IS4550 CHAPTER 10

Question 1

An implementation technique to control access to a resource by maintaining a table of authorized user IDs is called ___.

Answer 1

ACCESS CONTROL LIST (ACL)

Question 2

Software or plug-ins that run within a client browser, usually when visiting certain Web sites is called ___.

Answer 2

ACTIVE CONTENT

Question 3

The act of recording relevant security events that occur on a computing or network device (server, workstation, firewall, etc.) This can also refer to a review of business and financial processes and files by an auditor is called ___.

Answer 3

AUDIT

Question 4

The process of removing unnecessary software on a server or workstation, turning off unneeded network ports and services, and preventing users from changing a machine’s configuration is called ___.

Answer 4

HOST HARDENING

Question 5

A series of software agents, appliances, and servers that monitor for network activity that is deemed a threat, alerts, administrators, and logs the information. They operate by matching signatures of known poodle network attack traffic or by building over time a baseline of normal behavior then alerting on traffic that is anomalous to that normal pattern of behavior and is called ___.

Answer 5

INTRUSION DETECTION SYSTEM (IDS)

Question 6

A system that intercepts potentially hostile activity prior to it being process is called ___.

Answer 6

INTRUSION PREVENTION SYSTEM (IPS)

Question 7

An application firewall that is used to control the flow of traffic to and from the Internet to user workstations attached to a local area network. It intercepts the user’s request for an Internet resource, initiates a new connection, and proxies the result back to the requestor and is called ___.

Answer 7

USER PROXY

Question 8

Automated information services over the Internet using standardized technologies and formats/protocols that simplify the exchange and integration of data. This helps organizations to inter-operate regardless of the types of operating systems, programming languages, and databases being used and is called ___.

Answer 8

WEB SERVICES

Question 9

1. The steps to implement security controls on a firewall would be documented within which of the following?
2. Policy
3. Control standard
4. Baseline standard
5. Procedure

Answer 9

Procedure

Question 10

2. A DMZ separates a LAN from which of the following?
3. Phone network
4. Internet network
5. Cellular network
6. VoIP network

Answer 10

Internet network

Question 11

3. Visitor control is an aspect of which of the following?
4. Network security
5. Personnel security
6. Workstation security
7. Physical security

Answer 11

Physical security

Question 12

4. Which of the following can you use to segment LANs?
5. Routers and firewalls
6. Routers and gateways
7. Gateways and servers
8. Servers and workstations

Answer 12

Routers and firewalls

Question 13

5. Without a policy that leads to controls that restrict employees from installing their own software on a company workstation, a company could suffer which of the following consequences?
6. Malware on the network
7. Lawsuits from software licensing issues
8. Loss of productivity
9. All the above

Answer 13

Malware on the network
Lawsuits from software licensing issues
Loss of productivity

Question 14

6. Good sources for security policies and standards include which of the following?
7. US Government
8. Private companies selling standards
9. Professional organizations
10. Vendors
11. All the above

Answer 14

US Government
Private companies selling standards
Professional organizations
Vendors

Question 15

7. Two-factor authentication is a typical control used by employees to remotely access which of the following?
8. Workstation
9. LAN
10. DMZ Web site
11. WAN

Answer 15

LAN

Question 16

8. Which document outlines the specific controls that a technology device needs to support?
9. Control standard
10. Baseline standard
11. Procedure
12. Policy

Answer 16

Baseline standard

Question 17

9. The User Proxy control standard is needed for the ___ domain.

Answer 17

LAN-to-WAN

Question 18

10. The content for the documents in the policies and standards library should be written so they are ___ and ___.

Answer 18

Cohesive

Coherent

Question 19

11. Production data should be sanitized before being used in a test environment.
    TRUE OR FALSE

Answer 19

TRUE

Question 20

12. Organizations should always create new policies tailored to their needs rather than adopt industry norms found on the Internet.
    TRUE OR FALSE

Answer 20

FALSE