Exam 1 Practice Questions

Front 1

Although it is sometimes thought to be immune to attacks, Apple has shown that it too can be the victim of attackers and encourages its uders to be more secure.

True or False?

Back 1

True

Front 2

In a general sense, security is defined as a state of freedom from danger or risk.

True or False?

Back 2

True

Front 3

Utility companies, telecommunications, and financial services are considered prime targets of cyberterrorists because they can significantly disrupt business and personal activities by destroying a few targets.

True or False?

Back 3

True

Front 4

Removing a rootkit from an infected computer is extremely difficult.

True or False?

Back 4

True

Front 5

TCP/IP hijacking is successful because several protocols, such as File Transfer Protocol (FTP) and Telnet, do not check the source IP addresses of the device from which they receive packets.

True or False?

Back 5

True

Front 6

Controlling wireless access of devices to the WLAN is accomplished by limiting a device's access to the access point (AP)

True or False?

Back 6

True

Front 7

WEP relies on a secret key that is shared between the wireless client device and the AP.

True or False?

Back 7

True

Front 8

IEEE 802.11 WEP shared secret keys must be a minimum of 32 bits in length.

True or False?

Back 8

False

Front 9

Mandatory Access Control (MAC) model is the least restrictive access control model.

True or False?

Back 9

False

Front 10

Although ACLs can be associated with any type of object, these lists are most often viewed in relation to files maintained by the operating system.

True or False?

Back 10

True

Front 11

In a _____ attack, attackers can use hundreds or thousands of computers in an attack against a single computer or network.

Back 11

d. Distributed

Front 12

_____ ensures that only authorized parties can view information.

Back 12

d. Confidentiality

Front 13

_____ ensures that information is correct and that no unauthorized person or malicious software has altered that data.

Back 13

d. Integrity

Front 14

Business _____ theft involves stealing proprietary business information such as research for a new drug or a list of customers that competitors are eager to acquire.

Back 14

b. Data

Front 15

According to the 2007 FBI Computer Crime and Security Survey, the loss due to the theft of confidential data for 494 respondents was approximately _____.

Back 15

b. $10 Million

Front 16

____ involves using someone's personal information, such as social security numbers, to establish bank or credit card accounts that are then left unpaid, leaving the victim with the debts and ruining their credit rating.

Back 16

d.) Identity theft

Front 17

Under the _____, healthcare enterprises must guard protected health information and implemented policies and procedures to safeguard it, whether it be in paper or electronic format.

Back 17

c.) HIPAA

Front 18

What is the maximum fine for those who wrongfully disclose individually indentifiable health information with the intent to sell it?

Back 18

b.) $250,000

Front 19

In a company of 500 employees, it is estimated that _____ employees would be required to combat a virus attack.

Back 19

b.) five

Front 20

Targeted attacks against financial networks, unauthorized access to information, and the theft of personal information is sometimes known as _____.

Back 20

c.) cybercrime

Front 21

A security _____ focuses on the administration and management of plans, policies, and people.

Back 21

c.) manager

Front 22

A study by Foote Partners showed that security certifications earn employees ____ percent more than their uncertified counterparts.

Back 22

a.) 10 - 14

Front 23

A computer ____ is a program that secretly attaches itself to a legitimate "carrier", such as a document or program, and then executes when that document is opened or program is launched.

Back 23

c.) virus

Front 24

A _____ virus can interrupt almost any function executed by the computer operating system and alter it for its own malicious purposes.

Back 24

d.) resident

Front 25

In order to avoid detection, some viruses can alter how they appear. These are known as _____ viruses.

Back 25

c.) metamorphic

Front 26

A _____ is a program advertised as performing one activity but actually does something else.

Back 26

d.) Trojan

Front 27

A _____ is a computer program or part of a program that lies dormant until it is triggered by a specific logical event.

Back 27

b.) Logic bomb

Front 28

_____ involves horizontally seperating words, although it is still readable by the human eye.

Back 28

d.) Word splitting

Front 29

_____ is a software program that delivers advertising content in a manner that is unexpected and unwanted by the user.

Back 29

d.) Adware

Front 30

Today's computer systems have a(n) _____ chip in which the contents can be rewritten to provide new functionality.

Back 30

a.) PROM

Front 31

Flash memory is a type of ____, nonvolatile computer memory that can be electrically erased and rewritten repeatedly.

Back 31

a.) EEPROM

Front 32

A _____ is a single, dedicated hard disk-based file storage device that provides centralized and consolidated disk storage available to LAN users through a standard network connection.

Back 32

b.) NAS

Front 33

The ____ is the link between the cellular network and the wired telephone world and controls all transmitters and base stations in the cellular network.

Back 33

d.) MTSO

Front 34

____ is means of managing and presenting computer resources by function without regard to their physical layout or location.

Back 34

d.) Virtualization

Front 35

One type of virtualization in which an entire operating system environment is simulated is known as _____ virtualization.

Back 35

b.) operating system

Front 36

Creating and managing multiple server operating systems is known as ____ virtualization.

Back 36

c.) server

Front 37

Live migration can be used for ___; if the demand for a service or application increases, then network managers can quickly move this high-demand virtual machine to another physical server with more RAM or CPU resources.

Back 37

c.) load balancing

Front 38

A _____ is a cumulative package of all security updates plus additional features.

Back 38

a.) service pack

Front 39

A(n) ____ is a computer programming language that is typically interpreted into a language the computer can understand.

Back 39

b.) scripting language

Front 40

____ typically involves using client-side scripts written in JavaScript that are designed to extract information from the victim and then pass the information to the attacker.

Back 40

b.) Cross site scripting (XSS)

Front 41

____ is a process of ensuring that any inputs are "clean" and will not corrupt the system.

Back 41

a.) input validation

Front 42

____ is a language used to view and manipulate data that is stored in a relational database.

Back 42

b.) SQL

Front 43

____ hinges on an attacker being able to enter an SQL database query into a dynamic Web page.

Back 43

c.) SQL injection

Front 44

Regarding e-mail, ____ is responsible for incoming mail.

Back 44

d.) POP3

Front 45

SMTP servers can forward e-mail sent from an e-mail client to a remote domain. THis is known as _____.

Back 45

c.) SMTP relay

Front 46

____ is real-time communication between two or more users.

Back 46

c.) Instant Messaging (IM)

Front 47

In a P2P network, a ____ is a server program operated by the person or organization that wants to share the file.

Back 47

d.) tracker

Front 48

BitTorrent maximizes the transfer speed by gathering pieces of the file and downloading these peices simultaneously from users who alread have them. The collective pieces are called a ____.

Back 48

d.) swarm

Front 49

____ allows the administrator to configure a switch to redirect traffic that occurs on some or all ports to a designated monitoring port on the switch.

Back 49

d.) Port mirroring

Front 50

With wireless CSMA/CA, the amount of time that a device must wait after the medium is clear is called the ____.

Back 50

b.) slot time

Front 51

____ specifies that before a networked device starts to send, it should first listen (called carrier sensing) to see if any other device is transmitting.

Back 51

d.) CSMA/CD

Front 52

A(n) ____ attack makes a copy of the transmission before sending it to the recipient.

Back 52

a.) relay

Front 53

One approach to substituting a fraudulent IP address is to tarter the external DNS server and is called ____.

Back 53

c.) DNS poisoning

Front 54

An attacker could alter the MAC address in the ARP cache so that the corresponding IP address would point to a different computer, which is known as ____.

Back 54

d.) ARP poisoning

Front 55

Wireless location mapping is the formal expression for ____.

Back 55

c.) war driving

Front 56

The most common type of antenna for war driving is an omnidirectional antenna, also known as a ____ antenna.

Back 56

c.) Dipole

Front 57

A group of piconets in which connections exist between different piconets is called a ____.

Back 57

c.) scatternet

Front 58

____ is the unauthorized access of information from a wireless device through a bluetooth connection.

Back 58

a.) Bluesnarfing

Front 59

Using ____, networks can essentially be divided into three parts: network, subnet and host.

Back 59

c.) Subnetting

Front 60

____ IP addresses are not assigned to any specific user or organization; instead, they can be used by any user on the private internal network.

Back 60

a.) Private

Front 61

A variation of NAT is ____. Instead of giving each outgoing packet a different IP address, each packet is given the same IP address but a different TCP port number.

Back 61

c.) PAT

Front 62

____ examines the current state of a system or network device before it is allowed to connect to the network.

Back 62

c.) NAC

Front 63

The goal of ____ is to prevent computer with sub-optimal security from potentially infecting other computers through the network.

Back 63

c.) NAC

Front 64

____ packet filtering keeps a record of the state of a connection between an internal computer and an external server and then makes decisions based on the connection as well as the rule base.

Back 64

c.) Stateful

Front 65

The goal of a ____ is to hide the IP address of client systems inside the secure network.

Back 65

a.) Proxy server

Front 66

____ honeypots are used mainly by organizations to capture limited information regarding attacks on that organization's honeypot.

Back 66

a.) Production

Front 67

____ honeypots are complex to deploy and capture extensive information. These are used primarily by research, military and government organizations.

Back 67

a.) Research

Front 68

A(n) ____ attempts to identify inappropriate activity.

Back 68

a.) IDS

Front 69

A(n) ____ finds malicious traffic and deals with it immediately.

Back 69

c.) IPS

Front 70

____ work to protect the entire network and all devices that are connected to it.

Back 70

d.) NIPS

Front 71

____ can fully decode application-layer network protocols. Once these protocols are decoded, the different parts of the protocol can be analayzed for any suspicious behavior.

Back 71

a.) Protocol analyzers

Front 72

____ monitor internet traffic and block access to preselected websites and files.

Back 72

c.) Internet content filters

Front 73

In the early 1980s, the IEEE began work on developing computer network architecture standards. This work was called ____, and it quickly expanded into several different categories of network technology.

Back 73

d.) Project 802

Front 74

This IEEE ____ standard specifies a maximum rated speed of 54 Mbps using the 5 GHz spectrum.

Back 74

a.) 802.11a

Front 75

____ was designed to ensure that only authorized parties can view transmitted wireless information.

Back 75

d.) WEP

Front 76

____ can fully decode application-layer network protocols. Once these protocols are decoded, the different parts of the protocol can be analayzed for any suspicious behavior.

Back 76

a.) Protocol analyzers

Front 77

____ monitor internet traffic and block access to preselected websites and files.

Back 77

c.) Internet content filters

Front 78

In the early 1980s, the IEEE began work on developing computer network architecture standards. This work was called ____, and it quickly expanded into several different categories of network technology.

Back 78

d.) Project 802

Front 79

This IEEE ____ standard specifies a maximum rated speed of 54 Mbps using the 5 GHz spectrum.

Back 79

a.) 802.11a

Front 80

____ was designed to ensure that only authorized parties can view transmitted wireless information.

Back 80

d.) WEP

Front 81

WEP accomplishes confidentiality by taking unencrypted text and then encrypting or "scrambling" it into ____ so that it cannot be viewed by unauthorized parties while being transmitted.

Back 81

d.) ciphertext

Front 82

The plaintext to be transmitted has a cyclic redundancy check (CRC) value calculated, which is a checksum based on the contents of the text. WEP calls this the ____ and appends it to the end of the text.

Back 82

c.) integrity check value (ICV)

Front 83

At regular intervals, a wireless AP sends a beacon frame to announce its presence and to provide the necessary information for devices that want to join the network. This process is known as ____.

Back 83

b.) beaconing

Front 84

With ____ scanning, a wireless device simply listens for a beacon frame for a set period of time.

Back 84

a.) passive

Front 85

Mobile devices constantly survey the radio frequencies at regular intervals to determine if a different AP can provide better service. If it finds one, then the device automatically attempts to associate with the new AP (this process is called ____.)

Back 85

b.) a handoff

Front 86

Access points have a setting called "____", which what the PSK uses as a seed value to generate new keys.

Back 86

d.) Group Key Renewal

Front 87

WPA replaces WEP with an encryption technology called ____.

Back 87

c.) TKIP

Front 88

____ is intended for personal and small office users who do not have advanced server capabilities.

Back 88

c.) PSK

Front 89

IEEE 802.11i authentication and key management is accomplished by the IEEE ____ standard.

Back 89

d.) 802.1x

Front 90

Regarding access control, a(n) ____ is a specific resource, such as a file or a hardware device.

Back 90

a.) object

Front 91

Regarding access control, a(n) ____ is a user or a process functioning on behalf of the user who attempts to access an object.

Back 91

c.) subject

Front 92

Regarding accesss control, an example of a(n) ____ is when a user attempts to delete a file.

Back 92

d.) operation

Front 93

In the ____ model, the end user cannot implement, modify, or transfer any controls.

Back 93

d.) Mandatory Access Control (MAC)

Front 94

The ____ model is considered a more "real world" approach than the other models to structuring access control.

Back 94

b.) Role Based Access Control (RBAC)

Front 95

The ____ model can dynamically assign roles to subjects based on a set of rules defined by a custodian.

Back 95

d.) Rule Based Access Control (RBAC)

Front 96

Known as ____, this practice requires that if the fraudulent application of a process could potentially result in a breach of security, then the process should be divided between two or more individuals.

Back 96

d.) Seperation of duties

Front 97

____ in access control means that if a condition is not explicitly met, then it is to be rejected.

Back 97

d.) Implicit deny

Front 98

____ accounts are user accounts that remain active after an employee has left an organization.

Back 98

a.) Orphaned

Front 99

____ is the process of setting a user's account to expire.

Back 99

c.) Account expiration

Front 100

A ____ is a secret combination of letters and numbers that only the user knows.

Back 100

c.) password

Front 101

A ____ attack begins with the attacker creating hashes of common dictionary words, and compares those hased dictionary words against those in a stolen password file.

Back 101

d.) dictionary

Front 102

To address the security issues in the LM hash, Microsoft introduced the ____ hash.

Back 102

a.) NTLM

Front 103

A ____ lock, also known as they key-in-knob lock, is the easiest to use because it requires only a key for unlocking the door from the outside.

Back 103

b.) preset

Front 104

Known as a ____ lock, this lock extens a solid metal bar into the doorframe for extra security.

Back 104

b.) deadbolt

Front 105

A ____ is a secuirty device that monitors and controls two interlocking doors to a small room (a vestibue) that separates a nonsecured area from a secured area.

Back 105

d.) mantrap