Questions and Answers

Question 1

Aaron is a security manager who needs to develop a solution to allow
his company’s mobile devices to be authenticated in a standardized and
centralized manner using digital certificates. The applications these mobile
clients use require a TCP connection. Which of the following is the best
solution for Aaron to implement?
A. SESAME using PKI
B. RADIUS using EAP
C. Diameter using EAP
D. RADIUS using TTLS

Answer 1

C.
Diameter is a protocol that has been developed to build upon the
functionality of RADIUS and to overcome many of its limitations. Diameter
is an AAA protocol that provides the same type of functionality as RADIUS
and TACACS+ but also provides more flexibility and capabilities, including
working with EAP. RADIUS uses UDP, and cannot effectively deal well with
remote access, IP mobility, and policy control

Question 2

Terry is a security manager for a credit card processing organization. His
company uses internal DNS servers, which are placed within the LAN, and
external DNS servers, which are placed in the DMZ. The company also relies
upon DNS servers provided by their service provider. Terry has found out that
attackers have been able to manipulate several DNS server caches, which point
employee traffic to malicious websites. Which of the following best describes
the solution this company should implement?
A. IPSec
B. PKI
C. DNSSEC
D. MAC-based security

Answer 2

C.DNSSEC (DNS security, which is part of the many current implementations
of DNS server software) works within a PKI and uses digital signatures, which
allows DNS servers to validate the origin of a message to ensure that it is not
spoofed and potentially malicious. If DNSSEC were enabled on server A, then
server A would, upon receiving a response, validate the digital signature on
the message before accepting the information to make sure that the response
is from an authorized DNS server. So even if an attacker sent a message to a
DNS server, the DNS server would discard it because the message would not
contain a valid digital signature. DNSSEC allows DNS servers to send and
receive only authenticated and authorized messages between themselves,
and thwarts the attacker’s goal of poisoning a DNS cache table

Question 3

It is important to deal with the issue of “reasonable expectation of privacy”
(REP) when it comes to employee monitoring. In the U.S. legal system
the expectation of privacy is used when defining the scope of the privacy
protections provided by .
A. Federal Privacy Act
B. PATRIOT Act
C. The Fourth Amendment of the Constitution
D. The Bill of Rights

Answer 3

C.It is important to deal with the issue of “reasonable expectation of privacy”
(REP) when it comes to employee monitoring. In the U.S. legal system
the expectation of privacy is used when defining the scope of the privacy
protections provided by the Fourth Amendment of the Constitution. If it is not specifically explained to an employee that monitoring is possible and/
or probable, when the monitoring takes place he could claim that his privacy
rights have been violated and launch a civil suit against a company.

Question 4

Jane is suspicious that an employee is sending sensitive data to one of the
company’s competitors. The employee has to use these data for daily activities,
thus it is difficult to properly restrict the employee’s access rights. In this
scenario, which best describes the company’s vulnerability, threat, risk, and
necessary control?
A. Vulnerability is employee access rights, threat is internal entities misusing
privileged access, risk is the business impact of data loss, and the necessary
control is detailed network traffic monitoring.B. Vulnerability is lenient access rights, threat is internal entities misusing
privileged access, risk is the business impact of data loss, and the necessary
control is detailed user monitoring.
C. Vulnerability is employee access rights, threat is internal employees
misusing privileged access, risk is the business impact of confidentiality,
and the necessary control is multifactor authentication.
D. Vulnerability is employee access rights, threat is internal users misusing
privileged access, risk is the business impact of confidentiality, and the
necessary control is CCTV.

Answer 4

B.A vulnerability is a lack or weakness of a control. In this situation the access
control may be weak in nature, thus exploitable. The vulnerability is that the
user, who must be given access to the sensitive data, is not properly monitored
to deter and detect a willful breach of security. The threat is that any internal
entity might misuse given access. The risk is the business impact of losing
sensitive data. One control that could be put into place is monitoring so that
access activities can be closely watched.

Question 5

Which of the following best describes what role-based access control offers
companies in reducing administrative burdens?A. It allows entities closer to the resources to make decisions about who can
and cannot access resources.
B. It provides a centralized approach for access control, which frees up
department managers.
C. User membership in roles can be easily revoked and new ones established
as job assignments dictate.
D. It enforces an enterprise-wide security policy, standards, and guidelines.

Answer 5

C.An administrator does not need to revoke and reassign permissions to
individual users as they change jobs. Instead, the administrator assigns
permissions and rights to a role, and users are plugged into those roles.

Question 6

Mark needs to ensure that the physical security program he develops for his
company increases performance, decreases risk in a cost-effective manner, and
allows management to make informed decisions. Which of the following best
describes what he needs to put into place?
A. Performance-based program
B. Defense-in-depth program
C. Layered program
D. Security through obscurity

Answer 6

A.It is possible to determine how beneficial and effective your physical
security program is only if it is monitored through a performance-based
approach. This means you should devise measurements and metrics to
gauge the effectiveness of your countermeasures. This enables management
to make informed business decisions when investing in the protection of
the organization’s physical security. The goal is to increase the performance
of the physical security program and decrease the risk to the company in a
cost-effective manner. You should establish a baseline of performance and
thereafter continually evaluate performance to make sure that the company’s
protection objectives are being met.

Question 7

A software development company released a product that committed several
errors that were not expected once deployed in their customers’ environments.
All of the software code went through a long list of tests before being released.
The team manager found out that after a small change was made to the code,
the program was not tested before it was released. Which of the following
tests was most likely not conducted?
A. Unit
B. Compiled
C. Integration
D. Regression

Answer 7

D.Regression testing should take place after a change to a system takes place,
retesting to ensure functionality, performance, and protection.

Question 8

It is important to choose the right risk analysis methodology to meet the goals
of the organization’s needs. Which of the following best describes when the
risk management standard AS/NZS 4360 should be used?
A. When there is a need to assess items of an organization that are directly
related to information security.
B. When there is a need to assess items of an organization that are not just
restricted to information security.
C. When a qualitative method is needed to prove the compliance levels as
they pertain to regulations.
D. When a qualitative method is needed to prove the compliance levels as
they pertain to laws

Answer 8

B.AS/NZS 4360 takes a much broader approach to risk management than just
information security. This Australian and New Zealand methodology can be
used to understand a company’s financial, capital, human safety, and business
decisions risks. Although it can be used to analyze security risks, it was not
created specifically for this purpose. This risk management standard is more
focused on the health of a company from a business point of view, not security

Question 9

Companies should follow certain steps in selecting and implementing a new
computer product. Which of the following sequences is ordered correctly?
A. Evaluation, accreditation, certification
B. Evaluation, certification, accreditation
C. Certification, evaluation, accreditation
D. Certification, accreditation, evaluation

Answer 9

B.The first step is evaluation. Evaluation involves reviewing the product’s
protection functionality and assurance ratings. The next phase is certification.
Certification involves testing the newly purchased product within the company’s
environment. The final stage is accreditation, which is management’s formal
approval

Question 10

An operating system maintains several processes in memory at the same time.
The processes can only interact with the CPU during its assigned time slice since
there is only one CPU and many processes. Each process is assigned an interrupt
value to allow for this type of time slicing to take place. Which of the following
best describes the difference between maskable and nonmaskable interrupts?
A. A maskable interrupt is assigned to a critical process, and a nonmaskable
interrupt is assigned to a noncritical process.
B. A maskable interrupt is assigned to a process in ring 0, and a nonmaskable
interrupt is assigned to a process in ring 3.
C. A maskable interrupt is assigned to a process in ring 3, and a nonmaskable
interrupt is assigned to a process in ring 4.
D. A maskable interrupt is assigned to a noncritical process, and a
nonmaskable interrupt is assigned to a critical process.

Answer 10

D.A maskable interrupt is assigned to an event that may not be overly
important, and the programmer can indicate that if that interrupt calls, the
program does not stop what it is doing. This means the interrupt is ignored.
Nonmaskable interrupts can never be overridden by an application because
the event that has this type of interrupt assigned to it is critical.

Question 11

Cable telecommunication networks used to provide a security risk in that
neighbors could commonly access each other’s Internet-based traffic because
the traffic was not encrypted and protected. Which of the following is an
international telecommunications standard that addresses these issues?
A. Safe Harbor Encryption Requirements
B. Data-Over-Cable Service Interface Specifications
C. Privacy Service Requirements
D. Telecommunication Privacy Protection Standard

Answer 11

B.Most cable providers comply with Data-Over-Cable Service Interface
Specifications (DOCSIS), which is an international telecommunications
standard that allows for the addition of high-speed data transfer to an existing
cable TV (CATV) system. DOCSIS includes MAC-layer security services in its
Baseline Privacy Interface/Security (BPI/SEC) specifications. This protects
individual user traffic by encrypting the data as they travel over the provider’s
infrastructure. Sharing the same medium brings up a slew of security
concerns, because users with network sniffers can easily view their neighbors’
traffic and data as both travel to and from the Internet. Many cable companies
are now encrypting the data that go back and forth over shared lines through
a type of data link encryption.

Question 12

There are different categories for evidence depending upon what form it is
in and possibly how it was collected. Which of the following is considered
supporting evidence?
A. Best evidence
B. Corroborative evidence
C. Conclusive evidence
D. Direct evidence

Answer 12

B.Corroborative evidence cannot stand alone, but instead is used as supporting
information in a trial. It is often testimony indirectly related to the case but
offers enough correlation to supplement the lawyer’s argument. The other
choices are all types of evidence that can stand alone.

Question 13

_____________ is the graphical representation of data commonly used on
websites. It is a skewed representation of characteristics a person must enter to
prove that the subject is a human and not an automated tool, as in a software
robot.
A. Anti-spoofing
B. CAPTCHA
C. Spam anti-spoofing
D. CAPCHAT

Answer 13

B.A CAPTCHA is a skewed representation of characteristics a person must
enter to prove that the subject is a human and not an automated tool, as in
a software robot. It is the graphical representation of data.

Question 14

Mark has been asked to interview individuals to fulfill a new position in his
company. The position is a chief privacy officer (CPO). What is the function
of this type of position?
A. Ensuring that company financial information is correct and secure
B. Ensuring that customer, company, and employee data are protected
C. Ensuring that security policies are defined and enforced
D. Ensuring that partner information is kept safe

Answer 14

B.The CPO is a newer position, created mainly because of the increasing
demands on organizations to protect a long laundry list of different types
of data. This role is responsible for ensuring that customer, company, and
employee data are secure and kept secret, which keeps the company out of
criminal and civil courts and hopefully out of the headlines.

Question 15

A risk management program must be developed properly and in the right
sequence. Which of the following provides the correct sequence for the steps
listed?
i. Developed a risk management team
ii. Calculated the value of each asset
iii. Identified the vulnerabilities and threats that can affect the identified assets
iv. Identified company assets to be assessed
A. i, iii, ii, iv
B. ii, i, iv, iii
C. iii, i, iv, ii
D. i, iv, ii, iii

Answer 15

D.The correct steps for setting up a risk management program are as follows:

1. Develop a risk management team
2. Identify company assets to be assessed
3. Calculate the value of each asset
4. Identify the vulnerabilities and threats that can affect the identified assets

Question 16

Jack needs to develop a security program for a medical organization. He has
been instructed by the security steering committee to follow the ISO/IEC
international standards when constructing and implementing this program so
that certification can be accomplished. Which of the following best describes
the phases Jack should follow?
A. “Plan” by defining scope and policy. “Do” by managing identified risks.
“Check” by carrying out monitoring procedures and audits. “Act” by
implementing corrective actions.
B. “Plan” by defining scope and policy. “Do” by creating an implementation
risk mitigation plan and implementing controls. “Check” by carrying
out monitoring procedures and audits. “Act” by implementing corrective
actions.
C. “Plan” by identifying controls. “Do” by creating an implementation risk
mitigation plan. “Check” by carrying out monitoring procedures and
audits. “Act” by implementing corrective actions.
D. “Plan” by defining scope and policy. “Do” by creating an implementation
risk mitigation plan and implementing controls. “Check” by carrying
out monitoring procedures and audits. “Act” by implementing risk
management.

Answer 16

B.When building an information security management system (ISMS)
based upon the ISO/IEC standard, it is best to follow the Plan-Do-Check-Act
approach. ISO/IEC 27001 defines the components of this approach as the
following:
1. Plan: Establish ISMS policy, objectives, processes, and procedures relevant
to managing risk and improving information security to deliver results in
accordance with an organization’s overall policies and objectives.
2. Do: Implement and operate the ISMS policy, controls, processes, and
procedures.
3. Check: Assess and, where applicable, measure process performance against
ISMS policy, objectives, and practical experience and report the results to
management for review.
4. Act: Take corrective and preventive actions, based on the results of
the internal ISMS audit and management review or other relevant
information, to achieve continual improvement of the ISMS.

Question 17

All of the following are basic components of a security policy EXCEPT the:
A. definition of the issue and statement of relevant terms.
B. statement of roles and responsibilities
C. statement of applicability and compliance requirements.
D. statement of performance of characteristics and requirements

Answer 17

D.
Policies are considered the first and highest level of documentation, from which the lower level elements of standards, procedures, and guidelines flow. This order, however, does not mean that policies are more important than lower elements. These higher-level policies, which are the more general policies and statements, should be created first in the process for strategic reasons, and then the more tactical elements can follow

Question 18

A security policy would include all of the following EXCEPT:
A. Background
B. Scope statement
C. Audit requirements
D. Enforcement

Answer 18

B. Scope statement

Question 19

Which one of the following is an important characteristic of an information security policy?
A. Identifies major functional areas of information
B. Quantifies the effect of the loss of the information
C. Requires the identification of information of owners.
D. Lists applications that support the business function.

Answer 19

A.
Information security policies are high-level plans that describe the goals of the procedures. Policies are not guidelines or standards, nor are they procedures or controls. Policies describe security in general terms, not specifics. They provide the blueprints for an overall security program just as a specification defines your next procuct.

Question 20

Ensuring the integrity of business information is the PRIMARY concern of:
A. Encryption security
B. Procedural security.
C. Logical security
D. On-line security

Answer 20

B.
Procedures are looked at as the lowest level in the policy chain because they are closest to the computers and provide detailed steps for configuration and installation issues. They provide the steps to actually implement the statements in the policies, standards, and guidelines. Security procedures, standards, measures, practices and policies cover a number of different subject areas.

Question 21

Which of the following would be the first step in establishing an information security program?
A. Adoption of a corporate information security policy statement.
B. Development and implementation of an information security standards manual.
C. Development of a security awareness-training program
D. Purchase of security access control software

Answer 21

A.

Setting policy will preclude all other activities as this is the foundation for the security program.

Question 22

Which of the following department managers would be best suited to oversee the development of an information security policy?
A. Information Systems
B. Human Resources
C. Business Operations
D. Security Administration

Answer 22

C.

Question 23

What is the function of a corporate information security policy?
A. Issue corporate standard to be used when addressing specific security problems.
B. Issue guidelines in selecting equipment, configuration, design, and secure problems
C. Define the specific assets to be protected and identify the specific tasks which must be completed to secure them
D. Define the main security objectives which must be achieved and the security framework to meet business objectives.

Answer 23

D.
Information security policies are high-level plans that describe the goals of the procedures or controls. Policies describe security in general, not specifics. They provide the blueprint for an overall security program just as a specification defines your next product.

Question 24

Why must senior management endorse a security policy?
A So they will accept ownership for security within the organization.
B. So that employees will follow the policy directives
C. So that external bodies will recognize the organizations commitment to security
D. So that they can be held legally accountable

Answer 24

A.

Question 25

``` In which one of the following documents is the assignment of individual roles and responsibilities MOST appropriately defined? A. Security policy B. Enforcement guidelines C. Acceptable Use Policy D. Program manual ```

Answer 25

C. An AUP is a document that the employee signs in which the expectations, roles and responsibilities are outlined. Issue-specific policies address specific security issues that management feels need more detailed explanation and attention to make sure a comprehensive structure is built and all employees understand how they are to comply to these security issues.

Question 26

Which of the following defines the intent of a system security policy? A. A definition of the particular settings that have been determined to provide optimum security. B. A brief, high-level statement defining what is and is not permitted during the operation of the system. C. A definition of those items that must be excluded on the system D. A listing of tools and applications that will be used to protect the system

Answer 26

A. A system-specific policy presents the management's decisions that are closer to the actual computers, networks, applications and data. This type of policy can provide an approved software list, which contains a list of applications that can be installed on individual workstations. This policy can describe how databases are to be protected, how computers are to be locked down, and how firewall, intrusion detection systems and scanners are to be employed.

Question 27

When developing an information security policy, what is the FIRST step that should be taken? A. Obtain copies of mandatory regulations B. Gain management approval C. Seek acceptance from other departments D. Ensure policy is compliant with current working practices

Answer 27

B. | Management approval precludes all policies, thereby giving them the ownership of the policy.

Question 28

Which of the following should NOT be contained within a computer policy? A. Definition of management expectations B. Responsibilities of individuals and groups for protected information. C. Statement of senior executive support D. Definition of legal and regulatory controls

Answer 28

B. | This level of information is best suited for a lower level user policy or an Acceptable User Policy.

Question 29

``` Which of the following is NOT a fundamental component of a Regulatory Security Policy? A. What is to be done B. When it is to be done C. Who is to do it D. Why is it to be done ```

Answer 29

C. Regulatory Security Policies are mandated to the organization but it is up to them to implement it. "Regulatory - This policy is written to ensure that the organization is following standards set by a specific industry and is regulated by law. The policy type is detailed in nature and specific to a type of industry. This is used in financial institutions, health care facilities and public utilities."

Question 30

Which of the following statements describes management controls that are instituted to implement a security policy? A. They prevent users from accessing any control function. B. They eliminate the need for most auditing functions. C. They may be administrative, procedural or technical. D. They are generally inexpensive to implement

Answer 30

C. | Administrative, physical and technical controls should be utilized to achieve the managements directives.

Question 31

``` Which must bear the primary responsibility for determining the level of protection needed for information systems resources? A. IS security specialists B. Senior management C. Senior security analysts D. system auditors ```

Answer 31

B

Question 32

Which of the following is NOT part of a security policy? A. definition of overall steps of information security and the importance of security B. statement of management intent, supporting the goals and principles of information security C. definition of general and specific responsibilities for information security management D. description of specific technologies used in the field of information security

Answer 32

D.

Question 33

In an organization, an Information Technology security function should: A. be a function within the information systems functions of an organization B. report directly to a specialized business unit such as legal, corporate security or insurance C. be lead by a Chief Security Officer and report directly to the CEO D. be independent but report to the information systems functions

Answer 33

C

Question 34

``` Which of the following embodies all the detailed actions that personnel are required to follow? A. Standards B. Guidelines C. Procedures D. Baselines ```

Answer 34

C.

Question 35

A significant action has a state that enables actions on an ADP system to be traced to individuals who may then be held responsible. The action does NOT include: A. Violations of security policy B. Attempted violations of security policy C. Non-violations of security policy D. Attempted violations of allowed actions

Answer 35

D. Significant actions: The quality or state that enables actions on an ADP system to be traced to individuals who may then be held responsible. These actions include violations and attempted violations of the security policy, as well as allowed actions.

Question 36

``` Network security is a: A. product B. protocols C. ever evolving process D. quick-fix action ```

Answer 36

C

Question 37

``` Security is a process that is: A. continuous B. indicative C. examined D. abnormal ```

Answer 37

A. Security is a continuous process; as such you must closely monitor your systems on a regular basis. Log files are usually a good way to find an indication of abnormal activities. However some care must be exercised as to what will be logged and now the logs are protected. Having corrupted logs is about as good as not having logs at all.

Question 38

What are the three fundamental principles of security? A. Accountability, confidentiality and integrity B. Confidentiality, integrity and availability C. Integrity, availability, and accountability D. Availability, accountability and confidentiality

Answer 38

B.

Question 39

Which of the following prevents, detects and corrects errors so that the integrity, availability and confidentiality of transactions over networks may be maintained? A. Communications security management and techniques B. Networks security management and techniques C. Clients security management and techniques D. Servers security management and techniques

Answer 39

A

Question 40

``` Making sure that the data is accessible when and where it is needed is which of the following? A. Confidentiality B. Integrity C. Acceptability D. Availability ```

Answer 40

D.

Question 41

``` Most computer attacks result in violation of which of the following security properties? A. Availability B. Confidentiality C. Integrity and control D. All of the above ```

Answer 41

D. Most computer attacks only corrupt a system's security in very specific ways. For example, certain attacks may enable a hacker to read specific files but don't allow alteration of any system components. Another attack may allow a hacker to shut down certain system components but doesn't allow access to any files. Despite the varied capabilities of computer attacks, they usually result in violation of only four different security properties: availability, confidentiality, integrity and control.

Question 42

Which of the following are objectives of an information systems security program? A. Threats, vulnerabilities and risks B. Security, information value and threats C. Integrity, confidentiality and availability D. Authenticity, vulnerabilities and cost

Answer 42

C. There are several small and large objectives of a security program but the three main principles in all programs are confidentiality, integrity and availability. The CIA triad.

Question 43

``` An area of the telecommunications and network security domain that directly affects the information systems security tenet of availability can be defined as: A. Netware availability B. Network availability C. Network acceptability D. Network accountability ```

Answer 43

B.

Question 44

``` Which one of the following is the MOST crucial link in the computer security chain? A. Access controls B. People C. Management D. Awareness programs ```

Answer 44

C. Management

Question 45

The security planning process must define how security will be managed, who will be responsible and A. What practices are reasonable and prudent for the enterprise B. Who will work on the security department C. What impact security will have on the intrinsic value of data D. How security measures will be tested for effectiveness.

Answer 45

D. How security measures will be tested for effectiveness.

Question 46

``` Information security is the protection of data. Information will be protected mainly based on: A. Its sensitivity to the company. B. Its confidentiality. C. Its value. D. All of the choices. ```

Answer 46

D. Information security is the protection of data against accidental or malicious disclosure, modification, or destruction. Information will be protected based on its value, confidentiality, and/or sensitivity to the company and the risk of loss or compromise. At a minimum, information will be update-protected so that only authorized individuals can modify or erase the information.

Question 47

Organizations develop change control procedures to ensure that A. All changes are authorized, tested and recorded B. Changes are controlled by the Policy Control Board (PCB) C. All changes are requested, scheduled and completed on time D. Management is advised of changes made to systems

Answer 47

A. Change control: changes must be authorized, tested and recorded. Change systems may require re-certification and re-accreditation.

Question 48

``` Within the organizational environment, the security function should report to an organizational level that.. A. has information technology oversight B. has autonomy from other levels C. is an external operation D. provides the internal audit function ```

Answer 48

B.

Question 49

What is the MAIN purpose of a change control/change management system? A. Notify all interested parties of the completion of the change B. Ensure that the change meets user specifications C. Document the change for audit and management review D. Ensure the orderly processing of a change request

Answer 49

C.

Question 50

Which of the following is most relevant to determining the maximum effective cost of access control? A. the value of information that is protected. B. management's perceptions regarding data importance C. budget planning related to base versus incremental spending D. the cost to replace lost data

Answer 50

A.

Question 51

Which one of the following is the MAIN goal of a security awareness program when addressing senior management? A. Provide a vehicle for communicating security procedures B. Provide a clear understanding of potential risk and exposure. C. Provide a forum for disclosing exposure and risk analysis D. Provide a forum to communicate user responsibilities

Answer 51

B. When the security officer is addressing senior management, the focus would not be on user responsibilities, it would be on making sure the senior management has a clear understanding of the risk and potential liability is.

Question 52

In developing a security awareness program, it is MOST important to A. understand the corporate culture and how it will affect security B. understand employees preferences for information security C. know what security awareness products are available D. identify weakness inline management support

Answer 52

A. The controls and procedures of a security program should reflect the nature of the data being processed. These different types of companies would also have very different cultures. For a security awareness program to be effective, these considerations must be understood and the program should be developed in a fashion that makes sense per the environment.

Question 53

``` Which of the following would be best suited to provide information during a review of the controls over the process of defining IT service levels? A. Systems programmer B. Legal stuff C. Business unit manager D. Programmer ```

Answer 53

C.

Question 54

Which of the following best explains why computerized information systems frequently fail to meet the needs of users? A. inadequate quality assurance (QA) tools B. constantly changing user needs C. inadequate user participation in defining the system's requirements D. inadequate project management

Answer 54

C.

Question 55

``` Which of the following is not a compensating measure for access violations? A. backups B. business continuity planning C. insurance D. security awareness ```

Answer 55

D.

Question 56

``` Risk analysis is MOST useful when applied during which phase of the system development process? A. project identification B. requirements definition C. system construction D. implementation planning ```

Answer 56

A

Question 57

Which one of the following is not one of the outcomes of a vulnerability analysis? A. quantative loss assessment B. qualitative loss assessment C. formal approval of BCP scope and initiation document D. defining critical support areas

Answer 57

C.

Question 58

Which of the following is not a part of risk analysis? A. identify risks B. quantify the impact of potential threats C. provide an economic balance between the impact of the risk and the cost of the associated countermeasures D. choose the best countermeasure

Answer 58

D.

Question 59

A new worm has been released on the internet. After investigation, you have not been able to determine if you are at risk of exposure. Management is concerned as they have heard that a number of their counterparts are being affected by the worm. How could you determine if you are at risk? A. evaluate evolving environment B. contact your anti-virus vendor C. discuss threat with a peer in another organization D. wait for notification from an anit-virus vendor

Answer 59

B

Question 60

``` When conducting a risk assessment, which one of the following is NOT an acceptable social engineering practice? A. shoulder surfing B. misrepresentation C. subversion D. dumpster diving ```

Answer 60

A. Shoulder surfing: attackers can thwart confidentiality mechanisms by network monitoring, shoulder surfing, stealing password files and social engineering. Shoulder surfing is when a person looks over another person's shoulder and watches keystrokes or date as it appears on the screen. Social engineering is tricking another person into sharing confidential information by posing as an authorized individual to that information.

Question 61

``` Which one of the following risk analysis terms characterizes the absence or weakness of a risk-reducing safeguard? A. threat B. probability C. vulnerability D. loss expectancy ```

Answer 61

C. A weakness in system security procedures, system design, implementation, internal controls and so on that could be exploited to violate system security policy.

Question 62

Risk is commonly expressed as a function of the A. systems vulnerabilities and the cost to mitigate B. types of countermeasures needed and the system's vulnerabilities C. likelihood that the harm will occur and its potential impact D. computer system-related assets and their costs.

Answer 62

C. The likelihood of a threat agent taking advantage of a vulnerability. A risk is the loss potential, or probability, that a threat will exploit a vulnerability.

Question 63

``` How should a risk be handled when the cost of the countermeasures outweighs the cost of the risk? A. reject the risk B. perform another risk analysis C. accept the risk D. reduce the risk ```

Answer 63

C.

Question 64

Which of the following is an advantage of a qualitative over quantitative risk analysis? A. it prioritizes the risks and identifies areas for immediate improving in addressing the vulnerabilities B. it provides specific quantifiable measurements of the magnitude of the impacts C. it makes cost-benefit analysis of recommended controls easier.

Answer 64

A

Question 65

``` The absence or weakness in a system that may possibly be exploited is called a(n)? A. threat B. exposure C. vulnerability D. risk ```

Answer 65

C.

Question 66

``` What tool do you use to determine whether a host is vulnerable to known attacks? A. padded cells B. vulnerability analysis C. honey pots D. IDS ```

Answer 66

``` B. Vulnerability analysis (a.k.a. vulnerability assessment) tools test to determine whether a network or host is vulnerable to known attacks. Vulnerability assessment represents a special case of the intrusion detection process. The information sources used are system state attributes and outcomes of attempted attacks. The information sources are collected by a part of the assessment engine. The timing of analysis is interval-based or batch-mode, and the type of analysis is misuse detection. This means that vulnerability assessment systems are essentially batch mode misuse detectors that operate on system state information and results of specified test routines. ```

Question 67

Which of the following statements pertaining to ethical hacking is incorrect? A) An organization should use eithical hackers who do not sell auditing, consulting, hardware, software, firewall, hosting and/or networking services B)Testing should be done remotely C)Ethical hacking should not involved writing to or modifying the target systems D)Ethical hackers should never use tools that have potential of exploiting vulnerabilities in the organizations IT system

Answer 67

D

Question 68

Why would an information security policy require that communications test equipment be controlled? A) The equipment is susceptible to damage B) The equipment can be used to browse information passing on a network C) The equipment must always be available for replacement if necessary D)The equipment can be used to reconfigure the network multiplexers

Answer 68

B

Question 69

Management can expect penetration tests to provide all of the following EXCEPT A)identification of security flaws B)demonstration of the effects of the flaws C)a method to correct the security flaws D) verification

Answer 69

C Not B: it is not the objective of the pen tester to supply a method on how to correct the flaws. In fact management may decide to accept the risk and not repair the flaw. They may be able to demonstrate the effects of a flaw-especially if they manage to clobber a system.

Question 70

Which one of the following is a characteristic of a penetration testing project? A) the project is open-ended until all known vulnerabilities are identified. B)The project schedule is plotted to produce a critical path C)the project tasks are to break into a targeted system D)The project plan is reviewed with the target audience

Answer 70

C "one common method to test the strength of your security measures is to preform penetration testing. Penetration testing is a vigorous attempt to break into a protected network using any means necessary" pg 430 Tittlel

Question 71

What woman loves you more than life itself? A) Your wife B) Your lover C) Your baby momma D) All of the above!

Answer 71

I am sure you knew the answer but for filling in the cards sake its D!!! I love you so much!! I am so proud of all the hard work you do and what you strive to accomplish! You are an amazing role model for our kiddos! ALWAYS ALWAYS FOREVER FOREVER PROMISE PROMISE!

Question 72

Which one of the following is the PRIMARY objective of penetration testing? A)Assessment B)Correction C)Detection D) Protection

Answer 72

C Not A: Assessment would imply management deciding whether they can live with a given vulnerability. "Its goal is to measure an organization's resistance to an attack and to uncover an weakness within the environment...the result of a penetration test is a report given to management describing the list of vulnerabilities that were identified and the severity of those vulnerabilities."

Question 73

Open box testing, in the Flaw Hypothesis Methodology of Penetration Testing applies to the analysis of A)Routers and firewalls B)Host-based IDS systems C)Network-based IDS systems D)General purpose operating systems

Answer 73

D Flaw hypothesis methodology- a system analysis and penetration technique where specifications and documentation for the system are analyzed and then flaws in the system are hypothesized. The list of hypothesized flaws is then prioritized on the basis of the estimated probility that a flaw actually exist and, assuming a flaw does exist, on the ease of exploiting it and on the extent of control or compromise it would provide. The prioritized list is used to direct the actual testing of the system.

Question 74

What is the FIRST step that should be considered in a penetration test? A) the approval of change control management B) the development of a detailed test plan C)The formulation of specific management objectives D) the communication process among team members

Answer 74

C The type of penetration test depends on the organization, its security objectives and the management's goals.

Question 75

Penetration testing will typically include A) Generally accepted auditing practices B)Review of Public Key Infrastature (PKI) digital certificate, and encryption C)Social engineering, configuration review, and vulnerability assessment D)Computer Emergency Response Team (CERT) procedures

Answer 75

C

Question 76

Which of the following is not a valid reason to use external penetration service firms rather than corporate resources? A)They are more cost-effective B)They offer a lack of corporate bias C)They use highly talented ex-hackers D)They insure a more complete reporting

Answer 76

C

Question 77

Which of the following tools can you use to assess your networks vulnerability? A) ISS B) all of the choices C)SATAN D)Ballista

Answer 77

B | ISS, Ballista, and SATAN are all penetration tools

Question 78

Annualized Loss Expectancy (ALE) value is derived from an algorithm of the product of annual rate of occurrence and A)Cost of all losses expected B)Previous year's actual loss C)Average of previous losses D) Single loss expectancy

Answer 78

D Single loss expectancy (SLE) X Annualized Rate of Occurance (ARO) = ALE

Question 79

If your property insurance has Actual Cost Evaluation (ACV) clause your damaged property will be compensated A) Based on the value of the item on the date of loss B)Based on new item for old regardless of condition of lost item C)Based on value of item one month before loss D)Based on value of item of the date of loss plus 10 percent

Answer 79

D

Question 80

How is Annualized Loss Expectancy (ALE) derived from a threat? A)ARO x (SLE-EF) B)SLE x ARO C)SLE/EF D)AV x EF

Answer 80

B | "SLE x annualized rate of occurrence (ARO) = ALE"

Question 81

Qualitative loss resulting from the business interruption does not include: A) loss of revenue B)Loss of competitive advantage or market share C) Loss of public confidence and credibility D)Public embarrassment

Answer 81

A Another method of risk analysis is qualitative, which does not assign numbers and monetary values to components and losses

Question 82

Which risk management methodology uses the exposure factor multiplied by the asset value to determine its outcome? A) annualized loss expectancy B) single loss expectancy C) annualized rate of occurrence D) information risk management

Answer 82

B Single loss expectancy (SLE) an SLE is the dollar figure that is assigned to a single event. It represents an organization's loss from a single threat and is derived from the following formula: Asset value ($) x Exposure Factor (EF) = SLE

Question 83

Valuable paper insurance coverage does not cover damage to which of the following? A)inscribed, printed and written documents B) manuscripts C) records D) money and securities

Answer 83

D

Question 84

What is the window of time for recovery of information processing capabilities based on? A) quality of the data to be processed B) nature of the disaster C)criticality of the operations affected D)Applications that are mainframe based

Answer 84

C

Question 85

What is the Maximum Tolerable Downtown (MTD): A)maximum elapsed time required to complete recovery of application data B) minimum elapsed time required to complete recovery of application data C)maximum elapsed time required to move back to primary site a major disruption D)it is maximum delay businesses that can tolerate and still remain viable

Answer 85

D The MTD is period of time a business function or process can remain interrupted before its ability to recover becomes questionable.

Question 86

A "critical application" is one that MUST A) remain operational for the organization to survive B) be subject to continual program maintenance C)Undergo continual risk assessments D)be constantly monitored by operations management

Answer 86

A " A BIA is performed at the beginning of a disaster recovery and continuity planning to identify the areas that would suffer the greatest financial or operational loss in the event of disaster or disruption. It identifies the company's critical systems needed for survival and estimates the outage time that can be tolerated by the company as a result disaster or disruption.

Question 87

Which of the following questions is less likely to help in assessing physical and environmental protection? A) are entry codes changed periodically? B)are appropriate fire suppression and prevention devices installed and working? C)Are there processes to ensure that unauthorized individuals cannot read, copy, alter, or steal printed or electronic information? D)Is physical access to data transmission lines controlled?

Answer 87

C

Question 88

A common Limitation of information classification systems is the INABILITY to A)limit the number of classifications B)generate internal labels on diskettes C)declassify information when appropriate D)establish information ownership

Answer 88

C

Question 89

The purpose of information classification is to A)Assign access controls B)apply different protective measures C)define the parameters required for security labels D) ensure separation of duties

Answer 89

D

Question 90

Who should determine the appropriate access control of information? A) owner B)user C)administrator D)server

Answer 90

A all information generated, or used must have a designated owner. the owner must determine appropriate sensitivity classifications, and access controls. The owner must also take steps to ensure the appropriate controls for the storage, handling, distribution, and use of the information in the secure manner.

Question 91

What is the main responsibility of the information owner? A)making the determination to decided what level of classification the information requires B) running regular backups C)audit the users when they require access to the information D)periodically checking the validity and accuracy for all data in the information system

Answer 91

A

Question 92

What process determines who is trusted for a given purpose? A) identification B)authorization C)authentication D)Accounting

Answer 92

B Authorization determins who is trusted for the given purpose. More precisely, it determines whether a particular principal, who has been authenticated as the source of a request to do something, is trusted for that operation. Authorization may also include controls on the time at which something can be done. (e.g. only during working hours) or the computer terminal from which it can be requested (e.g. only the one on the system administration desk)

Question 93

The intent of least privilege is to enforce the most restrictive user rights required A)to execute systems processes B)by the job description C)to execute authorized tasks D) by their security role.

Answer 93

C Least privilege; the security principal that requires each subject to be granted the most restrictive set of privileges needed for the performance of authorized tasks. The application of this principle limits the damage that can result from accident, error, or unauthorized.

Question 94

Ensuring the integrity of business information is the PRIMARY concern of

Answer 94

B Procedures are looked at as the lowest level in the policy chain because they are closest to the computers and provide detailed steps for configuration and installation issues. They provide the steps to actually implement the statements in the policies, standards, and guidelines...Security procedures, standards, measures, practices, and policies cover a number of different subject areas.

Question 95

Which one of the following actions should be taken FIRST after a fire has been detected?

Answer 95

D Protection of life is of the utmost importance and should be dealt with first before looking to save material objects. .

Question 96

Which one of the following is the Open Systems Interconnection (OSI) protocol for message handling? A. X.25

Answer 96

B An ISO and ITU standard for addressing and transporting e-mail messages. It conforms to layer 7 of the OSI model and supports several types of transport mechanisms, including Ethernet, X.25, TCP/IP, and dial-up lines.

Question 97

Which of the following is a weakness of both statistical anomaly detection and pattern matching?

Answer 97

B Disadvantages of Knowledge-based ID systems: This system is resources-intensive; the knowledge database continually needs maintenance and updates New, unique, or original attacks often go unnoticed. Disadvantages of Behavior-based ID systems: The system is characterized by high false alarm rates. High positives are the most common failure of ID systems and can create data noise that makes the system unusable. The activity and behavior of the users while in the networked system might not be static enough to effectively implement a behavior-based ID system.

Question 98

Digital signature users register their public keys with a certification authority, which distributes a certificate containing the user's public key and digital signature of the certification authority. In order to create the certificate, the user's public key and the validity period are combined with what other information before computing the digital signature?

Answer 98

B This means that a one-way hashing function would be run on the message and then Kevin would encrypt that has value with his private key...The act of signing just means that value was encrypted with a private key

Question 99

Why are macro viruses easy to write?

Answer 99

Macro Languages enable programmers to edit, delete, and copy files. Because these languages are so easy to use, many more types of macro viruses are possible.

Question 100

Tracing violations, or attempted violations of system security to the user responsible is a function of?

Answer 100

Accountability: Auditing capabilities ensure that users are accountable for their actions, verify that the security policies are enforced, worked as a deterrent to improper actions, and are used as investigation tools.

Question 101

Which one of the following is concerned with masking the frequency, length, and origin-destination patterns of the communications between protocol entities? A. Masking analysis B. Protocol analysis C. Traffic analysis D. Pattern analysis

Answer 101

C Traffic analysis, which is sometimes called trend analysis, is a technique employed by an intruder that involves analyzing data characteristics (message length,message frequency, and so forth) and the patterns of transmissions (rather than any knowledge of the actual information transmitted) to infer information that is useful to an intruder)

Question 102

In which situation would TEMPEST risks and technologies be of MOST interest? A. Where high availability is vital. B. Where the consequences of disclose are very high. C. Where countermeasures are easy to implement D. Where data base integrity is crucial

Answer 102

B Answer: B Emanation eavesdropping. Receipt and display of information, which is resident on computers or terminals, through the interception of radio frequency (RF) signals generated by those computers or terminals. The U.S. government established a program called TEMPEST that addressed this problem by requiring a shielding and other emanation-reducing mechanisms to be employed on computers processing sensitive and classified government information.

Question 103

``` In which state must a computer system operate to process input/output instructions? A. User mode B. Stateful inspection C. Interprocess communication D. Supervisor mode ```

Answer 103

D A computer is in a supervisory state when it is executing these privileged instructions. (privileged instructions are executed by the system administrator or by an individual who is authorized to use those instructions.)

Question 104

All of the following are basic components of a security policy EXCEPT the A. definition of the issue and statement of relevant terms. B. statement of roles and responsibilities C. statement of applicability and compliance requirements. D. statement of performance of characteristics and requirements.

Answer 104

D Policies are considered the first and highest level of documentation, from which the lower level elements of standards, procedures, and guidelines flow. This order, however, does not mean that policies are more important than the lower elements. These higher-level policies, which are the more general policies and statements, should be created first in the process for strategic reasons, and then the more tactical elements can follow.

Question 105

What set of principles is the basis for information systems controls? A. Authentication, audit trails, and awareness briefings B. Individual accountability, auditing, and separation of duties C. Need to know, identification, and authenticity D. Audit trails, limited tenure, and awareness briefings

Answer 105

C I am going to disagree with the original answer in this question The original answer was B. I do think that is important but in the text that I have read (Harris,Krutz, the Sybex book and the Que book) they stress over and over again the Need to know and proper identification as a subset of the CIA. B to me, give more to the individual methods of control, not the underlying concepts to BASE information system controls on. However, use your best judgment on this based on your experience and knowledge.

Question 106

Why do vendors publish MD5 hash values when they provide software patches for their customers to download from the Internet? A. Recipients can verify the software's integrity after downloading. B. Recipients can confirm the authenticity of the site from which they are downloading the patch. C. Recipients can request future updates to the software by using the assigned hash value. D. Recipients need the hash value to successfully activate the new software.

Answer 106

A If the two values are different, Maureen knows that the message was altered, either intentionally or unintentionally, and she discards the message...As stated in an earlier section, the goal of using a one-way hash function is to provide a fingerprint of the message. MD5 is the newer version of MD4. It still produces a 128-bit hash, but the algorithm is a bit more complex to make it harder to break than MD4. The MD5 added a fourth round of operations to be performed during the hash functions and makes several of its mathematical operations carry steps or more complexity to provide a higher level of security

Question 107

Which one of the following is NOT a requirement before a search warrant can be issued? A. There is a probably cause that a crime has been committed. B. There is an expectation that evidence exists of the crime. C. There is probably cause to enter someone's home or business. D. There is a written document detailing the anticipated evidence.

Answer 107

D "If a computer crime is suspected, it is important not to alert the suspect. A preliminary investigation should be conducted to determine weather a crime has been committed by examining the audit records and system logs, interviewing witnesses, and assessing the damage incurred....Search warrants are issued when there is a probable cause for the search and provide legal authorization to search a location for specific evidence."

Question 108

The Trusted Computer Security Evaluation Criteria (TCSEC) provides A. a basis for assessing the effectiveness of security controls built into automatic data-processing system products B. a system analysis and penetration technique where specifications and document for the system are analyzed. C. a formal static transition model of computer security policy that describes a set of access control rules. D. a means of restricting access to objects based on the identity of subjects and groups to which they belong.

Answer 108

C In 1985, the Trusted Computer System Evaluation Criteria (TCSEC) was developed by the National Computer Security Center (NCSC) to provide guidelines for evaluating vendor's products for the specified security criteria. TCSEC provides the following: A basis for establishing security requirements in the acquisition specifications A standard of the security services that should be provided by vendors for the different classes of security requirements A means to measure the trustworthiness of an information system.

Question 109

``` Which factor is critical in all systems to protect data integrity? A. Data classification B. Information ownership C. Change control D. System design ```

Answer 109

A There are several good reasons to classify information. Not all data has the same value to an organization. Some data is more valuable to the people who are making strategic decisions because it aids them in making long-range or short-range business direction decisions. Some data, such as trade secrets, formulas, and new product information, is so valuable that its loss could create a significant problem for the enterprise in the marketplace by creating public embarrassment or causing a lack of credibility. For these reasons, it is obvious that information classification has a higher enterprise-level benefit. Information can have an impact on a business globally, not just on the business unit or line operation levels. Its primary purpose is to enhance confidentiality, integrity, and availability and to minimize the risks to the information.

Question 110

``` Audit trails based upon access and identification codes establish… A. intrusion detection thresholds B. individual accountability C. audit review criteria D. individual authentication ```

Answer 110

B Accountability is another facet of access control. Individuals on a system are responsible for their actions. This accountability property enables system activities to be traced to the proper individuals. Accountability is supported by audit trails that record events on the system and on the network. Audit trails can be used for intrusion detection and for the reconstruction of past events.