Cmit425 Quiz 2

Front 1

1. If an intruder is able to circumvent physical access security and is able to take over control of internal systems, what principle of security is violated?

Back 1

Integrity

Front 2

2. Which of the following is not a threat to physical security?

Back 2

c. Brute force password attacks (technical threat)

Front 3

3. Which of the following is not considered a form of physical access control?

Back 3

d. CCTV (Technical control)

Front 4

4. Which of the following is an example of a physical security administrative control?

Back 4

d. security guards (both a personnel [administrative] and a guard [physical] control)

Front 5

5. Which of the following is not an example of a physical security technical control?

Back 5

b. personnel controls (administrative control)

Front 6

6. Which of the following is an example of a physical security technical control?

Back 6

c. fire detection and suppression (detection and alerting are technical controls, fire and safety are physical/environmental issues)

Front 7

7. Physical security is maintained through three types of controls. Which of the following is not one of these?

Back 7

a. Defensive (all controls integrate to provide defense and protective barriers supporting human life and the C-I-A Triad)

Front 8

8. The study of the facility infrastructure to determine what elements are essential to the support of physical security is known as?

Back 8

a. Risk analysis (part of the BIA involves identifying all of the critical elements)

Front 9

9. Which of the following is not a physical security administrative control?

Back 9

c. Intrusion detection systems (technical control)

Front 10

10. When evaluating the security of a new facility or site, which of the following is the least important?

Back 10

10. When evaluating the security of a new facility or site, which of the following is the least important?

Front 11

11. Which of the following is the least important aspect of a secured server room?

Back 11

b. human compatibility (many secure locations are not designed with human accessible components under operation)

Front 12

12. When evaluating, selecting, and deploying physical security access controls, what is always the most important?

Back 12

c. protection of human safety (Human life and wellbeing is always a primary consideration)

Front 13

13. Which of the following is not a physical security physical control?

Back 13

c. Data backups (technical control)

Front 14

14. Which of the following is the least important aspect to consider when selecting a physical location for a highly secured facility?

Back 14

d. Proximity to airport flight path (With the exception of securing actual material against airplane impact, such as at a nuclear reactor, proximity to the flight path is unlikely to impact security compared to the other three aspects.)

Front 15

15. When constructing a new building for a secure site, which of the following is the least important issue to consider in regards to security?

Back 15

d. The size of the facility (As long as the facility is adequate to house the necessary equipment, its size is unrelated to security measures.)

Front 16

16. Which of the following is not an example of a physical security physical control?

Back 16

d. data backups (Technical control)

Front 17

17. Which of the following is an example of a physical security physical control?

Back 17

a. security guards (the other three are technical and environmental controls)

Front 18

18. Which of the following is the least important aspect to consider when selecting a security

Back 18

b. cost (cost is not generally a factor in the measure of security of a location)

Front 19

19. When should hardware be replaced to maintain availability?

Back 19

d. Before the mean time between failures (tech refresh should occur before expected end of life)

Front 20

20. Which of the following is not an example of a physical security administrative control?

Back 20

d. alarms (physical security technical control)

Front 21

21. Which of the following is not a benefit of a human incompatible server/computer room?

Back 21

a. An emergency shelter (Human incompatible server rooms lack facilities for human occupancy)

Front 22

22. When physical security is violated and damage occurs to the computer hardware itself, this is a violation of what principle of security?

Back 22

c. Size (As long as the facility is adequate to house the necessary equipment, its size is unrelated to security measures.)

Front 23

24. Which of the following is the least important aspect to consider when designing the interior of a security facility?

Back 23

d. consistency in decorating scheme (Decorating schemes are a factor of aesthetics, not of security design.)

Front 24

25. Which of the following is not an important physical security factor when considering the security of windows?

Back 24

a. UV reflection or blocking (Unless the protected assets are UV sensitive, this protection is not a factor in security protections.)

Front 25

26. What is the principle of least privilege?

Back 25

c. Users are assigned only enough access to accomplish their work tasks (Default being none, security is granted only to the degree required.)

Front 26

c. Users are assigned only enough access to accomplish their work tasks (Default being none, security is granted only to the degree required.)

Back 26

d. Take-grant model (A directed graph, whose vertices are labeled to indicate the rights a source has over another object)

Front 27

28. If the operating system fails to establish boundaries for the size and type of data that can be inputted, what malicious event or activity can occur?

Back 27

c. Buffer overflow (A state that occurs when input overflows buffer storage into application memory space.)

Front 28

29. Which operating state represents a process in normal execution?

Back 28

c. Supervisory state (In older IBM mainframes, the Supervisory State is one of two operational states, providing full functionality while the Problem State is limited in functional availability - such as lacking in I/O. In modern computers, Supervisory State is associated with elevated privilege such as running under root/SUDO.)

Front 29

30. In order for an OS to remain stable, what must it be able to accomplish or perform?

Back 29

c. Protect itself from users and software (Stability requires constraints on type and form of input.)

Front 30

31. What mode of operation exists when all users have the authorization and need-to-know to access all resources?

Back 30

a. Dedicated security mode (In dedicated security mode, all users have clearance and authorization to access all resources handled by that system or service. An example might be a dedicated outstanding warrants database, equally available to all law enforcement officers due to the clearance provided by their employment.)

Front 31

32. At which Ring of protection do device drivers operate?

Back 31

c. Ring 2 (Device drivers operate at ring 2, with the kernel at ring 1 atop a hypervisor.)

Front 32

33. What mechanism is used for a lower protection ring entity to communicate with a higher protection ring entity?

Back 32

d. System call (A system call allows a process to request a service outside of its permission set.)

Front 33

34. Of the four possible operating states of a system, which represents the state within which an application is being actively processed?

Back 33

d. Supervisory state (Unlike the ready and wait states, where processes are pending execution, Supervisory State operations are normal processes running with elevated privilege, Problem state processes run with limited functionality.)

Front 34

35. The orange book security classifications such as C2 and B1 are focused on what?

Back 34

b. The trusted computer base (The Rainbow Series of books define the Trusted Computer System Evaluation Criteria.)

Front 35

36. Secondary storage is?

Back 35

a. Nonvolatile storage, such as a hard drive (Secondary storage refers to any durable storage medium.)

Front 36

37. What is the most trusted component of a computer?

Back 36

b. CPU (The CPU’s instruction set is hard-coded and unable to be changed after manufacture.)

Front 37

38. A buffer overflow can cause all but which of the following?

Back 37

a. network throttling (Buffer overflows allow injection of code into executable memory space, and are highly unlikely to affect the network rate of transmission.)

Front 38

39. Once data has been processed by the CPU for a program, it is moved into memory areas known as?

Back 38

a. primary storage (CPU post-processing output is written to primary storage, typically RAM although some architectures will include Caches and/or on-motherboard FLASH storage, until transferred to secondary storage or returned to the CPU for further processing.)

Front 39

40. What type of memory storage requires constant updates because the data it stores dissipates and decays?

Back 39

c. Dynamic RAM or Random Access Memory (Dram requires a refresh to retain its stored values, releasing all data when power is removed or the refresh cycle interrupted.)

Front 40

41. Which of the following is the fastest form of memory

Back 40

d. cache (The cache is both the fastest form of memory outside of the CPU’s registers, as well as the closest-connected physically and so enjoying the lowest latency for communication.)

Front 41

42. For security to be effective which of the following should not be true?

Back 41

a. security is added to a product after its initial development (So-called “bolt on” security is never fully integrated at a product’s deepest levels.)

Front 42

43. Once security is implemented into the design of a product, it should also be all but which of the following?

Back 42

b. disabled (Disabling the security effectively removes its protections.)

Front 43

44. If the operating system or an application fails to set boundaries on input data, what problem can occur?

Back 43

c. buffer overflow (Buffer overflows allow data to be written into executable memory space past the input buffer’s allocated area.)

Front 44

45. When a buffer overflow occurs, the extra data may flow into the CPU and cause what?

Back 44

a. Data hiding (Also sometimes referred to as data segmentation or data sequestration.)

Front 45

47. Which of the following security models is focused on protecting confidentiality?

Back 45

b. Bell-LaPadula model (Protects confidentiality by enforcing access controls based on security labels and clearances.)

Front 46

48. Which of the books from the Rainbow series is concerned with the interactions of computers over a communication medium?

Back 46

c. Red (The “Red Book” from the Rainbow Series is focused on Trusted Network Interpretation.)

Front 47

49. The ability for a single processor computer system to execute more than one process simultaneously is known as?

Back 47

b. Multitasking (The ability of a CPU to rapidly switch between task elements, to allow near-simultaneous completion of more than a single process by swapping operational tasks during process wait states and timeslicing.)

Front 48

50. The _______________ a security system, the _______________ it provides.

Back 48

c. more complex, less assurance (As is often said of plumbing, “The more complex the pipes, the easier to stop up the drain.” Complexity requires greater testing for any change and can produce undesirable combinatory functions arising out of unexpected timing or uncontrolled process competition such as race conditions.)