Set 05 Flashcards
(15 cards)
Q51: Which is not a Good Security Metric?
A. Consistently measured without subjective criteria
B. Cheap to gather preferably in an automated way
C. Express results with quantitative label units of measure
D. Contextually specific and relevant enough to decision makers that they can take a decision
C. Express results with quantitative label units of measure
Q52: Which on is NOT part of the risk governance model? A. Emblematic B. Transparent C. Secisiontic D. Technocratic
A. Emblematic
Q53: Which is NOT an aspect of RISK Communication with relation to compliance and accountability
A. Password Policies
B. Training and Inducement behavior Change
C. Education
D. Involvement
C. Education
Q54: Which is a valuable framework for the system engineers and who probe deficiencies and vulnerabilities within such system? A. Procedures B. Policies C. IT Service Management D. Code of conduct
D. Code of conduct
Q55A: Which principle states that controls need to define and enable operations that can positively be identified as below in accordance with a security policy and reject all others? A. Penetration testing B. Complete Mediation C. Open Design D. Fail Safe Defaults
D. Fail Safe Defaults
Q56: Situations where risk are less clear cut there may be a need to include a broad set of evidence and consider a comparative approach such as cost benefit analysis and cost effectiveness. This is all true with regards A. Ambiguous Risks B. Uncertain Risks C. Complex Risk D. Routine Risks
C. Complex Risk
Q57: \_\_\_\_\_ is the result of a threat exploiting a vulnerability, which has a negative effect on the success on the objectives for which we are assessing the risk A. Impact B. Likelihodd C. Attack D. Threat
A. Impact
Q58: Which of the following is no done by Cyber Criminals? A. Mass attack using Trojans and Botnets B. Unauthorized around Access C. e-Mal spoofing and spamming D. Report vulnerability in any system.
D. Report vulnerability in any system.
Q59: In legal research, the term can refer to any systematized collection of primary legislation, secondary legislation, model laws or merely a set of rules published publics or private organizations A. Codes B. Ethics C. Compliance D. Contracts
A. Codes
Q60: TLS guarantees both the validation to the server to the client and the privacy of the exchange over the network. But it is difficult to evaluate the payload of pockets. The solution is to put a supplementary dedicated box next to the application server, usually name as Hardware Security Module (HSM)
What is the purpose of HSM?
A. The HSM is designed to establish the TLS session beforehand the application server delivers any information
B. HSM transfers the burden of establishing the TLS session external the application server.
C. TSL secured traffic is encrypted and decrypted at the HSM and strams in clear to the server and triggers IDPSec and WAFs to evaluate traffic
D. All the Options A, B, & C include the working functionally of the HSM
D. All the Options A, B, & C include the working functionally of the HSM
Q55B: Experts proposed a framework to systematize the attribution efforts of cyberattacks which of the following is NOT a layer of the framework A. Operational B. Analytical C. Strategic D. Tactical
D. Tactical
Q55C: What is the good example of a security measure made ineffective due to its 0.1% utilization and that has been around for over 20 years? A. Log Management B. Email Encryption C. Software Encryption D. Data backup
B. Email Encryption
Q55D: Which of the following is not a NIST architecture strategy? A. The Reference Monitor Concept B. Defense in Depth C. Isolation D. Behavior
D. Behavior
Q56D: The third Dimension generally applies to only persistent malware based on the layers that include firmware, boot-sector, operating system kernel, drivers and application programming interfaces (API’s) and user applications.
All the above mentioned layers are presented in which order?
A. All are in order in which they are implemented.
B. They are in random order.
C. In the context of persistent malware the order of system stack layers does not matter.
D. All layer of the system slack are mentioned in ascending order.
D. All layer of the system slack are mentioned in ascending order.
Q56E: As Netflow was designed by the network equipment providers it is exceptionally well implemented in networks and extensively used for network management jobs. It is standardized and even nonetheless the commercial names vary alike. Information is gathered by the manufacturers that are supportive of this technology.
Controlling packets to calculate Netflow Counters Requires access to what?
A. GPU Designed for visual AI
B. Router CPU
C. Transit Gateway CPU
B. Router CPU
