4.1 Security Architecture and Tool Sets Flashcards
which audit category will audit all instances of users exercising their rights?
the audit privilege use audit category
what is another term for logical controls?
technical controls
which type of controls dictates how security policies are implemented to fulfill the company’s security goals?
administrative or management control
what is the name of the process for removing only the incriminating data from the audit logs?
scrubbing
which type of controls is implemented to secure physical access to an object, such as building, a room, or a computer?
physical or operational control
which type of controls include developing policies and procedures, screening personnel, conducting security awareness training, and implementing change control?
administrative controls
what is the purpose of administrative controls?
to implement security policies based on procedures, standards, and guidelines
what is the purpose of password complexity rules?
to ensure that users do not use passwords that are easy to guess using dictionary attacks
what must you do for an effective security auditing policy, besides creating security logs?
analyze the logs
what is the purpose of physical controls?
to work with administrative and technical controls to enforce physical access control
which audit category tracks access to all objects outside active directory?
the audit object access audit category
which password attack does an account lockout policy protect against?
a brute force attack
if a user needs administrative-level access, how many user accounts should be issued to the user?
two - one for normal tasks, one for administrative-level tasks
which setting ensures that accounts are not used beyond a certain data and/or time?
account expiration
what are you trying to determine if you implement audit trails to ensure that users are not performing unauthorized functions?
accountability
which setting ensures that users periodically change their account passwords?
password expiration
what is the name for the process of tracking user activities by recording selected events in the server activity logs?
auditing
which document is used when it is necessary to invoke legal action against an employee for inappropriate use of computer resources?
acceptable use policy
which type of controls includes access control mechanisms, password management, identification methods, authentication methods, and security devices?
technical or logical controls
what are the FIVE stages in the life cycle of the evidence or the chain of custody?
- collection of evidence from the site
- analysis of the evidence by a team of experts
- storage of the evidence in a secure place to ensure that the evidence is not tampered with
- presentation of the evidence by legal experts in a court of law
- returning the evidence to the owner after the proceedings are over
what is the purpose of audit logs?
to document actions taken on a computer network and the party responsible for those actions
which type of controls work to protect system access, network architecture and access, control zones, auditing, and encryption and protocols?
technical controls
what is the purpose of technical controls?
to restrict access to objects and protect availability, confidentiality, and integrity
when should an administrative account be used?
when performing administrative-level tasks
which linux file contains encrypted user passwords that only the root user can read?
/etc/shadow
what is the purpose of password age rules?
to ensure that users change their passwords on a regular basis
which account should you rename immediately after installing a new operating system (OS) to harden the OS?
the administrator account
which assessment examines whether network security practices follow a company’s security policy?
an audit
which audit category monitors changes to user accounts and groups?
the audit account management audit category
what is the purpose of the password history settings?
to ensure that users do not keep reusing the same passwords
which setting ensures that repeated attempts to guess a user’s password is not possible beyond the configured value?
account lockout
which account should you disable immediately after installing a new operating system (OS) to harden the OS?
the guest account
which log in event viewer should you open to view events that are generated based on your auditing settings?
the security log
what is a good password complexity policy?
a mixture of numbers, uppercase and lowercase letters, and special characters, such as rObin3*nest
which audit category tracks all attempts to log on with a domain user account when enabled on domain controllers?
the audit account logon events audit category
which type of controls includes controlling access to different parts of a building, implementing locking systems, installing fencing, implementing environmental controls, and protecting the facility perimeter?
physical controls
