Term Test 1 Flashcards Preview

Intro to Computer Security Final > Term Test 1 > Flashcards

Flashcards in Term Test 1 Deck (79):
1

Which of the following contains the primary goals and objectives of security?
A. A network's border perimeter
B. The CIA Triad
C. A stand-alone system
D. The Internet

B. The CIA Triad

2

__________ refers to keeping information confidential that is personally identifiable or which might cause harm, embarrassment, or disgrace to someone if revealed.
A. Seclusion
B. Concealment
C. Privacy
D. Criticality

C. Priv1acy

3

Which of the following is NOT considered a violation of confidentiality?
A. Stealing passwords
B Eavesdropping
C. Hardware destruction
D. Social engineering

C. Hardware destruction

4

If a security mechanism offers availability, then it offers a high level of assurance that authorized subjects can ___________ the data, objects, and resources.
A. Control
B. Audit
C. Access
D. Repudiate

C.. Access

5

What element of data categorization management can override all other forms of access control?
A. Classification
B. Physical access
C. Custodian responsibilities
D. Taking ownership

D. Taking ownership

6

What is the primary goal of change management?
A. Maintaining documentation
B. Keeping users informed of changes
C. Allowing rollback of failed changes
D. Preventing security compromises

D. Preventing security compromises

7

What are the two common data classification schemes?
A. Military and private sector
B. Personal and government
C. Private sector and unrestricted sector
D. Classified and unclassified

A. Military and private sector

8

data classifications are used to focus security controls over all but which of the following?
A. Storage
B. Processing
C. Layering
D. Transfer

C. Layering

9

Which of the folowing is not ocnsidered an example of data hiding?
A. Preventing an authorized reader of an object from deleting that object
B. Keeping a database from being asccessed by unauthorized visitors
C. Restricting a subject at a lower classfication level from accessing data at a higher classification level
D. Preventing an application from acessing hardware directly

A. Preventing an authorized reader of an object from deleting that object

10

Which of the following is the weakest element in any security solution?
A.Software products
B. Internet connections
C. Security policies
D. Humans

D. Humans

11

What is the first step that individiuals responsible for the development of a business continuity plan should perform?
A. BCP team selction
B. Business organization analysis
C. Resource requirements analysis
D. Legal and regulatory assessment

B. Business organization analysis

12

Which one of the followiing BIA terms identifies the amount of money a business expects to lose to a given risk each year?
A. ARO
B. SLE
C. ALE
D. EF

C. ALE

13

You are concerned about the risk that an avalanche poses to your $3 million shipping facility. Based on expert opinion, you determine that there is a 5 percent chance that an avalanche will occur each year. Experts advise you that an avalanche would completely destroy your building and require you to rebuild on the same land. Ninety percent of the $3 million value of the facility is attributed to the building and 10 percent is attributed to the land itself. What is the single loss expectancy of your shipping facility to avalanches?

A. $3,000,000
B. $2,700,000
C. $270,000
D. $135,000

B. $2,700,000

14

You are concerned about the risk that a hurricane poses to your corporate headquarters in South Florida. The building itself is valued at $15 million. After consulting with the National Weather Service, you determine that there is a 10 percent likelihood that a hurricane will strike over the course of a year. You hired a team of architects and engineers who determined that the average hurricane would destroy approximately 50 percent of the building. What is the annualized loss expectancy (ALE)?

A. $750,000
B. $1.5 million
C. $7.5 million
D. $15 million

A. $750,000

15

Which task of BCP bridges the gap between the business impact assessment and the continuity planning phases?

A. Resource prioritization
B. Likelihood assessment
C. Strategy development
D. Provisions and processes

C. Strategy development

The strategy development task bridges the gap between business impact assessment and continuity planning by analyzing the prioritized list of risks developed during the BIA and determining which risks will be addressed by the BCP.

16

Which resource should you protect first when designing continuity plan provisions and processes?

A. Physical plant
B. Infrastructure
C. Financial
D. People

D. People

17

Lighter Than Air Industries expects that it would lose $10 million if a tornado struck its aircraft operations facility. It expects that a tornado might strike the facility once every 100 years. What is the single loss expectancy for this scenario?

A. 0.01
B. $10,000,000
C. $100,000
D. 0.10

B. $10,000,000

18

In which business continuity planning task would you actually design procedures and mechanisms to mitigate risks deemed unacceptable by the BCP team?

A. Strategy development
B. Business impact assessment
C. Provisions and processes
D. Resource prioritization

C. Provisions and processes

In the provisions and processes phase, the BCP team actually designs the procedures and mechanisms to mitigate risks that were deemed unacceptable during the strategy development phase.

19

What type of plan outlines the procedures to follow when a disaster interrupts the normal operations of a business?

A. Business continuity plan
B. Business impact assessment
C. Disaster recovery plan
D. Vulnerability assessment

C. Disaster recovery plan

20

Of the individuals listed, who would provide the best endorsement for a business continuity plan's statement of importance?

A. Vice president of business operations
B. Chief information officer
C. Chief executive officer
D. Business continuity manager

C. Chief executive officer

21

When an employee is to be terminated, which of the following should be done?

A. Inform the employee a few hours before they are officially terminated.
B. Disable the employee's network access just as they are informed of the termination.
C. Send out a broadcast email informing everyone that a specific employee is to be terminated.
D. Wait until you and the employee are the only people remaining in the building before announcing the termination.

B. Disable the employee's network access just as they are informed of the termination.

22

Which of the following is not an element of the risk analysis process?

A. Analyzing an environment for risks
B. Creating a cost/benefit report for safeguards to present to upper management
C. Selecting appropriate safeguards and implementing them
D. Evaluating each threat event as to its likelihood of occurring and cost of the resulting damage

C. Selecting appropriate safeguards and implementing them

23

Which of the following would generally not be considered an asset in a risk analysis?

A. A development process
B. An IT infrastructure
C. A proprietary system resource
D. Users' personal files

D. Users' personal files

24

Which of the following is a principle of the CIA Triad that means authorized subjects are granted timely and uninterrupted access to objects?

A. Identification
B. Availability
C. Encryption
D. Layering

B. Availability

25

Which of the following is not a valid definition for risk?

A. An assessment of probability, possibility, or chance
B. Anything that removes a vulnerability or protects against one or more specific threats
C. Risk = threat * vulnerability
D. Every instance of exposure

B. Anything that removes a vulnerability or protects against one or more specific threats

26

How is single loss expectancy (SLE) calculated?

A. Threat + vulnerability
B. Asset value ($) * exposure factor
C. Annualized rate of occurrence * vulnerability
D. Annualized rate of occurrence * asset value * exposure factor

B. Asset value ($) * exposure factor

27

How is the value of a safeguard to a company calculated?

A. ALE before safeguard - ALE after implementing the safeguard - annual cost of safeguard
B. ALE before safeguard * ARO of safeguard
C. ALE after implementing safeguard + annual cost of safeguard - controls gap
D. Total risk - controls gap

A. ALE before safeguard - ALE after implementing the safeguard - annual cost of safeguard

28

What security control is directly focused on preventing collusion?

A. Principle of least privilege
B. Job descriptions
C. Separation of duties
D. Qualitative risk analysis

C. Separation of duties

29

While performing a risk analysis, you identify a threat of fire and a vulnerability because there are no fire extinguishers. Based on this information, which of the following is a possible risk?

A. Virus infection
B. Damage to equipment
C. System malfunction
D. Unauthorized access to confidential information

B. Damage to equipment

30

You've performed a basic quantitative risk analysis on a specific threat/vulnerability/risk relation. You select a possible countermeasure. When performing the calculations again, which of the following factors will change?

A. Exposure factor
B. Single loss expectancy
C. Asset value
D. Annualized rate of occurrence

D. Annualized rate of occurrence

31

Which criminal law was the first to implement penalties for the creators of viruses, worms, and other types of malicious code that cause harm to computer system(s)?

A. Computer Security Act
B. National Infrastructure Protection Act
C. Computer Fraud and Abuse Act
D. Electronic Communications Privacy Act

C. Computer Fraud and Abuse Act

32

Which law first required operators of federal interest computer systems to undergo periodic training in computer security issues?

A. Computer Security Act
B. National Infrastructure Protection Act
C. Computer Fraud and Abuse Act
D. Electronic Communications Privacy Act

A. Computer Security Act

33

What is the broadest category of computer systems protected by the Computer Fraud and Abuse Act, as amended?

A. Government-owned systems
B. Federal interest systems
C. Systems used in interstate commerce
D. Systems located in the United States

C. Systems used in interstate commerce

34

What law prevents government agencies from disclosing personal information that an individual supplies to the government under protected circumstances?

A. Privacy Act
B. Electronic Communications Privacy Act
C. Health Insurance Portability and Accountability Act
D. Gramm-Leach-Bliley Act

A. Privacy Act

35

What law formalizes many licensing arrangements used by the software industry and attempts to standardize their use from state to state?

A. Computer Security Act
B. Uniform Computer Information Transactions Act
C. Digital Millennium Copyright Act
D. Gramm-Leach-Bliley Act

B. Uniform Computer Information Transactions Act

36

Which one of the following is not a requirement that Internet service providers must satisfy in order to gain protection under the "transitory activities" clause of the Digital Millennium Copyright Act?

A. The service provider and the originator of the message must be located in different states.
B. The transmission, routing, provision of connections, or copying must be carried out by an automated technical process without selection of material by the service provider.
C. Any intermediate copies must not ordinarily be accessible to anyone other than anticipated recipients and must not be retained for longer than reasonably necessary.
D. The transmission must be originated by a person other than the provider.

A. The service provider and the originator of the message must be located in different states.

37

What industry is most directly impacted by the provisions of the Gramm-Leach-Bliley Act?

A. Health care
B. Banking
C. Law enforcement
D. Defense contractors

B. Banking

38

Matthew recently authored an innovative algorithm for solving a mathematical problem, and he wants to share it with the world. However, prior to publishing the software code in a technical journal, he wants to obtain some sort of intellectual property protection. Which type of protection is best suited to his needs?

A. Copyright
B. Trademark
C. Patent
D. Trade secret

A. Copyright

39

What is the standard duration of patent protection in the United States?

A. 14 years from the application date
B. 14 years from the date the patent is granted
C. 20 years from the application date
D. 20 years from the date the patent is granted

D. 20 years from the date the patent is granted

40

What compliance obligation relates to the processing of credit card information?

A. SOX
B. HIPAA
C. PCI DSS
D. FERPA

C. PCI DSS (Payment Card Industry Data Security Standard)

41

Which one of the following identifies the primary a purpose of information classification processes?

A. Define the requirements for protecting sensitive data.
B. Define the requirements for backing up data.
C. Define the requirements for storing data.
D. Define the requirements for transmitting data.

A. Define the requirements for protecting sensitive data.

42

Which of the following statements correctly identifies a problem with sanitization methods?

A. Methods are not available to remove data ensuring that unauthorized personnel cannot retrieve data.
B. Even fully incinerated media can offer extractable data.
C. Personnel can perform sanitization steps improperly.
D. Stored data is physically etched into the media.

C. Personnel can perform sanitization steps improperly.

43

Which of the following choices is the most reliable method of destroying data on a solid state drive?

A. Erasing
B. Degaussing
C. Deleting
D. Purging

D. Purging

44

Which of the following does not erase data?

A. Clearing
B. Purging
C. Overwriting
D. Remanence

D. Remanence

45

Which one of the following would administrators use to connect to a remote server securely for administration?

A. Telnet
B. Secure File Transfer Protocol (SFTP)
C. Secure Copy (SCP)
D. Secure Shell (SSH)

D. Secure Shell (SSH)

46

Which one of the following data roles is most likely to assign permissions to grant users access to data?

A. Administrator
B. Custodian
C. Owner
D. User

A. Administrator

47

Which would an administrator do to classified media before reusing it in a less secure environment?

A. Erasing
B. Clearing
C. Purging
D. Overwriting

C. Purging

48

Which of the following best defines "rules of behavior" established by a data owner?

A. Ensuring users are granted access to only what they need
B. Determining who has access to a system
C. Identifying appropriate use and protection of data
D. Applying security controls to a system

C. Identifying appropriate use and protection of data

49

Within the context of the European Union (EU) Data Protection law, what is a data processor?

A. The entity that processes personal data on behalf of the data controller
B. The entity that controls processing of data
C. The computing system that processes data
D. The network that processes data

A. The entity that processes personal data on behalf of the data controller

50

What do the principles of notice, choice, onward transfer, and access closely apply to?

A. Privacy
B. Identification
C. Retention
D. Classification

A. Privacy

51

How many keys are required to fully implement a symmetric algorithm with 10 participants?

A. 10
B. 20
C. 45
D. 100

A. 10

52

How many possible keys exist in a 5-bit key space?

A. 4
B. 8
C. 16
D. 32

D. 32

53

John recently received an email message from Bill. What cryptographic goal would need to be met to convince John that Bill was actually the sender of the message?

A. Nonrepudiation
B. Confidentiality
C. Availability
D. Integrity

A. Nonrepudiation

54

What is the length of the cryptographic key used in the Data Encryption Standard (DES) cryptosystem?

A. 56 bits
B. 128 bits
C. 192 bits
D. 256 bits

A. 56 bits

55

Which one of the following cipher types operates on large pieces of a message rather than individual characters or bits of a message?

A. Stream cipher
B. Caesar cipher
C. Block cipher
D. ROT3 cipher

C. Block cipher

56

What type of cipher relies on changing the location of characters within a message to achieve confidentiality?

A. Stream cipher
B. Transposition cipher
C. Block cipher
D. Substitution cipher

B. Transposition cipher

57

Which one of the following cannot be achieved by a secret key cryptosystem?

A. Nonrepudiation
B. Confidentiality
C. Availability
D. Key distribution

A. Nonrepudiation

58

When correctly implemented, what is the only cryptosystem known to be unbreakable?

A. Transposition cipher
B. Substitution cipher
C. Advanced Encryption Standard
D. One-time pad

D. One-time pad

59

What is the minimum number of cryptographic keys required for secure two-way communications in symmetric key cryptography?

A. One
B. Two
C. Three
D. Four

A. One

60

Which one of the following Data Encryption Standard (DES) operating modes can be used for large messages with the assurance that an error early in the encryption/decryption process won't spoil results throughout the communication?

A. Cipher Block Chaining (CBC)
B. Electronic Codebook (ECB)
C. Cipher Feedback (CFB)
D. Output Feedback (OFB)

D. Output Feedback (OFB)

61

Many cryptographic algorithms rely on the difficulty of factoring the product of large prime numbers. What characteristic of this problem are they relying on?

A. It contains diffusion.
B. It contains confusion.
C. It is a one-way function.
D. It complies with Kerchoff's principle.

C. It is a one-way function.

62

Dave is developing a key escrow system that requires multiple people to retrieve a key but does not depend on every participant being present. What type of technique is he using?

A. Split knowledge
B. M of N Control
C. Work function
D. Zero-knowledge proof

B. M of N Control

63

How many encryption keys are required to fully implement an asymmetric algorithm with 10 participants?

A. 10
B. 20
C. 45
D. 100

C. 45

64

What kind of attack makes the Caesar cipher virtually unusable?

A. Meet-in-the-middle attack
B. Escrow attack
C. Frequency analysis attack
D. Transposition attack

C. Frequency analysis attack

65

What type of cryptosystem commonly makes use of a passage from a well-known book for the encryption key?

A. Vernam cipher
B. Running key cipher
C. Skipjack cipher
D. Twofish cipher

B. Running key cipher

66

Toby is attempting to log in to a secure system. He provides his username at the prompt and then is asked to provide a password. What stage of the access control process is taking place at that moment?

A. Identification
B. Authentication
C. Indemnification
D. Authorization

B. Authentication

67

Which of the following storage media would not be affected by a degausser?
A. HDD
B. SSD
C. Floppy Drive
D. Tape

B. SSD

68

What technique is most effective for removing data stored on an SSD device?

A. Erasing
B. Degaussing
C. Reformatting
D. Destruction

D. Destruction

69

Mary recently read about a new hacking group that is using advanced tools to break into the database servers of organizations running public websites. In risk management language, how would she describe this group of hackers?

A. Risk
B. Vulnerability
C. Threat
D. Standard

C. Threat

70

You are selecting an encryption algorithm for use in exchanging sensitive information over the Internet. Which one of the following algorithms would NOT be acceptable for use?

A. DES
B. RSA
C. AES
D. Blowfish

A. DES

71

What is the output value of the mathematical function 18 mod 3?

A. 0
B. 1
C. 3
D. 5

A. 0

72

Which of the following is the most secure method of deleting data on a DVD?

A. Formatting
B. Deleting
C. Destruction
D. Degaussing

C. Destruction

73

Mary is the cofounder of Acme Widgets, a manufacturing firm. Together with her partner, Joe she has developed a special oil that will dramatically improve the widget manufacturing process. To keep the formula secret, Mary and Joe plan to make a large quantities of the oil by themselves in the plant after the other workers have left. They want to protect this formula for as long as possible. What type of intellectual property protection best suits their needs?

A. Copyright
B. Trademark
C. Patent
D. Trade secret

D. Trade secret

74

What will be the major resource consumed by the BCP process during the BCP phase?

A. Hardware
B. Software
C. Processing time
D. Personnel

D. Personnel

75

What is the formula used to compute the single loss expectancy for a risk scenario?

A. SLE =AV x EF
B. SLE = RO x EF
C. SLE = AV x ARO
D. SLE = EF x ARO

A. SLE =AV x EF

76

How can a group reach an anonymous consensus while all members of that group are in the same room?

A. Delphi technique
B. Brainstorming
C. Storyboarding
D. Surveys

A. Delphi technique

77

What is the term for the percentage of loss an asset's value would experience in the event that a threat becomes realized?

A. Annualized loss expectancy
B. Annualized rate of occurrence
C. Single loss expectancy
D. Exposure factor

D. Exposure factor

78

What BIA metric can be used to express the longest time a business function can be unavailable without causing irreparable harm to the organization?

A. SLE
B. EF
C. MTD
D. ARO

C. MTD

79

When seeking to hire new emplloyees, what is the first step?

A. Create a job description
B. Set position classification
C. Screen candidates
D. Request resumes

A. Create a job description