ASSESSMENT TEST Flashcards
Which of the following types of access control seeks to discover
evidence of unwanted, unauthorized, or illicit behavior or activity?
A. Preventive
B. Deterrent
C. Detective
D. Corrective
C. Detective access controls are used to discover (and document)
unwanted or unauthorized activity.
Define and detail the aspects of password selection that distinguish
good password choices from ultimately poor password choices.
A. Difficult to guess or unpredictable
B. Meet minimum length requirements
C. Meet specific complexity requirements
D. All of the above
D. Strong password choices are difficult to guess, unpredictable, and
of specified minimum lengths to ensure that password entries cannot
be computationally determined. They may be randomly generated and
utilize all the alphabetic, numeric, and punctuation characters; they
should never be written down or shared; they should not be stored in
publicly accessible or generally readable locations; and they shouldn’t
be transmitted in the clear.
Which of the following is most likely to detect DoS attacks? A. Host-based IDS B. Network-based IDS C. Vulnerability scanner D. Penetration testing
B. Network-based IDSs are usually able to detect the initiation of an attack or the ongoing attempts to perpetrate an attack (including denial of service, or DoS). They are, however, unable to provide information about whether an attack was successful or which specific systems, user accounts, files, or applications were affected. Hostbased IDSs have some difficulty with detecting and tracking down DoS attacks. Vulnerability scanners don’t detect DoS attacks; they test for possible vulnerabilities. Penetration testing may cause a DoS or test for DoS vulnerabilities, but it is not a detection tool.
Which of the following is considered a denial-of-service attack?
A. Pretending to be a technical manager over the phone and asking a
receptionist to change their password
B. While surfing the Web, sending to a web server a malformed URL
that causes the system to consume 100 percent of the CPU
C. Intercepting network traffic by copying the packets as they pass
through a specific subnet
D. Sending message packets to a recipient who did not request them
simply to be annoying
B. Not all instances of DoS are the result of a malicious attack. Errors in coding OSs, services, and applications have resulted in DoS conditions. Some examples of this include a process failing to release control of the CPU or a service consuming system resources out of proportion to the service requests it is handling. Social engineering
and sniffing are typically not considered DoS attacks
At which layer of the OSI model does a router operate? A. Network layer B. Layer 1 C. Transport layer D. Layer 5
A. Network hardware devices, including routers, function at layer 3,
the Network layer.
Which type of firewall automatically adjusts its filtering rules based on
the content of the traffic of existing sessions?
A. Static packet filtering
B. Application-level gateway
C. Circuit level gateway
D. Dynamic packet filtering
D. Dynamic packet-filtering firewalls enable the real-time
modification of the filtering rules based on traffic content.
A VPN can be established over which of the following? A. Wireless LAN connection B. Remote access dial-up connection C. WAN link D. All of the above
D. A VPN link can be established over any other network communication connection. This could be a typical LAN cable connection, a wireless LAN connection, a remote access dial-up connection, a WAN link, or even an internet connection used by a
client for access to the office LAN.
What type of malware uses social engineering to trick a victim into installing it? A. Viruses B. Worms C. Trojan horse D. Logic bomb
C. A Trojan horse is a form of malware that uses social engineering tactics to trick a victim into installing it—the trick is to make the victim believe that the only thing they have downloaded or obtained is the host file, when in fact it has a malicious hidden payload.
The CIA Triad comprises what elements?
A. Contiguousness, interoperable, arranged
B. Authentication, authorization, accountability
C. Capable, available, integral
D. Availability, confidentiality, integrity
D. The components of the CIA Triad are confidentiality, availability, and integrity.
Which of the following is not a required component in the support of accountability? A. Auditing B. Privacy C. Authentication D. Authorization
B. Privacy is not necessary to provide accountability.
Which of the following is not a defense against collusion? A. Separation of duties B. Restricted job responsibilities C. Group user accounts D. Job rotation
C. Group user accounts allow for multiple people to log in under a single user account. This allows collusion because it prevents
individual accountability.
A data custodian is responsible for securing resources after
______________________ has assigned the resource a security
label.
A. Senior management
B. The data owner
C. An auditor
D. Security staff
B. The data owner must first assign a security label to a resource before the data custodian can secure the resource appropriately.
In what phase of the Capability Maturity Model for Software (SWCMM) are quantitative measures utilized to gain a detailed understanding of the software development process? A. Repeatable B. Defined C. Managed D. Optimizing
C. The Managed phase of the SW-CMM involves the use of quantitative development metrics. The Software Engineering Institute (SEI) defines the key process areas for this level as Quantitative Process Management and Software Quality Management.
Which one of the following is a layer of the ring protection scheme
that is not normally implemented in practice?
A. Layer 0
B. Layer 1
C. Layer 3
D. Layer 4
B. Layers 1 and 2 contain device drivers but are not normally implemented in practice. Layer 0 always contains the security kernel. Layer 3 contains user applications. Layer 4 does not exist.
What is the last phase of the TCP/IP three-way handshake sequence? A. SYN packet B. ACK packet C. NAK packet D. SYN/ACK packet
B. The SYN packet is first sent from the initiating host to the destination host. The destination host then responds with a SYN/ACK packet. The initiating host sends an ACK packet, and the connection is then established.
Which one of the following vulnerabilities would best be countered by adequate parameter checking? A. Time of check to time of use B. Buffer overflow C. SYN flood D. Distributed denial of service
B. Parameter checking is used to prevent the possibility of buffer overflow attacks.
