Itsy 1300 Information Security Exam 1 Ch 1 - 2 - 4 - 5

Front 1

The _____ worm carried no malicious payload, but continuously infected individual computer systems until they could no longer run programs.

Back 1

Morris

Front 2

_____ _____ used stolen accounts at the University of Southern California to store proprietary software stolen from various companies.

Back 2

Kevin Mitnick

Front 3

The _____ virus attached itself to documents which contained programs with a limited macro programming capability.

Back 3

Melissa

Front 4

The _____ _____ worm spread via e-mail as VBScript program attachment(s).

Back 4

Love Letter

Front 5

The _____-_____ worm infected computer systems by taking advantage of a buffer-overflow condition in Microsoft’s IIS Web servers.

Back 5

Code-Red

Front 6

The _____ worm would, after infecting a machine, start randomly selecting targets and send packets to them, attempting infection at a rate of 25,000 per second.

Back 6

Slammer

Front 7

Information warfare falls into the category of _____ structured threats.

Back 7

highly

Front 8

When an attacker defaces an organization’s Web site with graffiti, the attack can be classified as a(n) _____ _____.

Back 8

unstructured threat

Front 9

An attacker often performs a _____ _____ to identify all open ports before attacking a computer system.

Back 9

port scan

Front 10

The activities of an attacker who protests against globalization and defaces the web site of a multinational corporation can be termed as a _____ attack.

Back 10

hacktivist

Front 11

The _____ virus attached itself to documents which contain programs with a limited macro programming capability.

Back 11

Melissa

Front 12

To eliminate the Code-Red worm, the user could simply _____ _____ the infected machine.

Back 12

turn off

Front 13

The Code-Red worm took advantage of a buffer-overflow condition in _____ _____ _____ servers.

Back 13

Microsoft’s IIS Web

Front 14

A Philippine student named _____ _____ _____ wrote and released the Love Letter Worm that spread via e-mail with the subject line “ILOVEYOU”.

Back 14

Onel de Guzman

Front 15

The Melissa virus was attached to _______________ documents, and clogged networks with the traffic it generated.

Back 15

Microsoft Word 97 and Word 2000

Front 16

The act of deliberately accessing computer systems and networks without authorization is called _____.

Back 16

hacking

Front 17

_____ _____ are programming experts capable of writing scripts to exploit known vulnerabilities.

Back 17

Elite hackers

Front 18

Information _____ falls into the highly structured threat category.

Back 18

warfare

Front 19

An attacker performs a _____ _____ to determine which machines are reachable.

Back 19

ping sweep

Front 20

An attacker may resort to a _____-_____ attack to hack a user’s password.

Back 20

brute-force

Front 21

_____ _____ broke into Citibank’s network by dialing into the company’s cash management system.

Back 21

Vladimir Levin

Front 22

Shortly after he was dismissed, _____ _____ of Omega Engineering designed a software time bomb that deleted all design and production programs of the company.

Back 22

Timothy Lloyd

Front 23

The March 1997 disruption at the Worcester airport that occurred as a series of commands sent by a teenage computer hacker called _____, allowed access to the local telephone company.

Back 23

Jester

Front 24

The _____ virus, which clogged networks with the traffic it generated and caused problems for e-mail servers worldwide, was attached to Microsoft Word documents.

Back 24

Melissa

Front 25

The Love Letter Worm is also known as “ILOVEYOU” and the _____ _____.

Back 25

Love Bug

Front 26

The Love Letter Worm spread via e-mail with the subject line _____.

Back 26

I Love You

Front 27

The Code-Red worm was _____ _____, so switching off an infected machine eliminated the worm.

Back 27

memory resident

Front 28

The Slammer worm exploited a buffer-overflow vulnerability in computers running _____ or _____.

Back 28

Microsoft’s SQL Server
0r
Microsoft SQL Server Desktop Engine

Front 29

The act of deliberately accessing computer systems and networks without authorization is called
_____.

Back 29

hacking

Front 30

Attacks performed by an individual or even small groups of attackers fall into the category of _____ threats.

Back 30

unstructured

Front 31

Groups of individuals capable of discovering new vulnerabilities and writing scripts to exploit them are known as _____ _____.

Back 31

elite hackers

Front 32

Attacks by criminal organizations, characterized by a great deal of planning, a longer period of time, and with possible financial backing, fall into the _____ threat category.

Back 32

structured

Front 33

Warfare conducted against the information and the information-processing equipment used by an adversary is called _____ _____.

Back 33

information warfare

Front 34

Essential services such as water, oil and gas, and electricity fall into the category of _____ infrastructures.

Back 34

critical

Front 35

A hacker whose activities are motivated by a _____ or _____ is called a hacktivist.

Back 35

cause or position

Front 36

The method in which a hacker sends a series of “pings” to a range of target machine addresses is called a _____ _____.

Back 36

ping sweep

Front 37

The method that helps a hacker identify which ports are open, and gives an indication of which services are running on the target machine, is called a(n) _____ _____.

Back 37

port scan

Front 38

If an administrator has installed all appropriate patches so that known vulnerabilities have been addressed, the attacker may have to resort to a _____ _____ attack.

Back 38

brute force

Front 39

If an administrator has not installed the correct patch for _____, an attack could be successful.

Back 39

vulnerabilities

Front 40

Individuals who make use of ready-made automated tools, which allow novice attackers to exploit highly technical vulnerabilities, are called _____ _____.

Back 40

script kiddies

Front 41

_____ ensures that only authorized individuals are able to create or change information.

Back 41

Integrity

Front 42

_____ ensures that only authorized individuals are able to view a piece of information.

Back 42

Confidentiality

Front 43

_____ deals with the ability to verify that a message has been sent and received, and that the sender can be identified and verified.

Back 43

Nonrepudiation

Front 44

emphasizes controlling access to internal computers from external entities.

Back 44

The network security principle

Front 45

The network security principle is combined with _____ _____ to avoid introducing or overlooking vulnerabilities in a system

Back 45

host security

Front 46

_____ is an authentication tool that uses strong encryption so that a client can prove its identity to a server and vice versa.

Back 46

Kerberos

Front 47

The operational model of computer security implements the principle _____ = Prevention + (Detection + Response).

Back 47

Protection

Front 48

The _____ protocol is designed to provide authentication periodically using a challenge/response system.

Back 48

Challenge-Handshake Authentication Protocol
(CHAP)

Front 49

The authentication_____ _____ involves verification of an individual’s identity.

Back 49

security goal

Front 50

_____ authentication uses more than one authentication mechanism at the same time.

Back 50

Multifactor

Front 51

The layered security principle recognizes that no _____ _____ is perfect, and hence, encourages the use of a variety of security mechanisms.

Back 51

security mechanism

Front 52

The _____ _____ process verifies the authenticity of parties on both sides of an electronic communication.

Back 52

mutual authentication

Front 53

The _____ _____ security principle allows users to access certain files on the file server, but not other data present within the database.

Back 53

least privilege

Front 54

The term _____ refers to the ability of a subject to interact with an object.

Back 54

access

Front 55

CHAP uses the _____ communication protocol to provide authentication across a point-to-point link.

Back 55

point-to-point
PPP

Front 56

The field of authentication that uses technology such as retinal scans, fingerprints, and voice prints to verify an individual’s identity is _____ .

Back 56

biometrics

Front 57

Hand geometry, retinal scans, and voice prints are all types of _____ _____.

Back 57

biometric authentication

Front 58

The _____ authentication process might use biometrics in conjunction with a personal identification number to identify a user.

Back 58

multifactor

Front 59

The _____ principle states that a subject can write to an object only if its security classification is less than or equal to that of the object.

Back 59

*-property

Front 60

The _____ security model implements the Simple Security Rule and *-property principles.

Back 60

Bell-LaPadula

Front 61

_____ ensures that only authorized individuals are able to create or change information.

Back 61

Integrity

Front 62

If an organization fails to implement _____ security with _____ security, there is a high probability of introducing or overlooking vulnerabilities.

Back 62

host/network

Front 63

Network security emphasizes controlling access to _____ computers from _____ entities.

Back 63

internal/external

Front 64

According to ______ _____ _____, security is considered effective if the protection mechanisms are confusing or generally not known.

Back 64

security through obscurity

Front 65

_____ _____ refers to all security features used to prevent unauthorized access to a computer system or network.

Back 65

Access control

Front 66

The most common method of authentication is the use of a user ID and a password. _____ access controls are a means of restricting access to objects based on the identity of subjects and/or groups to which they belong. The controls are discretionary in the sense that a subject with certain access permission is capable of passing that permission on to any other subject.

Back 66

Discretionary

Front 67

_____ verifies an individual’s identity.

Back 67

Authentication

Front 68

Multifactor is a term used to describe the use of more than one _____ _____ at the same time.

Back 68

authentication mechanism

Front 69

A _____ is a hardware device that can be used in a challenge/response authentication process.

Back 69

token

Front 70

In the _____ Security Model, the integrity verification processes ensure that constrained data item (CDI) data meets integrity constraints.

Back 70

Clark-Wilson

Front 71

“Hacking” of systems used by a telephone company is also referred to as _____

Back 71

phreaking

Front 72

The protection of multiple computers and other devices that are connected is termed as _____ _____.

Back 72

network security

Front 73

The goal of availability is to ensure that the data or the system is available for use when the _____ _____ wants it.

Back 73

authorized user

Front 74

The purpose of _____ is to ensure that unauthorized individuals are not able to view data.

Back 74

confidentiality

Front 75

_____ _____ focuses on protecting each computer and device individually instead of addressing protection of the network as a whole.

Back 75

Host security

Front 76

Devices such as ______ are used in network security to control access to internal computers by external entities.

Back 76

firewalls

Front 77

The security principle in which a subject is given only the necessary rights needed to perform a task with no additional permissions is referred to as ______ _____.

Back 77

least privilege

Front 78

If encrypted data is encapsulated within SSL packets and sent through a firewall, the firewall will be unable to read the information in the individual packets. This is an example of _____ _____.

Back 78

layered security

Front 79

The _____ through _____ concept entails using environment and protection mechanisms that are confusing or not generally known to implement security.

Back 79

security/obscurity

Front 80

The _____-_____-_____ principle states that services not needed should be eliminated.

Back 80

keep-it-simple

Front 81

The most common method of authentication is the use of a _____ and a _____.

Back 81

User ID / password

Front 82

The security features used to prevent unauthorized access to a computer system or network are referred to as _____ _____.

Back 82

access controls

Front 83

An _____ _____ list is a list that contains the subjects that have access rights to a particular object.

Back 83

access control

Front 84

The access control mechanism in which the security apparatus controls access to all objects and in which individual subjects cannot change the access controls is called _____ _____ control.

Back 84

mandatory access

Front 85

The access control mechanism in which users will be granted permissions to objects in terms of the specific duties they must perform is called _____-_____ _____ control.

Back 85

role-based access

Front 86

The basis for authentication in a _____ environment is a ticket.

Back 86

Kerberos

Front 87

Tickets are granted by the _____ _____, which is an entity trusted by both the client and the server the client wishes to access.

Back 87

authentication server

Front 88

The hardware device that can be used in a challenge/response authentication process is called a _____.

Back 88

token

Front 89

The mechanism that uses more than one _____ _____ at the same time is called multifactor.

Back 89

authentication mechanism

Front 90

_____ are high-level, broad statements of what an organization wants to accomplish.

Back 90

Policies

Front 91

_____ are mandatory elements for the implementation of a policy.

Back 91

Standards

Front 92

Step-by-step instructions that describe how employees are expected to act in a given situation are called _____.

Back 92

procedures

Front 93

_____ is not a part of the operational process and policy life cycle.

Back 93

Assimilation

Front 94

A _____ _____ is a security approach that is not a physical access control mechanism.

Back 94

digital certificate

Front 95

Development of policies, procedures, and guidelines take place at the planning level of the _____ process.

Back 95

operational

Front 96

The use of _____ is a security method that is not a biometric approach.

Back 96

locks

Front 97

_____ _____ is an environmental issue that could affect the operation of computer systems.

Back 97

Air conditioning

Front 98

Retinal scanning is a _____ approach to computer security.

Back 98

biometric

Front 99

_____ _____ is a fire suppression system designed specifically to suppress the fire and also to protect the contents of the room.

Back 99

Clean agent

Front 100

Piggybacking is not an _____ issue that could pose a concern for computer systems.

Back 100

environmental

Front 101

A _____-_____ fire suppression system has been the most widely used tool to control structural fires.

Back 101

water-based

Front 102

_____ _____ fire extinguishers displace oxygen and also cool the fire zone.

Back 102

Carbon dioxide

Front 103

_____ fire extinguishers were designed to reduce the oxygen concentration in the fire zone to below 15 percent.

Back 103

Inergen

Front 104

_____-_____-_____ sensors activate when there is a sudden increase in the local temperature indicating the initial stages of a fire.

Back 104

Rate-of-rise

Front 105

_____-_____ fire suppression systems are commonly used in offices.

Back 105

Hand-held

Front 106

Carbon dioxide is appropriate for use in suppressing fires that involve _____ liquids.

Back 106

combustible

Front 107

______ is a type of fire detector that uses a small amount of radioactive material.

Back 107

Ionization

Front 108

A _____ fire detector sounds an alarm when the light beam it sends out is obstructed, assuming that the obstruction is smoke.

Back 108

photoelectric

Front 109

A “_____ _____” is considered an expensive method to address shielding.

Back 109

Faraday cage

Front 110

_____ and _____ technologies are dynamic in the sense that they acknowledge security is an ongoing process that needs constant monitoring.

Back 110

Detection/response

Front 111

_____ are recommendations relating to a policy.

Back 111

Guidelines

Front 112

_____ _____ is the process of convincing an individual to provide confidential information or access to an unauthorized individual.

Back 112

Social engineering

Front 113

_____ _____ is a procedure in which attackers position themselves in such a way as to be able to observe the authorized user entering the correct access code.

Back 113

Shoulder surfing

Front 114

An _____ period is the time when those who will be affected by the introduction of new documents will learn about their contents. This is part of the implementation of a policy.

Back 114

instruction

Front 115

Hand-held extinguishers are common in offices, but one should use them correctly to avoid _____.

Back 115

disasters

Front 116

Inergen suppresses fires by reducing the level of _____ to about 12.5 percent.

Back 116

oxygen

Front 117

Rate-of-increase temperature devices activate when there is a _____ _____ in the local temperature that may indicate the beginning stages of a fire.

Back 117

sudden increase

Front 118

An organization’s policies, procedures, standards, and guidelines detail what users and administrators should do to maintain _____ and _____ security

Back 118

system/network

Front 119

High-level, broad statements of what an organization wants to accomplish are called _____.

Back 119

policies

Front 120

Accepted specifications that provide details on how a policy is to be enforced are called _____.

Back 120

standards

Front 121

Recommendations related to a policy are called _____.

Back 121

guidelines

Front 122

Step-by-step instructions on how to implement policies in an organization are called _____.

Back 122

procedures

Front 123

An instruction period, a part of the _____ step of the operational process, is when those who will be affected by changes or introduction of company policies or procedures will learn about the contents of the new document.

Back 123

implementation

Front 124

Argon,inergen and carbon dioxide are examples of _____-_____ fire suppression systems.

Back 124

clean-agent

Front 125

The security mechanism that ensures physical access to computer systems and networks is restricted to authorized users is called _____ security.

Back 125

physical

Front 126

The technique of _____ involves following another person closely to avoid having to go through the access control procedures.

Back 126

piggybacking

Front 127

The process of convincing an authorized individual to provide confidential information or access to an unauthorized individual is called _____ _____.

Back 127

social engineering

Front 128

Organizations prefer _____-_____ fire suppression systems because they not only provide fire suppression capabilities, but also protect the contents of the room.

Back 128

clean-agent

Front 129

Class ___ fire extinguishers are designed to handle fires where magnesium or titanium is one of the combustible materials.

Back 129

D

Front 130

_____ _____ and _____ _____ devices go hand-in-hand in protecting computer systems from fires.

Back 130

Fire suppression/fire detection

Front 131

A photoelectric fire detector monitors an _____ beam of light.

Back 131

internal

Front 132

A ionization detector uses an ionization chamber and a small _____ source to detect fast-burning fires.

Back 132

radioactive

Front 133

An even more common physical security feature than locks is a _____ barrier.

Back 133

physical

Front 134

Fire detection devices activated by _____ are generally more expensive, but they detect a fire sooner.

Back 134

flames

Front 135

With the appropriate electromagnetic _____ equipment, the exact image displayed on monitors can be re-created some distance away by intercepting electronic emanations from the target.

Back 135

eavesdropping

Front 136

The U.S. Department of Defense defined _____ as a program in the military to control electronic emanations from electrical equipments.

Back 136

TEMPEST
jokingly:( Tiny ElectroMagnetic Particles Emitting Secret Things )

No acronym meaning

Front 137

In physical security, location plays a significant role since some facilities are easier to protect than others due to their _____.

Back 137

proximity

Front 138

The tactic of following a person who has just used a PIN to gain access to a room or building is called _____.

Back 138

piggybacking

Front 139

The technique of observing authorized users entering the correct access code for them to gain access later is called _____ _____.

Back 139

shoulder surfing

Front 140

Most users have at least one _____ _____ number used for authentication or access control associated with things such as their automated teller machine or a security code to gain physical access to a room.

Back 140

personal identification

Front 141

The process in which attackers often find valuable clues about user passwords from information carelessly discarded by users is called _____ _____.

Back 141

dumpster diving

Front 142

A _____ can be used to access a network system by circumventing the normal security mechanisms.

Back 142

backdoor

Front 143

A backdoor is a potential hazard which forces administrators to restrict users from _____ and _____ software or installing hardware without permission.

Back 143

downloading/installing

Front 144

Due to the risk of _____ _____, it is not advisable to read online bank balance statements or credit card information in a crowded cyber cafe.

Back 144

shoulder surfing

Front 145

One of the best tools in defending against a social engineering attack is _____.

Back 145

people

Front 146

The technique in which an attacker convinces an authorized user to pass classified information is called _____ ______.

Back 146

social engineering

Front 147

The approach in which an attacker hopes to convince the target to initiate a contact in order to obtain sensitive or important information is called _____ _____ _____.

Back 147

reverse social engineering

Front 148

Being aware of who is around when discussing _____ _____ is considered a good security practice.

Back 148

sensitive issues

Front 149

Conducting _____ _____ training programs is the most effective method of countering potential social engineering attacks.

Back 149

security awareness

Front 150

Storing _____ in the user inbox is not considered a good practice for password security.

Back 150

passwords

Front 151

Discussing _____ _____ with family members or friends is not considered a good practice to adopt.

Back 151

sensitive information

Front 152

Convincing a target to _____ contact with the attacker is a reverse social engineering approach.

Back 152

initiate

Front 153

Contractors and consultants in an organization pose concerns for security administrators because they often have _____ _____ to the facility as well as network access.

Back 153

physical access

Front 154

When reading sensitive information, a responsible user should be wary of who is around to avoid _____ _____.

Back 154

shoulder surfing

Front 155

By not allowing oneself to be _____ by an outsider, a user would be resisting the attacker’s social engineering approach.

Back 155

intimidated

Front 156

Installing _____ software from the Internet introduces the possibility of a backdoor.

Back 156

unlicensed

Front 157

Shoulder-surfing techniques enable an attacker to gain access into a facility by learning the _____ _____.

Back 157

access code

Front 158

Often, users carelessly discard passwords or clues to passwords in their trash, which a lucky _____ _____ might just find and, therefore, gain access to the user’s system.

Back 158

dumpster diver

Front 159

Attackers set _____ into a network to circumvent normal security mechanisms.

Back 159

backdoors

Front 160

Social engineering is the technique of _____ the target to divulge sensitive information.

Back 160

persuading

Front 161

In keeping with physical access control mechanisms, many organizations require employees to _____ identification badges at work.

Back 161

wear

Front 162

Due to the risk of introducing a backdoor into the network, organizations discourage employees from _____ attachments that come with unsolicited e-mails.

Back 162

downloading

Front 163

In reverse social engineering, an _____ hopes to convince the target to initiate the contact.

Back 163

attacker

Front 164

Social engineering is successful because it exploits the human being’s nature of being _____.

Back 164

helpful

Front 165

_____ paper containing sensitive information before discarding it can help avoid loss due to dumpster diving.

Back 165

Shredding

Front 166

Social engineering attacks are often successful since they use the technique of intimidating the target, who would seek to avoid _____ and _____.

Back 166

confrontation/trouble

Front 167

_____-_____ attackers take advantage of the fact that users often pick passwords that are easy to remember.

Back 167

Brute-force

Front 168

The tactic of closely following a person who has used an access card to gain access to a building is called _____.

Back 168

piggybacking

Front 169

When attackers position themselves in a way that they are able to observe an authorized user entering their access code, the technique is called _____ _____.

Back 169

shoulder surfing

Front 170

The process of going through a target’s trash to obtain sensitive information is known as _____ _____.

Back 170

dumpster diving

Front 171

Avenues that can be used to access a system while circumventing the normal security mechanisms are called _____.

Back 171

backdoors

Front 172

It is not advisable to download games from the Internet since this might open a backdoor that allows attackers to _____ the system.

Back 172

access

Front 173

Many organizations require employees to wear _____ _____ when at work.

Back 173

identification badges

Front 174

The technique, in which an attacker convinces an authorized user to divulge information which the attacker is not privileged to, is called _____ _____.

Back 174

social engineering

Front 175

The technique in which an attacker convinces the target to initiate the contact in order to obtain sensitive or important information is called _____ _____ _____.

Back 175

reverse social engineering

Front 176

Shredding paper containing sensitive information reduces the risk of losing _____ _____ due to dumpster diving.

Back 176

sensitive information

Front 177

Social engineering _____ the basic human nature of being helpful.

Back 177

exploits

Front 178

In the reverse social engineering technique, the attacker’s chances of success are often _____, since the target initiates the contact.

Back 178

higher

Front 179

The most effective method of countering potential social engineering attacks is to conduct an active _____ _____ program.

Back 179

security awareness

Front 180

Regardless of how advanced security technology is, it will ultimately be deployed in an environment where the _____ element may be its greatest weakness.

Back 180

human

Front 181

Securing storage media containing sensitive information in a secure storage device is one of the integral _____ of a user.

Back 181

responsibilities

Front 182

An attacker calling for some information and claiming to be under some deadline from a supervisor is using _____ _____.

Back 182

social engineering

Front 183

In shoulder surfing, the attacker does not closely follow an authorized user into a building, but leans over to _____ at sensitive information.

Back 183

peek

Front 184

A dumpster diver would go through a user’s _____ _____ in the hope of obtaining any clues that might point to passwords or other sensitive information.

Back 184

trash bin

Front 185

Users may execute a _____ program that is part of an unsolicited e-mail, sent by an attacker, designed to install a backdoor to access the user’s system.

Back 185

hostile

Front 186

Bogus Web sites of seemingly legitimate “_____ _____” companies employ the reverse social engineering tactic to gain insider information.

Back 186

tech support

Front 187

The _____ cipher system allows 26 possible values for every letter in a message, making it more complex than a standard shift cipher.

Back 187

substitution

Front 188

The _____ cipher system is one letter of the alphabet shifted a set number of places in the alphabet for another letter.

Back 188

shift

Front 189

The _____ system uses polyalphabetic substitution.

Back 189

Vigenère

Front 190

The _____ encryption algorithms is a variant of DES that, depending on the specific variant, uses two or three keys instead of the single key DES.

Back 190

Triple DES
(3DES)

Front 191

The _____ encryption algorithm can have key sizes of 128, 192, and 256 bits, with the key size affecting the number of rounds used in the algorithm.

Back 191

Advanced Encryption Standard
(AES)

Front 192

In the byte sub step of _____, each byte is replaced by its S-box substitute.

Back 192

AES

Front 193

_____ multiplication, based upon the arranged rectangle, is performed in the mix column step of AES.

Back 193

Matrix

Front 194

In the add round key step of AES, the round’s _____ is cored in.

Back 194

subkey

Front 195

The _____ encryption algorithm, designed to be a DES replacement, is a variable-key-size block-mode cipher.

Back 195

Rivest Cipher 2
(RC2)

Front 196

The Rivest Cipher 4 (RC4) algorithm is a _____ cipher.

Back 196

stream

Front 197

The _____ encryption algorithm is susceptible to a weak key made of all zeros.

Back 197

International Data Encryption Algorithm
(IDEA)

Front 198

The RC2 algorithm puts input blocks through ___ rounds of either mix or mash operations.

Back 198

18

Front 199

The _____ asymmetric encryption algorithm is based upon the difficulty of calculating discrete logarithms in a finite field.

Back 199

ElGamal

Front 200

The _____ asymmetric encryption algorithm works on the basis of a simple function that is drawn as a gently looping curve on the X, Y plane.

Back 200

Elliptic Curve Cryptography
(ECC)

Front 201

The _____ security principle ensures that the sender and the recipient of a message are informed that the message was not altered in transmission.

Back 201

integrity

Front 202

The process of confirming an individual’s identity is called _____.

Back 202

authentication

Front 203

The ECC encryption technique is an _____ encryption algorithm.

Back 203

asymmetric

Front 204

The Blowfish technique is a _____ encryption algorithm.

Back 204

symmetric

Front 205

The _____ cryptographic algorithm is a block-mode cipher that uses 64-bit blocks and a variable key length from 32 to 448 bits.

Back 205

Blowfish

Front 206

The Carlisle Adams and Stafford Tavares
(CAST) cryptographic algorithm is a _____ encryption method.

Back 206

symmetric

Front 207

Digital signatures provide _____ and _____.

Back 207

integrity / nonrepudiation

Front 208

In the fall of 2000, the National Institute of Standards and Technology (NIST) selected _____ as the new Advanced Encryption Standard.

Back 208

Rijndael

Front 209

The encryption type that is most commonly used to ensure confidentiality of data is called _____ encryption.

Back 209

symmetric

Front 210

The system by which the private key is kept by the user and by the government is called _____ _____.

Back 210

key escrow

Front 211

Recursive computational procedures for solving problems in finite steps are called _____.

Back 211

algorithms

Front 212

The _____ cipher works on the principle of substituting a different letter for every letter.

Back 212

substitution

Front 213

The Vigenère cipher works as a _____ substitution cipher that depends on a password.

Back 213

polyalphabetic

Front 214

When an algorithm lists a certain number of bits as a key, it defines the _____.

Back 214

keyspace

Front 215

The DES uses a ___-bit key, allowing 72,000,000,000,000,000 possible values.

Back 215

56

Front 216

_____ _____ pad ciphers have a key equal to the length of the message, and use random data for the key.

Back 216

One time

Front 217

Strong algorithms and appropriate key lengths assure security with _____ encryption.

Back 217

asymmetric

Front 218

A _____ is a special mathematical function that performs one-way encryption.

Back 218

hash

Front 219

_____ creates a 128 bit hash of a message of any length.

Back 219

Message-Digest algorithm 5
(MD5)

Front 220

In MD5, after padding is complete, four ___-bit variables, A, B, C, and D, are initialized.

Back 220

32

Front 221

All symmetric algorithms are based upon the _____ secret principle.

Back 221

shared

Front 222

DES is short for _____ _____ _____.

Back 222

Data Encryption Standard

Front 223

3DES spins through the DES algorithm _____ times using multiple encryption.

Back 223

three

Front 224

The _____ cipher of the RC series uses the 128-block size, separated into four words of 32 bits each.

Back 224

Rivest Cypher 6
(RC6)

Front 225

The IDEA encryption algorithm is susceptible to a _____ key.

Back 225

weak

Front 226

In the electronic key _____ process, the public key, which is the slower protocol, is used to exchange the secret key, and then the communication uses the faster symmetric key protocol.

Back 226

exchange

Front 227

ECC works on the basis of _____ curves.

Back 227

elliptic

Front 228

In the _____ cipher, one letter of the alphabet is shifted a number of places in the alphabet for another letter.

Back 228

shift

Front 229

The Vigenère cipher works as a polyalphabetic substitution cipher that depends on a _____.

Back 229

password

Front 230

The two methods of cryptanalysis are _____ and _____ .

Back 230

differential / linear

Front 231

The modern implementation of DES, _____, uses two or three keys.

Back 231

Triple Data Encryption Standard
(3DES)

Front 232

A hash algorithm runs the risk of a _____ attack, where an attacker finds two different messages that hash to the same value.

Back 232

collision

Front 233

RC2, RC4, RC5, and RC6 are working algorithms of the _____ series.

Back 233

Rivest Cypher
(RC)

Front 234

_____ creates 160-bit long message digests that can be used by the Digital Signature Algorithm to compute the signature of a message.

Back 234

Secure Hash Algorithm
(SHA)

Front 235

_____ algorithms are based upon the shared secret principle.

Back 235

Symmetric

Front 236

CAST uses the ___-bit block size for 64- and 128-bit key versions, and a 128-bit block size for the 256-bit key version.

Back 236

64

Front 237

RC4 is a ____ cipher

Back 237

stream

Front 238

Which of the following hackers accomplished illegal money transfers by breaking into Citibank's cash management system?

A) Kevin Mitnick
B) Robert Morris
C) Timothy Lloyd
D) Vladimir Levin

Back 238

Vladimir Levin

Front 239

Which virus, when run, would infect the current host and also send itself to the first 50 addresses in the individual's address book?

A) Code-Red
B) Love Bug
C) Melissa
D) Slammer

Back 239

Melissa

Front 240

The Slammer worm sent its single packet to UDP port ____.

A) 1434
B) 1524
C) 1645
D) 1718

Back 240

1434

Front 241

Which of the following malicious programs was memory resident and could be eliminated by simply turning off the infected machine?

A) Code-Red
B) Love Bug
C) Melissa
D) Slammer

Back 241

Code-Red

Front 242

Which of the following malicious programs generated 1TB of worm-related traffic every second at its peak?

A) Code-Red
B) Love bug
C) Melissa
D) Slammer

Back 242

Slammer

Front 243

Which worm ran as a VBScript attachment, and searched the infected system for files with specific extensions to replace them with copies of itself?
Need a Hint?
A) Code-Red
B) Love Bug
C) Morris
D) Slammer

Back 243

Love Bug

Front 244

Individuals who are not technical experts, but know enough to download and run scripts that others have developed are called ____.

A) dumpster divers
B) elite hackers
C) script kiddies
D) shoulder surfers

Back 244

script kiddies

Front 245

Which of the following groups of individuals are considered to be the biggest potential threat to computer security?

A) Dumpster divers
B) Insiders
C) Script kiddies
D) Shoulder surfers

Back 245

Insiders

Front 246

Which of the following terms refers to an individual who has the capability to write scripts, and discover new vulnerabilities?

A) Dumpster diver
B) Elite hacker
C) Script kiddie
D) Shoulder surfer

Back 246

Elite hacker

Front 247

Which of the following assets will NOT be classified as one of the nation's critical infrastructures?

A) Retail Industry
B) Banking and finance
C) Oil and gas refineries
D) Telecommunications

Back 247

Retail Industry

Front 248

Which of the following security principles ensures that unauthorized individuals are restricted from viewing data to which they are not entitled?

A) Authentication
B) Confidentiality
C) Integrity
D) Nonrepudiation

Back 248

Confidentiality

Front 249

Which security principle commonly uses a user ID and password to verify the identity of an individual?

A) Authentication
B) Availability
C) Integrity
D) Nonrepudiation

Back 249

Authentication

Front 250

Which of the following is a hardware device used for authentication?

A) Certificate
B) CHAP
C) Kerberos
D) Token

Back 250

Token

Front 251

Which security approach takes a granular view of security by focusing on protecting each computer and device individually?

A) Host security
B) Layered security
C) Least privilege
D) Network security

Back 251

Host security

Front 252

Which security approach does the concept of diversity of defense complement the best?

A) Host security
B) Layered security
C) Least privilege
D) Network security

Back 252

Layered security

Front 253

Which security principle states that no subject could read information from an object with a security classification higher than that possessed by the subject itself?

A) Integrity Verification process
B) Low-Water-Mark policy
C) Simple Security rule
D) Transformation process

Back 253

Simple Security rule

Front 254

Which of the following security approaches uses more than one authentication mechanism simultaneously?

A) Certificate
B) CHAP
C) Kerberos
D) Multifactor

Back 254

Multifactor

Front 255

Which of the following security policies is implemented by the Bell-LaPadula security model?

A) Integrity Verification process
B) Low-Water-Mark policy
C) *-property
D) Ring policy

Back 255

*-property

Front 256

Which of the following security principles ensures the confidentiality of data?

A) Constrained Data Items
B) Low-Water-Mark policy
C) Simple Security Rule
D) Unconstrained Data Items

Back 256

Simple Security Rule

Front 257

Which of the following security principles is more concerned with confidentiality rather than Integrity?

A) Constrained Data Items
B) *-property
C) Ring Policy
D) Unconstrained Data Items

Back 257

*-property

Front 258

Mandatory elements, which may be externally driven or set by an organization for its own goals, are called ____.

A) guidelines
B) policies
C) procedures
D) standards

Back 258

standards

Front 259

The key term for ____ is recommendation, because they are not mandatory steps.

A) guidelines
B) policies
C) procedures
D) standards

Back 259

guidelines

Front 260

The biggest danger to any organization's computer systems comes from ____.

A) crackers
B) insiders
C) phreakers
D) script kiddies

Back 260

insiders

Front 261

Handwriting analysis, retinal scans, and hand geometry are examples of ____.

A) biometrics
B) robotics
C) shielding
D) social engineering

Back 261

biometrics

Front 262

Which of the following power sources must an organization use for a smooth transition between normal and backup power?

A) Electric generators
B) Surge protectors
C) Uninterruptible power supplies
D) Voltage regulators

Back 262

Uninterruptible power supplies

Front 263

Which of the following chemical agents is NOT a clean agent?

A) Argon
B) Halon
C) INERGEN
D) Heptafluoropropane

Back 263

Halon

Front 264

Which of the following fire suppression agents reduces the concentration of gasified fuel?

A) Argon
B) Carbon dioxide
C) Halon-based
D) Water-based

Back 264

Carbon dioxide

Front 265

Which of the following elements suppresses fire by raising the total heat capacity of the environment?

A) Argon
B) Halon
C) INERGEN
D) Trifluoromethane

Back 265

Trifluoromethane

Front 266

Which fire detector activates when the temperature in the area exceeds a predefined level?

A) Fixed-point
B) Flame-activated
C) Photoelectric
D) Rate-of-rise

Back 266

Fixed-point

Front 267

Which of the following terms is a low-cost wireless technology?

A) Biometrics
B) Bluetooth
C) TEMPEST
D) HVAC

Back 267

Bluetooth

Front 268

Which of the following tactics involves closely following a person who has just gained access to a building?

A) Brute-force attack
B) Dumpster diving
C) Piggy backing
D) Social engineering

Back 268

Piggy backing

Front 269

The tactic in which an attacker leans over to read another person's e-mail in a cyber café is called ____.

A) dumpster diving
B) piggybacking
C) reverse social engineering
D) shoulder surfing

Back 269

shoulder surfing

Front 270

Which of the following tactics is used by a dumpster diver to gain confidential information?

A) Convince a target to initiate a contact.
B) Rummage a target's trash.
C) Seek information on the basis of sympathy.
D) Threaten a vulnerable target.

Back 270

Rummage a target's trash.

Front 271

Avenues that can be used to access a system by circumventing security mechanisms in place are called ____.

A) backdoors
B) dumpster divers
C) Passwords
D) Worms

Back 271

backdoors

Front 272

Which of the following activities is considered a good practice that every user in an organization should adopt?

A) Discussing sensitive information only with family members.
B) Downloading attachments from unsolicited e-mails.
C) Shredding organizational information documents before discarding.
D) Writing passwords and sticking them inside personal lockers.

Back 272

Shredding organizational information documents before discarding.

Front 273

The goal of ____ is to convince the target to provide information or accomplish some act that they normally would not do.

A) dumpster diving
B) reverse social engineering
C) shoulder surfing
D) social engineering

Back 273

social engineering

Front 274

The technique in which an attacker convinces an authorized user to pass classified information to an unauthorized person is called ____.

A) dumpster diving
B) reverse social engineering
C) shoulder surfing
D) social engineering

Back 274

social engineering

Front 275

An approach in which the attacker hopes to convince the target to initiate contact to get them to voluntarily divulge sensitive or important information is called ____.

A) backdoor entry
B) reverse social engineering
C) shoulder surfing
D) social engineering

Back 275

reverse social engineering

Front 276

Which of the following activities is considered a good security practice?

A) Being aware of who is around when discussing sensitive issues.
B) Discussing organizational information with family members and friends.
C) Divulging sensitive information to other company employees.
D) Leaving confidential organizational information unattended.

Back 276

Being aware of who is around when discussing sensitive issues.

Front 277

Which of the following procedures is the single most effective method to counter potential social engineering attacks?

A) Changing user IDs and passwords on a regular basis.
B) Conducting security awareness training programs.
C) Establishing a layered security structure in the network environment.
D) Implementing new policies, procedures, and standards.

Back 277

Conducting security awareness training programs.

Front 278

In which of the following steps in a round of AES are the bytes arranged in a rectangle and shifted?

A) Add round key
B) Byte sub
C) Mix column
D) Shift row

Back 278

Shift row

Front 279

Which of the following cryptographic algorithms is a block-mode cipher that uses 64-bit blocks and a variable key length from 32 to 448 bits?

A) AES
B) Blowfish
C) CAST
D) IDEA

Back 279

Blowfish

Front 280

Which of the following encryption algorithms is NOT a block-mode cipher?

A) RC2
B) RC4
C) RC5
D) RC6

Back 280

RC4

Front 281

Which of the following cryptographic algorithms is a symmetric encryption method?

A) CAST
B) Diffie-Hellman
C) ElGamal
D) RSA

Back 281

CAST

Front 282

Which asymmetric encryption algorithm plays a role in the electronic key exchange method of the Secure Sockets Layer protocol?

A) Diffie-Hellman
B) ECC
C) ElGamal
D) RSA

Back 282

Diffie-Hellman

Front 283

Which encryption algorithm spins through the DES algorithm three times via multiple encryption?

A) AES
B) 3DES
C) IDEA
D) RC2

Back 283

3DES

Front 284

The ability to maintain secrecy about some piece of data is called ____.

A) authentication
B) confidentiality
C) integrity
D) nonrepudiation

Back 284

confidentiality

Front 285

Which method of cryptanalysis puts the plaintext through a simplified cipher to deduce the likely key in the full version of the cipher?

A) Asymmetric cryptanalysis
B) Differential cryptanalysis
C) Linear cryptanalysis
D) Symmetric cryptanalysis

Back 285

Linear cryptanalysis

Front 286

Which asymmetric encryption algorithm uses the product of two large prime numbers and works on the principle of difficulty in factoring such numbers?

A) Diffie-Hellman
B) ECC
C) ElGamal
D) RSA

Back 286

RSA

Front 287

Which of the following security principles favors symmetric encryption due to its speed and because asymmetric encryption can increase the size of the object being encrypted?

A) Authentication
B) Confidentiality
C) Integrity
D) Nonrepudiation

Back 287

Confidentiality