Domain 7: Assessment Management

Question 1

Name the 4 types of IDS events

Answer 1

1. True positive
2. True negative
3. False positive
4. False negative

Question 2

• Types of IDS event

- A Worm spreading on a trusted network; NIDS alerts

Answer 2

True positive

Question 3

• Types of IDS event

- User surfs the web to an allowed site; NIDS is silent

Answer 3

True negative

Question 4

• Types of IDS event

- User surfs the web to an allowed site; NIDS alerts

Answer 4

False positive

Question 5

• Types of IDS event

- A worm is spreading on a trusted network; NIDS is silent

Answer 5

False negative

Question 6

• Type of NIPS

- Malicious traffic is identified and then “shot down”

Answer 6

Active response NIPS

Question 7

• Type of NIPS

- Acts as a Layer 3-7 firewall device traffic flows through

Answer 7

Inline NIPS

Question 8

Class of solutions that are tasked specifically with trying to detect or prevent data from leaving the organization in a unauthorized manner

Answer 8

Data loss prevention (DLP)

Question 9

Name 4 endpoint security controls

Answer 9

1. Antivirus
2. Application whitelisting
3. Removable media controls
4. Disk encryption

Question 10

• Endpoint Security Control

- App used to determine in advance which binaries are considered safe to execute on a given system

Answer 10

Application whitelisting

Question 11

• The process of capturing a snapshot of the current system security configuration
• Can use helpful during a potential security incident

Answer 11

Baselining

Question 12

Used to help mitigate the risks associated with hard disk failures

Answer 12

Redundant array of Inexpensive disks (RAID)

Question 13

Achieves full data redundancy by writing the same data to multiple hard disks

Answer 13

Mirroring

Question 14

• Increases read and write performance by spreading - data across multiple hard disks
• Writes can be performed in parallel across multiple disks rather than serially on one disk

Answer 14

Striping

Question 15

• Achieves data redundancy calculating data in two drives and storing the results on a third
• After failed drive is replaces the RAID controller rebuilds the lost data from the other two drives

Answer 15

Parity

Question 16

• RAID Level
• Block-level striping
• Employs stripping to increase performance of read and writes
• Stripping offers no data redundancy

Answer 16

RAID 0

Question 17

• RAID Level
• Creates/writes an exact duplicate of all data to an additional disk
• Mirrored set

Answer 17

RAID 1

Question 18

• RAID Level
• Legacy technology requires either 14 or 39 hard disks and a specially designed hardware controller
• Cost prohibitive
• Stripes at bit level

Answer 18

RAID 2

Question 19

• RAID Level
• Byte-level striping
• Dedicated disk is leveraged for storage of parity info used for recovery from a failure

Answer 19

RAID 3

Question 20

• RAID Level
• Block-level striping
• Employs a dedicated parity drive

Answer 20

RAID 4

Question 21

• RAID Level
• Block-level striping
• Distributes the parity info across multiple disks

Answer 21

RAID 5

Question 22

• RAID Level

- Block-level striping with double distributed parity

Answer 22

RAID 6

Question 23

• RAID Level
• Combines disk mirroring and stripping to protect data
• Requires minimum of four disks

Answer 23

RAID 10

Question 24

Multiple systems are configured so that in case of failure another can seamlessly take over and maintain availability to the service or application

Answer 24

High-availability cluster (aka Failover cluster)

Question 25

- Each member actively processes data in advance of failure | - i.e. load balancing

Answer 25

Active-active HA cluster

Question 26

Backup systems only begin processing data when a failure is detected

Answer 26

Active-passive cluster

Question 27

- Goal is to ensure any changes does not lead to reduced or compromised security - Makes it possible to roll back any changes to a previous secured state

Answer 27

Change management

Question 28

- Form of nonstatistical sampling that record only events that exceed a threshold - i.e. for a failed logon attempt an alarm can be raised only if five failed login attempts are detected within a 30-minute period

Answer 28

Clipping

Question 29

- Typically addresses common concepts such as purpose, scope, and results discovered or revealed - Reports that contain sensitive info should be assigned a classification label and handed appropriately

Answer 29

Audit reports

Question 30

Ensures that object access and account management practices support security policy

Answer 30

Access review audit

Question 31

Ensures that the principle of least privilege is followed and often focus on privileged accounts

Answer 31

User entitlement audits