Cis 4840 Chap 3

Front 1

John is a security expert who is stress testing a new server in his lab. He notices a security flaw one day and to ensure that his assumptions are correct, he exploits it. Which of the following terms would John be characterized as?

Back 1

White hat

Front 2

Advocates of full disclosure argue all of the following except which?

Back 2

Full disclosure promotes the existence of script kiddies.

Front 3

According to CERT"s full disclosure policy, when will software vulnerability be released to the public after it i sfirst reported and assuming all stipulations are met by the vendor?

Back 3

45 days

Front 4

The RFP Full Disclosure Policy enforces stricter actions on the software vendors than the other vulnerability disclosure models. What does RFP stand for?

Back 4

RainForest Puppy

Front 5

A consortium participates in the software vulnerability arena by working to achieve two primary goals:Reduce the risk of software vulnerability by providing an improved method of identification, investigation, and resolution.
2) Improve the overall engineering quality of software by tightening the scrutiny placed upon the end product. What is this consortium?

Back 5

OIS

Front 6

According to the OIS disclosure policy, what should the vulnerability finder complete and send to the vendor once a flaw has been identified and verified?

Back 6

VSR

Front 7

Which disclosure policy states that a vendor has five days to respond to a vulnerability report or the finder can take the information public?

Back 7

Full Disclosure RFP

Front 8

Which of the following is a global security organization that employs bug finders to look for vulnerabilities within commonly used systems and application?

Back 8

iDefense