Its 301

Front 1

Lack of appropriate security controls can result in a loss of revenue.

Back 1

True

Front 2

Having extra services/daemons running on your networked server is a good security practice because it makes future server enhancements occur without additional software installation

Back 2

False

Front 3

A DHCP server should acquire a dynamically assigned IP address from a peer DHCP server.

Back 3

False

Front 4

Because of its strong level of encryption, 3DES is one of those technologies that may not be available for export to some countries outside North America.

Back 4

True

Front 5

Wireless networking cannot enable encrypted data transfers from client to server.

Back 5

False

Front 6

A simple search a www.askjeeves.com on 'Browser password crackers' will result in numerous links that can provide downloadable utilities, which can crack a browser password.

Back 6

True

Front 7

The local folder in which your Temporary Internet files are stored cannot be changed.

Back 7

False

Front 8

Cookie theft requires access to the client's local machine.

Back 8

True

Front 9

A cookie is a piece of compiled code, similar to an applet that is downloaded to the client's machine.

Back 9

False

Front 10

Once a digital certificate is downloaded to a workstation, it will never expire unless the user cancels it.

Back 10

False

Front 11

Revoked certificates will continue to function properly, unless they are published on the CRL.

Back 11

True

Front 12

Publishing a CRL will prevent accidental or unauthorized use of certificates that are no longer valid.

Back 12

True

Front 13

If Your private key is corrupted,you can regenerate the same private key.

Back 13

False

Front 14

A corporate security policy will not address the physical security of an organization, just the technical components.

Back 14

False

Front 15

If no one follows the policy, no amount of high-tech software or hardware in the world will protect your network.

Back 15

True

Front 16

All companies must comply with the same legal and regulatory requirements.

Back 16

False

Front 17

Security is everyone's responsibility and is more commonly breached at the end-user level than anywhere else in the organization.

Back 17

True

Front 18

With appropriate processes and procedures in place, it is considered sound practice for the information security team to attempt common hacking techniques against their own E commerce Web site.

Back 18

True

Front 19

Many companies use a combination of network-based,host-based, and application-based monitoring IDSs.

Back 19

True

Front 20

Network-based IDSs cannot examine packets for known virus signatures.

Back 20

False

Front 21

What is a person who tests systems for the purpose of reporting vulnerabilities before they spread called?

Back 21

White hat

Front 22

What is another name for white hat testers?

Back 22

Ethical hackers

Front 23

What are the primary targets of a network-based attack?

Back 23

Network perimeter vulnerabilities

Front 24

An attacker is attempting to break into your computer network. He captures the intercepted data and transmits it back to your server at a later time. What type of attack was used?

Back 24

Replay attack

Front 25

Which of the following attacks commonly uses a sniffer to collect data?

Back 25

Man-in-the-middle
Replay attack

Front 26

what type of exploit uses an executable program to deliver destructive code to disable an operating system or application?

Back 26

Malicious code

Front 27

When a System Adiministrator uses her access level to secure systems to steal confidential data, what type of software-based attack is she using?

Back 27

Misuse of privilege

Front 28

Which of the following well-known programs is used for software-based takeover attacks?

Back 28

Back Orifice
SubSeven
NetBus

Front 29

What is the ANSI standard for LDAP?

Back 29

X.500

Front 30

Which of the following defines a directory and its objects and containers as extensible, meaning it can be extended or modified to support the specific needs of an organization?

Back 30

Schema

Front 31

When working with Windows 2000 Advanced Server and NetWare 6, which two are commonly used GUI utilities for managing LDAP objects?

Back 31

Active Directory Users and Computers
ConsoleOne

Front 32

Lightweight Directory Access Protocol is a component of which protocol grouping?

Back 32

TCP/IP

Front 33

DHCP servers automatically assign IP addresses to workstations. What must be configured on the DHCP server to assign the IP numbers?

Back 33

Scope

Front 34

You are the SA for WorldWide Bank. The Mailroom group and the Executives group share a print device. The Executive group requires their print jobs to print before the Mailroom group print jobs. How should you manage this requirement?

Back 34

Assign Priority 99 to Executive group and Priority 1 to Mailroom group.

Front 35

To install a new printer on a Windows 2000 Professional workstation, you must do what?

Back 35

Choose Start,Settings,Printers

Front 36

As the SA responsible for File and Print servers at WorldWide Bank, you decide to protect data as it is transmitted between clients and servers. You choose to have the client digitally sign the SMB protocol. This will require the use of public and private keys. In order for the client to sign the data, which key must he use, and which key must the server use?

Back 36

Client private and client public

Front 37

As the SA responsible for hardening the Windows 2000 Advanced file servers,you decide to use Permissions to lock down access to a folder. You apply the following Share and NTFS corporate network, what will the resulting permissions be?

Back 37

Read

Front 38

You are responsible for supporting three offices at WorldWide Bank. In order to monitor your network devices, you decide to use SNMP agents to trap error messages and send them to your remote site. What security threats should you be aware of?

Back 38

SNMP sends data in cleartext.

Front 39

What should you use as a protective measure that will help secure your use of SNMP?

Back 39

SNMPv2

Front 40

IP routers are used for directing IP requests. IP routers residing on your network border should be configured to block incoming IP addresses that have what?

Back 40

Have been assigned to your internal network.

Front 41

Which internetwork device should be used to hide your internal IP addresses?

Back 41

Proxy

Front 42

On Windows 2000 servers,you can protect against cache poisoning by enabling the Secure Cache Against Pollution setting. To do so,you must add the following registry value:Value Name:SecureRespones Data Type:RegWord Value:1. What registry setting must be edited to activate this new value?

Back 42

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DNS\Parameters

Front 43

The URLScan ISAPI filter from Microsoft can be used to filter characters and file extensions entered into the URL stream. Which of the following can URLScan block?

Back 43

.ASP
../
%

Front 44

To enable auditing on your Windows 2000 Web server,you need to make a configuration change to the default Web site. What utility is used to make this change?

Back 44

Internet Services Manager

Front 45

Of the following statements regarding HTTPS,which is most true of the data sent from a browser to an HTTPS server?

Back 45

The entire message is encrypted.

Front 46

As a consultant responsible for evaluating and locking down your clients' IIS Web server,you must come up with several tasks to improve the Web storefront's security. Your primary goal is to improve the overall security of the server. Your second goal is to limit URL-based attacks. Your third goal is to patch the vulnerabilities in the server. Action taken: You run the IIS Lockdown Toolkit,the IIS Security Rollup package,and you verify that URLScan ISAPI filter is enabled and properly configured. Which of your goals were accomplished?

Back 46

All of your goals were accomplished.

Front 47

When designing a secure architecture,the Information Security professional must consider the balance between cost and security. With this in mind,your customer has asked you to recommend an architectural design that facilitates FTP in a secure manner. Which would be the best recommendation?

Back 47

Install the FTP server on a dedicated machine,and on an isolated segment.

Front 48

Why is SFTP more secure than FTP?

Back 48

Data passes over an SSH encrypted connection.

Front 49

What tools/utilities does Microsoft provide that will assist in securing your FTP server?

Back 49

URLScan
IIS Lockdown toolkit

Front 50

What is another command,other than FTP,that can be used for securely transferring files over an SSH connection?

Back 50

SCP

Front 51

What type of a security attack is an e-mail hoax?

Back 51

Social engineering

Front 52

An attacker can overload an email server by flooding a network with emails. What would the email server be receiving in this case?

Back 52

Spam

Front 53

What does email spoofing entail?

Back 53

Impersonating the email sender.

Front 54

IPSec policies are composed of rules. Which component of the rules describes the specific protocol,port,and source computer to which the rule should apply?

Back 54

IP filter

Front 55

Which of the following algorithms are hashes used by IPSec?

Back 55

MD5 and SHA

Front 56

DES processes data for encryption in what size blocks?

Back 56

64-bit

Front 57

What must be established between two computers using IPSec in order to establish a connection and transfer data?

Back 57

Security association

Front 58

Windows XP Professional includes a new snap-in that you can add to a custom mmc console called what?

Back 58

IP Security monitor

Front 59

Which algorithm is used with the Internet Key Exchange protocol to generate a master key?

Back 59

Diffie-Hellman

Front 60

Since your handheld PDA has the ability to surf the Internet but limited screen real estate,a new Internet Web page language was developed to specifically work on handheld devices. What is the new language?

Back 60

WML

Front 61

What is the maximum open-area range between computing devices using the 802.11b wireless network protocol?

Back 61

1000 feet

Front 62

A user calls you for support about their PDA. The claim that they are missing files on their PDA,and some other files appear to be corrupted because they can open some files but not all of them. What is a likely cause of the problem?

Back 62

The PDA is infected with a virus

Front 63

As a parent of a 13-year-old son who is begining to use the World Wide Web for school research and for entertainment,you want to restrict inappropriate site access. What feature in Internet Explorer must be changed to prevent viewing of Web sites that contain violent content?

Back 63

Content Advisor

Front 64

Browsers save a record of your Internet activity. Some of this activity data can present a security threat. Which elements should the Information Security professional be aware of?

Back 64

History files
Cookies
Temporary Internet files

Front 65

There is an established group of general tenets that outline the foundation of good Information Security practices. Which tenet(s) does a digital certificate fulfill?

Back 65

Non-repudiation
Authentication
Authority
Availability

Front 66

In a large corporation with multiple CAs,a trust model of CAs is formed. What is this trust model commonly referred to as?

Back 66

CA Hierarchy

Front 67

What type of CA is created by a company for use primarily within the company itself?

Back 67

Private root

Front 68

What type of CA is created by a third-party vendor(such as Verisign)after they consult with a company and determine the company's particular CA needs and requirements?

Back 68

Public root

Front 69

After establishing your Root CA and subordinate CAs,how should the Root CA best be secured?

Back 69

Take the Root CA offline

Front 70

What process is used to define the information and parameters contained in the digital certificates?

Back 70

Certificate Policy

Front 71

Sean downloaded a digital certificate to his office PC. He needs to work at home this weekend,and will need to use his existing certificate. How can he get it from his office PC to his home PC?

Back 71

Export it

Front 72

When determining the life cycle length of your digital certificates,which two factors should affect your decision?

Back 72

Length of the CA's private key.
Strength of crypto being used.

Front 73

Which backup operation would you choose to have the shortest daily backup time?

Back 73

Incremental

Front 74

What backup tool option is available on Windows 2000 Advanced Server that does not back up your files or programs,but does back up critical NOS files to help restart Windows if it is damaged?

Back 74

Emergency Repair Disk

Front 75

Issuing certificates to a large employee base requires a great deal of administrative overhead. You could outsource this function to the controlling third-party CA TO reduce your workload. What drawback does this present?

Back 75

Cost prohibitive

Front 76

What does certificate renewal allow?

Back 76

The original certificate to be used longer.

Front 77

What should the CA do if a certificate owner's private key has been compromised?

Back 77

Revoke the certificate

Front 78

You have issued a certificate to a contractor that works on your location. The contractor will be off the job for 30 days. What should you do to temporarily disable the contractor's certificate?

Back 78

Suspend certificate

Front 79

After revoking a certificate,what should be done with the certificate file?

Back 79

Destroy the certificate

Front 80

What should you do after recovering your lost private key?

Back 80

Decrypt existing data and generate new key pair.

Front 81

What is the most important phase of implementing a security infrastructure?

Back 81

Monitoring and maintenance

Front 82

What outlines the plan for the individual security component?

Back 82

Policy statement

Front 83

There are a number of Information Security organizations that you should become familiar with in order to keep current and aligned with the industry. Which of the following associations is a leading contributor to the InfoSec industry?

Back 83

SANS

Front 84

Which of the following is a "Site Security Handbook" from the IETF that contains guidelines for developing computer security policies and procedures for organizations that allow Internet access to their resources?

Back 84

RFC2196

Front 85

Which of the following is a standard for Information Security developed by the ISO which is currently under development?

Back 85

ISO17799

Front 86

A good security policy is necessary for every company. The policy is determined by whose needs?

Back 86

The organization's

Front 87

Which of the following is a legal area of concern for an organization?

Back 87

Employees
Customers
Business partners

Front 88

The HIPAA of 1996 is important federal legislation that affects security professionals. Which of the following aspects of an individual's privacy does this act protect?

Back 88

Health records

Front 89

Due to their mobility and easy theft,your company should have a policy addressing which of the following devices?

Back 89

Laptop computers and PDAs

Front 90

Which of the following is an example of a physical control?

Back 90

Locked door

Front 91

You have acquired the skills you need to keep your security infrastructure healthy. But whose responsibility is Security?

Back 91

All individuals

Front 92

Your users represent the front lines of defense against which of the following types of hacking?

Back 92

Social engineering

Front 93

Security documentation takes various forms. Which of the following do security professionals commonly use?

Back 93

Systems Architecture
Inventories

Front 94

The most appropriate course of action against Scanning is what?

Back 94

Hardening devices

Front 95

The most appropriate course of action against Enumerating is what?

Back 95

Hardening services and resources

Front 96

Intrusion Detection Systems are categorized primarily by their monitoring method. The two most common implementations of an IDS are what?

Back 96

Network-based IDS and Host-based IDS

Front 97

You have secured all of the components that make up your ECommerce site. The last task that you want to complete is to install host-based IDS on the Web server. What will be monitored by the host-based IDS?

Back 97

Just the Web server.

Front 98

Which of the following honeypot solutions is the most complex to deploy?

Back 98

Software-based

Front 99

There are a number of different and appropriate responses to security incidents. Which response might be most appropriate upon detecting an attack that is not causing immediate damage,but has the potential to be esclated in the future?

Back 99

Gather evidence

Front 100

You wish to avoid having your system resources used by hackers to amplify broadcasts. What configuration change should you make to prevent this from happening?

Back 100

Disable directed broadcast on your routers.