models and creates new fuzzed input based on a n understanding of the types of data used by the program.
643
643. What is the zzuf tool used for?
The zzuf tool automates the process of mutation fuzzing by manipulating input according to user specifications.
644
644. What is interface testing?
Interface testing assesses the performance of modules against the interface specifications to ensure that they will work together properly when all of the development efforts are complete.
645
645. What is misuse case testing?
In some applications, there are clear examples of ways that software users might attempt to misuse the application. Software testers use a process known as misuse case testing or abuse case testing to evaluate the vulnerability of their software to these known risks.
646
646. What is test coverage analysis?
While testing is an important part of any software development process, it is unfortunately impossible to completely test any piece of software. There are simply too many ways that software might malfunction or undergo attack. Software testing professionals often conduct a test coverage analysis to estimate the degree of testing conducted against the new software.
647
647. Security managers should monitor key performance and risk indicators on an ongoing basis. Name some potential examples of metrics that should be monitored.
Number of open vulnerabilities
Time to resolve vulnerabilities
Number of compromised accounts
Number of software flaws detected in preproduction scanning
Repeat audit findings
User attempts to visit known malicious sites
648
648. What is entitlement?
Entitlement refers to the amount of privileges granted to users, typically when first provisioning an account.
649
649. What is segregation of duties?
Segregation of duties is similar to a separation of duties and responsibilities policy, but it also combines the principle of least privilege. The goal is to ensure that individuals do not have excessive system access that may result in a conflict of interest.
650
650. What is two-person control?
Two-person control (often called the two-man rule) is similar to segregation of duties. It requires the approval of two individuals for critical tasks.
651
651. What is versioning?
Versioning typically refers to version control used in software configuration management. A labeling or numbering system differentiates between different software sets and configurations across multiple machines or at different points in time on a single machine.
652
652. What is CVE?
Vulnerabilities are commonly referred to using the Common Vulnerability and Exposures (CVE) dictionary. The CVE dictionary provides a standard convention used to identify vulnerabilities. MITRE maintains the CVE database, and you can view it at: www.cve.mitre.org.
653
653. What is DDoS?
A distributed denial of service (DDoS) attack occurs when multiple systems attack a single system at the same time.
654
654. What is DRDoS?
A Distributed Reflective Denial of Service (DRDoS) attack is a variant of a DoS. It uses a reflected approach to an attack. In other words, it doesn't attack the victim directly but instead manipulates traffic or a network service so that the attacks are reflected back to the victim from other sources.
655
655. What is a ping flood?
A ping flood attack floods a victim with ping requests. This can be very effective when launched by zombies within a botnet as a DDoS attack. If tens of thousands of systems simultaneously send ping request to a system, the system can be overwhelmed trying to answer the ping requests.
656
656. What is a drive-by download?
A drive-by download is code downloaded and installed on a user's system without the user's knowledge. Attackers modify the code on a web page, and when the user visits, the code downloads and installs malware on the user's system without the user's knowledge or consent.
657
657. What is war dialing?
War dialing means using a modem to search for a system that accepts inbound connection attempts.
658
658. What is a honeypot or a honeynet?
A honeypot is an individual computer created as a trap for intruders. A honeynet is two or more networked honeypots used together to simulate a network. They look and act like legitimate systems, but they do not host data of any real value for an attacker.
659
659. What is a pseudo flaw?
A pseudo flaw is a false vulnerability or apparent loophole intentionally implanted in a system in an attempt to tempt attackers. They are often used on honeypot systems to emulate well-known operating system vulnerabilities.
660
660. What is a padded cell?
A padded cell system is similar to a honeypot, but it performs intrusion isolation using a different approach. When an IDS detects an intruder, that intruder is automatically transferred to a padded cell.
661
661. What is sandboxing?
Sandboxing provides a security boundary for applications and prevents the application from interacting with other applications. Anti-malware applications use sandboxing techniques to test unknown applications. If the application displays suspicious characteristics, the sandboxing technique prevents the application from infecting other applications or the operating system.
662
662. Many organizations use a centralized application to automate monitoring of systems on a network. Name three terms that refer to these types of systems.
Security Information and Event Management (SIEM), Security Event Management (SEM), and Security Information Management (SIM)
663
663. In relation to auditing and monitoring, what is sampling?
Sampling, or data extraction, is the process of extracting specific elements from a large collection of data to construct a meaningful representation or summary of the whole. In other words, sampling is a form of data reduction that allows someone to glean valuable information by looking at only a small sample of data in an audit trail.
664
664. What is egress monitoring?
Egress monitoring refers to monitoring outgoing traffic to prevent data exfiltration, which is the unauthorized transfer of data. Some common methods used to prevent data exfiltration are data loss prevention techniques, looking for steganography attempts, and watermarking.
665
665. What is DLP?
Data Loss Prevention (DLP) Systems attempt to detect and block data exfiltration attempts. These systems have the capability of scanning data looking for keywords and data patterns.
666
666. Name two common types of DLP.
A network-based DLP scans all outgoing data looking for specific data. An endpoint-based DLP can scan files stored on a system and files sent to external devices.
667
667. What is steganography?
Steganography is the practice of embedding a message within a file.
668
668. What is watermarking?
Watermarking is the practice of embedding an image or pattern in paper that isn't readily perceivable. It is often used with currency to thwart counterfeiting attempts. Similarly, organizations often use watermarking in digital documents and other types of files.
669
669. What is system resilience?
System resilience refers to the ability of a system to maintain an acceptable level of service during an adverse event. This could be a hardware fault managed by fault-tolerant components, or it could be an attack managed by other controls such as effective intrusion detection and prevention systems.
670
670. What is a failover cluster?
A failover cluster includes two or more servers, and if one of the servers fails, another server in the cluster can take over its load in an automatic process called failover. Failover clusters can include multiple servers (not just two), and they can also provide fault tolerance for multiple services or applications.
671
671. Define a fail-secure system.
A fail-secure system will default to a secure state in the event of a failure, blocking all access.
672
672. Define a fail-open system.
A fail-open system will fail in an open state, granting all access.
673
673. What use is QoS?
Quality of Service (QoS) controls protect the integrity of data networks under load. Many different factors contribute to the quality of the end user experience, and QoS attempts to manage all of those factors to create an experience that meets business requirements.
674
674. What does an operational investigation focus on?
An operational investigation examines issues related to the organization's computing infrastructure and has the primary goal of resolving operational issues.
675
675. What does a criminal investigation focus on?
A criminal investigation, typically conducted by law enforcement personnel, investigates the alleged violation of criminal law. A criminal investigation may result in charging suspects with a crime and the prosecution of those charges in criminal court.
676
676. What does a civil investigation focus on?
A civil investigation typically does not involve law enforcement but rather involves internal employees and outside consultants working on behalf of a legal team. It prepares the evidence necessary to present a case in civil court resolving a dispute between two parties.
677
677. What is electronic discovery?
In legal proceedings, each side has a duty to preserve evidence related to the case and, through the discovery process, share information with their adversary in the proceedings. This discovery process applies to both paper records and electronic records, and the electronic discovery (or eDiscovery) process facilitates the processing of electronic information for disclosure.
678
678. What is an APT?
Recent years marked the rise of sophisticated attackers known as Advanced Persistent Threats (APTs). These attackers are well funded and have advanced technical skills and resources. They act on behalf of a nation-state, organized crime, terrorist group, or other sponsor and wage highly effective attacks against a very focused target in order to maintain persistent unauthorized access or effect.
679
679. What does a business attack focus on?
A business attack focuses on illegally obtaining an organization's confidential information. This could be information that is critical to the operation of the organization, such as a secret recipe, or information that could damage the organization's reputation if disclosed, such as personal information about its employees.
680
680. What is industrial espionage?
The gathering of a competitor's confidential information, also called industrial espionage, is not a new phenomenon. Businesses have used illegal means to acquire competitive information for many years. The temptation to steal a competitor's trade secrets and the ease with which a savvy attacker can compromise some computer systems makes this type of attack attractive.
681
681. What are financial attacks?
Financial attacks are carried out to unlawfully obtain money or services. They are the type of computer crime you most commonly hear about in the news. The goal of a financial attack could be to steal credit card numbers, increase the balance in a bank account, or place "free" long-distance telephone calls.
682
682. What are terrorist attacks?
Terrorist attacks are a reality in modern society. Our increasing reliance on information systems makes them more and more attractive to terrorists. Such attacks differ from military and intelligence attacks. The purpose of a terrorist attack is to disrupt normal life and instill fear, whereas a military or intelligence attack is designed to extract secret information.
683
683. What are grudge attacks?
Grudge attacks are attacks that are carried out to damage an organization or a person. The damage could be in the loss of information or information processing capabilities or harm to the organization or a person's reputation.
684
684. What are thrill attacks?
Thrill attacks are the attacks launched only for the fun of it.
685
685. What are scanning attacks?
Scanning attacks are reconnaissance attacks that usually precede another, more serious attack.
686
686. What is the purpose of assurance procedures?
To ensure that the security control mechanisms built into a new application properly implements the security policy throughout the life cycle of the system
687
687. What is DevOps?
The word DevOps is a combination of Development and Operations, symbolizing that these functions must merge and cooperate to meet business requirements. The DevOps approach seeks to resolve these issues by bringing the three functions (software development, quality assurance, and technology operations) together in a single operational model.
688
688. What is an API?
An Application Programming Interface (API) allows application developers to bypass traditional web pages and interact directly with the underlying service through function calls.
689
689. What is a code repository?
It acts as a central storage point for developers to place their source code. It may also provide version control, bug tracking, web hosting, release management, and communications functions that support software development.
