Reading...
Play button
Play button
Use LEFT and RIGHT arrow keys to navigate between flashcards;
Use UP and DOWN arrow keys to flip the card;
H to show hint;
A reads text to speech;
84 Cards in this Set
- Front
- Back
|
Which of the following attacks would compromise the integrity of system information?
a. Denial of Service B. Smurf C. SQL Injection D. Fraggle |
C. SQL Injection
|
|
|
Which of the following is not a responsibility of the data or systems owner
a. To identify, designate the sensitivity of the application systems b. To ensure that appropriate security control requirements are included in specifications c. To assess security requirements by evaluating application assets, threats, and vulnerabilities. d. To develop industry best practices |
D. To develop industry best practices
|
|
|
A policy for physical component of the information technology infrastructure could work with all of the following except.
A. Firewalls B. ID Badges C. Cameras D. Security Guards |
A. Firewalls
|
|
|
Which of the following is NOT an example of the platform component of information technology infrastructure?
A. Switch Security B. Operating System Security C. Application Security D. Anti-Virus |
A. Switch Security
|
|
|
Which of the following is an example of the network component of information technology infrastructure?
A. Switch Security B. Operating systems security C. Application Security D. Anti-Virus |
A. Switch Security
|
|
|
When implementing a security control, an information security manager needs to be especially aware of:
A. Change control management B. What the organization's competition is doing C. A promotion to production procedure D. The impact on the end-use community |
D. The impact on the end-user community
|
|
|
Which of the following is often a disadvantage of using a closed system?
A. Lack of end user support B. Lack of product functionality C. The source code cannot be verified. D. The source code is provided by the Internet community at large. |
C. The source code cannot be verified
|
|
|
Which of the following is an advantage of an open system?
A. End user support B. The source code can be verified C. Difficulty in management D. All users are always permitted to access the system |
B. The source code can be verified
|
|
|
What would be the disadvantage of deploying a proxy-based firewall?
A. Proxy-based firewalls may not support custom applications B. Proxy based firewalls inspect on only the network layer of the OSI model. C. Proxy-based firewalls cannot block unwanted traffic. D. Proxy-based firewalls do not provide network address translation |
A. Proxy-based firewalls may not support custom applications
|
|
|
Which of the following is true of a stateful inspection firewall?
A. Stateful inspection firewalls protect through all layers of the OSI model B. Stateful inspection firewalls support more custom applications than other firewalls. C. Stateful inspection firewalls are faster than other firewalls. D. Stateful inspection firewalls do not provide network address translation |
B. Stateful inspection firewalls support more custom applications than other firewalls.
|
|
|
Which of the following is tru regarding a packet filter firewall?
A. Packet filter firewalls provide more protection than other firewalls B. Packet filter firewalls provide protection through the entire OSI model. C. Packet filter firewalls do not provide network address translation D. Packet filter firewalls provide less protection than other firewalls |
D. Packet filter firewalls provide less protection than other firewalls
|
|
|
Which of the following would be an advantage to deploying public key (asymmetric) as opposed to private key (symmetric) encryption technologies?
a. Public key is more scalable b. Public key encryption is faster c. Public key requires less infrastructure d. Private key is easier on the end-user community |
a. Public key is more scalable
|
|
|
Digital signatures encrypt the message hash with which of the following keys?
A. Sender's public key B. Sender's private key C. Receiver's public key D. Receiver's private key |
B. Sender's private key
|
|
|
What term is best defined as a model used to determine the security and functionality of a proposed project
A. Prototype B. Checkpoint C. Journaling D. Service level agreement |
A. Prototype
|
|
|
What is an advantage in performing a vulnerability assessment over a penetration test?
A. Penetration tests test the entire network B. Vulnerability assessments compromise a system or network C. Vulnerability assessments are a structured repeatable test D. Vulnerability assessments are faster to conduct than penetration testing |
C. Vulnerability assessments are a structured repeatable test
|
|
|
What advantage does discretionary access control have over mandatory access control?
A. MAC is easier to implement B. DAC uses extensive labeling C. DAC has less administrative overhead D. DAC is determined by policy |
C. DAC has less administrative overhead
|
|
|
Which of the following technologies protects the confidentiality of information by embedding the message into an image or music file?
A. Public key cryptography B. Private key cryptography C. Digital Signatures D. Steganography |
D. Steganography
|
|
|
Which of the following algorithms is a public key algorithm?
A. DES B. AES C. RC4 D. RSA |
D. RSA
|
|
|
Two factor authentication can be established by combining something you have, you are, and which of the following terms?
A. You Know B. You read C. You touch D. You need |
A. You know
|
|
|
Which of the following can be a security concern with host-based single-sign-on implementations?
A. Passwords are often stored in plaintext B. Passwords are often transmitted in plaintext C. Authentication host can be a single point of failure D. Lack of scalability |
C. Authentication host can be a single point of failure
|
|
|
A Message Authentication Code (MAC) is a message digest encrypted with the following keys?
A. The sender's public key B. The session Key C. the receiver's public key D. The server's public key |
B. The session key
|
|
|
Message hashes provide which of the following principles of information security management?
A. Integrity B. Confidentiality C. Availability D. Authentication |
A. Integrity
|
|
|
Which of the following terms is best defined as a project to identify the threats that exist over key information and information technology?
A. Vulnerability Assessment B. Penetration Testing C. Threat Analysis D. System Development Life Cycle |
C. Threat Analysis
|
|
|
Key escrow is an example of which of the following security principles?
A. Split Knowledge B. Two-factor authentication C. Need to Know D. Least privilege |
A. Split Knowledge
|
|
|
Which of the following algorithms is an an example of a one-time pad?
A. DES B. AES C. RSA D. RC4 |
D. RC4
|
|
|
A one-time pad differs from other symmetric key algorithms in that.
A. The new key is never exchanged B. The key is used for one message and then discarded C. The length of the key can be longer for other algorithms D. the key dynamically regenerates |
B. The key is used for one message and then discarded
|
|
|
Which of the following terms relates to increasing the integrity of information on a system?
A. Fault tolerance B. Fail Over C. Checkpoint D. Host-based intrusion detection |
D. Host-based intrusion detection
|
|
|
Public key cryptographic algorithms can be used for encryption and
A. Message Authentication Codes B. Digital signatures C. Message hashing D. Message integrity checks |
B. Digital signatures
|
|
|
First step in system development life cycle?
A. Perform a BIA B. Perform a penetration test C. Perform a vulnerability assessment D. Perform a risk analysis |
D. Perform a risk analysis
|
|
|
When should security become involved in the SDLC
A. Prior to implementation B. Prior to all audits C. during requirements development D. During development |
C. during requirements development
|
|
|
To implement the results of a risk assessment, the information security manager should assign responsibilities and
A. Define an implementation schedule B. Define a vulnerability matrix C. Define a system development life cycle D. Define a matrix for prototyping |
A. Define an implementation schedule
|
|
|
When comparing the security of wireless networks with traditional or cabled networking
A. Wired networking provides more points of potential eavesdropping B. Eavesdropping is not possible on a wireless network C. Wired networking provides some protection from eavesdropping D. Eavesdropping is not possible on a wireless network |
C. Wired networking provides some protection from eavesdropping
|
|
|
In order to determine metrics for your network you will need to begin with a measurement of current network conditions. This is called a
A. Threat assessment B. Baseline C. Risk assessment D. Prototype |
B. Baseline
|
|
|
Which of the following can be a disadvantage of using a centralized access control system?
A. Lack of consistent administration B. Lack of resource control C. Difficulty in synchronizing account information D. It can create a single point of failure |
D. It can create a single point of failure
|
|
|
Formal acceptance, by management, of a 3rd party review of the security controls of a system, network, or application is:
A. Certification B. Authentication C. Accreditation D. Classification |
C. Accreditation
|
|
|
Prior to development, to determine possible exposure points to a new application in you organization the information security manager would perform a
A. Vulnerability assessment B. BIA C. Risk Assessment D. Penetration Test |
C. Risk Assessment
|
|
|
Which of the following technologies or standards would apply to authenticating a wireless network connection?
A. Wired equivalent privacy B. 802.11b C. 802.11a D. 802.1x |
D. 802.1x
|
|
|
Wired Equivalent Privacy is a control that increases which of the basic principles of infosec mgmt?
A. Confidentiality B. Integrity C. Availability D. Authentication |
A. Confidentiality
|
|
|
SLA with a managed service provided provide minimum requirements and are included in a
A. Contract B. Policy C. Procedure D. Standard |
A. Contract
|
|
|
For e-mail messages with the greatest sensitivity which of the following technologies would have to be employed to provide confidentiality, integrity and authenticity?
A. Digital Signatures B. Message Digests C. Private Key Encryption D. Digital Signatures and encryption |
D. Digital Signatures and encryption
|
|
|
Which of the following technologies provide a mechanism for storing a digital certificate?
A. Magnetic cards B. Smart cards C. Stream cipher D. Block cipher |
B. Smart cards
|
|
|
Which layer of the OSI model would be responsible for ensuring reliable end-to-end delivery of a message?
A. Physical B. Application C. Session D. Transport |
D. Transport
|
|
|
At what layer of the OSI model would a proxy-based firewall exist?
A. Physical B. Application C. Session D. Transport |
B. Application
|
|
|
MD5 is an algorithm that is used to ensure message:
A. Integrity B. Authenticity C. Confidentiality D. Fault tolerance |
A. Integrity
|
|
|
Creating a message digest is often the first step in creating a
A. Packet B. Digital Signature C. Public key D. Private key |
B. Digital Signature
|
|
|
An attacker who is attempting to defeat an access control system often starts by performing which of the common types of attacks?
A. Brute force attack B. Denial of service attack C. Distributed Denial of service attack D. Dictionary attack |
D. Dictionary attack
|
|
|
Temporal Key Integrity Protocol (TKIP) is a component of Wi-Fi Protected Access (WPA). What is the major advantage of using TKIP?
A. TKIP ensures data integrity B. TKIP allows data encryption keys to be changed at regular time intervals C. TKIP provides protection against wireless denial-of-service attacks D. TKIP increases the signal strength of wireless networks |
B. TKIP allows data encryption keys to be changed at regular time intervals
|
|
|
An e-mail with a large attachment designed to slow down the response time for the e-mail server is a representation of what type of malicious code?
A. Trojan horse B. Worm C. E-mail bomb D. Logic Bomb |
C. E-mail bomb
|
|
|
What type of malicious code is a code fragment that attaches to a file and often replicates through the sharing of files on a network?
A. Virus B. Worm C. E-mail bomb D. Logic bomb |
A. Virus
|
|
|
What type of malicious code is typically a complete file that infects only one place on a single system and replicates through the network without file sharing?
A. Virus B. Worm C. E-mail bomb D. Logic bomb |
B. Worm
|
|
|
True or false: Private key cryptography requires less processing power than public key cryptography?
True False |
True
|
|
|
Which of the following IPSEC related terms will help resolve authentication issues present in Internet Protocol (IP)?
A. High level Message Authentication Code (HMAC) B. Authentication Headers (AH) C. Encapsulated Secure Payload (ESP) D. Data Encryption Standard (DES) |
B. Authentication Headers (AH)
|
|
|
Which of the following is true regarding IPSEC?
A. IPSEC will encapsulate IP traffic only B. IPSEC will support only one concurrent tunnel. C. IPSEC operates at the physical layer of the OSI Model. D. IPSEC requires the use of PKI. |
A. IPSEC will encapsulate IP traffic only
|
|
|
Presenting a fraudulent IP address to attempt to bypass the access control enforced by a stateful inspection firewall is an example of what common type of network attack?
A. Social engineering B. Spoofing C. SYN Flood D. Steganography |
B. Spoofing
|
|
|
Which of the following positions would be most likely to determine the security policy regarding access of information on a system?
A. Users B. Business process owners C. Senior Management D. Information Security Manager |
B. Business process owners
|
|
|
Which of the following groups or organizations is most commonly used to develop baselines for information systems?
A. Developers B. Programmers C. Software Vendors D. Promotion to production staff |
C. Software Vendors
|
|
|
Which type of malicious detection software would detect a polymorphic virus by comparing the function of the application rather than comparing it to a known signature?
A. Heuristic scanner B. Host-based intrusion detection C. Network-based intrusion detection D. Gateway anti-virus scanner |
A. Heuristic scanner
|
|
|
Primary difference between SSL and SHTTP
A. SSL only encrypts Web traffic B. SHTTP does not encrypt data C. SSL does not encrypt the data D. SSL is a transport-layer protocol |
D. SSL is a transport-layer protocol
|
|
|
Which statement accurately reflects the encryption used by SSL
A. The session key is encrypted using asymmetric key encryption and the bulk data is encrypted with symmetric encryption. B. The bulk data transfer is encrypted using asymmetric encryption; the key is exchanged out of band. C. SSL uses asymmetric encryption for both session key exchange and bulk data encryption D. SSL does not use encryption |
A. The session key is encrypted using asymmetric key encryption and the bulk data is encrypted with symmetric encryption.
|
|
|
If you wanted to ensure integrity of a message; which of the following technologies would provide the most insurance against tampering?
A. Logging before and after records B. Digital Signatures C. Asymmetric encryption D. Symmetric encryption |
B. Digital Signatures
|
|
|
A vendor is recommending implementation of a new technology that will give your application nonrepudiation. Which of the following primary tenants of information security will be addressed with this solution?
A. Availability and integrity? B. Confidentiality and integrity? C. Confidentiality and authenticity? D. Authenticity and integrity? |
D. Authenticity and integrity
|
|
|
Which of the following primary tenants of information security will be addressed by using 802.1x with a wireless network?
A. Authentication B. Availability C. Integrity D. Confidentiality |
A. Authentication
|
|
|
Which of the following technologies is commonly used in conjunction with 802.1x authentication?
A. Remote Authentication Dial In User Service (RADIUS) B. Single sign on (SSO) C. Public Key Infrastructure (PKI) D. Intrusion Detection System (IDS) |
A. Remote Authentication Dial In User Service (RADIUS)
|
|
|
Which common type of access control system assigns rights to job functions and not user accounts?
A. Rule-based access control B. Role-based access control C. Mandatory access control D. Discretionary access control |
B. Role-based access control
|
|
|
Which of the following is an example of security issues that can occur within the system development life cycle?
A. Lack of Senior management support B. Security is not involved in the requirements development C. Vendor interoperability D. Network latency |
B. Security is not involved in the requirements development
|
|
|
The information security manager needs to be most aware of which of the following issues when implementing new security controls?
A. Impact on end users B. Senior management support C. System development life cycle D. Annual Loss Expectancy |
A. Impact on end users
|
|
|
Which of the following security concerns needs to be addressed during the disposal phase of the SDLC?
A. Maintaining integrity of information B. Maintaining availability of the system C. Maintaining nonrepudiation of user access D. Maintaining confidentiality of information |
D. Maintaining confidentiality of information
|
|
|
Change control can be used in many phases on the SDLC. At which phase of the SDLC would you not use a change control process?
A. Development B. Installation C. Disposal D. Requirements |
D. Requirements
|
|
|
Which of the following types of controls would affect direct access to system consoles?
A. Process B. Platform C. Physical D. Network |
C. Physical
|
|
|
Which of the following types of controls would affect the security of an operating system?
A. Process B. Platform C. Physical D. Network |
B. Platform
|
|
|
Which of the following technologies would utilize a Public Key Infrastructure (PKI)?
A. Secure HyperText Transfer Protocol (SHTTP) B. Secure Shell (SSH) C. Message Authentication Code (MAC) D. Digital Signatures |
D. Digital Signatures
|
|
|
Smart card technology is often used for what information security purpose?
A. Message Integrity B. Authentication C. Confidentiality D. Availability |
B. Authentication
|
|
|
Extensible Markup Language (XML) is a language often used with Web application development. XML provides which of the following?
A. Dynamic Content Delivery B. Dynamic Message integrity C. Dynamic user authentication D. Dynamic client configuration |
A. Dynamic Content Delivery
|
|
|
An acceptable use policy would be an example of which type of control?
A. Process B. Platform C. Physical D. Network |
A. Process
|
|
|
Which type of attack against access control systems uses a list of common words?
A. A brute force attack B. A denial of service attack C. A dictionary attack D. A network spoofing attack |
C. A dictionary attack
|
|
|
Which type of information security process assigns a level of sensitivity of data as it is being created, amended, enhanced, stored, or transmitted?
A. Risk analysis B. Risk assessment C. Network vulnerability assessment D. Information Classification |
D. Information Classification
|
|
|
Which type of device creates a variable; alternating current (AC) field for the purpose of demagnetizing magnetic recording media?
A. A degausser B. A demagnetizer C. A deionizer D. A deflator |
A. A degausser
|
|
|
Which of the following terms frequently refers to a network segment between the Internet and a private network?
A. A security domain B. A zone of control C. A DeMilitarized Zone (DMZ) D. A security kernel |
C. A DeMilitarized Zone (DMZ)
|
|
|
Which type of network attack captures sensitive pieces of information, such as passwords, passing through a network?
A. Spoofing B. SYN flood C. Sniffing D. Steganography |
C. Sniffing
|
|
|
Which of the following technologies would best secure the data on a laptop or other device that could be stolen?
A. Data encryption B. File deletion C. No access to the floppy drive D. Port scanning |
A. Data encryption
|
|
|
Which of the following attacks is an example of a passive attack?
A. Spoofing B. SYN flood C. Information gathering D. Port scanning |
C. Information gathering
|
|
|
Which of the following common network attacks is an example of denial of service attack?
A. Spoofing B. SYN flood C. Sniffing D. Port scanning |
B. SYN flood
|
|
|
Which of the following common network attacks is an example of an active attack?
A. Information gathering B. Traffic analysis C. Sniffing D. Port scanning |
D. Port scanning
|
|
|
Which type of network attack is most likely to present the ability to execute commands on a compromised machine?
A. Spoofing B. SYN flood C. Sniffing D. Buffer overflow |
D. Buffer overflow
|
