Principals Of Information Security

Front 1

What does ARPA stand for?

Back 1

Advanced Research Procurement Agency

Front 2

Which US Government body created ARPA

Back 2

Department of Defence

Front 3

Which DoD report attempted to define the multiple control mechanisims nessicary for the protection of a multilevel computer system?

Back 3

The Rand Report R-609

Front 4

What was the name of the now obsolete operating system designed for security objectives?

Back 4

MULTICS

Front 5

What is the security that addresses the issues needed to protect items, objects or areas?

Back 5

Physical Security

Front 6

What is the security that addresses the protection of individuals or groups authorized to access an organization

Back 6

Personal Security

Front 7

What is the securty that encompasses the protection of an organization's communications media, technology and content?

Back 7

Communications Security

Front 8

If information has a state of being genuine or original and is not a fabrication, it has the characteristic of _________.

Back 8

Authenticity

Front 9

The characteristic of information that deals with preventing disclosure is _________.

Back 9

Confidentiality

Front 10

Information security programs that being at grassroots level by system administrators to imporve security are often called a ___________ approach.

Back 10

bottom-up

Front 11

When projects are initiated at the highest levels of an organization and then pushed to all levels, they are said to follow a _________ approach.

Back 11

top-down

Front 12

Who is the person responsible for the security and use of a particular set of information?

Back 12

The data owner

Front 13

Who is the person responsible for the storage, maintenance and protection of the information?

Back 13

The data custodian

Front 14

What are the three most commonly encountered communities of interest which have roles and responsibilities in information security?

Back 14

Information security management and professionals
Information technology management and professionals
Organizational management and professionals

Front 15

What is the principal goal of an information security program?

Back 15

to ensure that systems and their contents remain the same

Front 16

Information security has more to do with ______ than with ______

Back 16

management, technology

Front 17

Many organizations find that their most valuable asset is their ________

Back 17

data

Front 18

What is the name given to applying computer and network resources to try exhaustive combinations?

Back 18

brute force

Front 19

What is the name given to trying all commonly used passwords?

Back 19

dictionary attack

Front 20

What is the name given to attempting to reverse-calculate passwords?

Back 20

Password cracking

Front 21

What is the name given to attacking a system by flooding it with a large volume of traffic to prevent if from accomplishing its design goal?

Back 21

Denial of Service

Front 22

What is it called when an attacker conceals their true identity and adopts some other identity.

Back 22

Spoofing

Front 23

__________ is another name for TCP hijacking

Back 23

man in the middle

Front 24

_________ is unsolicited commercial email.

Back 24

Spam

Front 25

What is it called when a denial of service attack is done by sending large quantities of email?

Back 25

Mail bombing

Front 26

What is a type of law that represents all of the laws that apply to a citizen or subject of a jurisdiction?

Back 26

Civil law

Front 27

What is the type of law that addresses violations harmful to society and that is enforced by prosecutions by the state?

Back 27

Criminal law

Front 28

What is the type of law that regulates the relationship between an individual and an organization?

Back 28

Private law

Front 29

What is the type of law that regulates the structure and administration of government agencies?

Back 29

Public law

Front 30

What defines socially acceptable behaviors?

Back 30

Ethics

Front 31

What define rules that mandate or prohibit certain behavior?

Back 31

Laws

Front 32

What is the law that regulats the overall role of the government in protecting the privacy of individuals?

Back 32

Federal Privacy Act of 1974

Front 33

What is the law that regulates the role of the health-care industry in proteting the privacy of individuals?

Back 33

Health Insurance Portability and Accountability Act of 1996

Front 34

What is the generally recognized term for the government protection afforded to intellectual property?

Back 34

Copyright law

Front 35

What is the law that provides any persion with the right to request access to federal agency records?

Back 35

Freedom of Information Act of 1966

Front 36

What is the name of a respected professional society founded in 1974 as the worlds first education and scientific computing society?

Back 36

Association of Computing Machinery

Front 37

Is the FBI responsible for signal intelligence and information system security of classified systems?

Back 37

No

Front 38

Is the NSA responsible for the security of all non nationally critial infrastructure?

Back 38

No

Front 39

Is the NSA responsible for signal intelligence and information system security of classified systems?

Back 39

Yes

Front 40

For information security purposes, what are the systems that use, store and transmit information?

Back 40

Assets

Front 41

Which community of intrest should have the best understanding of threats and attacks and often takes a leadership role in addressing risks?

Back 41

Information security

Front 42

Which community of intrest must assist in risk management by configuring and operating information systems in a secure fashion?

Back 42

Information technology

Front 43

Which community of interest must ensure sufficient resources are allocated to the risk managment process?

Back 43

general managemnt

Front 44

The purpose of a weighted factor analysts is to?

Back 44

list assets in order of their importance to the organization

Front 45

What do organizations implement in order to ensure ensure effort is spent protecting information that needs protecting?

Back 45

data classification schemes

Front 46

What do individuals aquire when they are assigned security labels for access to categories of information?

Back 46

Security clearance

Front 47

What is the name of the process of examining how each threat will affect an organization?

Back 47

Threat assessment

Front 48

What is the process an organization uses to assign a risk rating or score to each information asset?

Back 48

Risk assessment

Front 49

What is the overall rating of the probability that a specific vulnerability will be successfully exploited?

Back 49

likelihood

Front 50

What is the name of the amount of risk that remains after all controls are put in place as designed?

Back 50

residual risk

Front 51

What is it called when users are assigned a matrix of authroizations for particular areas?

Back 51

Lattice-based access control

Front 52

What is the risk control strategy that attempts to prevent the exploitation of a vulnerability?

Back 52

Avoidance

Front 53

What is the control approach that attempts to shift risk to other assets, other processes or other organizations?

Back 53

Transference

Front 54

Which plan should contain the actions an organization can and perhaps should take while the incident is in progress?

Back 54

Incident response plan

Front 55

What is the most common mitigation procedure?

Back 55

Disaster recovery plan

Front 56

What is the process of avoiding the financial impact of an incident by implementing a control?

Back 56

Cost avoidance

Front 57

What is the value associated with the most likely loss from an attack?

Back 57

Single Loss Expectancy

Front 58

What is the value calulated to show how often a specific type of attack is likley to occur in a given year?

Back 58

The annualized rate of occurence

Front 59

What is the value calculated to show the estimated overall loss potential per risk per year?

Back 59

The annualized loss expectancy

Front 60

What is the process of seeking out and studying the practices used in other organizations that produce the results you desire in your organization

Back 60

Benchmarking

Front 61

What is the name given to the analysis of measures against established standards?

Back 61

Baselining

Front 62

What addresses user acceptance and support, management acceptance and support and the overall requirements of organizational stakeholders?

Back 62

Operation feasibility

Front 63

What determines whether or not the organization has the technology necessary to implement and support the control alternatives

Back 63

Technical feasibility

Front 64

What directs how issues should be addressed and technologys used?

Back 64

Policies

Front 65

What are detailed statements of what must be done to comply with policy?

Back 65

Standards

Front 66

Which policy is also known as a general security policy, IT security policy and an information security policy?

Back 66

Enterprise information security policy

Front 67

Which policy addresses specific areas of technology, requires frequent updates and contains a statement on the organizations positions on a specific issue

Back 67

Issue-specific security policy

Front 68

What is implementing security in a layered approach is refered to as?

Back 68

Defence in depth

Front 69

What defines the edge between the outer limit of an organizations security and the beginning of the outside world?

Back 69

The security permimter

Front 70

What is a device that uses a rule set to selectivly discriminate against information flowing into or out of the organization?

Back 70

Firewall

Front 71

What should an organization implement in an effort to detect unauthorized activity within the inner network or on individual machines?

Back 71

Intrusion detection systems

Front 72

What is the name of given to planning for the identification, classification and recovery from an incident?

Back 72

Incident response planning

Front 73

What is the name given to a clearly identified attack on the organizations information assets that would threaten their confidentiality, integrety or availability?

Back 73

incident

Front 74

What deals with the preperation for and recovery from a disaster, either natural or manmade?

Back 74

Disaster recovery planning

Front 75

What consists of the actions taken to plan for, detect and correct the impact of an incident on information assets?

Back 75

An Incident Response

Front 76

What provides many of the same services and options as a Hot site, but does not typically include the applications the compay needs?

Back 76

Warm site

Front 77

What is the name given to a fully configured computer facility with all services, communication links and physical plant operations including heating and air conditioning?

Back 77

Hot site

Front 78

What is the next step down from a warm site and provides only rudimentary services and facilities with no computer hardware or peripherals?

Back 78

Cold site

Front 79

What type of firewall examines every incoming header and can selectively filter packets based on destination address, source address, packet type and other key information?

Back 79

Packet filtering

Front 80

What type of firewall filtering allows the firewall to react to an emergent event and update or create rules to deal with the event?

Back 80

Dynamic

Front 81

What is the commonly used name for an intermediate area between a trusted network and an untrusted network

Back 81

Demilitarized zone

Front 82

What is the primary objective of the physical design phase of the SecSDLC?

Back 82

To select specific technologies to support the information security blueprint

Front 83

Which system is most often used to authenticate the credentials of users who are trying to access an organizations network via dial-up connection?

Back 83

RADIUS

Front 84

In which mode of IPSEC is the data within an IP packet encrypted, while the header information is not?

Back 84

Transport mode

Front 85

What is the name given to a system that can detect an intrusion and attempt to stop them?

Back 85

Intrusion Detection and prevention system (IDPS)

Front 86

What is the term given to the failure of an IDS system to react to an actual attack event?

Back 86

False Negative

Front 87

What is the term given to an alarm that indicates an attack is in progress or has succesfully occured when in fact, there has been no such attack?

Back 87

False Positive

Front 88

What is the name of a widley used IDP detection method that uses search patterns?

Back 88

Signature Based IDP

Front 89

What is the name given to a IDP detection method that sample network activity and compare it to 'normal' traffic?

Back 89

Statistical Anomaly-Based IDP

Front 90

What is the name given to a decoy system designed to lure potential attackers away from critical systems and encourage attacks against themselves?

Back 90

Honey pots

Front 91

What is the name given to the organized research of internet addresses owned or controlled by a target organization?

Back 91

Footprinting

Front 92

What is the name given to the systematic survey of all of the target organizations addresses collected during the footprinting phase?

Back 92

Fingerprinting

Front 93

What is the name of the tool used to identify computers active on a network?

Back 93

Port scanner

Front 94

What is the name of the tool used to scan networks for highly detailed vulnerability information?

Back 94

Vulnerability scanner

Front 95

Is encryption a process of hiding information that has been in use for a long time?

Back 95

No

Front 96

Was Julius Caesar associated with an early version of the substitution cypher?

Back 96

Yes

Front 97

What is the process of converting an origonal message into a form that is unreadable to unauthorized individuals?

Back 97

Encryption

Front 98

What is the information used in conjunction with an algorithm to create the ciphertext from the plaintext or derive the plaintext form the ciphertext?

Back 98

Key

Front 99

What is the name of the science of encryption?

Back 99

Cryptology

Front 100

What is the name of the process of making and using codes to secure the transmission of information?

Back 100

Cryptography

Front 101

Do hashing functions requrie the use of keys?

Back 101

No

Front 102

What is the name of the figerprint of the authors message that is to be compared with the receiver's locally calculated hash of the same message?

Back 102

Message Digest

Front 103

What is the entire range of values that can possibly be used to construct an individual key?

Back 103

Keyspace

Front 104

Which peice of information is used in conjunction with an algorithm to create the ciphertext from the plaintext or vice versa?

Back 104

Key

Front 105

Which algorithm was the first public key encryption algorithm plublished for commercial use?

Back 105

RSA

Front 106

Do popular cryptosystems use a hybrid combination of symmetric and asymmetric algorithms?

Back 106

Yes

Front 107

Are PKI systems based on public key cryptosystems with digital certificates and CA's?

Back 107

Yes

Front 108

Does Nonrepudiation mean that customers or partners can be held accountable for transactions, such as online purchases which they cannot later deny?

Back 108

Yes

Front 109

What is the process of hiding messages called?

Back 109

Steganography

Front 110

What kind of security addresses the design, implementation and maintanance of counter measures taht protect the physical resources of an organization?

Back 110

Physical security

Front 111

Which layer of management is responsible for the security of the facility in which the organization is housed, and the policys and standards for secure operation?

Back 111

General Management

Front 112

Which group are responsible for environmental and access security in the technology equipment locations and for the policies and standards fo secure equipment operation?

Back 112

Information Technology Management and Professionals

Front 113

Who have the ability to apply human reasoning?

Back 113

Guards

Front 114

Which animal is useful because of their keen sense of smell and hearing and can detect intrusions that human guards cannot?

Back 114

Dogs

Front 115

Which authentication system is not foolproof and can be easily duplicated, stolen and modified?

Back 115

ID Cards and badges

Front 116

Which control is devided into four categories: manual, programmable, electronic and biometric?

Back 116

Lock and Key

Front 117

What kind of control do the following fall into; Finger, and hand readers; iris and retina scanners; and void and signature readers?

Back 117

biometric

Front 118

Fires that invole combustible fules, such as wood, paper, textirels, rubber, cloth and trash belong to which class?

Back 118

Class A

Front 119

Fires fueled by combustible liquids or gasses, such as solvents, gasoline, paint, lacquer and oil belong to which class?

Back 119

Class B

Front 120

Fires with energized electrical equipment or applices belong to which class?

Back 120

Class C

Front 121

Fires fuled by combustible metals, such as magnesium ,lithium and sodium belong to which class?

Back 121

Class D

Front 122

What is a completed document or program module that can serve either as the beginning point for a later task or as an element in the finished project?

Back 122

Deliverable

Front 123

What is a specific point in the project plan when a task and its action steps are complete and have a noticeable impact ont he progress of the project plan as a whole?

Back 123

Milestone

Front 124

What kind of feedback loop ensures progress is measured periodically once a project is underway?

Back 124

negative feedback loop

Front 125

What is deploying a system by running the new methods alongside the old methods for a period of time called?

Back 125

Parrallel implementation

Front 126

What is the most common approach to deploing systems that involves rolling out a piece of the system?

Back 126

phased implementation

Front 127

What is the name of a development method that involves implementing all functions in a single part of the organization and resolving issues within that group before expanding to the rest of the organization

Back 127

Pilot implementation

Front 128

Who is typically the top information security employee in the organization

Back 128

CISO

Front 129

Who are accountable for the day-to-day operation fo the information security program?

Back 129

Security Managers

Front 130

Who are qualified individuals who are tasked to implement security software, diagnose and troubleshoot problems, and coordinate with systems administrators to ensure that security technology is operating to protect the organization?

Back 130

Security technicians

Front 131

Who is typically an expert in information security and may have been a CISO and or have CISSP credentials?

Back 131

Security consultant

Front 132

Which certifications require the applicant to complete a written practical assignment?

Back 132

GIAC

Front 133

What can determine the level of trust the business places in the individual

Back 133

background check

Front 134

What becomes an important security instrument after the candidate has accepted the job offer?

Back 134

Employment contract

Front 135

In order to heighten information security awareness and change workplace behavior, what should organizations incorperate information security components into?

Back 135

Employee job descriptions, traning sessions and performance evaluations