Quiz Pool Chapters 7-12

Question 1

Because even the implementation of new technologies does not necessarily guarantee an organization can gain or maintain a competitive lead, the concept of __________ has emerged as organizations strive not to fall behind technologically.

Answer 1

competitive disadvantage

Question 2

Treating risk begins with what?

Answer 2

an understanding of risk treatment strategies

Question 3

Application of training and education among other approach elements is a common method of which risk treatment strategy?

Answer 3

defense

Question 4

Each of the following is a recommendation from the FDIC when creating a successful SLA EXCEPT:

-determining objectives
-forecasting costs
-defining requirements
-setting measurements

Answer 4

forecasting costs

Question 5

What risk treatment strategies describes an organization’s attempt to shift risk to other assets, other processes, or other organizations?

Answer 5

transference

Question 6

What risk treatment strategies describes an organization’s efforts to reduce damage caused by a realized incident or disaster?

Answer 6

mitigation

Question 7

Strategies to reestablish operations at the primary site after an adverse event threatens continuity of business operations are covered by which of the following plans in the mitigation control approach?

Answer 7

disaster recovery plan

Question 8

The only use of the acceptance strategy that is recognized as valid by industry practices occurs when the organization has done all but which of the following?

-determined the level of risk posed to the information asset

-performed a thorough cost-benefit analysis

-determined that the costs to control the risk to an information asset are much lower than the benefit gained from the information asset

-assessed the probability of attack and the likelihood of a successful exploitation of a vulnerability

Answer 8

determined that the costs to control the risk to an information asset are much lower than the benefit gained from the information asset

Question 9

What can be described as the quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility?

Answer 9

risk appetite

Question 10

The goal of InfoSec is not to bring residual risk to __________; rather, it is to bring residual risk in line with an organization’s risk appetite.

Answer 10

zero

Question 11

All of the following are rules of thumb for selecting a risk treatment strategy EXCEPT:

-When a vulnerability exists in an important asset, implement security controls to reduce the likelihood of a vulnerability being exploited.

-When the likelihood of an attack is high and the impact is great, outsource security efforts so that any resulting loss is fiscally someone else’s responsibility.

-When a vulnerability can be exploited, apply layered protections, architectural designs, and administrative controls to minimize the risk or prevent the occurrence of an attack.

-When the potential loss is substantial, apply design principles, architectural designs, and technical and nontechnical protections to limit the extent of the attack, thereby reducing the potential for loss.

Answer 11

When the likelihood of an attack is high and the impact is great, outsource security efforts so that any resulting loss is fiscally someone else’s responsibility.

Question 12

Which of the following is NOT a valid rule of thumb on risk treatment strategy selection?

-When a vulnerability exists: Implement security controls to reduce the likelihood of a vulnerability being exploited.

-When a vulnerability can be exploited: Apply layered protections, architectural designs, and administrative controls to minimize the risk or prevent the occurrence of an attack.

-When the attacker’s potential gain is less than the costs of attack: Apply protections to decrease the attacker’s cost or reduce the attacker’s gain by using technical or operational controls.

-When the potential loss is substantial: Apply design principles, architectural designs, and technical and non-technical protections to limit the extent of the attack, thereby reducing the potential for loss.

Answer 12

When the attacker’s potential gain is less than the costs of attack: Apply protections to decrease the attacker’s cost or reduce the attacker’s gain by using technical or operational controls.

Question 13

Once a control strategy has been selected and implemented, what should be done on an ongoing basis to determine its effectiveness and to estimate the remaining risk?

Answer 13

monitoring and measurement

Question 14

When vulnerabilities have been controlled to the degree possible, what is the remaining risk that has not been completely removed, shifted, or planned for?

Answer 14

residual risk

Question 15

The financial savings from using the defense risk treatment strategy to implement a control and eliminate the financial ramifications of an incident is known as __________.

Answer 15

cost avoidance

Question 16

Also known as an economic feasibility study, the formal assessment and presentation of the economic expenditures needed for a particular security control, contrasted with its projected value to the organization, is known as __________.

Answer 16

cost-benefit analysis (CBA)

Question 17

The process of assigning financial value or worth to each information asset is known as __________.

Answer 17

asset valuation

Question 18

Which of the following affects the cost of a control?

-liability insurance

-CBA report

-asset resale

-maintenance

Answer 18

maintenance

Question 19

Each of the following is an item that affects the cost of a particular risk treatment strategy EXCEPT:

-cost of maintenance (labor expense to verify and continually test, maintain, train, and update)

-cost of development or acquisition (hardware, software, and services)

-cost of implementation (installing, configuring, and testing hardware, software, and services)

-cost of IT operations (keeping systems operational during the period of treatment strategy development)

Answer 19

cost of IT operations (keeping systems operational during the period of treatment strategy development)

Question 20

By multiplying the asset value by the exposure factor, you can calculate what?

Answer 20

single loss expectancy

Question 21

Each of the following is a commonly used quantitative approach for asset valuation EXCEPT:

-value to owners

-value to competitors

-value retained from past maintenance

-value to adversaries

Answer 21

value to competitors

Question 22

What is the result of subtracting the postcontrol annualized loss expectancy and the annualized cost of the safeguard from the precontrol annualized loss expectancy?

Answer 22

cost-benefit analysis

Question 23

What determines how well a proposed treatment will address user acceptance and support, management acceptance and support, and the system’s compatibility with the requirements of the organization’s stakeholders?

Answer 23

operational feasibility

Question 24

What determines acceptable practices based on consensus and relationships among the communities of interest?

Answer 24

political feasibility

Question 25

What determines whether the organization already has or can acquire the technology necessary to implement and support the proposed treatment?

Answer 25

technical feasibility

Question 26

What determines how well the proposed InfoSec treatment alternatives will contribute to the efficiency, effectiveness, and overall operation of an organization?

Answer 26

organizational feasibility

Question 27

Which of the following is NOT an alternative to using CBA to justify risk controls? -benchmarking -due care and due diligence -selective risk avoidance -the gold standard

Answer 27

selective risk avoidance

Question 28

In which technique does a group rate or rank a set of information, compile the results, and repeat until everyone is satisfied with the result?

Answer 28

Delphi

Question 29

Which alternative risk management methodology is a process promoted by the Computer Emergency Response Team (CERT) Coordination Center (www.cert.org) that has three variations for different organizational needs, including one known as ALLEGRO?

Answer 29

OCTAVE

Question 30

The Microsoft Risk Management Approach includes four phases; which of the following is NOT one of them? -conducting decision support -implementing controls -evaluating alternative strategies -measuring program effectiveness

Answer 30

evaluating alternative strategies

Question 31

Which of the following is not a step in the FAIR risk management framework? -identify scenario components -evaluate loss event frequency -assess control impact -derive and articulate risk

Answer 31

assess control impact

Question 32

What does FAIR rely on to build the risk management framework that is unlike many other risk management frameworks?

Answer 32

qualitative assessment of many risk components

Question 33

The ISO 27005 Standard for Information Security Risk Management includes all but which of the following stages?

Answer 33

risk determination

Question 34

Which international standard provides a structured methodology for evaluating threats to economic performance in an organization and was developed using the Australian/New Zealand standard AS/NZS 4360:2004 as a foundation?

Answer 34

ISO 31000

Question 35

The NIST risk management approach includes all but which of the following elements? -inform -assess -frame -respond

Answer 35

inform

Question 36

NIST’s Risk Management Framework follows a three-tiered approach, with most organizations working from the top down, focusing first on aspects that affect the entire organization, such as __________.

Answer 36

governance

Question 37

Which of the following is NOT one of the methods noted for selecting the best risk management model? -Use the methodology most similar to what is currently in use. -Study known approaches and adapt one to the specifics of the organization. -Hire a consulting firm to provide a proprietary model. -Hire a consulting firm to develop a proprietary model.

Answer 37

Use the methodology most similar to what is currently in use.

Question 38

In information security, a framework or security model customized to an organization, including implementation details, is a _________.

Answer 38

blueprint

Question 39

Which of the following is a generic model for a security program?

Answer 39

framework

Question 40

In information security, a specification of a model to be followed during the design, selection, and initial and ongoing implementation of all subsequent security controls is known as a __________.

Answer 40

framework

Question 41

Which of the following is the original purpose of ISO/IEC 17799?

Answer 41

To offer guidance for the management of InfoSec to individuals responsible for their organization’s security programs

Question 42

When the ISO 27002 standard was first proposed, several countries, including the United States, Germany, and Japan, refused to adopt it, claiming that it had fundamental problems; which of the following is NOT one of them? -It was not as complete as other frameworks. -The standard lacked the measurement precision associated with a technical standard. -The standard was hurriedly prepared. -It was feared it would lead to government intrusion into business matters.

Answer 42

It was feared it would lead to government intrusion into business matters.

Question 43

One of the most widely referenced InfoSec management models, known as Information Technology—Code of Practice for Information Security Management, is also known as __________.

Answer 43

ISO 27002

Question 44

The managerial tutorial equivalent of NIST SP 800-12, providing overviews of the roles and responsibilities of a security manager in the development, administration, and improvement of a security program, is NIST __________.

Answer 44

SP 800-100: Information Security Handbook: A Guide for Managers (2007)

Question 45

Which NIST publication describes the philosophical guidelines that the security team should integrate into the entire InfoSec process, beginning with “Security supports the mission of the organization”?

Answer 45

SP 800-14: Generally Accepted Principles and Practices for Securing Information Technology Systems (1996)

Question 46

This NIST publication provides information on the elements of InfoSec, key roles and responsibilities, an overview of threats and vulnerabilities, a description of the three NIST security policy categories, and an overview of the NIST RM Framework and its use, among other topics needed for a foundation in InfoSec.

Answer 46

SP 800-12, Rev. 1: An Introduction to Information Security (2017)

Question 47

Which of the following provides advice about the implementation of sound controls and control objectives for InfoSec, and was created by ISACA and the IT Governance Institute?

Answer 47

COBIT

Question 48

Although COBIT was designed to be an IT __________ and management structure, it includes a framework to support InfoSec requirements and assessment needs.

Question 49

The COSO framework is built on five interrelated components. Which of the following is NOT one of them? -control environment -risk assessment -control activities -InfoSec governance

Answer 49

InfoSec governance

Question 50

The Information Technology Infrastructure Library (ITIL) is a collection of methods and practices primarily for __________.

Answer 50

managing the development and operation of IT infrastructures

Question 51

The Information Security __________ is a managerial model provided by an industry working group, National Cyber Security Partnership, which provides guidance in the development and implementation of organizational InfoSec structures and recommends the responsibilities that various members should have in an organization.

Answer 51

Governance Framework

Question 52

Which piece of the Trusted Computing Base's security system manages access controls?

Answer 52

reference monitor

Question 53

Which security architecture model is part of a larger series of standards collectively referred to as the “Rainbow Series”?

Answer 53

TCSEC

Question 54

Under the Common Criteria, which term describes the user-generated specifications for security requirements?

Answer 54

Protection Profile (PP)

Question 55

Which access control principle specifies that no unnecessary access to data exists by regulating members so they can perform only the minimum data manipulation necessary?

Answer 55

least privilege

Question 56

What is the information security principle that requires significant tasks to be split up so that more than one individual is required to complete them?

Answer 56

separation of duties

Question 57

Which access control principle limits a user’s access to the specific information required to perform the currently assigned task?

Answer 57

need-to-know

Question 58

Controls that remedy a circumstance or mitigate damage done during an incident are categorized as which of the following?

Answer 58

corrective

Question 59

Which of the following is NOT a category of access control? preventative mitigating deterrent compensating

Answer 59

mitigating

Question 60

Which control category discourages an incipient incident—e.g., video monitoring?

Answer 60

deterrent

Question 61

An information attack that involves searching through a target organization’s trash and recycling bins for sensitive information is known as __________.

Answer 61

dumpster diving

Question 62

Which of the following is NOT one of the three levels in the U.S. military data classification scheme for National Security Information? confidential secret top secret for official use only

Answer 62

for official use only

Question 63

Which of the following specifies the authorization level that each user of an information asset is permitted to access, subject to the need-to-know principle?

Answer 63

security clearances

Question 64

Under lattice-based access controls, the column of attributes associated with a particular object (such as a printer) is referred to as which of the following?

Answer 64

access control list

Question 65

Which type of access controls can be role-based or task-based?

Answer 65

nondiscretionary

Question 66

In which form of access control is access to a specific set of information contingent on its subject matter?

Answer 66

content-dependent access controls

Question 67

An ATM that limits what kinds of transactions a user can perform is an example of which type of access control?

Answer 67

constrained user interface

Question 68

A time-release safe is an example of which type of access control?

Answer 68

temporal isolation

Question 69

Which security architecture model is based on the premise that higher levels of integrity are more worthy of trust than lower ones?

Answer 69

Biba

Question 70

Which of the following is NOT a change control principle of the Clark-Wilson model? -no changes by unauthorized subjects -no unauthorized changes by authorized subjects -no changes by authorized subjects without external validation -the maintenance of internal and external consistency

Answer 70

no changes by authorized subjects without external validation

Question 71

Which of the following is NOT a common type of background check that may be performed on a potential employee? -identity -political activism -motor vehicle records -drug history

Answer 71

political activism

Question 72

Employees pay close attention to job __________, and including InfoSec tasks in them will motivate employees to take more care when performing these tasks.

Answer 72

performance evaluations

Question 73

Employees new to an organization should receive an extensive InfoSec briefing that includes all of the following EXCEPT: -signing the employment contract -security policies -security procedures -access levels

Answer 73

signing the employment contract

Question 74

Incorporating InfoSec components into periodic employee performance evaluations can __________.

Answer 74

heighten InfoSec awareness

Question 75

Which of the following is NOT a task that must be performed if an employee is terminated? -former employee must return all media -former employee’s home computer must be audited -former employee’s office computer must be secured -former employee should be escorted from the premises

Answer 75

former employee’s home computer must be audited

Question 76

What policy requires that every employee be able to perform the work of at least one other staff member?

Answer 76

job rotation

Question 77

What policy requires that two individuals review and approve each other’s work before the task is considered complete?

Answer 77

two-person control

Question 78

What policy makes it difficult for an individual to violate InfoSec and is quite useful in monitoring financial affairs?

Answer 78

separation of duties

Question 79

Organizations are required by privacy laws to protect sensitive or personal employee information, including __________.

Answer 79

personally identifiable information (PII)

Question 80

Contract employees—or simply contractors—should not be allowed to do what?

Answer 80

Wander freely in and out of facilities.

Question 81

Workers typically hired to perform specific services for the organization and hired via a third-party organization are known as __________.

Answer 81

contract employees

Question 82

If a temporary worker (temp) violates a policy or causes a problem, what is the strongest action that the host organization can usually take, depending on the SLA?

Answer 82

Terminate the relationship with the individual and request that he or she be censured.

Question 83

What is described as the process of designing, implementing, and managing the use of the collected data elements to determine the effectiveness of the overall security program?

Answer 83

performance management

Question 84

Organizations must consider all but which of the following during development and implementation of an InfoSec measurement program? -Measurements must yield quantifiable information. -Data that supports the measures needs to be readily obtainable. -Only repeatable InfoSec processes should be considered for measurement. -Measurements must be useful for tracking non-compliance by internal personnel.

Answer 84

Measurements must be useful for tracking non-compliance by internal personnel.

Question 85

Which of the following is NOT a factor critical to the success of an information security performance program? -strong upper-level management support -high level of employee buy-in -quantifiable performance measurements -results-oriented measurement analysis

Answer 85

high level of employee buy-in

Question 86

Which of the following is NOT one of the types of InfoSec performance measures used by organizations? -those that determine the effectiveness of the execution of InfoSec policy -those that determine the effectiveness and/or efficiency of the delivery of InfoSec services -those that evaluate the frequency with which employees access internal security documents -those that assess the impact of an incident or other security event on the organization or its mission

Answer 86

those that evaluate the frequency with which employees access internal security documents

Question 87

Which of the following is NOT a question a CISO should be prepared to answer before beginning the process of designing, collecting, and using performance measurements, according to Kovacich? -Why should these measurements be collected? -Where will these measurements be collected? -What affect will measurement collection have on efficiency? -Who will collect these measurements?

Answer 87

What affect will measurement collection have on efficiency?

Question 88

The InfoSec measurement development process recommended by NIST is divided into two major activities. Which of the following is one of them? -development and selection of qualified personnel to gauge the implementation, effectiveness, efficiency, and impact of the security controls -identification and definition of the current InfoSec program -maintenance of the vulnerability management program -comparison of organizational practices against similar organizations

Answer 88

identification and definition of the current InfoSec program

Question 89

InfoSec measurements collected from production statistics depend greatly on which of the following factors?

Answer 89

number of systems and users of those systems

Question 90

Which of the following is NOT a phase in the NIST InfoSec performance measures development process? -Identify relevant stakeholders and their interests in InfoSec measurement. -Integrate the organization’s process improvement activities across all business areas. -Identify and document the InfoSec performance goals and objectives that would guide security control implementation for the InfoSec program. -Review any existing measurements and data repositories that can be used to derive measurement data.

Answer 90

Identify relevant stakeholders and their interests in InfoSec measurement.

Question 91

One of the fundamental challenges in InfoSec performance measurement is defining what?

Answer 91

effective security

Question 92

NIST recommends the documentation of performance measurements in a standardized format to ensure ____________.

Answer 92

the repeatability of measurement development, customization, collection, and reporting activities

Question 93

What is a possible result of failure to establish and maintain standards of due care and due diligence?

Answer 93

legal liability

Question 94

Which of the following is NOT a consideration when selecting recommended best practices? -threat environment is similar -resource expenditures are practical -organization structure is similar -same certification and accreditation agency or standard

Answer 94

same certification and accreditation agency or standard

Question 95

Creating a blueprint by looking at the paths taken by organizations similar to the one whose plan you are developing is known as which of the following?

Answer 95

benchmarking

Question 96

What do you call the legal requirements that an organization must adopt a standard based on what a prudent organization should do, and then maintain that standard?

Answer 96

due care and due diligence

Question 97

Problems with benchmarking include all but which of the following? -Organizations don’t often share information on successful attacks. -Organizations being benchmarked are seldom identical. -Recommended practices change and evolve, so past performance is no indicator of future success. -Benchmarking doesn’t help in determining the desired outcome of the security process.

Answer 97

Benchmarking doesn’t help in determining the desired outcome of the security process

Question 98

Which of the following is NOT a question to be used as a self-assessment for recommended security practices in the category of people? -Do you perform background checks on all employees with access to sensitive data, areas, or access points? -Are the user accounts of former employees immediately removed on termination? -Would the typical employee recognize a security issue? -Would the typical employee know how to report a security issue to the right people?

Answer 98

Are the user accounts of former employees immediately removed on termination?

Question 99

The ISO certification process takes approximately six to eight weeks and involves all of the following steps EXCEPT: -rejection of the certification application based on lack of compliance or failure to remediate shortfalls -initial assessment of the candidate organization’s InfoSec management systems, procedures, policies, and plans -writing of a manual documenting all procedural compliance presentation of certification by the certification organization

Answer 99

rejection of the certification application based on lack of compliance or failure to remediate shortfalls

Question 100

The benefits of ISO certification to organizations include all of the following EXCEPT: -increased opportunities for government contracts -reduced costs associated with incidents -smoother operations resulting from more clearly defined processes and responsibilities -improved public image of the organization, as certification implies increased trustworthiness

Answer 100

increased opportunities for government contracts

Question 101

The benefits of ISO certification to an organization's employees include all of the following EXCEPT: -reduced employee turnover due to misinterpreted security policies and practices -lower risk of accidents and incidents associated with critical or sensitive information -employee confidence in organizational security practices -improved productivity and job satisfaction from more clearly defined InfoSec roles and responsibilities

Answer 101

reduced employee turnover due to misinterpreted security policies and practices

Question 102

The organization of a task or process so it requires at least two individuals to work together to complete is known as __________ control.

Answer 102

two-person

Question 103

A conspiracy or cooperation between two or more individuals or groups to commit illegal or unethical actions is known as __________.

Answer 103

collusion

Question 104

The requirement that all critical tasks can be performed by multiple individuals is known as __________.

Answer 104

task rotation

Question 105

The requirement that every employee be able to perform the work of at least one other employee is known as __________.

Answer 105

job rotation

Question 106

A requirement that all employees take time off from work, which allows the organization to audit the individual’s areas of responsibility, is known as __________ vacation policy.

Answer 106

mandatory

Question 107

Best security practices balance the need for user __________ to information with the need for adequate protection while simultaneously demonstrating fiscal responsibility.

Answer 107

access

Question 108

A practice related to benchmarking is __________, which is a measurement against a prior assessment or an internal goal.

Answer 108

baselining

Question 109

__________ encompasses a requirement that the implemented standards continue to provide the required level of protection.

Answer 109

Due diligence

Question 110

A goal of 100 percent employee InfoSec training as an objective for the training program is an example of a performance __________.

Answer 110

target

Question 111

The Hartford insurance company estimates that, on average, __________ businesses that don’t have a disaster plan go out of business after a major loss like a fire, a break-in, or a storm.

Answer 111

over 40 percent of

Question 112

Contingency planning is primarily focused on developing __________.

Answer 112

plans for unexpected adverse events

Question 113

The actions taken by senior management to specify the organization’s efforts and actions if an adverse event becomes an incident or disaster are known as __________.

Answer 113

contingency planning

Question 114

Which of the following is the first component in the contingency planning process?

Answer 114

business impact analysis

Question 115

The team responsible for designing and managing the IR plan by specifying the organization’s preparation, reaction, and recovery from incidents is known as the __________.

Answer 115

computer security incident response team (CSIRT)

Question 116

The group of senior managers and project members organized to conduct and lead all CP efforts is known as the __________.

Answer 116

crisis management planning team (CMPT)

Question 117

What is the final stage of the business impact analysis when using the NIST SP 800-34 approach?

Answer 117

Identify recovery priorities for system resources.

Question 118

What is a mathematical tool that is useful in assessing the relative importance of business functions based on criteria selected by the organization?

Answer 118

weighted table analysis

Question 119

At what point in the incident life cycle is the IR plan initiated?

Answer 119

when an incident is detected that affects the organization

Question 120

Which of the following is NOT a major component of contingency planning?

Answer 120

threat assessment

Question 121

According to NIST’s SP 800-34, Rev. 1, which of the following is NOT one of the stages of the business impact assessment? -Calculate asset valuation and combine with the likelihood and impact of potential attacks in a TVA worksheet. -Determine mission/business processes and recovery criticality. -Identify resource requirements. -Identify recovery priorities for system resources.

Answer 121

Calculate asset valuation and combine with the likelihood and impact of potential attacks in a TVA worksheet.

Question 122

The total amount of time the system owner or authorizing official is willing to accept for a business process outage or disruption, including all impact considerations, is known as __________.

Answer 122

maximum tolerable downtime (MTD)

Question 123

The maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact on other system resources and supported business processes is known as __________.

Answer 123

recovery time objective (RTO)

Question 124

A useful tool for resolving the issue of what business function is the most critical, based on criteria selected by the organization, is the __________.

Answer 124

weighted table analysis or weighted factor analysis

Question 125

Which of the following is the first major task in the BIA, according to NIST SP 800-34, Rev. 1? -Calculate asset valuation and combine with the likelihood and impact of potential attacks in a TVA worksheet. -Determine mission/business processes and recovery criticality. -Identify resource requirements. -Identify recovery priorities for system resources.

Answer 125

Determine mission/business processes and recovery criticality.

Question 126

The amount of effort (expressed as elapsed time) needed to make business functions work again after the technology element is recovered is known as __________.

Answer 126

work recovery time (WRT)

Question 127

Which of the following NIST Cybersecurity Framework (CSF) stages relates to reacting to an incident?

Answer 127

Respond

Question 128

Which of the following NIST Cybersecurity Framework (CSF) stages relates to implementation of effective security controls (policy, education, training and awareness, and technology)?

Answer 128

Protect

Question 129

Which of the following is NOT a stage in the NIST Cybersecurity Framework (CSF)? -Identify -Detect -Recover -React

Answer 129

React

Question 130

What is a backup method that uses bulk batch transfer of data to an off-site facility and is usually conducted via leased lines or secure Internet connections?

Answer 130

electronic vaulting

Question 131

What refers to the backup of data to an off-site facility in close to real time based on transactions as they occur?

Answer 131

remote journaling

Question 132

What is the process of examining a possible incident and determining whether it constitutes an actual incident?

Answer 132

incident classification

Question 133

Which of the following is a "possible" indicator of an actual incident, according to Donald Pipkin? -unusual consumption of computing resources -activities at unexpected times -presence of hacker tools -reported attacks

Answer 133

unusual consumption of computing resources

Question 134

Which of the following is a definite indicator of an actual incident, according to Donald Pipkin? -unusual system crashes -reported attack -presence of new accounts -use of dormant accounts

Answer 134

use of dormant accounts

Question 135

The steps in IR are designed to:

Answer 135

stop the incident, mitigate incident effects, provide information for recovery from the incident

Question 136

What determines the scope of the breach of confidentiality, integrity, and availability of information and information assets?

Answer 136

incident damage assessment

Question 137

What is an organizational CP philosophy for overall approach to contingency planning reactions?

Answer 137

protect and forget

Question 138

Which of the following is a part of the incident recovery process? -identifying the vulnerabilities that allowed the incident to occur and spread -determining the event’s impact on normal business operations and, if necessary, making a disaster declaration -supporting personnel and their loved ones during the crisis -keeping the public informed about the event and the actions being taken to ensure the recovery of personnel and the enterprise

Answer 138

identifying the vulnerabilities that allowed the incident to occur and spread

Question 139

After an incident, but before returning to its normal duties, the CSIRT must do which of the following?

Answer 139

Conduct an after-action review.

Question 140

Which of the following is the best example of a rapid-onset disaster? -flood -hurricane -famine -environmental degradation

Answer 140

flood

Question 141

When a disaster renders the current business location unusable, which plan is put into action?

Answer 141

business continuity

Question 142

In the event of an incident or disaster, which planning element is used to guide off-site operations?

Answer 142

business continuity

Question 143

Which of the following is true about a hot site? -It is an empty room with standard heating, air conditioning, and electrical service. -It includes computing equipment and peripherals with servers but not client workstations. -It duplicates computing resources, peripherals, phone systems, applications, and workstations. -All communications services must be installed after the site is occupied.

Answer 143

It duplicates computing resources, peripherals, phone systems, applications, and workstations.

Question 144

In which type of site are no computer hardware or peripherals provided?

Answer 144

cold site

Question 145

Which of the following is a responsibility of the crisis management team? -restoring the data from backups -evaluating monitoring capabilities -keeping the public informed about the event and the actions being taken -restoring the services and processes in use

Answer 145

keeping the public informed about the event and the actions being taken

Question 146

In which contingency plan testing strategy do individuals follow each and every IR/DR/BC procedure, including the disruption of service, restoration of data from backups, and notification of appropriate individuals?

Answer 146

full-interruption

Question 147

In which contingency plan testing strategy do individuals participate in a role-playing exercise in which the CP team is presented with a scenario of an actual incident or disaster and expected to react as if it had occurred?

Answer 147

simulation

Question 148

__________ are a component of the "security triple."

Answer 148

Threats, Assets, Vulnerabilities

Question 149

A(n) __________ item is a hardware or software item that is to be modified and revised throughout its life cycle.

Answer 149

configuration

Question 150

A __________ is the recorded condition of a particular revision of a software or hardware configuration item.

Answer 150

version

Question 151

To maintain optimal performance, one typical recommendation suggests that when the memory usage associated with a particular CPU-based system averages __________% or more over prolonged periods, you should consider adding more memory.

Answer 151

60

Question 152

To evaluate the performance of a security system, administrators must establish system performance __________.

Answer 152

baselines

Question 153

Control __________ baselines are established for network traffic and for firewall performance and IDPS performance.

Answer 153

performance

Question 154

A primary mailing list for new vulnerabilities, called simply __________, provides time-sensitive coverage of emerging vulnerabilities, documenting how they are exploited and reporting on how to remediate them. Individuals can register for the flagship mailing list or any one of the entire family of its mailing lists.

Answer 154

Bugtraq

Question 155

The __________ is a center of Internet security expertise and is located at the Software Engineering Institute, a federally funded research and development center operated by Carnegie Mellon University.

Answer 155

CERT/CC

Question 156

The __________ Web site is home to the leading free network exploration tool, Nmap.

Answer 156

insecure.org

Question 157

The __________ commercial site focuses on current security tool resources.

Answer 157

Packet Storm

Question 158

The __________ mailing list includes announcements and discussion of a leading open-source IDPS.

Answer 158

Snort

Question 159

The optimum approach for escalation is based on a thorough integration of the monitoring process into the __________.

Answer 159

IRP

Question 160

Detailed __________ on the highest risk warnings can include identifying which vendor updates apply to which vulnerabilities as well as which types of defenses have been found to work against the specific vulnerabilities reported.

Answer 160

intelligence

Question 161

A process called __________ examines the traffic that flows through a system and its associated devices to identify the most frequently used devices.

Answer 161

traffic analysis

Question 162

One approach that can improve the situational awareness of the information security function is to use a process known as __________ to quickly identify changes to the internal environment.

Answer 162

difference analysis

Question 163

__________ is used to respond to network change requests and network architectural design proposals.

Answer 163

Network connectivity RA

Question 164

The __________ is a statement of the boundaries of the RA.

Answer 164

scope

Question 165

The __________ process is designed to find and document vulnerabilities that may be present because there are misconfigured systems in use within the organization.

Answer 165

PSV

Question 166

__________, a level beyond vulnerability testing, is a set of security tests and evaluations that simulate attacks by a malicious external source (hacker).

Answer 166

Penetration testing

Question 167

Common vulnerability assessment processes include:

Answer 167

Internet VA, wireless VA, intranet VA

Question 168

__________ penetration testing is usually used when a specific system or network segment is suspect and the organization wants the pen tester to focus on a particular aspect of the target.

Answer 168

White box

Question 169

A step commonly used for Internet vulnerability assessment includes __________, which occurs when the penetration test engine is unleashed at the scheduled time using the planned target list and test selection.

Answer 169

scanning

Question 170

The __________ vulnerability assessment is a process designed to find and document selected vulnerabilities that are likely to be present on the organization's internal network.

Answer 170

intranet

Question 171

The __________ vulnerability assessment is designed to find and document vulnerabilities that may be present in the organization’s wireless local area networks.

Answer 171

wireless

Question 172

What access control processes confirms the identity of the entity seeking access to a logical or physical area?

Answer 172

authentication

Question 173

Which of the following is NOT among the three types of authentication mechanisms? -something a person knows -something a person has -something a person says -something a person can produce

Answer 173

something a person says

Question 174

Which of the following characteristics currently used for authentication purposes is the LEAST unique? -fingerprints -iris -retina -face geometry

Answer 174

face geometry

Question 175

The rate at which authentic users are denied or prevented access to authorized areas as a result of a failure in the biometric device is known as the __________.

Answer 175

false reject rate

Question 176

What is a commonly used criterion for comparing and evaluating biometric technologies?

Answer 176

crossover error rate

Question 177

What biometric authentication systems is considered to be truly unique, suitable for use, and currently cost-effective?

Answer 177

fingerprint recognition

Question 178

What biometric authentication systems is the most accepted by users?

Answer 178

signature recognition

Question 179

Which type of firewall keeps track of each network connection established between internal and external systems?

Answer 179

stateful packet inspection

Question 180

The combination of a system's TCP/IP address and a service port is known as a __________.

Answer 180

socket

Question 181

Which type of device exists to intercept requests for information from external users and provide the requested information by retrieving it from an internal server?

Answer 181

proxy server

Question 182

The intermediate area between trusted and untrusted networks is referred to as which of the following?

Answer 182

demilitarized zone

Question 183

Which type of device can react to network traffic and create or modify configuration rules to adapt?

Answer 183

dynamic packet filtering firewall

Question 184

Which technology employs sockets to map internal private network addresses to a public address using one-to-many mapping?

Answer 184

port-address translation

Question 185

The bastion host is usually implemented as a __________, as it contains two network interfaces: one that is connected to the external network and one that is connected to the internal network, such that all traffic must go through the device to move between the internal and external networks.

Answer 185

dual-homed host

Question 186

In the _________ firewall architecture, a single device configured to filter packets serves as the sole security point between the two networks.

Answer 186

single bastion host

Question 187

Which of the following is true about firewalls and their ability to adapt in a network? -Firewalls can interpret human actions and make decisions outside their programming. -Because firewalls are not programmed like a computer, they are less error prone. -Firewalls are flexible and can adapt to new threats. -Firewalls deal strictly with defined patterns of measured observation.

Answer 187

Firewalls deal strictly with defined patterns of measured observation.

Question 188

Which of the following is NOT one of the administrative challenges to the operation of firewalls? -training -uniqueness -replacement -responsibility

Answer 188

replacement

Question 189

Which of the following is NOT a method employed by IDPSs to prevent an attack from succeeding? -sending DoS packets to the source -terminating the network connection -reconfiguring network devices -changing the attack’s content

Answer 189

sending DoS packets to the source

Question 190

Which type of IDPS is also known as a behavior-based intrusion detection system?

Answer 190

anomaly-based

Question 191

In an IDPS, a piece of software that resides on a system and reports back to a management server is known as a(n) __________.

Answer 191

Both of these are correct.

Question 192

Which type of IDPS works like antivirus software?

Answer 192

signature-based

Question 193

Which tool can best identify active computers on a network?

Answer 193

port scanner

Question 194

What is the next phase of the pre-attack data gathering process after an attacker has collected all of an organization’s Internet addresses?

Answer 194

fingerprinting

Question 195

What tool would you use if you want to collect information as it is being transmitted on the network and analyze the contents for the purpose of solving network problems?

Answer 195

packet sniffer

Question 196

What is an application that entices individuals who are illegally perusing the internal areas of a network by providing simulated rich content areas while the software notifies the administrator of the intrusion?

Answer 196

honey pot

Question 197

What is the organized research and investigation of Internet addresses owned or controlled by a target organization?

Answer 197

footprinting

Question 198

When an information security team is faced with a new technology, which of the following is NOT a recommended approach? -Determine if the benefits of the proposed technology justify the expected costs. -Include costs for any additional risk control requirements that are mandated by the new technology. -Consider how the proposed solution will affect the organization’s risk exposure. -Evaluate how the new technology will enhance employee skills.

Answer 198

Evaluate how the new technology will enhance employee skills.

Question 199

What is used in conjunction with an algorithm to make computer data secure from anybody except the intended recipient of the data?

Answer 199

key

Question 200

In which cipher method are values rearranged within a block to create the ciphertext?

Answer 200

permutation

Question 201

Which of the following is true about symmetric encryption? -It uses a secret key to encrypt and decrypt. -It uses a private and public key. -It is also known as public key encryption. -It requires four keys to hold a conversation.

Answer 201

It uses a secret key to encrypt and decrypt.

Question 202

Which technology has two modes of operation: transport and tunnel?

Answer 202

IP Security Protocol

Question 203

What provides an identification card of sorts to clients who request services in a Kerberos system?

Answer 203

ticket granting service

Question 204

What is a Kerberos service that initially exchanges information with the client and server by using secret keys?

Answer 204

key distribution center

Question 205

What is most commonly used for the goal of nonrepudiation in cryptography?

Answer 205

digital signature

Question 206

The process of obtaining the plaintext message from a ciphertext message without knowing the keys used to perform the encryption is known as __________.

Answer 206

cryptanalysis