Mixed Flashcards
(143 cards)
1
Q
Best way to minimize impact of DDoS
A
use firewall to identify and deny traffic to addresses
2
Q
Main reason to measure impact of unplanned interruption
A
Provides insight into critical business processes
3
Q
When to use digital signatures instead of Message Auth Code
A
When must be known that sender is the only one who made changes to doc
4
Q
Distinctive characteristic of network tunneling process
A
encapsulation of packets
5
Q
In what sec. mode is a system operating when 2 or more classification levels are processed and not all users have clearance for all data handled by system
A
Multi-Level
6
Q
Primary reason for Code Obfuscation
A
increases diff. of reverse engineering
7
Q
Which is a security service not defined in ISO 7498-2 Security Architecture model
A
Availability
8
Q
Why are audit trails important
A
They provide individual accountability
9
Q
Primary components of effective security program
A
People, Processes, Technology
10
Q
Access Control attack used against a remote user’s callback
A
Call forwarding
11
Q
Major Weakness of PPTP
A
Encryption key derived from User’s Password
12
Q
BCP project scope identification includes
A
BIA, also most CRUCIAL factor for DRP
13
Q
With 802.11B wireless, which tech protects users from each other
A
Firewall on each device/computer
14
Q
Stack overflow that crashes TCP/IP service daemon can result in serious security breach because
A
process is executed by a privileged entity
15
Q
ISO 27001 complements…
A
17799
16
Q
17799 is evolution of
A
7799
17
Q
Activation of virus attached in email is avoided by
A
configuring client to not automatically open attachments
18
Q
Crypto attack that uses execution times and cryptographic device power requirement
A
Differential
19
Q
Main reason to use IPsec in tunnel mode is
A
protect entire IP packet
20
Q
Design phase in Software Development Life Cycle (SDLC) includes all but:
A
Developing maintenance and operations manual
21
Q
Which EAL within Common Criteria provides security assurance “methodically tested and checked” ?
A
EAL 3
22
Q
Which attack will a Network-Based IDS detect
A
Phone Book File attack from a browser using SSL
23
Q
Term that defines what security properties of a product is evaluated in Common Criteria evaluation is:
A
Security Target
24
Q
Regularly scheduled check of network cards in promiscuous mode is a countermeasure for:
A
Sniffer
25
Basic foundation of Privacy Management process is
Organizational Governance
26
Reconnaissance phase of penetration testing employs:
Social engineering
27
Risk analysis based on historical costs and probability of a thread and is measured in cost to the organization is:
quantitative method
28
In a computer forensics investigation involving a HD, examiner should keep a log including:
timestamps of files on the media
29
Which of the following is a weakness of both statystical anomaly detection and pattern matching:
lack of a learning model
30
In addition to providing audit trail auditors can use, loggin provides:
backout and recovery information
31
Which approach to IPsec key exchange is protocol of choice of IETF (Internet engineering task force)
ISAKMP
32
Patch management life cycle begins with:
developing a baseline software inventory management system
33
Not a fundamental component (question) of Regulatory Security Policy
WHY it is to be done
34
Important aspect of computer ethics program involves consideration of
Regulatory Requirements
35
Commonly used technique by covert Channel is
tunneling
36
Class of threat associated with manual or automated process
operational
37
Provides a minimum level of security acceptable for an environment
Baseline
38
Formal Security Policy Model is one that:
is a mathematically precise statement of a security policy
39
Inner workings of a buffer overflow attack:
Program fails to check buffer size limits before storing data
40
Expert systems differ from other AI programs because
need to encode domain-dependant knowledge of the everyday practitioner and using it to solves problem
41
Mitigation strategy that falls in certification framework for application development security
waiver authorization
42
Financial transaction digitally signed, what method can be used to prevent the transaction from being done again
Include timestamp on the message
43
Operates at the media layer and is an attempt by an intruder to inject packets in a conversation
Real-Time Transport Protocol (RTP) hijacking
44
Birthday attack can be used to:
find Hash Collisions
45
Could be used to encrypt network traffic streaming between two offices
IPsec AH (Authentication Header) tunnel
46
Valid reason to propose two-factor auth for Remote Access
More vulnerable and requires better authentication
47
Implementation of a positive security model on a firewall allows:
all defined legitimate traffic and denies everything else
48
Main advantage of positive security model
New or Unknown attackes are more easily prevented
49
IPsec provides security to traffic at what point in transmission?
At perimeter if IPsec is enabled on Firewall or Router
50
SYN attack can be determined by observing
Spoofed source IP address
51
NOT a characteristic of an IDS
Determines the source of incoming packets
52
As part of BCP, two characteristics of a business task or function MUST be identified:
Result and requirement
53
Primary consideration when a shared device is used to store data outside with an outsourced organization:
Minimize risk of data loss due to device failure through volume partitioning
54
Organizational Security Policy (OSP) is
a High-Level management document to inform all users on the goals and constraints on using a system
55
Primary benefit of hierarchical storage management system is:
Use of less expensive storage media for infrequently accessed data
56
Benefits of IPsec include:
Access control, Connectionless integrity and Rejection of replayed packets (NOT Data Destination Authentication)
57
Principal difference between OpenPGP and S/MIME
Method of key exchange is different between OPGP and SMIME
58
Organizational Security Program is completed by:
Establishing a methodology for resolving discovered problems
59
Common Criteria defines security controls in these categories:
Functional and Assurance
60
Inbound traffic pattern that indicates voice network being hacked
High number of short duration calls
61
Encryption to avoid traffic analysis would be based on:
hop-by-hop
62
DB with physicians and researchers pose what challenge to developer:
Provide general information without revealing details
63
Crypto pseudorandom key generation is best described as:
Calculation of a key using a seed value and a deterministic algorithm
64
Information retention policy should be clearly defined to all employees to protect company from:
discovery issues
65
in Bell-Lapadula, system state is secure if access mode from subject to object is in accordance to:
Specific security policy
66
When significant changes to system occur during maintenance phase of SDLC, what is required:
Recertification of sensitive applications and periodic risk analysis
67
In web application logs, a "request has succeeded" code is:
200
68
OSI layer 1
Physical - point to point data connection
69
OSI layer 2
Data link - point to point data connection (reliable)
70
OSI layer 3
Network - addressing, routing, datagram delivery
71
OSI layer 4
Transport - reliable packet delivery betweek Point to point in network, TCP-IP (connected session)
72
OSI ayer 5
Session - interhost comm, session management between apps
73
OSI layer 6
Presentation - data representation, encryption - decryption, conversion of machine dependent to machine independent data
74
OSI layer 7
Application - Network process to application
75
DSSS
Direct sequence spread spectrum
76
FHSS
Frequency Hopping Spread Spectrum - rapidly changing freq.
77
OFDM
Orthogonal Frequency division multiplexing - high bandwidth spling in many low bandwidth transmissions
78
FDMA
Frequency Division Multiple Access - analog cell
79
TDMA
Time division multiple access - digital cell, two bands for each call
80
CDMA
10x DSSS bandwidth
81
UMTS
3GPP cell tech
82
War Dialing
Dial entire range of numbers to identify lines connected to modems
83
Rogue model vulnerability
Modem connection without knowledge or authorization from organization
84
SONET/SDH
fiber-optic net (MAN is typically based on that)
85
VAN
Value Added Network - between organizations typically
86
IGMP
Used to manage multicasting groups
87
Switches
Forward frames only to the specified MAC
88
Miltiplexor
Combines several signals into one data stream
89
WPA
uses RC4 with 128-bit keys with TKIP
90
TKIP
Temporal Key Integrity Protocol
91
WPA2
uses AES and CCMP (Counter-mode/CBC-MAC protocol), supports EAP framework
92
Blue Jacking
anonymous message displayed on device
93
Blue bug attack
initiate calls from victim's phone
94
ARP
Address resolution protocol (resolve layer 3 IP with Layer 2 MAC)
95
PAP
Password authentication protocol (not as secure as CHAP)
96
CHAP
Challenge Handshake Authentication Protocol - password sent as a one-way MD5 hash, challenge includes nonce
97
Nonce
Parameter that varies with time, or number used once.
98
EAP
Extensible Authentication Protocol
99
EAP-TLS
Both client and server mutually authenticate over TLS with certificate
100
EAP-TTLS
less secure than TLS, certificate presented to client only
101
EAP-PEAP
less secure than TLS
102
Eavesdropping
discover user identities by sniffing authentication traffic
103
War Driving
driving around area trying to find Wireless APs
104
Layer 3
IP devices (NAC, PCs, etc...)
105
PPTP
Point to Point tunneling protocol, derives encryption from user password
106
SSH
Protects integrity of comm and supports strong AUTH.
107
SSH2
Improved integrity and more digital certs types
108
IPSec
IP Security, provides encryption and AUTH
109
AH
Authentication Header - guarantees identity of sending node
110
ESP
Encapsulating Security Payload - encrypts IP packet for confidentiality and integrity
111
IKE
Internet Key Exchange for IPSec
112
Ping of Death
based on misconfigured ICMP packet that is 64k, host may crash if improperly patched
113
traceRT exploit
helps map victim network
114
Smurf attack
ICM echo request with spoofed source address of victim to a network's broadcast address, victim overwhelmed by echo replies
115
Teardrop attack
ip frags are constructed by attacker to create a negative number for host when it reconstructs packet. IP stack can crash
116
TCP Ports
0-1023, Well-known. 1024-49151, Registered ports. 49152-65535, Dynamic or private.
117
UDP
User Datagram Protocol - no handshake, no error detection
118
SYN scanning
scanning method that doesn't complete handshake process, sometimes undetectable, not logged
119
Session Hijacking
(Man in the middle) - Unauthorized insertion of packets in a data stream. App layer protection can mitigate.
120
Remote Procedure Call
Executes objects across hosts.
121
TACACS+
Separates AUTH and AUTOR, unlike Radius, IETF STD
122
LDAP
directory based on X.500, weak AUTH unless over SSL
123
NIS+ (Unix)
AUTH and AUTOR, better than NIS
124
CIFS/SMB
File sharing protocol in WIN
125
AES
Rijndael algorithm
126
Clipper chip
Key Escrow
127
XOR
Stream cipher/encryption algorithm
128
DES
Data Encryption Standard - Symm., 56-bit, uses private key for encryption
129
Reference monitor requires:
Isolation, Completeness, Verifiability
130
RSA
uses public key for encryption, based on difficulty of factoring large numbers, Asymmetric.
131
PGP
Pretty good privacy - doesn't use a hierarchical trust model. Symm. key and public key crypto. Web of Trust. Provides Confidentiality, Integrity, Authenticity.
132
SOCKS Gateway
Circuit-level firewall
133
in SDLC, waterfall model assumes that:
each step can be completed and finalized without any effect from the later stages that may require rework
134
elements of a TCV that implement reference monitor concept
Protection rings
135
Percentage of loss a realized threat could have:
Exposure Factor (EF)
136
Malware that is self-contained, no need to be part of another computer program to propagate
Worm
137
CA can revoke a certificate when:
Certificate owner's private key is compromised
138
protocol - eWallet, encrypted credit card info sent to merchant then DigiSigned and sent to bank
SET
139
Cryptanalytic attack with least amount of info
Ciphertext-only
140
Public Key algo. are:
1-10K slower than secret key algo.
141
Kerberos protected from replay attacks by:
Time Stamps
142
Diffie-Hellman
Key Exchange
143
Digital Signature
Sender encrypts a message digest with his private key
