Cissp Study Course Homework - Risk Management And Access Control

Front 1

An access control policy for a bank teller is an example of the implementation of what?

Back 1

Role-based policy

Front 2

What is defined as fact or opinion based information used to verify an individual's identity?

Back 2

Cognitive passwords

Front 3

Why should batch files and scripts be stored in a protected area?

Back 3

because they may contain credentials

Front 4

Behavorial-based systems are known as?

Back 4

profile-based systems

Front 5

Which Kerberos component holds all users and services cryptographic keys?

Back 5

the key distribution center

Front 6

What kind of certificate is used to validate a user identity?

Back 6

public key certificate

Front 7

Which type of security control is also known as a "logical" control?

Back 7

technical

Front 8

Which access control model requires a security clearance for subjects?

Back 8

mandatory access control (MAC)

Front 9

What is considered the weakest authentication mechanism?

Back 9

passwords

--passphrases, token devices, and one-time passwords are much stronger

Front 10

What trusted, third party authentication protocol was developed under Project Athena at MIT?

Back 10

Kerberos

Front 11

What should organizations consider first before connecting their LANs to the Internet?

Back 11

plan for considering proper authentication options

Front 12

What is considered a straight-forward approach that provides access rights to subjects for objects?

Back 12

Access Matrix Model

Front 13

Honeypots, intrusion detection software, and audit trails are all considered forms of what?

Back 13

detective technical controls

Front 14

What does the * property mean in the Bell-LaPadula model?

Back 14

no write down

Front 15

Intrusion detection systems and automatically generated violation reports from audit trails describes?

Back 15

detective and technical measures

Front 16

In biometric identification systems, at the beginning, it was soon apparent that truly positive identification could only be based on what?

Back 16

physical attributes of a person

Front 17

Controls provide accountability for individuals who are accessing sensitive information. This accountability is accomplished:

Back 17

through access control mechanisms that require identification and authentication and through the audit function

Front 18

What is Kerberos?

Back 18

a trusted third-party authentication protocol

Front 19

What is called the verification that the user's claimed identity is valid and is usually implemented through a user password at logon?

Back 19

authentication

Front 20

What is used for identification in physical controls and for authentication in logical controls?

Back 20

biometrics

Front 21

What is the most critical characteristic of a biometric identifying system?

Back 21

accuracy

Front 22

True or False.
In the process of gathering evidence from a computer attack, displaying the contents of a folder may compromise the whole evidence collection process.

Back 22

True

Front 23

True or False.
If access is not explicitly denied, it should be implicitly allowed as pertaining to access control.

Back 23

False

Front 24

According to the NISTIR 5153 document, what should not be recorded in the security audit trail?

Back 24

character strings inputted as a response to a password challenge

Front 25

What is called the access protection system that limits connections by calling back the number of a previously authorized location?

Back 25

Callback systems

Front 26

What is used to represent the columns of a table in a relational database?

Back 26

attributes

Front 27

Which security-model introduces access to objects only through programs?

Back 27

Clark-Wilson model

Front 28

Audit trails are a type of ____________ control?

Back 28

detective

Front 29

What refers to legitimate users accessing networked services that would normally be restricted to them?

Back 29

logon abuse

Front 30

A timely review of system access audit records is an example of what basic security function?

Back 30

detection

Front 31

What method is used to capture network user passwords?

Back 31

sniffing

Front 32

Who developed one of the first mathematical models of a multilevel-security computer system?

Back 32

Bell and LaPadula

Front 33

Using clipping levels refers to?

Back 33

setting allowable thresholds on a reported activity

Front 34

What term is used to describe a weakness that could potentially be exploited?

Back 34

vulnerability

Front 35

What is the main key management challenge associated with choosing an identity management solution?

Back 35

it must be able to scale to support high volumes of data and peak transaction rates

Front 36

A network-based vulnerability assessment is also called what?

Back 36

an active vulnerability assessment

Front 37

True or False.
System generated passwords are more vulnerable to brute force and dictionary attacks?

Back 37

False

Front 38

What is the main concern associated with single sign-on?

Back 38

maximum unauthorized access would be possible if a password is disclosed

Front 39

In biometric identification systems, the parts of the body conveniently available for identification are?

Back 39

hands, face, eyes

Front 40

The control measures that are intended to reveal the violations of security policy using technical means are associated with?

Back 40

detective and technical

Front 41

An IDS is what type of control?

Back 41

deterrent

Front 42

What is used to monitor network traffic in real time?

Back 42

network-based IDS

Front 43

Role-based, mandatory, and rule-based are all examples of?

Back 43

access controls

Front 44

What is a called a sequence of characters that is usually longer than the allotted number for a password?

Back 44

passphrase

Front 45

What is used to monitor network traffic or to monitor host audit logs in order to determine violations of security policy?

Back 45

IDS

Front 46

What type of control is concerned with avoiding occurrences of risks?

Back 46

preventative controls

Front 47

What is the Biba security model concerned with?

Back 47

Integrity

Front 48

What can be defined as a list of subjects along with their access rights that are authorized to access a specific object?

Back 48

an access control list (ACL)

Front 49

Syn Flood, Smurf, and TearDrop are all examples of what?

Back 49

denial of service attacks

Front 50

What is the first step in protecting data's confidentiality?

Back 50

identify what information is sensitive

Front 51

What protocol protects a password from eavesdroppers and supports the encryption of communication?

Back 51

CHAP

Front 52

Which access model achieves data integrity through well-formed transactions and separation of duties?

Back 52

Clark-Wilson model

Front 53

What physical characteristic does a retina scan biometric device measure?

Back 53

the pattern of blood vessels at the back of the eye

Front 54

Which access control model is best suited in an environment where a high security level is required and where it is desired that only the admin grants access control?

Back 54

MAC

Front 55

What are called user interfaces that limit the functions that can be selected by a user?

Back 55

Constrained user interfaces

Front 56

What primary security service is provided by Kerberos?

Back 56

Authentication

Front 57

What is an alternate to using passwords for authentication in logical or technical access control?

Back 57

Biometrics

Front 58

Mandatory access requires sensitivity labels to be attached to all objects. What are considered objects on a MAC system?

Back 58

files, directories, and devices

Front 59

A chunk of data, or sequence of commands that take advantage of a bug, glitch, or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software best describes what?

Back 59

exploit

Front 60

In a security context, what are database views used for?

Back 60

to restrict user access to data in a database

Front 61

In what type of access control does the system determine which users or groups may access a file?

Back 61

MAC

Front 62

In biometric identification systems, at the beginning, it became apparent that truly positive identification could only be based on physical attributes of a person. What questions did this raise?

Back 62

What part of the body should be used and how to accomplish identification to be viable

Front 63

Password aging, minimum password length, and account expiration all describe what type of login control?

Back 63

preventive

Front 64

Which access control model is based on sensitivity labels?

Back 64

MAC

Front 65

What centralized access control mechanism is not appropriate for mobile workers accessing the corporate network over analog lines?

Back 65

Call-back

Front 66

Tokes, smart cards, and biometric devices used in conjunction with other factors to validate identification and authentication provide robust authentication of the individual by practicing what principle?

Back 66

two-factor authentication

Front 67

What is the main focus of the Bell-LaPadula security model?

Back 67

confidentiality

Front 68

What is the primary use of a password?

Back 68

authenticate the user

Front 69

Which access control mode is also called non discretionary access control?

Back 69

role-based access control

Front 70

What would be the name of a logical or virtual table dynamically generated to restrict the information a user can access in a database?

Back 70

database views

Front 71

What is not a security goal for remote access?

Back 71

automated login for remote users

Front 72

What security principle is not addressed by Kerberos?

Back 72

availability

Front 73

What is required for system accountability?

Back 73

audit mechanisms

Front 74

Policies and procedures, security awareness training, background checks, work habit checks, a review of personal family history, and increased supervision are all factors of what type of control?

Back 74

administrative controls

Front 75

What security principle does the Clark-Wilson security model focus on?

Back 75

integrity

Front 76

The act of requiring two of the three factors to be used in the authentication process refers to?

Back 76

two-factor authentication

Front 77

Something you know, something you have, and something you are describes the factors of?

Back 77

authentication

Front 78

Which access control model uses a directed graph to specify rights that can be transferred from a subject to an object?

Back 78

the take-grant model

Front 79

What best describes a tool (key fob, calculator, memory card, or smart card) used to supply dynamic passwords?

Back 79

tokens

Front 80

Once an individual obtains access to the system through the initial logon, they have access to all resources within the environment that the account has access to describes a major disadvantage of what?

Back 80

single sign-on (SSO)

Front 81

Which access model is most appropriate for companies with a high employee turnover?

Back 81

role-based access control

Front 82

What is defined as high level statements on management's expectations that must be met in regards to security?

Back 82

security policy

Front 83

The task of collecting as much information as possible about your target prior to moving to other phases refers to what?

Back 83

reconnaissance

Front 84

A weakness or lack of a safeguard which may be exploited by a threat, causing harm to the information systems or networks is called a?

Back 84

vulnerability

Front 85

Modifying employee attitude and behavior is one goal of a ______________ program?

Back 85

security awareness

Front 86

What is define as protection mechanisms implemented after an information system has become operational?

Back 86

add-on security

Front 87

What would be the annualized rate of occurrence (ARO) of the threat "user input error", in the case where a company employs 100 data entry clerks and every one of them makes one input error each month?

Back 87

1,200

Front 88

What is the difference between advisory and regulatory security policies?

Back 88

Advisory policies are not mandated. Regulatory policies must be implemented.

Front 89

What is the main difference between quantitative and qualitative analysis?

Back 89

quantitative provides a formal cost/benefit analysis, qualitative does not

Front 90

What is the best criterion to consider in determining the classification of an information asset?

Back 90

value

Front 91

The absence of a safeguard or a weakness in a system that may possibly be exploited is called?

Back 91

vulnerability

Front 92

What is the highest amount a company should spend annually on countermeasures for protecting an asset valued at $1,000,000 from a threat that has an ARO of once every five years and an EF of 30%?

Back 92

$60,000

Front 93

What group represents the leading source of computer crime losses?

Back 93

employees

Front 94

Within the context of the CBK, what provides a minimum level of security acceptable for an environment?

Back 94

a baseline

Front 95

True or False.
IT security measures should be tailored to meet organizational security goals.

Back 95

True

Front 96

Whose role is it to assign classification levels to information?

Back 96

owner or data owner

Front 97

In a discretionary access environment, what entity is authorized to grant information access to other people?

Back 97

owner

Front 98

What type of documentation embodies all the detailed actions that personnel are required to follow?

Back 98

procedures

Front 99

How should a risk be handled when the cost of the countermeasure outweighs the cost of the risk?

Back 99

accept the risk

Front 100

All risks must be _________.

Back 100

identified

Front 101

What is opposite of the CIA in risk management?

Back 101

disclosure, alteration, and destruction

Front 102

What is considered the weakest link in a security system?

Back 102

people

Front 103

What formula is used to represent an ALE calculation?

Back 103

SLE x ARO = ALE

Front 104

Which approach to a security program makes sure that the people actually responsible for protecting the company's assets are driving the program?

Back 104

top-down approach

Front 105

Making sure data has not been changed unintentionally due to an accident or malice is?

Back 105

integrity

Front 106

Making sure data is accessible when and where it is needed is?

Back 106

availability

Front 107

True or False.
Within the realm of IT security, threat coupled with a vulnerability best defines risk.

Back 107

True

Front 108

The likelihood of a threat agent taking advantage of a vulnerability is?

Back 108

a risk

Front 109

What is the main responsibility of the information (data) owner?

Back 109

determining the data sensitivity or classification level

Front 110

What is the first step in establishing an information security program?

Back 110

adoption of a corporate information security policy statement

Front 111

Preservation of confidentiality information systems requires that the information is not disclosed to?

Back 111

unauthorized persons or processes