OSG-CH1

Question 1

prevent or minimize unauthorized access to data.

Answer 1

Confidentiality

Question 2

protection prevents unauthorized alterations of data

Answer 2

Integrity

Question 3

functional and allows authorized users to gain authorized access

Answer 3

Availability

Question 4

Disclosure, alteration, and destruction make up the DAD Triad

Answer 4

Failures of the CIA Triad

Question 5

Overprotecting confidentiality

Answer 5

result in a restriction of availability.

Question 6

Overprotecting integrity

Answer 6

result in a restriction of availability.

Question 7

Overproviding availability

Answer 7

result in a loss of confidentiality and integrity

Question 8

Providing pieces of information such as involve typing in a username; swiping a smartcard; waving a proximity device; speaking a phrase; or positioning your face, hand, or finger for a camera or scanning device

Answer 8

Identification

Question 9

requires the subject to provide additional information that corresponds to the identity they are claiming

Answer 9

Authentication

Question 10

ensures that the requested activity or access to an object is possible given the rights and privileges assigned to the authenticated identity.

Answer 10

Authorization

Question 11

Log files provide a trail for re-creating the history of an event, intrusion, or system failure. needed to detect malicious actions by subjects, attempted intrusions, and system failures and to reconstruct events, provide evidence for a prosecution, and produce problem reports and analysis

Answer 11

Auditing

Question 12

Is established by linking an individual to the activities of an online identity through the security services and mechanisms of auditing, authorization, authentication

Answer 12

Accountability

Question 13

use of multiple controls in a series. No one control can protect against all possible threats.

Answer 13

Defense in depth (layering)

Question 14

used for efficiency. Similar elements are put into groups, classes, or roles that are assigned security controls, restrictions, or permissions as a collective. the concept is used when classifying objects or assigning roles to subjects.

Answer 14

Abstraction

Question 15

Type of Steganography; ensures that data existing at one level of security is not visible to processes running at different security levels. positioning data so that it is not viewable or accessible to an unauthorized subject.

Answer 15

Data hiding

Question 16

exists between a high-security area and a low-security one, such as between a LAN and the internet.

Answer 16

security boundary

Question 17

compare the security processes and infrastructure used within the organization with knowledge and insight obtained from external sources; imposed on organizations due to legislative and regulatory compliance needs.

Answer 17

Security governance

Answer 18

Third-party governance

Answer 19

Documentation review