6 - Operations Security

Question 1

1. Which of the following is not an important aspect of the new employee hiring process?a. Background screeningb. Drug testingc. Non-disclosure agreementsd. Exit interview

Answer 1

D: The exit interview is part of the termination process.

Question 2

2. Which of the following is considered the lowest level of privilege?a. Read onlyb. Read-Write c. Change accessd. Need to know

Answer 2

A: Read only is the lowest privilege level.

Question 3

3. The first step in hiring a new employee is what?a. Screening candidatesb. Creating the job descriptionc. Signing non-disclosure agreementsd. Background verification

Answer 3

B: The first step in hiring a new employee is the creation of a job description. Without a job description there is no clear understanding of who is needed and the work tasks they will be required to perform.

Question 4

4. What type of security controls are used to encourage compliance with other security controls?a. directiveb. recoveryc. applicationd. transaction

Answer 4

A: Directive or deterrent controls are used to encourage compliance with other security controls.

Question 5

5. The Orange Book defines two types of assurance. Which of the following are they?a. Life cycle and Developmentb. Operational and Life cyclec. Development and Improvementd. Functional and Efficiency

Answer 5

B: The Orange book defines Operational and Life Cycle assurance.

Question 6

6. Operations security is primarily concerned with?a. Protecting assets from threatsb. Establishing audit trailsc. Classifying subjectsd. Managing personnel security awareness

Answer 6

A: Operations security is primarily concerned with protecting assets from threats.

Question 7

7. The security practice of ensuring that no one individual has complete control or access over a system’s security mechanism is known as?a. Principle of least privilegeb. Separation of dutiesc. Job rotationd. Role based access control

Answer 7

B: The security practice of ensuring that no one individual as complete control or access over a system’s security mechanism is known as separation of duties.

Question 8

8. What is trusted recovery?a. A storage system that ensures the security of backup setsb. An element in disaster recovery planning where the restoration of backups is assigned to a trusted team of security professionalsc. A process that ensures a system’s security is not violated when it encounters a failure requiring a restorationd. An automatic process that restores the most recent backup to a system when a security fault is encountered.

Answer 8

C: Trusted recovery is a process that ensures a system’s security is not violated when it encounters a failure requiring a restoration.

Question 9

9. Which of the following is not a safeguard against collusion?a. Rotation of dutiesb. Trusted recoveryc. Separation of dutiesd. Auditing

Answer 9

B: Trusted recovery is not a safeguard against collusion. It is a safeguard against failure states encountered by the OS or software which prevents the system from restarting into an insecure state.

Question 10

10. What is the primary goal of configuration or change management?a. enable rollback to a previous system stateb. duplicate changes on multiple systemsc. prevent changes from diminishing securityd. informing users of changes

Answer 10

C: The primary goal of configuration or change management is to ensure that security is not diminished.

Question 11

11. What is the primary purpose of mandatory vacations?a. Job rotationb. Background checkingc. Testing recovery plansd. Auditing

Answer 11

D: Mandatory vacations are used to perform auditing.

Question 12

12. When an automated trusted recovery is performed, what must happen?a. All corrupted system files must be restoredb. All suspect data is flagged for inspectionc. A system administrator is required to regain a secured stated. The system must restore itself to a secure state

Answer 12

D: When an automated trusted recovery is performed, the system must restore itself to a secure state.

Question 13

13. What is the goal of configuration change management?a. To ensure that all changes to the system do not diminish securityb. To control who performs changes to the security systemc. To track all changes to the security systemd. To automate the distribution of widespread security changes throughout a network

Answer 13

A: The primary goal of configuration change management is to ensure that all changes to the system do not diminish security.

Question 14

14. Which of the following is not true about configuration change management?a. Ensures that rolling back to a previous state by removing changes is possibleb. Simplifies the process of rolling out security changes throughout an organizationc. Is required by TCSEC certified B2, B3, and A1 systemsd. All changes must be documented

Answer 14

B: Configuration change management is not a distribution mechanism.

Question 15

15. The ability to easily audit and inspect the work tasks of an employee is made possible by?a. Separation of dutiesb. Exit interviewsc. Mandatory vacationsd. Background checks

Answer 15

C: Mandatory vacations allow for job auditing to ensure compliance with security policy and laws.

Question 16

16. Which of the following is not a form of monitoring?a. Biometric enrollmentb. port scanningc. Intrusion detectiond. penetration testing

Answer 16

A: Biometric enrollment is not a form of monitoring. Biometric enrollment is often a determining factor in whether or not a biometric identification or authenticating device will be accepted by the user community. If enrollment takes longer than minutes, most users will be unwilling to use it.

Question 17

17. The act of examining traffic patterns rather than the contents of packets is known as?a. Transaction processingb. Trend analysisc. Sniffingd. Port scanning

Answer 17

B: Trend or traffic analysis is the examination of traffic patterns rather than packet contents.

Question 18

18. Security controls should be _________ to the authorized user.a. obstructiveb. accessiblec. transparentd. inhibiting

Answer 18

C: Security controls should be transparent to the authorized user.

Question 19

19. When no single person has total control over a system’s security mechanisms, this is called?a. split knowledgeb. rotation of dutiesc. mandatory vacationsd. strong access controls

Answer 19

A: Split knowledge is when no single person has total control over a system’s security mechanisms.

Question 20

20. Another term for a security control that employees split knowledge is?a. mandatory vacationsb. separation of dutiesc. rotation of dutiesd. background checks

Answer 20

B: Separation of duties is a split-knowledge security control.

Question 21

21. The security mechanism that requires that users have the minimum amount of access that is absolutely required by their job tasks and that they have that access for the shortest amount of time is known as?a. due diligenceb. two-man controlsc. least privileged. rotation of duties

Answer 21

C: Least privilege is a security mechanism that requires that users have the minimum amount of access that is absolutely required by their job tasks and that they have that access for the shortest amount of time.

Question 22

22. The top priority of configuration or change control management is?a. prevent changes from diminishing securityb. analyze the effects of changes on a systemc. provide a means to track and audit changes to a systemd. ensure formalized testing of all system changes

Answer 22

A: The top priority of configuration or change control management is to prevent changes from diminishing security.

Question 23

23. Which of the following is not one of the five generally recognized procedural steps to implement configuration or change control management?a. Implementing the changeb. Applying to introduce a changec. Updating the security policyd. Cataloging the intended change

Answer 23

C: Since changes are not supposed to alter the security environment, there should be no need to change or alter the security policy. Therefore Updating the security policy is not one of the five generally recognized procedural steps to implement configuration or change control management.

Question 24

24. Which of the following is not an element of operational assurance as defined by the Orange Book?a. system architectureb. covert channel analysisc. security testingd. trusted recovery

Answer 24

C: Security testing, design specification and testing, configuration management, and trusted distribution are all elements of Life cycle assurance as defined by the Orange book.

Question 25

25. Which of the following is not an element of life cycle assurance as defined by the Orange Book? a. design specification and testing b. configuration management c. trusted distribution  d. system architecture

Answer 25

D: System architecture, system integrity, covert channel analysis, trusted facility management, and trusted recovery are all elements of operational assurance as defined by the Orange book.

Question 26

26. _________________ controls focus on day to day activities for the protection of IT and the support of the security policy. a. Procedural security b. Oversight security c. Operations security d. Physical security

Answer 26

C: Operations security controls focus on day to day activities for the protection of IT and the support of the security policy.

Question 27

27. What type of resources need not be included in the resource protection scheme for the organization? a. hardware resources b. software resources c. data resources d. transitive resources

Answer 27

D: Transitive resources, those provided by other organizations, need not be included in the resource protection scheme for an organization.

Question 28

28. Which of the following is not a common requirement for maintaining security while hardware undergoes maintenance or repair? a. recertification of security label b. trusted offsite technicians c. bonded escorts d. accredited supervision

Answer 28

A: Recertification may be necessary after a repair, but it is not an element of the actual maintenance and repair process.

Question 29

29. Which of the following is an example of a split knowledge security control? a. mandatory vacations b. auditing c. rotation of duties d. two-man control

Answer 29

D: Two-man controls are a form of split-knowledge control that requires two users to work in unison to complete some privileged action.

Question 30

30. What is the purpose of trusted recovery? a. to ensure that security is not breached during a system failure b. to maintain the accreditation of a system c. to guarantee that files can be restored from backup media d. to provide a means to return to the primary site after a disaster occurs

Answer 30

A: The purpose of trusted recovery is to ensure that security is not breached during a system failure.

Question 31

31. Which of the following is not an element of trusted recovery? a. rebooting into a single user mode b. revalidating the trusted computer base c. recovering all file systems that were active at the time of failure d. verifying the integrity of system level security critical files

Answer 31

B: The TCB is not re-validated by the trusted recovery process. Instead, the trusted recovery process relied upon the TCB to provide its capability of returning the system to a secure state after a failure.

Question 32

32. One of the most important aspects of configuration or change control management is? a. updated new employee training materials b. revising the organization's security policy c. compliance with due care requirements d. the ability to rollback changes to a previous state

Answer 32

D: One of the most important aspects of configuration or change control management is the ability to rollback changes to a previous state.

Question 33

33. Which of the following TCSEC rating levels does not require configuration and change control management? a. C2 b. A1 c. B2 d. B3

Answer 33

A: C does not require configuration and change control management.

Question 34

34. Administrative controls for personnel security should include all but which of the following? a. background checks b. enrollment in biometric authentication systems c. mandatory vacations d. job action warnings

Answer 34

B: Enrollment in biometric authentication systems is a logical or technical control for personnel security.

Question 35

35. Which of the following is not one of the three hierarchical types of trusted recovery as defined by the Common Criteria? a. automated recovery without undo loss b. manual recovery c. asynchronous assisted recovery d. automated recovery

Answer 35

C: The Common Criteria does not define a type of trusted recovery named asynchronous assisted recovery.

Question 36

36. Which of the following is not a primary function of configuration or change control management? a. provide a means to track and audit changes to a system b. ensure formalized testing of all system changes c. analyze the effects of changes on a system d. keep users from learning about changes to a system

Answer 36

D: A primary function of configuration or change control management is to keep users informed of system changes.

Question 37

37. _____________ operations should be restricted to authorized individuals who's work tasks specifically require greater than normal capabilities. a. privileged b. backup c. Internet client d. productivity software

Answer 37

A: Privileged operations should be restricted to authorized individuals whose work tasks specifically require greater than normal capabilities.

Question 38

38. What is the primary goal of media security controls? a. control inventory of backup media b. prevent loss or disclosure of sensitive data while it is stored on removable media c. maintain chain of custody information just in case media must be used in a legal action d. prevent users from accessing removable media

Answer 38

B: The primary goal of media security controls is to prevent loss or disclosure of sensitive data while it is stored on removable media.

Question 39

39. Which of the following is not considered an element of maintaining media security controls? a. logging b. chain of custody c. deploying security guards d. inventory management

Answer 39

C: Deploying security guard is not an element of maintaining media security controls. Security guards are used to provide physical access control to facilities.

Question 40

40. Maintenance accounts are considered a threat to security since they may be used as an access means for unauthorized individuals. What are maintenance accounts? a. any account that has administrative level privileges b. supervisory level factory installed accounts c. accounts used by hardware repair technicians that are created and maintained by your IT staff d. those administrators involved in the daily support of user accounts and access

Answer 40

B: Maintenance accounts are supervisory level factory installed accounts. These accounts should be disabled or be assigned strong passwords.

Question 41

41. Which of the following is not a valid countermeasure against the unauthorized use of maintenance accounts? a. change password b. disable accounts c. network traffic logging d. maintain physical access control over devices

Answer 41

C: Network traffic logging is not an effective or valid countermeasure against the unauthorized use of maintenance accounts.

Question 42

42. Which of the following is not considered an operational security software control? a. software testing b. safe software media storage c. backup controls d. diagnostic port controls

Answer 42

D: Diagnostic port controls are physical security controls for hardware, not software.

Question 43

43. Which of the following is not considered a monitoring technique? a. Intrusion Detection b. Probing c. Passwords d. Dumpster Diving

Answer 43

C: Passwords are access controls, not monitoring techniques.

Question 44

44. Which of the following is not considered a monitoring technique? a. Penetration Testing b. Demon (war) Dialing c. Sniffing d. Use of packet filters.

Answer 44

D: Packet filters are an access control mechanism, not a monitoring technique.

Question 45

45. Which of the following is not considered a monitoring technique? a. Biometrics b. Scanning c. Violation Analysis d. Social Engineering

Answer 45

A: Biometrics are an identification or authentication technique, not a monitoring technique.

Question 46

46. Monitoring should begin after all but which of the following is completed? a. user logon b. application installation c. system configuration d. operating system patching

Answer 46

A: Monitoring should already be enabled before users begin logging on to the system.

Question 47

47. Monitoring should focus on all but which of the following? a. violation tracking b. violation resolution c. violation processing d. violation analysis

Answer 47

B: Monitoring is not directly concerned with the resolution of violations. That is a secondary result of the monitoring process.

Question 48

48. Which of the following is most concerned with personnel security?  a. Management controls b. Operational controls c. Technical controls d. Human resources controls

Answer 48

B: Personnel security always have to deal more with Operational controls, they provide the guidelines and the correct procedures to implement the different operations, which maintains security. Management controls are used mainly by management. Technical controls deal with system security. Human resources control deal with organizational controls, not always related to security.

Question 49

49. When a removable media is labeled with a security classification, which of the following is true? a. Only users with the same or lower clearance can use the removable media. b. The removable media can only store data that is lower than the labeled clearance level. c. Availability is maintained through classification labeling of removable media. d. The removable media must be protected under the same restrictions as data with the same classification.

Answer 49

D: This is a true statement. The removable media must be protected under the same restrictions as data with the same classification.

Question 50

50. At the end of the useful lifetime of a removable media with a high security classification level, what should occur? a. it should be incinerated b. it should be purged for re-use c. it should be cleaned for use in any security domain d. it should be stored in a retention vault

Answer 50

A: At the end of the useful lifetime of a removable media with a high security classification level, that media should be destroyed, such as by incineration.

Question 51

51. Without _________________ there is no security. a. removable media usage controls b. physical access controls c. access control lists d. firewalls

Answer 51

B: Without physical access controls there is no security.

Question 52

52. The purpose of audit trails is to? a. detect normal activity b. test system security c. validate trust d. recreate events

Answer 52

D: The purpose of audit trails is to recreate events.

Question 53

53. The goal of audit trails is to? a. check compliance with security policy b. evaluate the cost effectiveness of safeguards c. provide a risk analysis treatment of an environment d. keep security administrators busy

Answer 53

A: The goal of audit trails is to check compliance with security policy.

Question 54

54. The first activity that must be performed when employing penetration testing to test the effectiveness of your security perimeter is to? a. develop an attack plan b. obtain management approval c. collect the attack tools d. produce a results report

Answer 54

B: Obtaining management approval is always the first step when using penetration testing.

Question 55

55. What is a clipping level? a. The point at which a monitoring device is unable to process further data due to saturation b. The point at which normal activity is distinguished from abnormal c. The point at which a device experiences a power surge and thus an operational failure d. The rate at which a firewalls access ports are scanned when under attack

Answer 55

B: The clipping level is the point at which normal activity is distinguished from abnormal.

Question 56

56. When an activity crosses or exceeds the clipping level, what occurs? a. access is denied b. the intruder is moved to a padded cell c. a violation report is generated d. the firewall disables further communications

Answer 56

C: When the clipping level is exceeded a violation report is generated.

Question 57

57. Clipping levels are useful for detecting all but which of the following? a. repetitive mistakes b. individuals exceeding their authorized privileges c. serious intrusion attempts d. slow low-volume attacks

Answer 57

D: Slow low-volume attacks are typically not detected through the use of clipping levels. Slow low-volume attacks are lost in the bulk of normal expected activity.

Question 58

58. The final step in penetration testing is? a. deploying new safeguards b. performing risk analysis c. reporting findings d. exploiting discovered vulnerabilities

Answer 58

C: The final step in penetration testing is reporting findings.

Question 59

59. An audit log should contain all but which of the following? a. time and data of violation b. location (physical or logical) of incident c. what event violated the security policy d. biometric profile of the offending user account

Answer 59

D: An audit log will not contain the biometric profiles for individuals, those are stored in the security database. Only the user account name or ID number will appear in the audit log.

Question 60

60. Which of the following is not considered an important security issue related to audit trails? a. purging of audit media b. retention and protection of audit media c. protection against alteration d. support of availability of audit media

Answer 60

A: Purging of audit media should be avoided. Audit details should be retained for historical comparisons.

Question 61

61. Violating the confidentiality of sensitive data is what type of inappropriate activity? a. abuse of privileges b. waste of corporate resources c. inappropriate content d. vandalism

Answer 61

A: Violating the confidentiality of sensitive data is an abuse of privileges.

Question 62

62. Which of the following is not a computer crime even if it results in a serious financial loss to your organization? a. fraud b. input error or omission c. eavesdropping d. war dialing

Answer 62

B: An input error or omission is not a computer crime even if it results in a serious financial loss to your organization. It is simply an unwanted activity.

Question 63

63. Which of the following is an example of piggybacking? a. cutting through a wire fence b. re-transmitting intercepted packets  c. passing through a door opened by another person who used a key d. decrypting the content of secured communication sessions

Answer 63

C: Passing through a door opened by another person who used a key is an example of piggybacking.

Question 64

64. Which of the following is not a countermeasure to traffic or trend analysis? a. message padding b. transmission of noise c. covert channel analysis d. encrypting individual messages

Answer 64

D: Encrypting individual messages is not an effective countermeasure to traffic or trend analysis.

Question 65

65. The goal of penetration testing is? a. altering the security policy b. placing blame for security violations c. evaluate the existing security protection d. tricking management into purchasing new security solutions

Answer 65

C: The goal of penetration testing is to evaluate the existing security protection.

Question 66

66. If you want to discover how much data can be learned about your environment from external users, your penetration attack team should have ____ knowledge.  a. partial b. disclosed c. full d. zero

Answer 66

D: A penetration attack team with zero knowledge will be able to clearly demonstrate how much information can be discovered about your environment from the outside.

Question 67

67. Which of the following is not considered a standard step or element in the process of penetration testing? a. safeguard tuning b. discovery c. enumeration d. exploitation

Answer 67

A: Safeguard tuning is not an element of penetration testing.

Question 68

68. When performing a penetration attack on your own system, which of the following activities would not be performed during the discovery phase? a. foot printing b. social engineering c. scavenging d. dumpster diving

Answer 68

B: Social engineering requires some level of data already known in order to be effective. Social engineering usually takes place in the enumeration, vulnerability mapping, or exploitation phases of penetration testing.

Question 69

69. What is the purpose of interim reports by security auditors? a. used to communicate regarding items that need immediate attention b. used to keep the length of the final report to a minimum c. used to provide process reports to management d. used to request additional clarifications on audit objectives

Answer 69

A: The purposed of interim reports is to communicate regarding items that need immediate attention.

Question 70

70. Oral reports can be used instead of written reports for which of the following? a. findings report b. interim reports c. final report d. objectives definition report

Answer 70

B: Oral reports can be used for interim reports only.

Question 71

71. What is the purpose of the exit conference? a. place blame for security deficiencies b. recommendation of countermeasures c. discuss issues with all relevant and effected parties d. rebuttal of auditing objectives

Answer 71

C: The purpose of the exit conference is to discuss issues with all relevant and effected parties.

Question 72

72. Which of the following identifies the goals of auditing? a. problem identification and object identification b. problem identification and problem resolution c. problem identification and risk evaluation d. problem identification and safeguard Selection

Answer 72

B: The goals of auditing are problem identification and problem resolution.

Question 73

73. Which of the following is used to locate significant information within audit trails? a. scavenging b. data diddling c. data mining d. random access

Answer 73

C: Data mining is used to locate significant information within audit trails.

Question 74

74. Reviews and evaluations of the security solutions of an environment are often performed by? a. senior management b. end users c. the risk assessment team d. external consultants

Answer 74

D: External consultants, specifically analysis or auditors, are commonly used to perform reviews and evaluations of the security solutions of an environment.

Question 75

75. Once auditing discovers a problem, what is the next step? a. countermeasure Selection b. problem management c. risk analysis d. security policy modification

Answer 75

B: Once a problem is discovered through auditing, the next step is problem management.

Question 76

76. Which of the following is not a primary goal of problem management? a. reduce failures to a reasonable level b. prevent re-occurrence of discovered problems c. maintain cost effectiveness of countermeasures d. mitigate negative impact of problems

Answer 76

C: Maintaining the cost effectiveness of countermeasures is a secondary goal of problem management. In many cases it is an automatic benefit of the risk analysis aspect of problem management.

Question 77

77. Which of the following is not considered an inappropriate activity? a. viewing political content while at work b. using company resources to sell personal items on eBay c. accessing resources for which you have no legitimate work task requirements d. consuming all of the bandwidth of a WAN connection performing a required data transfer

Answer 77

D: Performing a work task is always an appropriate activity, even if the results are not always acceptable.

Question 78

78. Which of the following is not considered a browsing attack? a. viewing another user's files b. shoulder surfing c. going through someone's trash d. extracting data from a purged media.

Answer 78

D: Extracting data from purged media is a scavenging attack, not a browsing attack.

Question 79

79. When an intruder enters through a secured doorway by tagging along with an authorized user, this is known as? a. Social engineering b. Spoofing c. Piggybacking d. Eavesdropping

Answer 79

C: When an intruder enters through a secured doorway by tagging along with an authorized user this is known as piggybacking.

Question 80

80. When should the final report from an auditor be issued? a. After interim reports b. During the exit conference c. At the beginning of the auditing process d. After the exit conference

Answer 80

D: The final report should be issued after the exit conference.

Question 81

81. Who is ultimately responsible for implementing the changes recommended in the findings report from an external auditor? a. senior management b. end users c. internal auditors d. system managers

Answer 81

A: Senior management is responsible for the selection and delegation of implementation of the changes recommended in the findings report from an external auditor.

Question 82

82. Traffic or trend analysis is primarily concerned with? a. the amount of data traveling to another system b. the content of network packets c. the application used in a communication d. the user account and password associated with a communication session

Answer 82

A: Traffic or trend analysis is primarily concerned with the amount of data traveling to another system.

Question 83

83. Initial program load vulnerabilities include all but which of the following? a. booting from a CD b. turning off the power c. using alternate boot menu d. accessing CMOS

Answer 83

B: IPL vulnerabilities do not include removing power from a system.

Question 84

84. Which of the following is not true in regards to superzap? a. it can bypass system security mechanisms b. is not easily detected c. its use is usually logged by the system d. used to recovery from system freezes

Answer 84

C: Superzap is usually not logged by the system because it by passes the auditing capabilities, as well as the access controls of the system.

Question 85

85. Countermeasures against traffic or trend analysis include all but which of the following? a. Message padding b. Noise transmission c. Encrypting transmitted messages d. Analyzing covert channel usage

Answer 85

C: The encryption of message traffic will not alter the traffic patterns themselves that is the focus of traffic or trend analysis.

Question 86

86. Improving employee motivation and job satisfaction is a countermeasure against all but which of the following attacks? a. Disgruntled employees b. Collusion c. Sabotage d. Violation of non disclosure agreement

Answer 86

C: Sabotage requires additional countermeasures, such as monitoring, physical controls, preventative controls, etc.

Question 87

87. Trusted recovery is concerned with all but which of the following conditions? a. Hot swapping of a failed RAID member drive b. System reboot c. Emergency system restart d. Cold system boot

Answer 87

A: Trusted recovery is not concerned with the hot swapping of a failed RAID member drive.

Question 88

88. The most important aspect of security controls is? a. The need to be transparent to the user b. They must be simple c. They should be obvious to the user d. They can be circumvented by a superzap tool

Answer 88

A: Security controls need to be transparent to the user.

Question 89

89. Which of the following is not an immediate goal of auditing? a. Identifying IT events b. Preventing attacks c. Recording information about problems d. Maintaining a historical record of IT activities

Answer 89

B: Preventing attacks is an indirect goal of auditing. Auditing itself offers no direct means to prevent attacks.

Question 90

90. Which of the following is not an auditing technique used to protect your IT environment? a. Intrusion Detection System b. Port scanning c. Dumpster diving d. Packet sniffing

Answer 90

C: Dumpster diving is rarely if ever used as a means to improve security of an organization, most often it is used as a data gathering mission for an attack.

Question 91

91. An audit trail should include all but which of the following elements? a. Information about the date and time of the violation b. Information pinpointing the origin or source of the attack, intrusion, or violation c. The user account under which the violation was perpetrated d. The cost of the loss imposed by the violation

Answer 91

D: The cost of the loss is not an element recorded in the audit trail. That issue is determined by a asset valuation and risk analysis.

Question 92

92. Which of the following is not considered a threat to operational security? a. Responding to hostile customers via e-mail b. Conducting private business on the company's IT infrastructure c. Distributing sexually charged material to coworkers d. Revealing the contexts of sensitive documents to users outside the realm of need-to-know

Answer 92

A: This is not directly considered a threat to operational security. Unfortunately, hostile customers are a fact of doing business.

Question 93

93. Monitoring the patterns of packets transmitted over a network or a communications link without knowing the contents of those packets is known as? a. Packet sniffing b. Trend analysis c. Man-in-the-middle attack d. Teardrop attack

Answer 93

B: Monitoring the patterns of packets transmitted over a network or a communications link without knowing the contents of those packets is known as trend or traffic analysis.

Question 94

94. The data that can be accessed on an erased media is known as? a. Private data b. Residual logistical data c. Covert channel data d. Data remanence

Answer 94

D: Data remaining on an erased media is known as data remanence.

Question 95

95. Which of the following is not a form of auditing that can be used to gather information about your environment for an intrusion attack attempt? a. Social engineering b. Packet sniffing c. Port scanning d. Intrusion Detection System

Answer 95

D: An IDS is typically within the private network and inaccessible to external users and therefore cannot serve as a data gathering source for an attempted intrusion attack. IDS is vulnerable as a source of data about an organization after an intrusion is successful.

Question 96

96. Before it can be performed against you by a malicious attacker, what should you use against your IT infrastructure first? a. Penetration testing b. Social engineering c. Dumpster diving d. War dialing

Answer 96

A: You should perform penetration testing against your own IT infrastructure before an attacker. If you discover a fault, you can fix it. If an attacker discovers a fault, they may exploit it.

Question 97

97. Violation analysis employs a technique that detects abnormal levels of activity that have exceeded what? a. Saturation point b. Clipping level c. Quota level d. Tuple

Answer 97

B: A clipping level is a baseline of normal activity used to discern abnormal or malicious activity when that baseline is crossed or exceeded.

Question 98

98. Which of the following is not a typical activity that causes a violation report to be created? a. Repetitive mistakes that exceed the clipping level b. Users who attempt to exceed their access or privileges c. Several users performing normal work tasks that consume significant system resources without exceeding a clipping level d. Patterns of intrusion attempts

Answer 98

C: This activity will not produce a violation report.

Question 99

99. The main categories of access control does not include? a. Administrative access control b. Logical access control c. Random access control d. Physical access control

Answer 99

C: Random access control. Random access control is a distractor. Access control categories are Logical access control, Technical access control, Physical access control and Administrative access control.

Question 100

100. The discloser of confidential information to another employee by the action of that employee viewing your system's screen or keyboard is known as? a. Shoulder surfing b. Social engineering c. Espionage d. Enticement

Answer 100

A: Shoulder surfing is the act of disclosing confidential information to another employee by the action of that employee viewing your system's screen or keyboard.

Question 101

101. The ability of a system to terminate applications and services that attempt invalid or security violating activities is known as? a. Fail-over b. Trusted recovery c. Trusted computer base d. Fail-safe

Answer 101

D: The ability of a system to terminate applications and services that attempt invalid or security violating activities is known as fail-safe.

Question 102

102. Which of the following activities most strongly encourages users to comply with security polices? a. Awareness training b. Separation of duties c. Principle of least privilege d. Activity monitoring

Answer 102

D: Activity monitoring most strongly encourages users to comply with security polices

Question 103

103. Session hijacking can not be accomplished by which of the following? a. Spoofing IP addresses b. Juggernaut c. Hunt d. Smurf

Answer 103

D: Smurf is a denial of service attack.

Question 104

104. Which backup method offers the fastest means to restore a failed system with minimal data loss? a. Daily copy backups b. A weekly full backup with daily incremental backups c. A weekly full backup with daily differential backups d. Only weekly full backups

Answer 104

C: A weekly full backup with daily differential backups offers the fastest restore path, only two tapes needed, and provides for the least amount of data loss, only up to hours of lost changes.

Question 105

105. Which of the following is often compromised into supporting spamming? a. E-mail clients b. Relay agents c. SNMP servers d. IP routing tables

Answer 105

B: Relay agents are often exploited into distributing spam, sometimes known as SMTP relay agents.

Question 106

106. An attack that re-routes packets by altering network addresses in the routing table or DNS system is known as? a. Masquerading b. Spoofing c. Hijacking d. Superzapping

Answer 106

C: Hijacking is an attack that re-routes packets by altering network addresses in the routing table or DNS system.

Question 107

107. Which of the following cannot be used to block access at the perimeter of a network? a. Firewall b. Router c. IDS d. Proxy server

Answer 107

C: IDS will detect network perimeter access, but it does not block access.

Question 108

108. Which of the following is not considered a serious issue with network sniffers in regards to violating network security? a. Their ability to decode the content of captured packets b. Their ability to use an extended buffer c. Their ability to edit packets and re-transmit them d. Their ability to view all traffic on a wire

Answer 108

B: This is not a serious security threat of network sniffers when used by an attacker. However, the ability of a network sniffer to save a captured buffer to the hard drive is a serious security threat.

Question 109

109. The documents of a formalized security structure are examples of what type of security control? a. Corrective b. Preventative c. Directive d. Detective

Answer 109

C: The documents of a formalized security structure, such as policies, standards, guidelines, and procedures, are examples of directive security controls.

Question 110

110. An attack that employs default accounts and settings on newly installed devices, OS’s, or software is known as? a. Keyboard attacks b. Maintenance Account attacks c. Laboratory attacks d. Initial Program Load attacks.

Answer 110

B: Maintenance Account attacks employ default accounts and settings on newly installed devices, OS’s, or software.

Question 111

111. What is the first and most important step in performing vulnerability testing or ethical hacking? a. Deploying security measures b. Backing up the network c. Scanning for vulnerabilities d. Obtaining senior management approval

Answer 111

D: The first and most important step in performing vulnerability testing or ethical hacking is obtaining senior management approval.

Question 112

112. The cyber crime that involves the gathering of data from various sources including the IT infrastructure itself as well as physical evidence within the facility is known as? a. Scavenging b. Dumpster diving c. Social engineering d. Data diddling

Answer 112

A: Scavenging is the cyber crime that involves the gathering of data from various sources including the IT infrastructure itself as well as physical evidence within the facility.

Question 113

113. Which of the following is not a useful activity to improve perimeter security? a. Disable service banners b. Update anti-virus software c. Disable unnecessary ports d. Use public IP addresses inside the network

Answer 113

D: Using public IP addresses inside the network does not improve perimeter security, it actually makes intrusions and attacks easier.

Question 114

114. A RAID array is an example of what type of security control? a. Detective b. Recovery c. Administrative d. Physical

Answer 114

B: RAID is an example of a recovery control, since RAID offers fault-tolerance and can continue functioning with the loss of a single drive member.

Question 115

115. Which of the following is not a vulnerability scanning tool? a. SATAN b. Tracert c. Nessus d. Nmap

Answer 115

B: Tracert is used to view the hops between two systems, it is not a vulnerability scanning tool.

Question 116

116. What is system fingerprinting? a. A tool used by security administrators to examine the state of security on their networks b. A process of testing the security mechanisms of a network c. A method of gathering information about a network to be used in an intrusion or attack attempt d. A biometric device that provides authentication for remote networks

Answer 116

C: System fingerprinting is a method of gathering information about a network to be used in an intrusion or attack attempt.

Question 117

117. Which of the following is the primary countermeasure to session hijacking? a. IPSec AH b. Proxy servers c. Strong passwords d. Intrusion detection system

Answer 117

A: IPSec's Authentication Header mode is the primary countermeasure to session hijacking.

Question 118

118. TCP wrappers is useful for what? a. Protecting against port scanning b. Securing Internet communications c. Blocking VPN eavesdropping d. Preventing spoofing

Answer 118

A: TCP wrappers is a tool that is used as a protection against port scanning.

Question 119

119. Which form of IT communications is the most vulnerable to spoofing? a. Telnet b. FTP c. Web d. E-mail

Answer 119

D: E-mail is the most vulnerable communication means to spoofing.

Question 120

120. Verifying the sequence numbers on filed departmental financial reports is what form of control? a. Detective b. Preventative c. Corrective d. Recovery

Answer 120

A: Verifying the sequence numbers on filed departmental financial reports is a detective control.

Question 121

121. Brute force and dictionary are forms of what? a. Denial of service attacks b. Password attacks c. Social engineering attacks d. Trend analysis attacks

Answer 121

B: Brute force and dictionary are forms of password attacks.

Question 122

122. Countermeasures to a dictionary attack includes all but which of the following? a. Strong password policy b. Use of non-keyboard characters c. Firewall deployment d. Account lockout

Answer 122

C: Firewalls do not protect against dictionary password attacks.