Sybex

Question 1

What are some examples of detective access controls?

Answer 1

Security guards, supervising users, incident investigations, and intrusion detection systems

Question 2

What are some examples of physical access controls?

Answer 2

Guards, fences, motion detectors, locked doors, sealed windows, lights, backups, cable protection, laptop locks, swipe cards, dogs, CCTV, mantraps, and alarms

Question 3

What are the three commonly recognized authentication factors?

Answer 3

Something you know, something you have, and something you are

Question 4

What is a cognitive password?

Answer 4

A series of questions about facts or predefined responses that only the subject should know (for example, what is your birth date? What is your mother’s maiden name?)

Question 5

Name at least eight biometric factors.

Answer 5

Fingerprints, face scans, iris scans, retina scans, palm topography, palm geography, heart/pulse pattern, voice pattern, signature dynamics, keystroke patterns

Question 6

What are the issues related to user acceptance of biometric enrollment and throughput rate?

Answer 6

Enrollment times longer than 2 minutes are unacceptable; subjects will typically accept a throughput rate of about 6 seconds or faster.

Question 7

What access control technique employs security labels?

Answer 7

Mandatory access controls. Subjects are labeled as to their level of clearance. Objects are labeled as to their level of classification or sensitivity.

Question 8

The Bell–LaPadula, Biba, and Clark–Wilson access control models were all designed to protect a single aspect of security. Name the corresponding aspect for each model.

Answer 8

Bell–LaPadula protects confidentiality; Biba and Clark–Wilson protect integrity.

Question 9

Name the three types of subjects and their roles in a security environment.

Answer 9

The user accesses objects on a system to perform a work task; the owner is liable for protection of data; the data custodian is assigned to classify and protect data.

Question 10

Explain why the separation of duties and responsibilities is a common security practice.

Answer 10

It prevents any single subject from being able to circumvent or disable security mechanisms.

Question 11

What is the principle of least privilege?

Answer 11

Subjects should be granted only the amount of access to objects that is required to accomplish their assigned work tasks.

Question 12

Name the four key principles upon which access control relies.

Answer 12

Identification, authentication, authorization, accountability

Question 13

How are domains related to decentralized access control?

Answer 13

A domain is a realm of trust that shares a common security policy. This is a form of decentralized access control.

Question 14

Why is monitoring an important part of a security policy?

Answer 14

Monitoring is used to watch for security policy violations and to detect unauthorized or abnormal activities.

Question 15

What are the functions of an intrusion detection system (IDS)?

Answer 15

An IDS automates the inspection of audit logs and real-time system events, detects intrusion attempts, and watches for violations of confidentiality, integrity, and availability.

Question 16

What are the pros and cons of a host-based IDS?

Answer 16

It can pinpoint resources compromised by a malicious user. It can’t detect network-only attacks or attacks on other systems, has difficulty detecting DoS attacks, and can be detected by intruders.

Question 17

What are the pros and cons of a network-based IDS?

Answer 17

It can monitor a large network and can be hardened against attack. It requires a central view of traffic and can’t pinpoint compromised resources. High levels of traffic flow require sufficiently capable IDS systems in order for them not to be overloaded.

Question 18

What are the differences between knowledge-based and behavior-based detection methods used by IDS?

Answer 18

Knowledge-based uses a signature database and tries to match monitored events to that database. Behavior-based learns about the normal activities on your system through watching and learning.

Question 19

What is a honeynet, and what is it used for?

Answer 19

Honeynets are fake networks used to lure intruders in order to create sufficient audit trails for tracking them down and prosecuting. Honeynets contain no real or sensitive data.

Question 20

How does penetration testing improve your system’s security?

Answer 20

Penetration testing allows you to more accurately judge the security mechanisms deployed by an organization by using the tools and techniques an attacker might use.

Question 21

What is a denial-of-service attack?

Answer 21

An attack that prevents the system from receiving, processing, or responding to legitimate traffic or requests for resources and objects

Question 22

What is a spoofing attack?

Answer 22

The attacker pretends to be someone or something other than whom or what they are. They can spoof identities, IP addresses, email addresses, and phone numbers. They often replace the valid source and/or destination IP address and node numbers with false ones.

Question 23

What are countermeasures to spoofing attacks?

Answer 23

Countermeasures to spoofing attacks include patching the OS and software, enabling source/destination verification on routers, and employing an IDS to detect and block attacks.

Question 24

What is a man-in-the-middle attack?

Answer 24

An attack in which a malicious user is positioned between the two endpoints of a communication’s link

Question 25

What is a replay or playback attack?

Answer 25

A malicious user records the traffic between a client and a server and then retransmits them to the server with slight variations of the timestamp and source IP address. It is similar to hijacking.

Question 26

What is a sniffer attack?

Answer 26

Any activity that results in a malicious user obtaining information about a network or the traffic over that network. Data is captured using a sniffer or protocol analyzer.

Question 27

What is a spamming attack?

Answer 27

Directing floods of messages to a victim’s email inbox or other messaging system. Such attacks cause DoS issues by filling up storage space and preventing legitimate messages from being delivered.

Question 28

What are some countermeasures to common attack methods?

Answer 28

Patching software, reconfiguring security, employing firewalls, updating filters, using IDSs/IPSs, improving security policy, using traffic filters, improving physical access control, using system monitoring/auditing

Question 29

Name the seven layers of the OSI model by their layer name and layer number.

Answer 29

Application (7), Presentation (6), Session (5), Transport (4), Network (3), Data Link (2), and Physical (1)

Question 30

List the security features offered by the Network layer of the OSI model.

Answer 30

The Network layer (layer 3) offers confidentiality, authentication, and integrity.

Question 31

Name the common network topologies.

Answer 31

Ring, bus, star, and mesh

Question 32

What are the five generation types of firewalls?

Answer 32

Static packet filtering, application-level gateway, stateful inspection, dynamic packet filtering, and kernel proxy

Question 33

Name at least five networking device types other than firewalls.

Answer 33

Routers, switches, hubs, repeaters, bridges, gateways, proxies

Question 34

What is a proxy, and what is it used for?

Answer 34

Any system that performs a function or requests a service on behalf of another system. Proxies are most often used to provide clients with Internet access while protecting their identity.

Question 35

Name at least 10 network and protocol security mechanisms.

Answer 35

IPsec, SKIP, SWIPE, SSL, S/MIME, SET, PEM, PGP, PPP, SLIP, PPTP, L2TP, CHAP, PAP, RADIUS, TACACS, S-RPC

Question 36

Name at least six protocol services used to connect to LAN and WAN communication technologies.

Answer 36

Frame Relay, SMDS, SDH, SONET, X.25, ATM, SDLC, HDLC, ISDN

Question 37

How are PVC, SVC, DTE, and DCE used in a Frame Relay network?

Answer 37

Frame Relay requires the use of a DTE and a DCE at each connection point. PVC is always available; SVC is established using the best paths currently available.

Question 38

What are three remote access authentication mechanisms?

Answer 38

RADIUS, DIAMETER, and TACACS+

Question 39

What is tunneling, and why is it used?

Answer 39

A process that protects the contents of packets by encapsulating them in another protocol. This creates the logical illusion of a communications tunnel through an untrusted intermediary network.

Question 40

What is a VPN?

Answer 40

A virtual private network (VPN) is a communication tunnel that provides point-to-point transmission of both authentication and data traffic over an intermediary network.

Question 41

What are some common VPN protocols?

Answer 41

PPTP, L2TP, SSH, and IPsec (Note: SSL/TLS is a valid VPN protocol as well, but it’s not necessarily recognized on the exam as such.)

Question 42

What are the two modes available through IPsec, and what do they do?

Answer 42

In transport mode, the IP packet data is encrypted, but the header is not. In tunnel mode, the entire IP packet is encrypted, and a new header is added to govern transmission through the tunnel.

Question 43

What is NAT?

Answer 43

Network Address Translation (NAT) allows the private IP addresses defined in RFC 1918 to be used in a private network while still being able to communicate with the Internet.

Question 44

What is transparency?

Answer 44

A characteristic of a service, security control, or access mechanism that ensures it is unseen by users

Question 45

What are some important aspects to consider when designing email security?

Answer 45

Nonrepudiation, access control, message integrity, source authentication, verified delivery, acceptable use policies, privacy, management, and backup and retention policies

Question 46

What are some common threats that may occur through email?

Answer 46

Email is a common delivery mechanism for viruses, worms, Trojan horses, documents with destructive macros, and phishing attacks.

Question 47

What are possible mechanisms for adding security to email?

Answer 47

S/MIME, MOSS, PEM, and PGP

Question 48

What are elements of effective user training against social-engineering attacks?

Answer 48

Always err on the side of caution whenever communications are odd or unexpected. Always request proof of identity. Identify what information can be conveyed via voice communications by classifying the information. Never change passwords over the phone.

Question 49

What are the most common threats against communication systems?

Answer 49

Denial of service, eavesdropping, impersonation, replay, and modification

Question 50

What are some countermeasures to eavesdropping?

Answer 50

Maintaining physical access security, using encryption, employing one-time authentication methods

Question 51

What is an ARP attack?

Answer 51

The modification of ARP mappings. When ARP mappings are falsified, packets are not sent to their proper destination. ARP mappings can be attacked through spoofing. Spoofing provides false MAC addresses for requested IP addressed systems to redirect traffic to alternate destinations.

Question 52

What is privacy?

Answer 52

Prevention of unauthorized intrusion, knowledge that information deemed personal or confidential won’t be shared with unauthorized entities, freedom from being observed without consent

Question 53

What are the requirements for accountability?

Answer 53

Identification, authentication, authorization, and auditing

Question 54

What is nonrepudiation?

Answer 54

Nonrepudiation prevents a subject from claiming not to have sent a message, not to have performed an action, or not to have been the cause of an event.

Question 55

What is layering?

Answer 55

Layering is the use of multiple controls in a series. The use of a multilayered solution allows for numerous controls to be brought to bear against whatever threats occur.

Question 56

How is abstraction used?

Answer 56

Abstraction is used to collect similar elements into groups, classes, or roles that are assigned security controls, restrictions, or permissions.

Question 57

What is data hiding?

Answer 57

Data hiding is preventing data from being known by a subject. Keeping a database from being accessed by unauthorized visitors is a form of data hiding.

Question 58

What is change control or change management?

Answer 58

A mechanism used to systematically manage change. Typically, it involves extensive logging, auditing, and monitoring of activities related to security controls and security solutions.

Question 59

What are the goals of change management?

Answer 59

Implementation of changes in an orderly manner, formalized testing, ability to reverse changes, ability to inform users of changes, systematical analysis of changes, minimization of negative impact of changes

Question 60

What is data classification?

Answer 60

Data classification is the primary means by which data is protected based on categories of secrecy, sensitivity, or confidentiality.

Question 61

What criteria are used to classify data?

Answer 61

Usefulness, timeliness, value or cost, maturity or age, lifetime or expiration period, disclosure damage assessment, modification damage assessment, national or business security implications, storage

Question 62

What is the government/military data classification scheme?

Answer 62

Top secret, secret, confidential, sensitive, and unclassified

Question 63

What is the commercial business/private sector classification scheme?

Answer 63

Confidential, private, sensitive, public

Question 64

Name at least seven security management concepts and principles.

Answer 64

CIA Triad, confidentiality, integrity, availability, privacy, identification, authentication, authorization, auditing, accountability, and nonrepudiation

Question 65

What are the elements of a termination procedure policy?

Answer 65

Have at least one witness; escort terminated employee off the premises immediately; collect identification, access, or security devices; perform exit interview; disable network account

Question 66

What is the function of the data owner security role?

Answer 66

The data owner is responsible for classifying information for protection within the security solution.

Question 67

What is the data custodian security role?

Answer 67

The data custodian is assigned the tasks of implementing the prescribed protection defined by the security policy and upper management.

Question 68

What is the function of the auditor security role?

Answer 68

The auditor is responsible for testing and verifying that the security policy is properly implemented and the derived security solutions are adequate.

Question 69

What should the documents that make up a formalized security structure include?

Answer 69

Policies, standards, baselines, guidelines, and procedures

Question 70

What is generally involved in the processes of risk management?

Answer 70

Analyzing an environment for risks, evaluating each risk as to its likelihood and damage, assessing the cost of countermeasures, and creating a cost/benefit report to present to upper management

Question 71

What should be considered when establishing the value of an asset?

Answer 71

Cost of purchase, development, maintenance, acquisition, and protection; value to owners/users/competitors; equity value; market valuation; liability of asset loss; and usefulness

Question 72

Name at least five possible threats that should be evaluated when performing a risk analysis.

Answer 72

Viruses; buffer overflows; coding errors; user errors; intruders (physical and logical); natural disasters; equipment failure; misuse of data, resources, or services; loss of data; physical theft; denial of service

Question 73

What is single loss expectancy, and how is it calculated?

Answer 73

The cost associated with a single realized risk against a specific asset. SLE = asset value (AV) * exposure factor (EF). The SLE is expressed in a dollar value.

Question 74

What is annualized loss expectancy, and how is it calculated?

Answer 74

The possible yearly cost of all instances of a specific realized threat against a specific asset. ALE = single loss expectancy (SLE) * annualized rate of occurrence (ARO).

Question 75

What are the basics distinctions between qualitative and quantitative risk analysis?

Answer 75

Quantitative risk analysis assigns real dollar figures to the loss of an asset. Qualitative risk analysis assigns subjective and intangible values to the loss of an asset.

Question 76

What are the four possible responses by upper/senior management to risk?

Answer 76

Reduce/mitigate, assign/transfer, accept, or reject/deny

Question 77

What is residual risk?

Answer 77

Once countermeasures are implemented, the risk that remains is known as residual risk. Residual risk is the risk that management has chosen to accept rather than mitigate.

Question 78

What is total risk?

Answer 78

The amount of risk an organization would face if no safeguards were implemented. A formula for total risk is threats * vulnerabilities * asset value = total risk.

Question 79

What is the controls gap?

Answer 79

The difference between total risk and residual risk. The controls gap is the amount of risk that is reduced by implementing safeguards.

Question 80

What are the three learning levels of security?

Answer 80

Awareness, training, and education

Question 81

What are the three types of plans employed in security management planning?

Answer 81

A strategic plan is a long-term plan that is fairly stable. The tactical plan is a midterm plan that provides more details. Operational plans are short term and highly detailed.

Question 82

How many primary keys may each database table have?

Answer 82

One

Question 83

What type of malicious code spreads through the sharing of infected media?

Answer 83

Viruses

Question 84

What term is used to describe intelligent code objects that perform actions on behalf of a user?

Answer 84

Agent

Question 85

What term is used to describe code sent by a server to a client for execution on the client machine?

Answer 85

Applet

Question 86

What type of database key enforces relationships between tables?

Answer 86

Foreign key

Question 87

What security principle ensures that multiple records are created in a database table for viewing at different security levels?

Answer 87

Polyinstantiation

Question 88

What process evaluates the technical and nontechnical security features of an IT system?

Answer 88

Certification and accreditation

Question 89

What type of accreditation evaluates the systems and applications at a specific, self-contained location?

Answer 89

Site accreditation

Question 90

In which phase of the Software Capability Maturity Model do you often find hardworking people charging ahead in a disorganized fashion?

Answer 90

Initial

Question 91

In which layer of the ring protection scheme do user applications reside?

Answer 91

Layer 3

Question 92

What system mode requires that the system process only one classification level at a time and all system users have clearance and need to know that information?

Answer 92

Dedicated security mode

Question 93

What is another term for the master boot record?

Answer 93

Boot sector

Question 94

What type of virus embeds itself in application documents?

Answer 94

Macro virus

Question 95

What can antivirus programs do when they encounter a virus infection?

Answer 95

Delete the file, disinfect the file, or quarantine the file.

Question 96

What type of virus modifies itself each time it infects a new system in an attempt to avoid detection?

Answer 96

Polymorphic virus

Question 97

What type of malicious code launches itself when certain conditions (such as a specific date) are met?

Answer 97

Logic bomb

Question 98

Where are passwords stored in a Unix or Linux system?

Answer 98

In the /etc/shadow file, much older systems may still use /etc/passwd.

Question 99

What term is used to describe hackers rooting through trash looking for useful information?

Answer 99

Dumpster diving

Question 100

What is the cornerstone of computer security?

Answer 100

Education

Question 101

What are the three phases of the three-way handshake used by TCP/IP?

Answer 101

SYN, SYN/ACK, ACK

Question 102

How does the teardrop attack operate?

Answer 102

It sends overlapping packet fragments to the victim machine.

Question 103

What is the term used to describe a secret method used by a programmer to gain access to the system?

Answer 103

Trap door (or back door)

Question 104

When is the XOR function true?

Answer 104

When only one of the input bits is true

Question 105

What term describes a mathematical function that easily produces output values for each possible combination of inputs but makes it impossible to retrieve the input values?

Answer 105

One-way function

Question 106

True or false? All ciphers are meant to obscure the meaning of a message.

Answer 106

True

Question 107

True or false? All codes are meant to obscure the meaning of a message.

Answer 107

False

Question 108

What occurs when a change in the plain text results in multiple changes spread throughout the cipher text?

Answer 108

Diffusion

Question 109

What type of cipher is the Caesar cipher?

Answer 109

Simple substitution

Question 110

True or false? Modern cryptosystems rely on the secrecy of the encryption algorithm.

Answer 110

False

Question 111

What is the length of the key used by the standard DES algorithm?

Answer 111

56 bits

Question 112

How many rounds of encryption does DES utilize?

Answer 112

16

Question 113

True or false? The IDEA algorithm is available free for noncommercial use.

Answer 113

True

Question 114

What encryption algorithm was selected for the Advanced Encryption Standard (AES)?

Answer 114

Rijndael

Question 115

What is the Diffie-Hellman algorithm most commonly used for?

Answer 115

Key exchange

Question 116

True or false? The Hashed Message Authentication Code (HMAC) provides nonrepudiation.

Answer 116

False

Question 117

What are the three encryption algorithms supported by the Digital Signature Standard?

Answer 117

DSA, RSA, and ECDSA

Question 118

What ITU standard describes the contents of a digital certificate?

Answer 118

X.509

Question 119

What is the process by which you are issued a digital certificate?

Answer 119

Enrollment

Question 120

Who issues digital certificates?

Answer 120

Certificate authorities (CAs)

Question 121

True or false? PEM provides protection against replay attacks.

Answer 121

False

Question 122

What protocol uses the RSA encryption algorithm to provide encrypted mail support for a number of common commercial email packages?

Answer 122

S/MIME

Question 123

True or false? S-HTTP secures individual messages between a client and a server.

Answer 123

True

Question 124

What cryptographic methods are used by the Secure Electronic Transaction (SET) protocol?

Answer 124

RSA public key cryptography and DES private key cryptography in connection with digital certificates

Question 125

What are the four components of IPsec?

Answer 125

Authentication Header (AH), Encapsulating Security Payload (ESP), IP Payload Compression protocol (IPComp), and Internet Key Exchange (IKE)

Question 126

What type of cryptographic attack is used against algorithms that don’t incorporate temporal protections?

Answer 126

Replay attack

Question 127

What are some common reasons a certificate might need to be revoked?

Answer 127

The certificate was compromised, the certificate was erroneously issued, the certificate details changed, the private key was exposed, or there was a change of security association.

Question 128

What type of cryptography relies on the use of public and private keys?

Answer 128

Asymmetric

Question 129

What technology allows multiple users to make use of the same process without interfering with each other?

Answer 129

Multithreading

Question 130

What are some of the terms used to describe the CPU mode that gives access to the full range of supported instructions?

Answer 130

System mode, privileged mode, supervisory mode, and kernel mode

Question 131

What is the greatest security risk to RAM modules?

Answer 131

Theft

Question 132

What addressing scheme supplies the CPU with the actual address of the memory location to be accessed?

Answer 132

Direct addressing

Question 133

Magnetic/optical media devices are classified as what type of memory?

Answer 133

Secondary

Question 134

Memory devices designed to retain their data when power is removed are known as ___________________.

Answer 134

nonvolatile

Question 135

What two ways can storage devices be accessed?

Answer 135

Randomly and sequentially

Question 136

What is another term often used for firmware?

Answer 136

Microcode

Question 137

Where are the operating system–independent primitive instructions that a computer needs to start and load the operating system stored?

Answer 137

BIOS or UEFI

Question 138

What concept ensures that data existing at one level of security is not visible to processes running at different security levels?

Answer 138

Data hiding

Question 139

What are the important factors in personnel management?

Answer 139

Hiring practices, ongoing job performance reviews, and termination procedures

Question 140

What security mechanisms are countermeasures to collusion?

Answer 140

Job rotation, separation of duties, mandatory vacations, workstation change

Question 141

Why is antivirus protection important?

Answer 141

Malware is the most common form of security breach in the IT world. Any communications pathway can be and is being exploited as a delivery mechanism for a virus or other malicious code.

Question 142

What is need to know?

Answer 142

Need to know is the requirement to have access to, knowledge of, or possession of data or a resource in order to perform specific work tasks.

Question 143

What principle states that users should be granted the minimum amount of access to the secure environment as possible for them to be able to complete their work tasks?

Answer 143

Principle of least privilege

Question 144

What are due care and due diligence?

Answer 144

Due care is using reasonable care to protect the interest of an organization. Due diligence is practicing the activities that maintain the due care effort.

Question 145

How are security and illegal activities related?

Answer 145

A secure environment should provide mechanisms to prevent the committal of illegal activities, which are actions that violate a legal restriction, regulation, or requirement.

Question 146

With what level of security precautions should backup media be treated?

Answer 146

Backup media should be handled with the same security precautions as any other asset with the same data classification.

Question 147

What are the goals of managing backup media?

Answer 147

Preventing disclosure, destruction, or alteration of data

Question 148

What are the processes that can be applied to used media in order to prepare the media for reuse in various environments?

Answer 148

Erasing, clearing, and overwriting media that will be used in the same classification environments; purging, sanitizing, and degaussing if media is used in different classification environments

Question 149

What are the classifications of security control types?

Answer 149

Preventive, deterrent, detective, corrective, recovery, compensation, directive

Question 150

What is the purpose of auditing?

Answer 150

To ensure compliance with security policy and to detect abnormalities, unauthorized occurrences, or outright crimes

Question 151

What types of activities are labeled as auditing?

Answer 151

Recording of event/occurrence data, examination of data, data reduction, use of event/occurrence alarm triggers, log analysis, logging, monitoring, using alerts, intrusion detection

Question 152

What is the purpose of compliance testing?

Answer 152

To ensure that all of the necessary and required elements of a security solution are properly deployed and functioning as expected

Question 153

How are audit trails used?

Answer 153

To reconstruct an event, to extract information about an incident, to prove or disprove culpability

Question 154

What types of activities can be used as penetration tests?

Answer 154

Information/intelligence gathering, war driving, sniffing, eavesdropping, radiation monitoring, dumpster diving, social engineering, port scanning, ping scanning, vulnerability scanning, war dialing, and actual compromise activities.

Question 155

What are some ways to keep inappropriate content to a minimum?

Answer 155

Address the issue in the security policy, perform awareness training, use content filtering tools to filter source or word content.

Question 156

Why is it important to protect against resource waste?

Answer 156

If the storage space, computing power, or networking bandwidth capacity is consumed by inappropriate or non-work-related (non-profit-producing) data, the organization loses money.

Question 157

Why is it important to protect against privilege abuse?

Answer 157

It can cause the disclosure of sensitive information, violating the principle of confidentiality.

Question 158

What countermeasures are moderately effective against errors and omissions?

Answer 158

Input validators and user training

Question 159

How can you protect data against fraud and theft?

Answer 159

The use of access controls (auditing and monitoring, for example) reduce fraud and theft.

Question 160

What are some safeguards against sabotage?

Answer 160

Intensive auditing, monitoring for abnormal or unauthorized activity, keeping lines of communication open between employees and managers, and compensating and recognizing employees for excellence

Question 161

Why isn’t there an effective direct countermeasure against the threat of malicious hackers or crackers?

Answer 161

Most safeguards and countermeasures protect against one specific threat or another, but it is not possible to protect against all possible threats that a cracker represents.

Question 162

What is malicious code?

Answer 162

Malicious code is any script or program that performs an unwanted, unauthorized, or unknown activity on a computer system.

Question 163

True or false? Senior management should be included in the BCP process from the beginning.

Answer 163

True

Question 164

What resource is in greatest demand during the BCP testing, training, and maintenance process?

Answer 164

Manpower

Question 165

What type of decision making is mainly concerned with metrics such as dollar values and downtime?

Answer 165

Quantitative

Question 166

What Business Impact Analysis/Assessment variable is used to describe the longest period of time a resource can be unavailable without causing irreparable harm to the business?

Answer 166

Maximum tolerable downtime (MTD)

Question 167

What is the formula for computing single loss expectancy?

Answer 167

SLE = AV * EF [Single Loss Expectancy = Asset Value * Exposure Factor]

Question 168

What is the formula for computing annualized loss expectancy?

Answer 168

ALE = SLE * ARO [Annualized Loss Expectancy = Single Loss Expectancy * Annual Rate of Occurrence]

Question 169

What are some of the qualitative factors that must be taken into account when assessing the cost of a disaster?

Answer 169

Loss of goodwill among client base, loss of employees after prolonged downtime, social/ethical responsibilities to the community, and negative publicity

Question 170

What is the first thing you should do when a disaster strikes?

Answer 170

Ensure that people are safe.

Question 171

What are the two possible responses to a risk?

Answer 171

Acceptance and mitigation

Question 172

Provide two examples of devices that might be used to harden a system.

Answer 172

Computer-safe fire suppression systems and uninterruptible power supplies

Question 173

What is the goal of business continuity planning (BCP)?

Answer 173

To ensure the continuous operation of a business in the face of an emergency situation

Question 174

What are some of the elements that should be included in emergency response guidelines?

Answer 174

Immediate response procedures, notification procedures, and secondary response procedures

Question 175

What are the five steps of the business impact assessment process?

Answer 175

Identification of priorities, risk identification, likelihood assessment, impact assessment, and resource prioritization

Question 176

What process brings order to the chaotic events surrounding the interruption of an organization’s normal activities by an emergency?

Answer 176

Disaster recovery planning (DRP)

Question 177

Name some common natural disasters.

Answer 177

Earthquakes, floods, storms, tornadoes, and fires

Question 178

What organization sponsors the National Flood Insurance Program and is a good source of historical flood information?

Answer 178

Federal Emergency Management Agency (FEMA)

Question 179

What disaster recovery system is often highly dependent on the public water supply?

Answer 179

Fire suppression system

Question 180

What type of disaster recovery separates recovery sites by business teams?

Answer 180

Workgroup recovery

Question 181

What are the three major options for alternative processing sites?

Answer 181

Hot sites, warm sites, and cold sites

Question 182

What type of recovery site is particularly suited to workgroup recovery options?

Answer 182

Mobile site

Question 183

True or false? Organizations participating in a mutual assistance agreement are typically located in the same geographic region.

Answer 183

True

Question 184

True or false? There is an accepted standards document defining the requirements for an electronic vaulting solution.

Answer 184

False

Question 185

What is the most common document type used for emergency response plans?

Answer 185

Checklists

Question 186

What are the three major types of filesystem backups?

Answer 186

Full backups, incremental backups, and differential backups

Question 187

What can be used to protect a company against the failure of a developer to provide adequate support?

Answer 187

Software escrow agreements

Question 188

It is sometimes useful to separate disaster ___________________ tasks from disaster ___________________ tasks.

Answer 188

recovery, restoration (in either order)

Question 189

True or false? In most circumstances, it is illegal for an employer to monitor an employee’s email.

Answer 189

False

Question 190

If a witness is not able to uniquely identify an object, how else may it be authenticated in court?

Answer 190

By establishing a chain of evidence

Question 191

What type of evidence is an authenticated computer log?

Answer 191

Documentary evidence

Question 192

What are the three major evidence admissibility requirements?

Answer 192

Evidence must be relevant, material, and competent.

Question 193

What law created the category of mission-critical computer systems?

Answer 193

Government Information Security Reform Act

Question 194

What are the two requirements for acceptance of a trademark application?

Answer 194

The trademark must not be confusingly similar to another trademark, and it must not be descriptive.

Question 195

What are the three requirements for acceptance of a patent application?

Answer 195

The invention must be new, useful, and nonobvious.

Question 196

How long does trade secret protection last?

Answer 196

Indefinitely

Question 197

What amendment to the US Constitution forms the basis for privacy rights?

Answer 197

Fourth Amendment

Question 198

What law requires that websites provide parents with the opportunity to review any information collected from their children?

Answer 198

Children’s Online Privacy Protection Act

Question 199

What law grants privacy rights to students enrolled in educational institutions that accept government funding?

Answer 199

Family Educational Rights and Privacy Act

Question 200

Which type of computer crime would likely be timed to occur simultaneously with a physical attack to reduce the ability to effectively respond to the physical attack?

Answer 200

Terrorist attack

Question 201

What term refers to any hardware, software, or data that can be used to prove the identity and actions of an attacker?

Answer 201

Evidence

Question 202

What term describes any violation or threatened violation of a security policy?

Answer 202

Incident

Question 203

Which type of incident generally does not cause direct damage to the victim?

Answer 203

Scanning. The purpose of a scanning attack is to collect information. The real damage to the system occurs in later attacks.

Question 204

How do you protect your system from a malicious code incident?

Answer 204

Make sure your security policy restricts the introduction of untested files to your computer system. Have a good scanner with an up-to-date signature database. Frequently scan all files. Implement whitelisting of applications.

Question 205

Which two types of incidents are the easiest to stop by dynamically altering filtering rules?

Answer 205

Scanning and denial of service. They can both potentially be stopped by filtering out the offending packets.

Question 206

What must you do to make sure evidence is kept viable for use in a trial?

Answer 206

You must ensure that the evidence has not changed, and you must be able to validate its integrity.

Question 207

Where should you begin looking to find information about an incident that occurred in the recent past?

Answer 207

The first place to look is in the system and network log files.

Question 208

If an incident has occurred that has violated no laws or regulations, how do you determine whether to report it?

Answer 208

The incident reporting guidelines should be in your security policy.

Question 209

Is adherence to the (ISC)2 Code of Ethics recommended, mandatory, or optional for CISSPs?

Answer 209

Adherence to the (ISC)2 Code of Ethics is mandatory, and acceptance of the Code of Ethics is a condition of certification.

Question 210

What is the leading reason many incidents are not reported?

Answer 210

Because they are not recognized as incidents

Question 211

What are the three main types of physical security controls?

Answer 211

Administrative physical security controls, technical physical security controls, physical controls for physical security

Question 212

What is the primary purpose of lighting as a physical security device?

Answer 212

To discourage casual intruders, trespassers, prowlers, and would-be thieves

Question 213

What are the benefits of security guards?

Answer 213

They are able to adapt and react to any condition or situation, are able to learn and recognize attack patterns, can adjust to a changing environment, and are able to make decisions and judgment calls.

Question 214

What are the disadvantages of security guards?

Answer 214

Not all environments support them; prescreening, bonding, and training is not always effective; they are expensive, subject to illness, take vacations, and are vulnerable to social engineering.

Question 215

What are the benefits and disadvantages of guard dogs?

Answer 215

They can be deployed as a perimeter security control and as detection and deterrent agents, they are costly and require high maintenance, and their use involves insurance and liability issues.

Question 216

What are the 11 electrical terms and definitions you should be aware of?

Answer 216

Fault, blackout, sag, brownout, spike, surge, inrush, noise, transient, clean, ground

Question 217

What are the types of noise or interference and their sources?

Answer 217

Common mode noise is generated by the difference in power between the hot and ground wires. Traverse mode noise is generated by the difference in power between the hot and neutral wires.

Question 218

What are the typical HVAC requirements for a computer room?

Answer 218

A computer room should be kept at 60 to 75 degrees Fahrenheit (15 to 23 degrees Celsius). Humidity in a computer room should be maintained at between 40 and 60 percent.

Question 219

What type of damage occurs when static electricity discharges exceed 40 volts?

Answer 219

Destruction of sensitive circuits

Question 220

What is a Type C fire extinguisher used for, and what is it made of?

Answer 220

A Type C fire extinguisher is for use on electrical devices, thus the extinguishing agent is non-conductive, so the devices might use CO2, halon, or various alternatives.

Question 221

What are the four types of water-based fire suppression systems?

Answer 221

Wet pipe system, dry pipe system, deluge system, preaction system

Question 222

What are the alternatives for halon?

Answer 222

FM-200 (HFC-227ea), CEA-410 or CEA 308, NAF-S-III (HCFC Blend A), FE-13 (HCFC-23), Aragon (IG55) or Argonite (IG01), Inergen (IG541), and low-pressure water mists

Question 223

Which security vulnerability conveys information by altering the performance of a system component or modifying a resource’s timing in a predictable manner?

Answer 223

Covert timing channel

Question 224

What is a separate object that is associated with a resource and describes its security attributes?

Answer 224

Security token

Question 225

In the Clark–Wilson security model, what is a procedure that scans data items and confirms their integrity?

Answer 225

Integrity verification procedure (IVP)

Question 226

In the Biba integrity model, what is the Simple Integrity Axiom, which states that a subject cannot read an object of a lower integrity, also called?

Answer 226

No read down

Question 227

Which organization developed the Bell–LaPadula security model?

Answer 227

The US Department of Defense

Question 228

What is the collection of TCB components that work together to implement the reference monitor functions?

Answer 228

Security kernel

Question 229

What does ITSEC call the system that is being evaluated?

Answer 229

The target of evaluation (TOE)

Question 230

What TCSEC category is reserved for systems that have been evaluated but do not meet the requirements of any other category?

Answer 230

Category D (minimal protection)

Question 231

Which IPsec protocol provides integrity, authentication, and nonrepudiation to the secure message exchange?

Answer 231

Authentication Header (AH)

Question 232

Which type of controls considers static attributes of the subject and the object to determine the permissibility of an access?

Answer 232

Mandatory access controls

Question 233

What term is used to refer to the user or process that makes a request to access a resource?

Answer 233

Subject

Question 234

What is the imaginary boundary that separates the TCB from the rest of the system?

Answer 234

Security perimeter

Question 235

What term describes the technical evaluation of each part of a computer system to assess its concordance with security standards?

Answer 235

Certification

Question 236

What is the difference between analog and digital signals?

Answer 236

Analog communications occur with a continuous signal that varies in frequency, amplitude, and so on. Digital communications occur through the use of a state change of on-off pulses.

Question 237

What is the difference between synchronous and asynchronous communications?

Answer 237

Synchronous communications rely on a timing or clocking mechanism. Asynchronous communications rely on a stop and start delimiter bit to manage transmission of data.

Question 238

What is the difference between baseband and broadband communications?

Answer 238

Baseband technology uses a direct current to support a single communication channel. Broadband technology uses frequency modulation to support multiple simultaneous signals.

Question 239

Describe broadcast, multicast, and unicast communications.

Answer 239

A broadcast supports communications to all possible recipients. A multicast supports communications to multiple specific recipients. A unicast supports only a single communication to one recipient.

Question 240

What is the difference between packet switching and circuit switching?

Answer 240

In circuit switching, a dedicated physical pathway is created between the two parties. Packet switching occurs when the message is broken up into segments and sent across the intermediary network.

Question 241

What are the characteristics of PPP?

Answer 241

The Point-to-Point Protocol (PPP) is an encapsulation protocol designed to support the transmission of IP traffic over dial-up or point-to-point links. PPP supports CHAP and PAP for authentication.

Question 242

What is CORBA?

Answer 242

Common Object Request Broker Architecture (CORBA) is an international standard (sanctioned by the International Organization for Standardization) for distributed computing.

Question 243

What’s the most desirable default setting for access control?

Answer 243

Denial. When access is not specifically granted, it should be denied by default. This is also known as implicit deny.

Question 244

What type of approach to security is considered better than a fortress mentality approach?

Answer 244

Defense in depth, multiple layers of security, concentric circles of security

Question 245

What form of password attack consists first of a dictionary attack and then a brute-force attack based on the dictionary list?

Answer 245

A hybrid attack. Sometimes called a one-upped password attack.

Question 246

What is the most unacceptable form of biometric control to end users?

Answer 246

Retina scans

Question 247

What is the stored sample of a biometric factor called?

Answer 247

A reference profile or a reference template

Question 248

With what other forms of single sign-on can Kerberos be combined?

Answer 248

Any or all of them, including SESAME, KryptoKnight, NetSP, thin clients, directory services, and scripted access

Question 249

How is the ticket-granting ticket used by Kerberos generated?

Answer 249

The user’s password is hashed, and a timestamp is added.

Question 250

What is a centralized database of resources available to the network?

Answer 250

A directory service

Question 251

What are examples of rule-based access control?

Answer 251

MAC, RBAC, TBAC

Question 252

What form of access control can combine levels of security domains with compartments of additional control and isolation?

Answer 252

MAC (specifically, a hybrid MAC environment)

Question 253

What form of access control is best suited to those organizations with a high rate of employee turnover?

Answer 253

RBAC

Question 254

When an intrusion is detected, what should be the first response?

Answer 254

Contain or constrain the intrusion.

Question 255

Once an intrusion has occurred, what is the most secure process for restoring the environment?

Answer 255

Format and reinstall from scratch.

Question 256

What form of IDS is easier for an intruder to discover and disable?

Answer 256

Host-based IDS

Question 257

What network device works primarily at the Application layer?

Answer 257

Gateway

Question 258

What are the most common causes of network failure?

Answer 258

Cable failures and misconfigurations

Question 259

What type of cabling must be used to comply with building code safety requirements?

Answer 259

Plenum-rated cable

Question 260

What type of cabling must be used to comply with building code safety requirements?

Answer 260

Plenum-rated cable

Question 261

How many sockets does TCP have?

Answer 261

65, 536 (2^16) sockets (aka ports), numbered from 0 to 65,535

Question 262

What is the IP header protocol field value for TCP? UDP? ICMP? IGMP?

Answer 262

6, 17, 1, 2

Question 263

What protocol is used by ping, pathping, and traceroute?

Answer 263

ICMP

Question 264

What is the APIPA range?

Answer 264

169.254.0.1 to 169.254.255.254 along with the default Class B subnet mask of 255.255.0.0

Question 265

What port is used by IMAP?

Answer 265

143

Question 266

What port is used by DHCP?

Answer 266

Port 68 for client request broadcast and port 67 for server point-to-point response

Question 267

Network devices at what layer and above separate collision domains?

Answer 267

Layer 2

Question 268

Network devices at what layer and above separate broadcast domains?

Answer 268

Layer 3

Question 269

Which VPN protocol supports multiple simultaneous connections?

Answer 269

IPsec

Question 270

What is the primary weakness of satellite communications?

Answer 270

Large terrestrial footprint

Question 271

What makes the usable throughput of ISDN less than the stated bandwidth?

Answer 271

The D channel is used only for call management, not data.

Question 272

What type of system is a common target of attackers who want to disseminate email spam?

Answer 272

Open relay SMTP servers

Question 273

What is the primary method to improve fax security?

Answer 273

Disable automatic printing of received faxes.

Question 274

What is the form of new system deployment testing called when the new system and the old system are run simultaneously?

Answer 274

Parallel run

Question 275

When an asset no longer needs or warrants a high security sensitivity label, what should occur?

Answer 275

Declassification

Question 276

What is the cost/benefit analysis equation for countermeasures?

Answer 276

(ALE before safeguard – ALE after implementing the safeguard) – annual cost of safeguard = value of the safeguard to the company

Question 277

What type of relationships can be established with relational databases? With hierarchical databases? With distributed databases?

Answer 277

One-to-one, one-to-many, and many-to-many

Question 278

What are the six basic SQL commands?

Answer 278

Select, Update, Delete, Insert, Grant, and Revoke

Question 279

What is a placeholder for SQL literal values such as numbers or character strings?

Answer 279

Bind variable

Question 280

What database security feature uses locking to prevent simultaneous write access to cells?

Answer 280

Concurrency

Question 281

What database security feature can be used to subvert aggregation, inferencing, and contamination vulnerabilities?

Answer 281

Database partitioning

Question 282

What feature of databases allows two or more rows in the same table to appear to have identical primary key elements but contain different data for use at differing classification levels?

Answer 282

Polyinstantiation

Question 283

What acts as an interface between back-end database systems and user applications?

Answer 283

ODBC

Question 284

What attack collects numerous low-level security items or low-value items and combines them to create something of a higher security level or value?

Answer 284

Aggregation

Question 285

What is more secure than a data warehouse and designed to store metadata?

Answer 285

Data mart

Question 286

What type of application analyzes business data and presents it in such a way as to make business decisions easier for users?

Answer 286

Decision support system

Question 287

What security problem cannot be prevented or compensated for by environmental controls or hardware devices?

Answer 287

Bad coding

Question 288

What is a valid security response when an application violates OS-imposed security, such as interfering with other processes or accessing hardware directly?

Answer 288

Stopping the environment, a STOP error, a BSOD

Question 289

What is it called when programmers decompile vendor code in order to understand the intricate details of its functionality?

Answer 289

Reverse engineering

Question 290

What is the communication to or input of an object?

Answer 290

Message

Question 291

What is the internal code that defines the actions an object performs in response to a message?

Answer 291

Method

Question 292

What are the results or output exhibited by an object based on processing a message through a method?

Answer 292

Behavior

Question 293

What is the collection of the common methods from a set of objects that is used to define the behavior of those objects?

Answer 293

Class

Question 294

What is it called when an object is an example of a class because the object contains a method from that class?

Answer 294

Instance

Question 295

What characteristic describes an object that exhibits different behaviors based on the same message and methods because of variances in external conditions?

Answer 295

Polymorphism

Question 296

Highly __________ objects are not as dependent on other objects.

Answer 296

cohesive

Question 297

Lower ___________ provides better software design because objects are more independent.

Answer 297

coupling

Question 298

What is a type of bar chart that shows the interrelationships over time between projects and schedules?

Answer 298

Gantt chart

Question 299

What is a project-scheduling tool that is used to judge the size of a software product in development and calculate the standard deviation for risk assessment?

Answer 299

Program Evaluation Review Technique (PERT)

Question 300

What form of testing examines the internal logical structures of a program?

Answer 300

White-box testing

Question 301

What form of testing examines the input and output of a program without focusing on the internal logical structures?

Answer 301

Black-box testing

Question 302

What form of testing examines the extent of the system testing in order to locate untested program logic?

Answer 302

Test data method

Question 303

Which form of antivirus response not only removes the virus from the system but also repairs any related damage?

Answer 303

Cleaning

Question 304

What is the name of the assumption that all algorithms should be public but all keys should remain private?

Answer 304

Kerckhoffs’s principle

Question 305

What is the range of valid values of keys for an algorithm called?

Answer 305

Key space

Question 306

What defines the hardware and software requirements of cryptographic modules in use by the federal government?

Answer 306

Federal Information Processing Standards (FIPS-140-2)

Question 307

What acts as a placeholder variable in mathematical functions and is used in random number generation?

Answer 307

Nonce

Question 308

What is a random bit string (a nonce) that is the same length as the block size that is XORed with the message and adds strength to cryptography systems?

Answer 308

Initialization vector (IV)

Question 309

What is the most significant bit in a string?

Answer 309

The leftmost bit

Question 310

What is it called when a plain-text message generates identical cipher-text messages using the same algorithm but different keys?

Answer 310

Clustering or key clustering

Question 311

What is a concept of communication whereby a specific type of information is exchanged but no real data is exchanged?

Answer 311

Zero-knowledge proof

Question 312

What is the basic idea that the information or privilege required to perform an operation is divided among multiple users (it is an application of separation of duties)?

Answer 312

Split knowledge

Question 313

What is an example of split knowledge employed to protect key escrow?

Answer 313

M of N control

Question 314

What is a way of measuring the strength of a cryptography system by measuring the effort in terms of cost and/or time?

Answer 314

Work function or work factor

Question 315

What is an example of a polyalphabetic substitution cipher?

Answer 315

Vigenère cipher

Question 316

What attack is often successful against substitution ciphers?

Answer 316

Frequency analysis

Question 317

What attack is often successful against polyalphabetic substitution ciphers?

Answer 317

Period analysis

Question 318

What form of encryption is used to protect communications that occur in real time?

Answer 318

Stream ciphers

Question 319

What form of encryption can provide secure communications between two parties when they have no prior method of communicating securely?

Answer 319

Asymmetric cryptography

Question 320

What modes of DES employ an IV?

Answer 320

CBC, CFB, OFB

Question 321

What are the valid key sizes for RC5?

Answer 321

0 to 2,048 bits

Question 322

If a message is signed and encrypted, what security services are you providing?

Answer 322

Confidentiality, integrity, authenticity/access control, and nonrepudiation

Question 323

Who has the responsibility to ensure that communications are secured?

Answer 323

The sender

Question 324

What is the standard that wireless networking technology is based on?

Answer 324

802.11

Question 325

What cryptographic attack attempts to find a weakness in the algorithm?

Answer 325

Analytic attack

Question 326

What cryptographic attack attempts to find a weakness in the software code?

Answer 326

Implementation attack

Question 327

What cryptographic attack attempts to exploit weaknesses in the computer hardware or operating system?

Answer 327

Statistical attack

Question 328

A _________ system is one in which all protection mechanisms work together to process sensitive data for many types of users while maintaining a stable and secure computing environment.

Answer 328

trusted

Question 329

__________ is simply defined as the degree of confidence in satisfaction of security needs.

Answer 329

Assurance

Question 330

What are the security requests of a client called under Common Criteria?

Answer 330

Protection profile

Question 331

What are the security features of a designed system called under Common Criteria?

Answer 331

Security target

Question 332

What method of verifying or establishing a trusted label of system security requires a DAA?

Answer 332

Accreditation

Question 333

What is the name of the accreditation process of the Department of Defense?

Answer 333

Defense Information Technology Security Certification and Accreditation Process (DITSCAP)

Question 334

What are the three forms of accreditation offered by National Information Assurance Certification and Accreditation Process (NIACAP)?

Answer 334

Site, type, system

Question 335

What are often added to passwords under Linux to make their resultant hash even more secure?

Answer 335

Salts

Question 336

When a disaster strikes but your ability to perform work tasks is only threatened, not actually interrupted, what response should be used?

Answer 336

BCP

Question 337

What is always your top priority when dealing with a disaster of any type or significance?

Answer 337

Safety of personnel

Question 338

What feature of insurance can improve your ability to replace lost or damaged assets?

Answer 338

Actual Cost Value (ACV)

Question 339

What is the most common cause of unplanned downtime?

Answer 339

Hardware failures

Question 340

What are some examples of alternate processing facilities that should be considered when designing a DRP?

Answer 340

Hot, warm, and cold sites; mobile sites; service bureaus; multiple sites; and reciprocal agreements

Question 341

What forms of backup always set the archive bit to 0?

Answer 341

Full and incremental

Question 342

What backup media may be appropriate for personal backups but not for network backups?

Answer 342

Writable CDs, DVDs, and Blu-ray discs as well as flash drives. These and similar types of smaller capacity storage mechanisms are useful for holding smaller amounts of data than when compared to enterprise options such as multiterabyte hard drives and tapes.

Question 343

What form of backup, when used to restore data, will always result in some amount of data loss?

Answer 343

Periodic backups

Question 344

What law requires all communications carriers to make wiretaps possible for law enforcement with an appropriate court order regardless of the technology in use?

Answer 344

Communications Assistance for Law Enforcement Act (CALEA) of 1994

Question 345

What law extends the definition of property to include proprietary economic information so that the theft of this information can be considered industrial or corporate espionage?

Answer 345

Economic and Protection of Proprietary Information Act of 1996

Question 346

__________ controls are your first line of defense, while ________ are your last line of defense.

Answer 346

Physical, people

Question 347

What is the functional order of controls when deployed for physical security?

Answer 347

Deterrence, then denial, then detection, then delay

Question 348

What type of lock consists of three elements: an electromagnet, a credential reader, and a door-closed sensor?

Answer 348

Electronic access control (EAC)

Question 349

Reviewing the recorded images from CCTV is what type of security control?

Answer 349

Detective

Question 350

What is the primary difference between memory cards and smart cards?

Answer 350

Processing capability

Question 351

At what stage of a fire is a flame visible?

Answer 351

At what stage of a fire is a flame visible?

Question 352

What is the most common cause of fires in a data center?

Answer 352

Overloaded electrical distribution outlets

Question 353

Where should fire detectors be placed?

Answer 353

In dropped ceilings, raised floors, server rooms, private offices and public areas, HVAC vents, elevator shafts, the basement, and so on

Question 354

What is the most common cause of failure of a water-based suppression system?

Answer 354

Human error

Question 355

Name one or more examples of vector routing protocol.

Answer 355

RIP, IGRP, BGP

Question 356

Name an example of a link state routing protocol.

Answer 356

OSPF

Question 357

At what layer does SSL and TLS function?

Answer 357

Transport layer (OSI layer 4)

Question 358

Name at least four technologies commonly called wireless.

Answer 358

802.11 networking, Bluetooth (802.15), mobile phones, and cordless phones

Question 359

What are the three unlicensed frequencies (at least in the United States as designated by the FCC)?

Answer 359

900 MHz, 2.4 GHz, and 5 GHz

Question 360

Name three wireless frequency access technologies.

Answer 360

FHSS, DSSS, and OFDM

Question 361

What is the IEEE standard for Bluetooth?

Answer 361

802.15

Question 362

What is the IEEE standard for WiMax?

Answer 362

802.16

Question 363

What is another name for the area of Bluetooth connectivity?

Answer 363

Personal area network (PAN)

Question 364

What is the primary security feature of Bluetooth pairing?

Answer 364

A four-digit PIN

Question 365

What two items are required for infrastructure mode wireless networking?

Answer 365

Wireless access points and wireless clients

Question 366

What mode is used when a wireless network link is established without the use of an access point?

Answer 366

Ad hoc or peer-to-peer

Question 367

What is the minimum amount of information needed by a wireless client to connect to a network hosted by a wireless access point?

Answer 367

SSID

Question 368

Name four examples of infrastructure mode wireless networking.

Answer 368

Stand-alone, wired extension, enterprise extended, and bridge

Question 369

What two forms of authentication are supported by 802.11?

Answer 369

Open System Authentication (OSA) and Shared Key Authentication (SKA)

Question 370

What is the minimum length of a TCP header?

Answer 370

20 bytes

Question 371

How long is a UDP header?

Answer 371

8 bytes

Question 372

What are the four TCP header flags that are used in virtual circuit setup and teardown?

Answer 372

SYN, ACK, FIN, and RES (or RST)

Question 373

What two ICMP type field values are employed in a successful ping activity?

Answer 373

8: echo request, 0: echo reply

Question 374

What is Control Objectives for Information and Related Technology (COBIT)?

Answer 374

A security concept infrastructure used to organize the complex security solution of companies.

Question 375

What form of testing examines the internal logical structures of a program from a developer’s perspective?

Answer 375

White-box testing

Question 376

What form of testing examines the input and output of a program without access to the internal logical structures?

Answer 376

Black-box testing

Question 377

What form of testing examines the input and output of a program with access to the internal logical structures?

Answer 377

Gray-box testing

Question 378

What kinds of items qualify as access controls?

Answer 378

Any hardware, software, or organizational administrative policy or procedure that maintains confidentiality, integrity, and/or accountability also counts as an access control.

Question 379

What is the proper term for ensuring that information is accessible only to authorized parties?

Answer 379

Confidentiality

Question 380

What is the proper term for the assurance that information and security controls used to protect information are accessible and usable when needed?

Answer 380

Availability

Question 381

What is it called when an authorized party indicates its intention to fulfill some contractual obligation and forgoes its right to dispute that fulfillment after the fact?

Answer 381

Nonrepudiation

Question 382

Items of information used to establish or prove authorized identities are known as what kind of factors?

Answer 382

Authentication

Question 383

What kind of access control enforces access policy determined by the owner of the object to which the control applies?

Answer 383

Discretionary access control (DAC)

Question 384

What kind of access control is determined by the system in which the object resides rather than its owner?

Answer 384

Mandatory access control (MAC)

Question 385

Which access control scheme requires organizational roles to be defined along with various task requirements and applicable object permissions?

Answer 385

Role-based access control (RBAC)

Question 386

Which access control scheme requires administrative rules to be defined along with the various conditions under which they apply as well as applicable object permissions?

Answer 386

Rule-based access control

Question 387

What is the practice of defense in depth called when it involves a multilayered security infrastructure that includes multiple combined individual applications and processes?

Answer 387

Concentric circle strategy

Question 388

What is the term for exercising reasonable care in protecting organizational assets and interests, including development of a formalized security structure consisting of policies, procedures, and protocols?

Answer 388

Due care

Question 389

When users are granted only the minimum access necessary to complete some task or process, what principle is involved?

Answer 389

The principle of least privilege

Question 390

What kinds of processes must be applied when confidential storage media is prepared for reuse in questionably secure environments?

Answer 390

Declassification

Question 391

What is the name for the demagnetization process used to erase disk drives or tapes to wipe out all previously stored data?

Answer 391

Degaussing

Question 392

What kind of control does any security tool provide when it’s used to guide the security implementation within an organization?

Answer 392

Directive control

Question 393

What kind of control does any mechanism, tool, or practice provide if it deters or mitigates undesirable actions or events?

Answer 393

Preventive control

Question 394

What kind of control should be used to verify the effectiveness of other security controls?

Answer 394

Detective control

Question 395

What kind of check should be applied to ensure that all necessary elements of a security solution are properly deployed and functioning as expected?

Answer 395

Compliance checking

Question 396

What do you call a person who is trained in responsible network security methods, who employs a philosophy of nondestructive and nonintrusive penetration testing, but who may also use underground or “black-hat” tools?

Answer 396

Ethical hacker

Question 397

What is the proper name for a criminal act committed against an organization by a current or former employee who exploits knowledge gained on the job in its perpetration?

Answer 397

Sabotage

Question 398

What is the proper name for the illegal intent behind obtaining and profiting from sensitive information that belongs to some third party (government, corporation, individual, and so on)?

Answer 398

Espionage

Question 399

When a person attempts to deceive an insider within an organization to divulge sensitive information or to perform sensitive actions on their behalf, what might this be called?

Answer 399

Social engineering

Question 400

When a penetration test team is privy to detailed information about organizational assets, including hardware and software inventory, but not to other information (accounts, users, naming conventions, and so on), how might this team be described?

Answer 400

Partial-knowledge team

Question 401

When a penetration test team is privy only to what it itself can learn about the target organizations for the test, how might this team be described?

Answer 401

Zero-knowledge team (performs black-box testing)

Question 402

What term identifies the data extraction technique whereby elements of data are extracted from a much larger body of data to construct a meaningful representation of its overall contents?

Answer 402

Sampling

Question 403

What governs how long records are kept to substantiate system security assessments and support system analysis?

Answer 403

Record retention

Question 404

What does BCP stand for, and what does it mean?

Answer 404

Business continuity planning (BCP) is the preventive practice of establishing and planning for threats to business flow, including natural and unnatural risk and threats to daily operations.

Question 405

What does DRP stand for, and what does it mean?

Answer 405

Disaster recovery planning (DRP) is the practice of establishing and executing recovery actions as part of an emergency response following a disaster.

Question 406

What term describes damage from disruptive and irresistible forces of nature (such as earthquakes, floods, storms, and so on)?

Answer 406

Natural disaster

Question 407

What term describes damage resulting from arson, human error, acts of terrorism, or power outages and other utility failures?

Answer 407

Man-made disaster

Question 408

What kind of strategy drives defining practices, policies, and procedures to restore a business to normal operation in the wake of some kind of outage or disaster?

Answer 408

Recovery strategy

Question 409

What label applies to a partial standby facility for which power and other infrastructure elements are available, but for which no operational computing facilities are supplied in advance of a disaster?

Answer 409

Cold site

Question 410

What label applies to a standby facility that is ready to take over for a primary facility as soon as notice is received that the primary facility has gone down?

Answer 410

Hot site

Question 411

What label applies to a site that is already provisioned with hardware and software to take over for a primary facility but that needs to obtain and install a backup or image of client-specific data before going online?

Answer 411

Warm site

Question 412

How might you describe a site housed in self-contained transportable units with all the control, hardware, and software elements necessary to establish an operational, safe computing environment?

Answer 412

Mobile site

Question 413

What roles can a service bureau play in disaster recovery?

Answer 413

Service bureaus lease computer time via contractual agreements and can meet an organization’s entire IT needs in the event of disaster or catastrophic failure.

Question 414

What is critical path analysis?

Answer 414

A systematic effort to identify relationships between mission-critical applications, processes, and operations and all of the necessary supporting elements

Question 415

Name three examples of administrative physical security controls.

Answer 415

Facility construction and selection, site management, personnel controls, security awareness training, emergency response, and procedures

Question 416

Name three examples of technical physical security controls.

Answer 416

Access controls; intrusion detection; alarm systems; closed-circuit television (CCTV); monitoring systems; heating, ventilation, and air conditioning (HVAC) systems; power supplies; fire detection and suppression systems

Question 417

Name three physical controls for physical security.

Answer 417

Fencing, lighting, locks, construction materials, mantraps, watchdogs, guards

Question 418

What term describes the act of gathering information about a system by observing the display or watching an operator at the keyboard?

Answer 418

Shoulder surfing

Question 419

What term describes the act of using another person’s security ID to gain unauthorized entry into a facility?

Answer 419

Masquerading

Question 420

When one person follows another though a secured gate or doorway without presenting identification or otherwise being authenticated, what is this entry technique called?

Answer 420

Piggybacking

Question 421

What kinds of system is designed to detect intrusions, breaches, or attack attempts as they are underway or after the fact?

Answer 421

Intrusion detection system (IDS)

Question 422

What does UPS stand for, and what does it mean?

Answer 422

An uninterruptible power supply (UPS) is a type of self-charging battery that can be used to supply consistent clean power to sensitive equipment.

Question 423

What does EMI stand for, and what does it mean?

Answer 423

Electromagnetic interference refers to any noise generated by electric current and can affect any means of data transmission or storage that relies on electromagnetic transport mechanisms.

Question 424

Describe the models of systems development.

Answer 424

The waterfall model is a sequential development process that results in the development of a finished product. Developers may step back only one phase in the process if errors are discovered. The spiral model uses several iterations of the waterfall model to produce a number of fully specified and tested prototypes. Agile development models place an emphasis on the needs of the customer and quickly developing new functionality that meets those needs in an iterative fashion.

Question 425

Describe the purpose of software development maturity models.

Answer 425

Maturity models help software organizations improve the maturity and quality of their software processes by implementing an evolutionary path from ad hoc, chaotic processes to mature, disciplined software processes.

Question 426

What are the important elements of change and configuration management?

Answer 426

The three basic components of change control are request control, change control, and release control.

Question 427

What is TEMPEST?

Answer 427

TEMPEST is a standard for the study and control of electronic signals produced by various types of electronic hardware, such as computers, televisions, phones, and so on. Its primary goal is to prevent EMI and RFI radiation from leaving a strictly defined area to eliminate the possibility of external radiation monitoring, eavesdropping, and signal sniffing.

Question 428

What is static software testing?

Answer 428

Static testing evaluates the security of software without running it by analyzing either the source code or the compiled application. Static analysis usually involves the use of automated tools designed to detect common software flaws, such as buffer overflows.

Question 429

What type of software testing is most appropriate when the tester does not have access to the underlying source code?

Answer 429

Dynamic testing

Question 430

What does malicious code often create on an infected system to allow the developers of the malicious code to remotely access the system at a later time?

Answer 430

Back door

Question 431

What name is given to the cryptographic concept of making the relationship between the plain text and the key so complex that an attacker can’t use known plain text attacks to determine the key?

Answer 431

Confusion

Question 432

What types of organizations need to comply with PCI DSS?

Answer 432

Those that store, process, or transmit credit card account information

Question 433

What trend makes it especially important to incorporate an assessment of security controls in contracting and procurement reviews?

Answer 433

The increased use of third-party and cloud services

Question 434

What are the branches of forensic analysis?

Answer 434

Media analysis, network analysis, software analysis, and hardware/embedded device analysis

Question 435

What is it called when a user has more access, privilege, or permission than their assigned work tasks dictate?

Answer 435

Excessive privileges (also known as the violation of least privilege)

Question 436

What is it called when a user accumulates privileges over time as their job roles and assigned tasks change but unneeded privileges are not revoked?

Answer 436

Creeping privileges or privilege creep

Question 437

Which access control scheme requires administrative rules to be defined along with the various conditions under which they apply as well as applicable object permissions?

Answer 437

Rule-based access control

Question 438

Name three physical controls for physical security.

Answer 438

Fencing, lighting, locks, construction materials, mantraps, watchdogs, guards

Question 439

What term is used to refer to the user or process that makes a request to access a resource?

Answer 439

Subject

Question 440

What kind of control does any mechanism, tool, or practice provide if it deters or mitigates undesirable actions or events?

Answer 440

Preventive control

Question 441

What process identifies the actual value of assets so that assets can be prioritized?

Answer 441

Asset valuation

Question 442

What process identifies and categorizes potential threats?

Answer 442

Threat modeling

Question 443

What process is used to identify weaknesses?

Answer 443

Vulnerability analysis

Question 444

When evaluating access control attacks, what are three primary elements that must be identified?

Answer 444

Assets, threats, and vulnerabilities

Question 445

A group of attackers is sponsored by a government. They are highly motivated, skilled, and patient and focused on a single target to gain and retain access over long periods of time. What is this group called?

Answer 445

Advanced persistent threat (APT)

Question 446

What are often added to passwords to make their resultant hash secure and resistant to rainbow attacks?

Answer 446

Salts

Question 447

What is a nonstatistical sampling method that only records or alerts on events that exceed a threshold?

Answer 447

Clipping levels

Question 448

What is a group of records from one or more databases or logs that can be used to reconstruct events after an incident?

Answer 448

Audit trail

Question 449

What is the purpose of an access review and audit?

Answer 449

Check to ensure that users do not have excessive privileges and that accounts are managed appropriately

Question 450

What can a user entitlement review detect?

Answer 450

Violation of the principle of least privilege policy, as incidents of excessive privileges or creeping privileges

Question 451

What types of accounts are focused on during a user entitlement review?

Answer 451

Privileged accounts such as administrator or root user accounts

Question 452

Who should have access to audit reports?

Answer 452

Only people who have a need to know

Question 453

What determines how often an audit should be performed?

Answer 453

Risk

Question 454

What policy requires users to spend at least a week away from their jobs on an annual basis to help prevent fraud?

Answer 454

Mandatory vacations

Question 455

What method will remove all data with assurances that it cannot be removed using any known methods?

Answer 455

Purging, sanitization, or destruction

Question 456

What methods can be used to protect mobile devices such as a smartphone?

Answer 456

Encryption, GPS, password-protected screen locks, and remote wipe

Question 457

What can be used to remove data on a lost smartphone?

Answer 457

Remote wipe

Question 458

What should be done before disposing of a desktop computer at the end of its life cycle?

Answer 458

Sanitization

Question 459

What is the term that identifies data on a disk after the data has supposedly been erased?

Answer 459

Data remanence

Question 460

What are the steps of a patch management program?

Answer 460

Evaluate, test, apply, and audit patches

Question 461

What can be used to verify patches have been applied?

Answer 461

Vulnerability scanner or a patch management system

Question 462

What should be done to verify patches have been applied?

Answer 462

Audit patches, or use a vulnerability scanner to verify patches have been applied

Question 463

What tool can check for weaknesses in systems?

Answer 463

Vulnerability scanner

Question 464

What would be completed to check an entire organization for weaknesses?

Answer 464

Vulnerability assessment

Question 465

What does imaging provide in relation to configuration management?

Answer 465

Baseline

Question 466

What helps prevent outages that can occur from unauthorized modifications?

Answer 466

Change management

Question 467

What helps prevent inadvertent weakening of security from unauthorized outages?

Answer 467

Change management

Question 468

What are the five steps in incident response quoted in the CISSP CIB?

Answer 468

Detection, Response, Reporting, Recovery, and Remediation and Review

Question 469

In which stage of incident response should a root cause analysis be conducted?

Answer 469

Remediation and Review

Question 470

While containing an incident, what is the next important consideration?

Answer 470

Protection of evidence

Question 471

An attack has a negative effect on the confidentiality, integrity, or availability of an organization’s assets. What is this called?

Answer 471

Computer security incident

Question 472

What is it called when malware is installed on a user’s system after visiting a website?

Answer 472

Drive-by download

Question 473

What three generic elements can help prevent malware infections?

Answer 473

Education, policies, and tools

Question 474

An attacker has launched an attack using a vulnerability known only to him. What is this called?

Answer 474

Zero-day exploit

Question 475

What type of attack leverages part of the TCP three-way handshake?

Answer 475

SYN flood attack

Question 476

What are computers in a botnet commonly called?

Answer 476

Zombies

Question 477

What is the best protection against a computer joining a botnet?

Answer 477

Up-to-date antivirus software

Question 478

What type of IDS detects attacks based on known methods?

Answer 478

Knowledge-based (also called signature-based or pattern-matching)

Question 479

What type of IDS detects attacks based by comparing it to a baseline?

Answer 479

Behavior-based (also called statistical-intrusion detection or anomaly detection)

Question 480

After a network is upgraded, what must be done with a behavior-based IDS?

Answer 480

Upgrade the baseline

Question 481

What is required before starting a penetration test?

Answer 481

Knowledge and consent of management

Question 482

When a penetration test team is privy to detailed information about organizational assets, including hardware and software inventory, but not to other information (accounts, users, naming conventions, and so on), how might this team be described?

Answer 482

Partial-knowledge team (performs gray-box testing)

Question 483

A penetration testing team has full knowledge about a target. What is this team called?

Answer 483

Full-knowledge team (performs white-box testing)

Question 484

What is used to provide fault tolerance for a disk subsystem?

Answer 484

Redundant array of independent disks (RAID)

Question 485

What is used to provide fault tolerance for a server?

Answer 485

Failover cluster

Question 486

What is used to provide short-term fault tolerance for a power failure?

Answer 486

Uninterruptible power supply (UPS)

Question 487

What is used to provide long-term fault tolerance for a power failure?

Answer 487

Generator

Question 488

What are the six flags from the TCP header that we still commonly use and what is their order in the header?

Answer 488

XXUAPRSF. The X represents two flags no longer used, followed by Urgent, Acknowledgment, Push, Reset, Synchronization, and Finish. You can memorize this flag order using the phrase “Unskilled Attackers Pester Real Security Folk.”

Question 489

What are the six flags from the TCP header that we still commonly use and what is their order in the header?

Answer 489

XXUAPRSF. The X represents two flags no longer used, followed by Urgent, Acknowledgment, Push, Reset, Synchronization, and Finish. You can memorize this flag order using the phrase “Unskilled Attackers Pester Real Security Folk.”

Question 490

What is VLAN hopping?

Answer 490

An attack using double-encapsulated IEEE 802.1Q VLAN tags to fool a switch into allowing traffic to jump to a different VLAN from which the traffic originated

Question 491

What is NAC?

Answer 491

Network Access Control (NAC) is a concept of controlling access to an environment through strict adherence to and implementation of security policy. The goals of NAC are to prevent/reduce zero-day attacks, enforce security policy throughout the network, and use identities to perform access control.

Question 492

What is endpoint security?

Answer 492

The concept that each individual device must maintain local security whether or not its network or telecommunications channels provide or offer security. Sometimes this is expressed as the end device is responsible for its own security.

Question 493

On an 802.11 wireless network, what contains the regular announcement of the network name by default?

Answer 493

The beacon frame contains the SSID (i.e., network name) by default. This can be stopped using the Disable SSID Broadcast feature of a wireless access point.

Question 494

What are the standards-based form(s) of encryption of 802.11 wireless networks and the cryptography protocols related to WPA-2?

Answer 494

WPA-2 (AES/CCMP)

Question 495

What is 802.1x?

Answer 495

Port authentication; basically a mechanism to proxy authentication from the local device to another dedicated authentication service within the network

Question 496

What is war driving?

Answer 496

A collection of techniques to discover that a wireless network is present at a given location

Question 497

What is a VLAN?

Answer 497

A hardware-imposed network segmentation created by switches used to manage traffic

Question 498

What is screen scraping?

Answer 498

1) Remote control, remote access, or remote desktop–like services. 2) A technology that can allow an automated tool to interact with a human interface, such as extracting information from web pages.

Question 499

What is virtualization?

Answer 499

Technology used to host one or more operating systems within the memory of a single host computer. This mechanism allows virtually any OS to operate on any hardware. It also allows multiple operating systems to work simultaneously on the same hardware.

Question 500

What are the two main forms of DoS?

Answer 500

The first form exploits a vulnerability in hardware or software. This exploitation of a weakness, error, or standard feature of software to cause a system to hang, freeze, consume all system resources, and so on. The end result is that the victimized computer is unable to process any legitimate tasks. The second form floods the victim’s communication pipeline with garbage network traffic. Sometimes called a traffic generation or flooding attack.

Question 501

What is security management planning?

Answer 501

Security management planning ensures proper creation, implementation, and enforcement of a security policy. Security management is a responsibility of upper management, not of the IT staff, and is considered a business operations issue rather than an IT administration issue.

Question 502

What is security governance?

Answer 502

Security governance is the collection of practices related to supporting, defining, and directing the security efforts of an organization. A common goal of organizational governance is to ensure that the organization will continue to exist and will grow or expand over time.

Question 503

What is third-party governance?

Answer 503

Third-party governance is the system of oversight that may be mandated by law, regulation, industry standards, or licensing requirements. The actual method of governance may vary but generally involves an outside investigator or auditor.

Question 504

What is documentation review?

Answer 504

Documentation review is the process of not just reading the exchange materials but verifying it against standards and expectations. The documentation review is typically performed before any on-site inspection is performed.

Question 505

Define the Goguen–Meseguer model.

Answer 505

The Goguen−Meseguer model is an integrity model based on predetermining the set or domain of objects that a subject can access. This model is based on automation theory and domain separation.

Question 506

Define the Sutherland model.

Answer 506

The Sutherland model is an integrity model focused on preventing interference in support of integrity. It is based on the idea of defining a set of system states, initial states, and state transitions. Through the use of and limitations to only these predetermined secure states, integrity is maintained and interference is prohibited.

Question 507

Define the Graham–Denning model.

Answer 507

The Graham–Denning model is focused on the secure creation and deletion of both subjects and objects. Ultimately, it is a collection of eight primary protection rules or actions that define the boundaries of certain secure actions.

Question 508

What are some benefits of virtualization?

Answer 508

Being able to launch individual instances of servers or services as needed, real-time scalability, and being able to run the exact needed OS version for the needed application

Question 509

What is TPM?

Answer 509

Trusted Platform Module (TPM) is a cryptoprocessor chip on a mainboard used to store and process cryptographic keys for the purposes of a hardware-supported or -implemented hard drive encryption system.

Question 510

What is an HSM?

Answer 510

A hardware security module (HSM) is a cryptoprocessor used to manage/store digital encryption keys, accelerate crypto operations, support faster digital signatures, and improve authentication.

Question 511

What is cloud computing?

Answer 511

A concept of computing where processing and storage are performed elsewhere over a network connection rather than locally

Question 512

What are some issues or concerns regarding cloud computing?

Answer 512

Privacy concerns, regulation compliance difficulties, use of open/closed source solutions, adoption of open standards, and whether or not cloud-based data is actually secured (or even securable)

Question 513

What is PaaS?

Answer 513

Platform as a Service (PaaS) is the concept of providing a computing platform and software solution stack as a virtual or cloud-based service.

Question 514

What is SaaS?

Answer 514

Software as a Service (SaaS) is a derivative of Platform as a Service (PaaS). Software as a Service provides on-demand online access to specific software applications or suites without the need for local installation (or even local hardware and OS requirements in many cases).

Question 515

What is IaaS?

Answer 515

Infrastructure as a Service (IaaS) takes the Platform as a Service (PaaS) model another step forward. It provides not just on-demand operating solutions but complete outsourcing options as well. This can include utility or metered computing services, administrative task automation, dynamic scaling, virtualization services, policy implementation and management services, and managed/filtered Internet connectivity.

Question 516

What is grid computing?

Answer 516

Grid computing is a form of parallel distributed processing that loosely groups a significant number of processing nodes toward the completion of a specific processing goal.

Question 517

What is technology convergence?

Answer 517

The tendency for various technologies, solutions, utilities, and systems to evolve and merge over time. Often this results in multiple systems performing similar or redundant tasks or one system taking over the features and abilities of another. While in some instances this can result in improved efficiency and cost savings, it can also be an increased single point of failure and can become a more valuable target for hackers and intruders.

Question 518

Define the aspect of confidentiality known as sensitivity.

Answer 518

Sensitivity refers to the quality of information that could cause harm or damage if disclosed. Maintaining confidentiality of sensitive information helps to prevent harm or damage.

Question 519

Define the aspect of confidentiality known as discretion.

Answer 519

Discretion is an act of decision whereby an operator can influence or control disclosure in order to minimize harm or damage.

Question 520

Define the aspect of confidentiality known as criticality.

Answer 520

The level to which information is mission critical is its measure of criticality. The higher the level of criticality, the more likely the need to maintain the confidentiality of the information. High levels of criticality are essential to the operation or function of an organization.

Question 521

Define the aspect of confidentiality known as concealment.

Answer 521

Concealment is the act of hiding or preventing disclosure. Often concealment is viewed as a means of cover, obfuscation, or distraction.

Question 522

Define the aspect of confidentiality known as secrecy.

Answer 522

Secrecy is the activity of keeping something a secret or preventing the disclosure of information.

Question 523

Define the aspect of confidentiality known as privacy.

Answer 523

Privacy refers to keeping information confidential that is personally identifiable or that might cause harm, embarrassment, or disgrace to someone if revealed.

Question 524

Define the aspect of confidentiality known as seclusion.

Answer 524

Seclusion refers to storing something in an out-of-the-way location. This location can also provide strict access controls. Seclusion can help enforce confidentiality protections.

Question 525

Define the aspect of confidentiality known as isolation.

Answer 525

Isolation is the act of keeping something separated from others. Isolation can be used to prevent co-mingling of information or disclosure of information.

Question 526

What is a business case?

Answer 526

A business case is usually a documented argument or stated position in order to define a need to make a decision or take some form of action. To make a business case is to demonstrate a business-specific need to alter an existing process or choose an approach to a business task. A business case is often made to justify the start of a new project, especially a project related to security. It is also important to consider the budget that can be allocated to a business-need-based security project.

Question 527

What is threat modeling?

Answer 527

Threat modeling is the security process whereby potential threats are identified, categorized, and analyzed. Threat modeling can be performed as a proactive measure during design and development or as a reactive measure once a product has been deployed.

Question 528

What is SD3+C?

Answer 528

Secure by Design, Secure by Default, Secure in Deployment and Communication

Question 529

What are the two goals of SD3+C?

Answer 529

To reduce the number of security-related design and coding defects. To reduce the severity of any remaining defects.

Question 530

Define proactive and reactive threat modeling?

Answer 530

A proactive approach to threat modeling takes place during early stages of systems development, specifically during initial design and specifications establishment. This type of threat modeling is also known as a defensive approach. This method is based on predicting threats and designing in specific defenses during the coding and crafting process rather than relying on post-deployment updates and patches.

A reactive approach to threat modeling takes place after a product has been created and deployed. This deployment could be in a test or laboratory environment or to the general marketplace. This type of threat modeling is also known as the adversarial approach. This technique of threat modeling is the core concept behind ethical hacking, penetration testing, source code review, and fuzz testing.

Question 531

Name the three common approaches to identifying threats.

Answer 531

Focused on assets, focused on attackers, and focused on software.

Question 532

What is STRIDE?

Answer 532

Microsoft developed a threat categorization scheme known as STRIDE. STRIDE is often used in relation to assessing threats against applications or operating systems. However, it can also be used in other contexts as well. STRIDE is an acronym standing for Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege.

Question 533

What is reduction analysis?

Answer 533

Reduction analysis is also known as decomposing the application, system, or environment. The purpose of this task it to gain a greater understanding of the logic of the product as well as its interactions with external elements. Whether an application, a system, or an entire environment, it needs to be divided into smaller containers or compartments.

Question 534

Name three methods to rank and prioritize threats.

Answer 534

Probability * Damage Potential, high/medium/low, or DREAD.

Question 535

What is DREAD?

Answer 535

DREAD is a threat rating system designed to provide a flexible rating solution that is based on asking five main questions of each threat:

Damage potential: How severe is the damage likely to be if the threat is realized?

Reproducibility: How complicated is it for attackers to reproduce the exploit?

Exploitability: How hard is it to perform the attack?

Affected users: How many users are likely to be affected by the attack (as a percentage)?

Discoverability: How hard is it for an attacker to discover the weakness?

Question 536

What is cross-training?

Answer 536

Cross-training is often discussed as an alternative to job rotation. In both cases, workers learn the responsibilities and tasks of multiple job positions. However, in cross-training the workers are just prepared to perform the other job positions; they are not rotated through them on a regular basis. Cross-training enables existing personnel to fill the work gap when the proper employee is unavailable as a type of emergency response procedure.

Question 537

What is compliance?

Answer 537

Compliance is the act of conforming to or adhering to rules, policies, regulations, standards, or requirements. Compliance is an important concern to security governance.

Question 538

What is a risk framework?

Answer 538

A risk framework is a guideline or recipe for how risk is to be assessed, resolved, and monitored.

Question 539

What is FISMA?

Answer 539

The Federal Information Security Management Act (FISMA), passed in 2002, requires that federal agencies implement an information security program that covers the agency’s operations. FISMA also requires that government agencies include the activities of contractors in their security management programs.

Question 540

What is HITECH?

Answer 540

In 2009, Congress amended HIPAA by passing the Health Information Technology for Economic and Clinical Health (HITECH) Act. This law updated many of HIPAA’s privacy and security requirements and was implemented through the HIPAA Omnibus Rule in 2013.

Question 541

What are the parameters of the HITECH data breach notification requirements?

Answer 541

Under the HITECH Breach Notification Rule, HIPAA-covered entities that experience a data breach must notify affected individuals of the breach and must also notify both the Secretary of Health and Human Services and the media when the breach affects more than 500 individuals.

Question 542

What is an early step in asset security?

Answer 542

Classifying and labeling assets.

Question 543

What is sensitive data?

Answer 543

Sensitive data is any information that isn’t public or unclassified. It can include confidential, proprietary, protected, or any other type of data that an organization needs to protect due to its value to the organization or to comply with existing laws and regulations.

Question 544

What is PII?

Answer 544

Personally identifiable information (PII) is any information that can identify an individual.

Question 545

What is PHI?

Answer 545

Protected health information (PHI) is any health-related information that can be related to a specific person. In the US, the Health Insurance Portability and Accountability Act (HIPAA) mandates the protection of PHI.

Question 546

What is proprietary data?

Answer 546

Proprietary data refers to any data that helps an organization maintain a competitive edge. It could be software code it developed, technical plans for products, internal processes, intellectual property, or trade secrets. If competitors are able to access the proprietary data, it can seriously affect the primary mission of an organization.

Question 547

What legal protections exist for proprietary data?

Answer 547

Copyrights, patents, and trade secret laws provide protection for proprietary data.

Question 548

What are the three data states and their definitions?

Answer 548

Data at rest is any data stored on media such as system hard drives, external USB drives, storage area networks (SANs), and backup tapes. Data in transit (sometimes called data in motion) is any data transmitted over a network. This includes data transmitted over an internal network using wired or wireless methods and data transmitted over public networks such as the Internet. Data in use refers to data in temporary storage buffers while an application is using it.

Question 549

When sensitive data is no longer needed by an organization, what should be done with it?

Answer 549

When an organization no longer needs sensitive data, personnel should destroy it. Proper destruction ensures that it cannot fall into the wrong hands and result in unauthorized disclosure.

Question 550

What is data remanence?

Answer 550

Data remanence is the data that remains on a storage device as residual and potentially recoverable data. Using system tools to delete data generally leaves much of the data remaining on the media, and widely available tools can easily undelete it. Even when you use sophisticated tools to overwrite the media, traces of the original data may remain.

Question 551

In relation to storage media, what is erasing?

Answer 551

Erasing media is simply performing a delete operation against a file, a selection of files, or the entire media. In most cases, the deletion or removal process removes only the directory or catalog link to the data. The actual data remains on the drive.

Question 552

In relation to storage media, what is clearing?

Answer 552

Clearing, or overwriting, is a process of preparing media for reuse and assuring that the cleared data cannot be recovered using traditional recovery tools. When media is cleared, unclassified data is written over all addressable locations on the media.

Question 553

In relation to storage media, what is purging?

Answer 553

Purging is a more intense form of clearing that prepares media for reuse in less-secure environments. It provides a level of assurance that the original data is not recoverable using any known methods. A purging process will repeat the clearing process multiple times and may combine it with another method such as degaussing to completely remove the data. Even though purging is intended to remove all data remnants, it isn’t always trusted.

Question 554

In relation to storage media, what is declassification?

Answer 554

Declassification involves any process that purges media or a system in preparation for reuse in an unclassified environment. Purging can be used to prepare media for declassification, but often the efforts required to securely declassify media are significantly greater than the cost of new media for a less-secure environment.

Question 555

In relation to storage media, what is sanitization?

Answer 555

Sanitization is a combination of processes that removes data from a system or from media. It ensures that data cannot be recovered by any means.

Question 556

What is degaussing?

Answer 556

A degausser creates a strong magnetic field that erases data on some media in a process called degaussing. Technicians commonly use degaussing methods to remove data from magnetic tapes with the goal of returning the tape to its original state. While it is possible to degauss hard disks, it is not recommended. Degaussing a hard disk will normally destroy the electronics used to access the data.

Question 557

What are some methods of storage media destruction?

Answer 557

Destruction is the final stage in the life cycle of media and is the most secure method of sanitizing media. When destroying media it’s important to ensure that the media cannot be reused or repaired and that data cannot be extracted from the destroyed media. Methods of destruction include incineration, crushing, shredding, disintegration, and dissolving using caustic or acidic chemicals. Some organizations remove the platters in highly classified disk drives and destroy them separately.

Question 558

What are scoping and tailoring?

Answer 558

Scoping refers to reviewing baseline security controls and selecting only those controls that apply to the IT system you’re trying to protect. Tailoring refers to modifying the list of security controls within a baseline so that they align with the mission of the organization.

Question 559

In 2012, the committee overseeing the development of SHA-3 made what announcement?

Answer 559

In 2012, the federal government design committee announced the selection of the Keccak algorithm as the SHA-3 standard. However as of mid-2015, the SHA-3 standard remains in draft form and some technical details still require finalization.

Question 560

What is DRM?

Answer 560

Digital rights management (DRM) software uses encryption to enforce copyright restrictions on digital media.

Question 561

What is a cryptographic salt and what is it used for?

Answer 561

The cryptographic salt is a random value that is added to the end of the password before the operating system hashes the password. The salt is then stored in the password file along with the hash. It is used to help combat the use of brute-force attacks, including those aided by dictionaries and rainbow tables.

Question 562

What is transitive trust?

Answer 562

Transitive trust is the concept that if A trusts B and B trusts C, then A inherits trust of C through the transitive property, which works like it would in a mathematical equation: if A = B, and B = C, then A = C. In this example, when A requests data from B, then B requests data from C, the data that A receives is essentially from C. Transitive trust is a serious security concern because it may enable bypassing of restrictions or limitations between A and C.

Question 563

What is the purpose of memory protection?

Answer 563

Memory protection is used to prevent an active process from interacting with an area of memory that was not specifically assigned or allocated to it. Memory protection is a core security component that must be designed and implemented into an operating system. It must be enforced regardless of the programs executing in the system. Otherwise instability, violation of integrity, denial of service, and disclosure are likely results.

Question 564

What is flash memory?

Answer 564

Flash memory is a derivative concept from EEPROM. It is a nonvolatile form of storage media that can be electronically erased and rewritten. The primary difference between EEPROM and flash memory is that EEPROM must be fully erased to be rewritten, while flash memory can be erased and written in blocks or pages.

Question 565

What is UEFI?

Answer 565

UEFI (Unified Extensible Firmware Interface) is a more advanced interface (than BIOS) between hardware and the operating system, which maintains support for legacy BIOS services.

Question 566

What is a local cache?

Answer 566

A local cache is anything that is temporarily stored on the client for future reuse. There are many local caches on a typical client, including ARP cache, DNS cache, and Internet files cache.

Question 567

What are two forms of ARP poisoning?

Answer 567

ARP cache poisoning is caused by an attack responding to ARP broadcast queries in order to send back falsified replies. A second form of ARP cache poisoning is to create static ARP entries.

Question 568

What are five examples of DNS poisoning?

Answer 568

HOSTS poisoning, authorized DNS server attack, caching DNS server attack, changing a DNS server address, and DNS query spoofing

Question 569

What is data analytics?

Answer 569

Data analytics is the science of raw data examination with the focus of extracting useful information out of the bulk information set. The results of data analytics could focus on important outliers or exceptions to normal or standard items, a summary of all data items, or some focused extraction and organization of interesting information.

Question 570

What is big data?

Answer 570

Big data refers to collections of data that have become so large that traditional means of analysis or processing are ineffective, inefficient, and insufficient. Big data involves numerous difficult challenges, including collection, storage, analysis, mining, transfer, distribution, and results presentation.

Question 571

What are parallel data systems?

Answer 571

Parallel data systems or parallel computing is a computation system design to perform numerous calculations simultaneously. But parallel data systems often go far beyond basic multiprocessing capabilities. They often include the concept of dividing up a large task into smaller elements, then distributing each subelement to a different processing subsystem for parallel computation. This implementation is based on the idea that some problems can be solved efficiently if they are broken into smaller tasks that can be worked on concurrently.

Question 572

What is an ICS?

Answer 572

An industrial control system (ICS) is a form of computer-management device that controls industrial processes and machines. ICSs are used across a wide range of industries, including manufacturing, fabrication, electricity generation and distribution, water distribution, sewage processing, and oil refining.

Question 573

What are three forms of ICS?

Answer 573

There are several forms of ICS, including distributed control systems (DCS), programmable logic controllers (PLC), and supervisory control and data acquisition (SCADA).

Question 574

Where are DCS systems used and why?

Answer 574

DCS units are typically found in industrial process plans where the need to gather data and implement control over a large-scale environment from a single location is essential. An important aspect of DCS is the controlling elements are distributed across the monitored environment, such as a manufacturing floor or a production line, while the centralized monitoring location sends commands out of those localized controllers while gathering status and performance data.

Question 575

What is a PLC?

Answer 575

Programmable logic controller (PLC) units are effectively single-purpose or focused-purpose digital computers. They are typically deployed for the management and automation of various industrial electromechanical operations, such as controlling systems on an assembly line or a large-scale digital light display.

Question 576

What is SCADA?

Answer 576

Supervisory control and data acquisition (SCADA) systems can operate as a stand-alone device, be networked together with other SCADA systems, or be networked with traditional IT systems. Most SCADA systems are designed with minimal human interfaces. Often, they use mechanical buttons and knobs or simple LCD screen interfaces.

Question 577

Name five generic terms that refer to mobile phones, tablets, and other similar devices.

Answer 577

A device owned by an individual can be referenced using any of these terms: portable device, mobile device, personal mobile device (PMD), personal electronic device or portable electronic device (PED), and personally owned device (POD).

Question 578

What is Android (the OS)?

Answer 578

Android is a mobile device OS based on Linux, which was acquired by Google in 2005. The Android source code is made open source through the Apache license, but most devices also include proprietary software. Although it’s mostly intended for use on phones and tablets, Android is being used on a wide range of devices, including televisions, game consoles, digital cameras, microwaves, watches, e-readers, cordless phones, and ski goggles.

Question 579

What is iOS?

Answer 579

iOS is the mobile device OS from Apple that is available on the iPhone, iPad, iPod, and Apple TV. iOS isn’t licensed for use on any non-Apple hardware. Thus, Apple is in full control of the features and capabilities of iOS.

Question 580

What is remote wiping?

Answer 580

Remote wipe lets you delete all data and possibly even configuration settings from a device remotely. The wipe process can be triggered over mobile phone service or sometimes over any Internet connection.

Question 581

What is storage segmentation on a mobile device?

Answer 581

Storage segmentation is used to artificially compartmentalize various types or values of data on a storage medium. On a mobile device, the device manufacturer and/or the service provider may use storage segmentation to isolate the device’s OS and preinstalled apps from user-installed apps and user data.

Question 582

What is MDM?

Answer 582

Mobile device management (MDM) is a software solution to the challenging task of managing the myriad mobile devices that employees use to access company resources. The goals of MDM are to improve security, provide monitoring, enable remote management, and support troubleshooting. Many MDM solutions support a wide range of devices and can operate across many service providers. You can use MDM to push or remove apps, manage data, and enforce configuration settings both over the air (across a carrier network) and over Wi-Fi connections.

Question 583

What is credential management?

Answer 583

The storage of credentials in a central location is referred to as credential management. Given the wide range of Internet sites and services, each with its own particular logon requirements, it can be a burden to use unique names and passwords. Credential management solutions offer a means to securely store a plethora of credential sets.

Question 584

What is geo-tagging?

Answer 584

Mobile devices with GPS support enable the embedding of geographical location (geo-tagging) in the form of latitude and longitude as well as date/time information on photos taken with these devices.

Question 585

What is application whitelisting?

Answer 585

Application whitelisting is a security option that prohibits unauthorized software from being able to execute. Whitelisting is also known as deny by default or implicit deny. In application security, whitelisting prevents any and all software, including malware, from executing unless it’s on the preapproved exception list: the whitelist.

Question 586

What is BYOD?

Answer 586

Bring-your-own-device (BYOD) is a policy that allows employees to bring their own personal mobile devices to work and use those devices to connect to (or through) the company network to business resources and/or the Internet. Although BYOD may improve employee morale and job satisfaction, it increases security risk to the organization.

Question 587

What is an embedded system?

Answer 587

An embedded system is a computer implemented as part of a larger system. The embedded system is typically designed around a limited set of specific functions in relation to the larger product of which it’s a component. It may consist of the same components found in a typical computer system, or it may be a microcontroller (an integrated chip with on-board memory and peripheral ports). Examples of embedded systems include network-attached printers, smart TVs, HVAC controls, smart appliances, smart thermostats, Ford SYNC (a Microsoft embedded system in vehicles), and medical devices.

Question 588

What is a static system?

Answer 588

A static system or static environment is a set of conditions, events, and surroundings that don’t change. In theory, once understood, a static environment doesn’t offer new or surprising elements. A static IT environment is any system that is intended to remain unchanged by users and administrators. The goal is to prevent or at least reduce the possibility of a user implementing change that could result in reduced security or functional operation.

Question 589

What is a cyber-physical syste

Answer 589

Cyber-physical system is a term used to refer to devices that offer a computational means to control something in the physical world. In the past these might have been referred to as embedded systems, but the category of cyber-physical seems to focus more on the physical world results rather than the computational aspects.

Question 590

What is IoT?

Answer 590

Internet of Things (IoT) is the collection of devices that can communicate over the Internet with each other or with a control console in order to affect and monitor the real world. IoT devices might be labeled as smart devices or smart home equipment.

Question 591

What is DNP3?

Answer 591

DNP3 (Distributed Network Protocol) is a multilayer protocol primarily used in the electric and water utility and management industries. It is used to support communications between data acquisition systems and the system control equipment. DNP3 is an open and public standard. DNP3 is a multilayer protocol that functions similarly to TCP/IP, in that it has link, transport, and transportation layers.

Question 592

What are converged protocols?

Answer 592

Converged protocols are the merging of specialty or proprietary protocols with standard protocols, such as those from the TCP/IP suite. The primary benefit of converged protocols is the ability to use existing TCP/IP supporting network infrastructure to host special or proprietary services without the need for unique deployments of alternate networking hardware. Common examples of converged protocols include FCoE, MPLS, iSCSI, and VOIP.

Question 593

What is FCoE?

Answer 593

Fibre Channel over Ethernet (FCoE) can be used to support Fibre Channel communications over the existing network infrastructure. FCoE is used to encapsulate Fibre Channel communications over Ethernet networks. It typically requires 10 Gbps Ethernet in order to support the Fibre Channel protocol.

Question 594

What is MPLS?

Answer 594

MPLS (multiprotocol label switching) is a high-throughput, high-performance network technology that directs data across a network based on short path labels rather than longer network addresses.

Question 595

What is iSCSI?

Answer 595

Internet Small Computer System Interface (iSCSI) is a networking storage standard based on IP. This technology can be used to enable location-independent file storage, transmission, and retrieval over LAN, WAN, or public Internet connections. iSCSI is often viewed as a low-cost alternative to Fibre Channel.

Question 596

What is VoIP?

Answer 596

Voice over IP (VoIP) is a tunneling mechanism used to transport voice and/or data over a TCP/IP network. VoIP has the potential to replace or supplant PSTN because it’s often less expensive and offers a wider variety of options and features.

Question 597

What is SDN?

Answer 597

Software-defined network (SDN) is a unique approach to network operation, design, and management. SDN aims at separating the infrastructure layer (i.e., hardware and hardware-based settings) from the control layer (i.e., network services of data transmission management). Furthermore, this also removes the traditional networking concepts of IP addressing, subnets, routing, and so on from needing to be programmed into or be deciphered by hosted applications.

Question 598

What is a captive portal?

Answer 598

A captive portal is an authentication technique that redirects a newly connected wireless web client to a portal access control page. The portal page may require the user to input payment information, provide logon credentials, or input an access code

Question 599

What is a site survey?

Answer 599

A site survey is a formal assessment of wireless signal strength, quality, and interference using a RF signal detector. A site survey is performed by placing a wireless base station in a desired location and then collecting signal measurements from the area. The signal measurements are overlaid onto a blueprint of the building to determine whether sufficient signal is present where needed, while minimizing signals outside the desired location.

Question 600

What is a CDN?

Answer 600

A content-distribution network (CDN) or content delivery network is a collection of resource services deployed in numerous data centers across the Internet in order to provide low-latency, high-performance, high-availability of the hosted content.

Question 601

What is port isolation or private ports in relation to VLANs?

Answer 601

These are private VLANs that are configured to use a dedicated or reserved uplink port. The members of a private VLAN or a port isolated VLAN can only interact with each other and over the predetermined exit port or uplink port. A common implementation of port isolation occurs in hotels.

Question 602

What is guest OS?

Answer 602

Virtualization technology is used to host one or more operating systems within the memory of a single host computer. This mechanism allows virtually any OS to operate on any hardware. Such an OS is also known as a guest operating system. From the perspective that there is an original or host OS installed directly on the computer hardware, the additional OSes hosted by the hypervisor system are guests.

Question 603

What is OAuth?

Answer 603

OAuth is an open SSO standard designed to work with HTTP, and it allows users to log on with one account. For example, users can log onto their Google account and use the same account to access Facebook and Twitter pages.

Question 604

What is OpenID?

Answer 604

OpenID is also an open SSO standard but it is maintained by the OpenID Foundation rather than as an IETF RFC standard. OpenID can be used in conjunction with OAuth or on its own.

Question 605

What is IDaaS?

Answer 605

Identity as a Service, or Identity and Access as a Service (IDaaS), is a third-party service that provides identity and access management. IDaaS effectively provides SSO for the cloud and is especially useful when internal clients access cloud-based Software as a Service (SaaS) applications.

Question 606

What is ABAC?

Answer 606

An advanced implementation of a rule-BAC is an attribute-based access control (ABAC) model. ABAC models use policies that include multiple attributes for rules. Many software-defined networking applications use ABAC models.

Question 607

What is a security test for?

Answer 607

Security tests verify that a control is functioning properly. These tests include automated scans, tool-assisted penetration tests, and manual attempts to undermine security.

Question 608

What is a security assessment?

Answer 608

Security assessments are comprehensive reviews of the security of a system, application, or other tested environment. During a security assessment, a trained information security professional performs a risk assessment that identifies vulnerabilities in the tested environment that may allow a compromise and makes recommendations for remediation as needed.

Question 609

What is a security audit?

Answer 609

Security audits use many of the same techniques followed during security assessments but must be performed by independent auditors.

Question 610

What are vulnerability scans?

Answer 610

Vulnerability scans automatically probe systems, applications, and networks looking for weaknesses that may be exploited by an attacker. The scanning tools used in these tests provide quick, point-and-click tests that perform otherwise tedious tasks without requiring manual intervention.

Question 611

What is nmap?

Answer 611

The most common tool used for network discovery scanning is an open source tool called nmap. Originally released in 1997, nmap is remarkably still maintained and in general use today. It remains one of the most popular network security tools, and almost every security professional either uses nmap regularly or used it at some point in their career.

Question 612

What are network vulnerability scans?

Answer 612

Network vulnerability scans go deeper than discovery scans. They don’t stop with detecting open ports but continue on to actually probe a targeted system or network for the presence of known vulnerabilities. These tools contain databases of thousands of known vulnerabilities along with tests they can perform to identify whether a system is susceptible to each vulnerability in the system’s database.

Question 613

What is a false positive?

Answer 613

When the scanner tests a system for vulnerabilities, it uses the tests in its database to determine whether a system may contain the vulnerability. In some cases, the scanner may not have enough information to conclusively determine that a vulnerability exists and it reports a vulnerability when there really is no problem. This situation is known as a false positive report and is sometimes seen as a nuisance to system administrators.

Question 614

What is a false negative?

Answer 614

Far more dangerous than a false positive is when the vulnerability scanner misses a vulnerability and fails to alert the administrator to the presence of a dangerous situation. This error is known as a false negative report.

Question 615

What are web vulnerability scanners?

Answer 615

Web vulnerability scanners are special-purpose tools that scour web applications for known vulnerabilities. They play an important role in any security testing program because they may discover flaws not visible to network vulnerability scanners. When an administrator runs a web application scan, the tool probes the web application using automated techniques that manipulate inputs and other parameters to identify web vulnerabilities.

Question 616

What is a penetration test?

Answer 616

The penetration test goes beyond vulnerability testing techniques because it actually attempts to exploit systems. Security professionals performing penetration tests actually try to defeat security controls and break into a targeted system or application to demonstrate the flaw.

Question 617

What is Nessus?

Answer 617

An example of a vulnerability scanner.

Question 618

What is Metasploit?

Answer 618

A penetration testing tool used to automatically execute exploits against targeted systems. Metasploit uses a scripting language to allow the automatic execution of common attacks, saving testers (and hackers!) quite a bit of time by eliminating many of the tedious, routine steps involved in executing an attack.

Question 619

What is code review?

Answer 619

Code review is the foundation of software assessment programs. During a code review, also known as a peer review, developers other than the one who wrote the code review it for defects. Code reviews may result in approval of an application’s move into a production environment or they may send the code back to the original developer with recommendations for rework of issues detected during the review.

Question 620

The Fagan code review process has six steps. Name them.

Answer 620

Planning

Overview

Preparation

Inspection

Rework

Follow-up

Question 621

What is static testing?

Answer 621

Static testing evaluates the security of software without running it by analyzing either the source code or the compiled application. Static analysis usually involves the use of automated tools designed to detect common software flaws, such as buffer overflows.

Question 622

What is dynamic testing?

Answer 622

Dynamic testing evaluates the security of software in a runtime environment and is often the only option for organizations deploying applications written by someone else. In those cases, testers often do not have access to the underlying source code.

Question 623

What are synthetic transactions?

Answer 623

Dynamic testing may include the use of synthetic transactions to verify system performance. These are scripted transactions with known expected results. The testers run the synthetic transactions against the tested code and then compare the output of the transactions to the expected state.

Question 624

What is fuzz testing?

Answer 624

Fuzz testing is a specialized dynamic testing technique that provides many different types of input to software to stress its limits and find previously undetected flaws. Fuzz testing software supplies invalid input to the software, either randomly generated or specially crafted to trigger known software vulnerabilities.

Question 625

Name two types of fuzz testing.

Answer 625

Mutation (dumb) fuzzing takes previous input values from actual operation of the software and manipulates (or mutates) it to create fuzzed input. It might alter the characters of the content, append strings to the end of the content, or perform other data manipulation techniques.

Generational (intelligent) fuzzing develops data models and creates new fuzzed input based on an understanding of the types of data used by the program.

Question 626

What is the zzuf tool used for?

Answer 626

The zzuf tool automates the process of mutation fuzzing by manipulating input according to user specifications.

Question 627

What is interface testing?

Answer 627

Interface testing assesses the performance of modules against the interface specifications to ensure that they will work together properly when all of the development efforts are complete.

Question 628

What is misuse case testing?

Answer 628

In some applications, there are clear examples of ways that software users might attempt to misuse the application. Software testers use a process known as misuse case testing or abuse case testing to evaluate the vulnerability of their software to these known risks.

Question 629

What is test coverage analysis?

Answer 629

While testing is an important part of any software development process, it is unfortunately impossible to completely test any piece of software. There are simply too many ways that software might malfunction or undergo attack. Software testing professionals often conduct a test coverage analysis to estimate the degree of testing conducted against the new software.

Question 630

Security managers should monitor key performance and risk indicators on an ongoing basis. Name some potential examples of metrics that should be monitored.

Answer 630

Number of open vulnerabilities

Time to resolve vulnerabilities

Number of compromised accounts

Number of software flaws detected in preproduction scanning

Repeat audit findings

User attempts to visit known malicious sites

Question 631

What is entitlement?

Answer 631

Entitlement refers to the amount of privileges granted to users, typically when first provisioning an account.

Question 632

What is segregation of duties?

Answer 632

Segregation of duties is similar to a separation of duties and responsibilities policy, but it also combines the principle of least privilege. The goal is to ensure that individuals do not have excessive system access that may result in a conflict of interest.

Question 633

What is two-person control?

Answer 633

Two-person control (often called the two-man rule) is similar to segregation of duties. It requires the approval of two individuals for critical tasks.

Question 634

What is versioning?

Answer 634

Versioning typically refers to version control used in software configuration management. A labeling or numbering system differentiates between different software sets and configurations across multiple machines or at different points in time on a single machine.

Question 635

What is CVE?

Answer 635

Vulnerabilities are commonly referred to using the Common Vulnerability and Exposures (CVE) dictionary. The CVE dictionary provides a standard convention used to identify vulnerabilities. MITRE maintains the CVE database, and you can view it here .

Question 636

What is DDoS?

Answer 636

A distributed denial of service (DDoS) attack occurs when multiple systems attack a single system at the same time.

Question 637

What is DRDoS?

Answer 637

A distributed reflective denial of service (DRDoS) attack is a variant of a DoS. It uses a reflected approach to an attack. In other words, it doesn’t attack the victim directly but instead manipulates traffic or a network service so that the attacks are reflected back to the victim from other sources

Question 638

What is a ping flood?

Answer 638

A ping flood attack floods a victim with ping requests. This can be very effective when launched by zombies within a botnet as a DDoS attack. If tens of thousands of systems simultaneously send ping requests to a system, the system can be overwhelmed trying to answer the ping requests.

Question 639

What is a drive-by download?

Answer 639

A drive-by download is code downloaded and installed on a user’s system without the user’s knowledge. Attackers modify the code on a web page, and when the user visits, the code downloads and installs malware on the user’s system without the user’s knowledge or consent.

Question 640

What is war dialing?

Answer 640

War dialing means using a modem to search for a system that accepts inbound connection attempts.

Question 641

What is a honeypot or a honeynet?

Answer 641

A honeypot is an individual computer created as a trap for intruders. A honeynet is two or more networked honeypots used together to simulate a network. They look and act like legitimate systems, but they do not host data of any real value for an attacker.

Question 642

What is a pseudo flaw?

Answer 642

A pseudo flaw is a false vulnerability or apparent loophole intentionally implanted in a system in an attempt to tempt attackers. They are often used on honeypot systems to emulate well-known operating system vulnerabilities.

Question 643

What is a padded cell?

Answer 643

A padded cell system is similar to a honeypot, but it performs intrusion isolation using a different approach. When an IDS detects an intruder, that intruder is automatically transferred to a padded cell.

Question 644

What is sandboxing?

Answer 644

Sandboxing provides a security boundary for applications and prevents the application from interacting with other applications. Anti-malware applications use sandboxing techniques to test unknown applications. If the application displays suspicious characteristics, the sandboxing technique prevents the application from infecting other applications or the operating system.

Question 645

Many organizations use a centralized application to automate monitoring of systems on a network. Name three terms that refer to these types of systems.

Answer 645

Security Information and Event Management (SIEM), Security Event Management (SEM), and Security Information Management (SIM)

Question 646

In relation to auditing and monitoring, what is sampling?

Answer 646

Sampling, or data extraction, is the process of extracting specific elements from a large collection of data to construct a meaningful representation or summary of the whole. In other words, sampling is a form of data reduction that allows someone to glean valuable information by looking at only a small sample of data in an audit trail.

Question 647

What is egress monitoring?

Answer 647

Egress monitoring refers to monitoring outgoing traffic to prevent data exfiltration, which is the unauthorized transfer of data. Some common methods used to prevent data exfiltration are data loss prevention techniques, looking for steganography attempts, and watermarking.

Question 648

What is DLP?

Answer 648

Data loss prevention (DLP) systems attempt to detect and block data exfiltration attempts. These systems have the capability of scanning data looking for keywords and data patterns.

Question 649

Name two common types of DLP.

Answer 649

A network-based DLP scans all outgoing data looking for specific data. An endpoint-based DLP can scan files stored on a system and files sent to external devices.

Question 650

What is steganography?

Answer 650

Steganography is the practice of embedding a message within a file.

Question 651

What is watermarking?

Answer 651

Watermarking is the practice of embedding an image or pattern in paper that isn’t readily perceivable. It is often used with currency to thwart counterfeiting attempts. Similarly, organizations often use watermarking in digital documents and other types of files.

Question 652

What is system resilience?

Answer 652

System resilience refers to the ability of a system to maintain an acceptable level of service during an adverse event. This could be a hardware fault managed by fault-tolerant components, or it could be an attack managed by other controls such as effective intrusion detection and prevention systems.

Question 653

What is a failover cluster?

Answer 653

A failover cluster includes two or more servers, and if one of the servers fails, another server in the cluster can take over its load in an automatic process called failover. Failover clusters can include multiple servers (not just two), and they can also provide fault tolerance for multiple services or applications.

Question 654

Define a fail-secure system.

Answer 654

A fail-secure system will default to a secure state in the event of a failure, blocking all access

Question 655

Define a fail-open system.

Answer 655

A fail-open system will fail in an open state, granting all access.

Question 656

What use is QoS?

Answer 656

Quality of Service (QoS) controls protect the integrity of data networks under load. Many different factors contribute to the quality of the end user experience, and QoS attempts to manage all of those factors to create an experience that meets business requirements.

Question 657

What does an operational investigation focus on?

Answer 657

An operational investigation examines issues related to the organization’s computing infrastructure and has the primary goal of resolving operational issues.

Question 658

What does a criminal investigation focus on?

Answer 658

A criminal investigation, typically conducted by law enforcement personnel, investigates the alleged violation of criminal law. A criminal investigation may result in charging suspects with a crime and the prosecution of those charges in criminal court.

Question 659

What does a civil investigation focus on?

Answer 659

A civil investigation typically does not involve law enforcement but rather involves internal employees and outside consultants working on behalf of a legal team. It prepares the evidence necessary to present a case in civil court resolving a dispute between two parties.

Question 660

What is electronic discovery?

Answer 660

In legal proceedings, each side has a duty to preserve evidence related to the case and, through the discovery process, share information with their adversary in the proceedings. This discovery process applies to both paper records and electronic records, and the electronic discovery (or eDiscovery) process facilitates the processing of electronic information for disclosure.

Question 661

What is an APT?

Answer 661

Recent years marked the rise of sophisticated attackers known as advanced persistent threats (APTs). These attackers are well funded and have advanced technical skills and resources. They act on behalf of a nation-state, organized crime, terrorist group, or other sponsor and wage highly effective attacks against a very focused target in order to maintain persistent unauthorized access or effect.

Question 662

What does a business attack focus on?

Answer 662

A business attack focuses on illegally obtaining an organization’s confidential information. This could be information that is critical to the operation of the organization, such as a secret recipe, or information that could damage the organization’s reputation if disclosed, such as personal information about its employees.

Question 663

What is industrial espionage?

Answer 663

The gathering of a competitor’s confidential information, also called industrial espionage, is not a new phenomenon. Businesses have used illegal means to acquire competitive information for many years. The temptation to steal a competitor’s trade secrets and the ease with which a savvy attacker can compromise some computer systems makes this type of attack attractive.

Question 664

What are financial attacks?

Answer 664

Financial attacks are carried out to unlawfully obtain money or services. They are the type of computer crime you most commonly hear about in the news. The goal of a financial attack could be to steal credit card numbers, increase the balance in a bank account, or place “free” long-distance telephone calls.

Question 665

What are terrorist attacks?

Answer 665

Terrorist attacks are a reality in modern society. Our increasing reliance on information systems makes them more and more attractive to terrorists. Such attacks differ from military and intelligence attacks. The purpose of a terrorist attack is to disrupt normal life and instill fear, whereas a military or intelligence attack is designed to extract secret information.

Question 666

What are grudge attacks?

Answer 666

Grudge attacks are attacks that are carried out to damage an organization or a person. The damage could be in the loss of information or information processing capabilities or harm to the organization or a person’s reputation.

Question 667

What are thrill attacks?

Answer 667

Thrill attacks are the attacks launched only for the fun of it.

Question 668

What are scanning attacks?

Answer 668

Scanning attacks are reconnaissance attacks that usually precede another, more serious attack.

Question 669

What is the purpose of assurance procedures?

Answer 669

To ensure that the security control mechanisms built into a new application properly implement the security policy throughout the life cycle of the system

Question 670

What is DevOps?

Answer 670

The word DevOps is a combination of Development and Operations, symbolizing that these functions must merge and cooperate to meet business requirements. The DevOps approach seeks to resolve these issues by bringing the three functions (software development, quality assurance, and technology operations) together in a single operational model.

Question 671

What is an API?

Answer 671

An application programming interface (API) allows application developers to bypass traditional web pages and interact directly with the underlying service through function calls.

Question 672

What is a code repository?

Answer 672

It acts as a central storage point for developers to place their source code. It may also provide version control, bug tracking, web hosting, release management, and communications functions that support software development.

Question 673

What type of website monitoring technique is only able to detect issues after they occur?

Answer 673

Passive monitoring

Question 674

What type of website monitoring technique executes artificial transactions against the site?

Answer 674

Synthetic monitoring (or active monitoring)

Question 675

What is the most common open source database vulnerability scanner?

Answer 675

sqlmap

Question 676

What are the four components covered by assessments under NIST 800-53A?

Answer 676

Specifications, mechanisms, activities, and individuals

Question 677

What is the minimum timeframe covered by an SSAE 16 or SSAE 18 Type II report?

Answer 677

Six months

Question 678

What SCAP component provides a standardized scoring system for describing the severity of security vulnerabilities?

Answer 678

Common Vulnerability Scoring System (CVSS)

Question 679

What are the three major characteristics of a functional requirement?

Answer 679

Inputs, behaviors, and outputsw

Question 680

Administrators are removing all data from data records that can be used to identify an individual. What is this process called?

Answer 680

Anonymisation (or anonymization)

Question 681

Administrators are replacing all data in data records that can be used to identify an individual with pseudonyms. What is this process called?

Answer 681

Pseudonymisation (or pseudonymization)

Question 682

What is the GDPR?

Answer 682

The European Union (EU) General Data Protection Regulation (GDPR). It replaced the EU Data Protection Directive, and it regulates the transfer of personal data in and out of the EU.

Question 683

What is context-aware authentication?

Answer 683

An authentication method often used by mobile device management (MDM) systems to identify mobile device users. It includes multiple elements such as the location of the user, the time of day, and the mobile device.

Question 684

Where are you most likely to see an ABAC model?

Answer 684

An attribute-based access control (ABAC) model is typically implemented in software defined networks (SDNs).

Question 685

What type of attack is thwarted with the use of bcrypt?

Answer 685

Rainbow table attacks. Bcrypt salts passwords.

Question 686

What is the purpose of a cryptographic pepper?

Answer 686

A pepper can be added to a salt to add additional protection for passwords.

Question 687

What is the purpose of a cryptographic salt?

Answer 687

A salt adds extra bits to a password before hashing it to protect against rainbow table attacks.

Question 688

What type of VDI maintains a user’s desktop changes?

Answer 688

A persistent virtual desktop infrastructure (VDI) maintains user desktop changes.

Question 689

What is a hybrid cloud?

Answer 689

A combination of two or more private, public, and/or community clouds

Question 690

What are the 5 elements of an AAA service?

Answer 690

Identification, authentication, authorization, auditing, and accounting

Question 691

Define Sensitive But Unclassified (SBU)?

Answer 691

Sensitive But Unclassified (SBU) is used for data that is for internal use or office use only. Often SBU is used to protect information that could violate the privacy rights of individuals.

Question 692

What are the seven elements of PASTA (Process for Attack Simulation and Threat Analysis)?

Answer 692

Stage I is Definition the Objectives (DO) for the Analysis of Risks, Stage II is Definition of the Technical Scope (DTS), Stage III is Application Decomposition and Analysis (ADA), Stage IV is Threat Analysis (TA), Stage V is Weakness and Vulnerability Analysis (WVA), Stage VI is Attack Modeling & Simulation (AMS), and Stage VII is Risk Analysis & Management (RAM).

Question 693

What is Trike?

Answer 693

Trike is another threat modeling methodology that focuses on a risk-based approach instead of depending upon the aggregated threat model used in STRIDE and DREAD. Trike provides a method of performing a security audit in a reliable and repeatable procedure. It also provides a consistent framework for communication and collaboration among security workers.

Question 694

What is VAST?

Answer 694

VAST (Visual, Agile, and Simple Threat) is a threat modeling concept based on Agile project management and programming principles. The goal of VAST is to integrate threat and risk management into an Agile programming environment on a scalable basis.

Question 695

What is onboarding?

Answer 695

Onboarding is the process of adding new employees to the identity and access management (IAM) system of an organization. The onboarding process is also used when an employee’s role or position changes or when that person is awarded additional levels of privilege or access.

Question 696

What is offboarding?

Answer 696

Offboarding is the reverse of this process. It is the removal of an employee’s identity from the identity and access management (IAM) system once that person has left the organization.

Question 697

What is risk deterrence?

Answer 697

Risk deterrence is the process of implementing deterrents to would-be violators of security and policy. Some examples include implementation of auditing, security cameras, security guards, instructional signage, warning banners, motion detectors, strong authentication, and making it known that the organization is willing to cooperate with authorities and prosecute those who participate in cybercrime.

Question 698

What is risk avoidance?

Answer 698

Risk avoidance is the process of selecting alternate options or activities that have less associated risk than the default, common, expedient, or cheap option. For example, choosing to fly to a destination instead of drive is a form of risk avoidance. Another example is to locate a business in Arizona instead of Florida to avoid hurricanes.

Question 699

Define Security Control Assessment (SCA).

Answer 699

A Security Control Assessment (SCA) is the formal evaluation of a security infrastructure’s individual mechanisms against a baseline or reliability expectation. The SCA can be performed in addition to or independently of a full security evaluation, such as a penetration test or vulnerability assessment.

Question 700

What is split-DNS?

Answer 700

What is split-DNS?

Question 701

What ports are used by DNS and for what purposes?

Answer 701

TCP 53 is used for zone transfers (which includes most DNS server to DNS server communications), and UDP 53 is used for queries (which is any non-DNS system sending a query to a DNS server).

Question 702

What the two types of hypervisors?

Answer 702

A type I hypervisor is a native or bare-metal hypervisor. In this configuration, there is no host OS; instead, the hypervisor installs directly onto the hardware where the host OS would normally reside. A type II hypervisor is a hosted hypervisor. In this configuration, a standard regular OS is present on the hardware, and then the hypervisor is installed as another software application.

Question 703

What is cloud storage?

Answer 703

Cloud storage is the idea of using storage capacity provided by a cloud vendor as a means to host data files for an organization. Cloud storage can be used as form of backup or support for online data services. Cloud storage may be cost effective, but it is not always high speed or low latency.

Question 704

Define on-premise solution.

Answer 704

An on-premise solution is the traditional deployment concept in which an organization owns the hardware, licenses the software, and operates and maintains the systems on its own usually within their own building.

Question 705

Define hosted solution.

Answer 705

A hosted solution is a deployment concept where the organization must license software and then operates and maintains the software. The hosting provider owns, operates, and maintains the hardware that supports the organization’s software.

Question 706

Define cloud solution.

Answer 706

A cloud solution is a deployment concept where an organization contracts with a third-party cloud provider. The cloud provider owns, operates, and maintains the hardware and software. The organization pays a monthly fee (often based on a per-user multiplier) to use the cloud solution.

Question 707

What is a private cloud?

Answer 707

A private cloud is a cloud service within a corporate network and isolated from the Internet.

Question 708

What is a public cloud?

Answer 708

A public cloud is a cloud service that is accessible to the general public, typically over an Internet connection. Public cloud services may require some form of subscription or pay per use or may be offered for free.

Question 709

What is a hybrid cloud?

Answer 709

A hybrid cloud is a mixture of private and public cloud components.

Question 710

What is a community cloud?

Answer 710

A community cloud is a cloud environment maintained, used, and paid for by a group of users or organizations for their shared benefit, such as collaboration and data exchange. This may allow for some cost savings compared to accessing private or public clouds independently.

Question 711

What are snapshots?

Answer 711

Snapshots are backups of virtual machines. They offer a quick means to recover from errors or poor updates. It’s often easier and faster to make backups of entire virtual systems rather than the equivalent native hardware installed system.

Question 712

What is a cloud access security broker (CASB)?

Answer 712

A cloud access security broker (CASB) is a security policy enforcement solution that may be installed on-premises, or it may be cloud-based. The goal of a CASB is to enforce and ensure that proper security measures are implemented between a cloud solution and a customer organization.

Question 713

What is Security as a Service (SECaaS)?

Answer 713

Security as a Service (SECaaS) is a cloud provider concept in which security is provided to an organization through or by an online entity. The purpose of an SECaaS solution is to reduce the cost and overhead of implementing and managing security locally.

Question 714

What is the cloud shared responsibility model?

Answer 714

The cloud shared responsibility model is the concept that when an organization uses a cloud solution, there is a division of security and stability responsibility between the provider and the customer. The different forms of cloud service (such as SaaS, PaaS, and IaaS) may each have different levels or division points of shared responsibility.

Question 715

What is a smart device?

Answer 715

Smart devices are a range of mobile devices that offer the user a plethora of customization options, typically through installing apps, and may take advantage of on-device or in-the-cloud artificial intelligence (AI) processing.

Question 716

What is IoT?

Answer 716

The Internet of Things (IoT) is a new subcategory or even a new class of smart devices that are Internet-connected in order to provide automation, remote control, or AI processing to traditional or new appliances or devices in a home or office setting.

Question 717

Define COPE.

Answer 717

The concept of COPE (company-owned, personally enabled) is for the organization to purchase devices and provide them to employees. Each user is then able to customize the device and use it for both work activities and personal activities.

Question 718

Define CYOD.

Answer 718

The concept of CYOD (choose your own device) provides users with a list of approved devices from which to select the device to implement. A CYOD can be implemented so that employees purchase their own devices from the approved list (a BYOD variant) or the company can purchase the devices for the employees (a COPE variant).

Question 719

Describe the concept of a corporate-owned mobile strategy.

Answer 719

A corporate-owned mobile strategy is when the company purchases the mobile devices that can support security compliance with the security policy. These devices are to be used exclusively for company purposes, and users should not perform any personal tasks on the devices. This often requires workers to carry a second device for personal use.

Question 720

What is VDI?

Answer 720

Virtual desktop infrastructure (VDI) is a means to reduce the security risk and performance requirements of end devices by hosting virtual machines on central servers that are remotely accessed by users. It is a means to retain storage control on central servers, gain access to higher levels of system processing and other resources, and allow lower-end devices access to software and services behind their hardware’s capacity.

Question 721

What is VMI?

Answer 721

Virtual mobile infrastructure (VMI) is a technology where the operating system of a mobile device is virtualized on a central server. Thus most of the actions and activities of the traditional mobile device are no longer occurring on the mobile device itself. This remote virtualization allows an organization greater control and security than when using a standard mobile device platform.

Question 722

What does a cable plant management policy address?

Answer 722

A cable plant is the collection of interconnected cables and intermediary devices (such as cross-connects, patch panels, and switches) that establish the physical network. Elements of a cable plant include entrance facility, equipment room, backbone distribution system, telecommunications room, and horizontal distribution system.

Question 723

What is a Faraday cage?

Answer 723

A Faraday cage is EM blocking enclosure, often a wire mesh that fully surrounds an area on all sides. This metal skin acts as an EMI absorbing capacitor (which is why it’s named after Michael Faraday, a pioneer in the field of electromagnetism) that prevents electromagnetic signals (emanations) from exiting or entering the area that the cage encloses.

Question 724

What is white noise (as related to EMI)?

Answer 724

White noise simply means broadcasting false traffic at all times to mask and hide the presence of real emanations.

Question 725

When a domain name is registered, where and how is it stored?

Answer 725

A fully qualified domain names (FQDN) consists of three main parts: top-level domain (TLD), like the com in www.google.com; registered domain name, like the google in www.google.com; and subdomain(s) or hostname, like the www in www.google.com.

Question 726

When a domain name is registered, where and how is it stored?

Answer 726

Every registered domain name has an assigned authoritative name server. The primary authoritative name server hosts the original zone file for the domain. Secondary authoritative name servers can be used to host read-only copies of the zone file. A zone file is the collection of resource records or details about the specific domain. There are dozens of possible resource records.

Question 727

What is DNSSEC?

Answer 727

DNSSEC (Domain Name System Security Extensions) is a security improvement to the existing DNS infrastructure. The primary function of DNSSEC is to provide reliable authentication between devices during DNS operations. DNSSEC has been implemented across a significant portion of the DNS system. Each DNS server is issued a digital certificate, which is then used to perform mutual certificate authentication.

Question 728

What is DNS poisoning?

Answer 728

DNS poisoning is the act of falsifying the DNS information used by a client to reach a desired system. It can take place in many ways.

Question 729

What are some of the means for a DNS poisoning or attack to occur?

Answer 729

Rogue DNS server, planting false data in zone file, altering the HOSTS file, and corrupting IP configuration to change DNS lookup server address.

Question 730

What is DNS pharming?

Answer 730

DNS pharming is the malicious redirection of a valid website’s URL or IP address to a fake website that hosts a false version of the original valid site. This is often part of a phishing attack where the attacker is attempting to trick victims into giving up their logon credentials.

Question 731

What is domain hijacking?

Answer 731

Domain hijacking, or domain theft, is the malicious action of changing the registration of a domain name without the authorization of the valid owner. This may be accomplished by stealing the owner’s logon credentials; using XSRF, session hijacking, or MitM; or exploiting a flaw in the domain registrar’s systems.

Question 732

What is the WiFi attack known as KRACK?

Answer 732

In late 2017, a concept of attack known as KRACK (Key Reinstallation AttaCKs) was disclosed that is able to corrupt the initial four-way handshake between client and WAP into reusing a previously used key and in some cases use a key composed of only zeros.

Question 733

What is WPS?

Answer 733

WiFi Protected Setup (WPS) is a security standard for wireless networks. It is intended to simplify the effort involved in adding new clients to a well-secured wireless network. It operates by autoconnecting the first new wireless client to seek the network once the administrator triggered the feature by pressing the WPS button on the base station.

Question 734

What is war chalking?

Answer 734

War chalking is a type of geek graffiti that some wireless hackers used during the early years of wireless (1997–2002). It’s a way to physically mark an area with information about the presence of a wireless network.

Question 735

What is RFID?

Answer 735

RFID (Radio Frequency Identification) is a tracking technology based on the ability to power a radio transmitter using current generated in an antenna when placed in a magnetic field. RFID can be triggered/powered and read from a considerable distance away (often hundreds of meters).

Question 736

What is the evil twin attack?

Answer 736

Evil twin is an attack in which a hacker operates a false access point that will automatically clone, or twin, the identity of an access point based on a client device’s request to connect.

Question 737

What is NFC?

Answer 737

Near field communication (NFC) is a standard that establishes radio communications between devices in close proximity. It lets you perform a type of automatic synchronization and association between devices by touching them together or bringing them within inches of each other.

Question 738

What is SRTP?

Answer 738

SRTP (Secure Real-Time Transport Protocol, or Secure RTP) is a security improvement over RTP (Real-Time Transport Protocol) that is used in many VoIP (Voice over IP) communications. SRTP aims to minimize the risk of VoIP DoS through robust encryption and reliable authentication.

Question 739

What is Opportunistic TLS?

Answer 739

Opportunistic TLS for SMTP will attempt to set up an encrypted connection with every other email server in the event that it is supported; otherwise, it will downgrade to plaintext. Using opportunistic TLS for SMTP gateways reduces the opportunities for casual sniffing of email.

Question 740

What is a broadcast storm?

Answer 740

A broadcast storm is a flood of unwanted Ethernet broadcast network traffic.

Question 741

What is VM escaping?

Answer 741

VM escaping occurs when software within a guest OS is able to breach the isolation protection provided by the hypervisor in order to violate the container of other guest OSs or to infiltrate a host OS.