Cards from Book

Question 1

What are some examples of detective access controls?

Answer 1

Security guards, supervising users, incident investigations, and intrusion detection systems

Question 2

What are some examples of physical access controls?

Answer 2

Guards, fences, motion detectors, locked doors, sealed windows, lights, backups, cable protection, laptop locks, swipe cards, dogs, CCTV, mantraps, and alarms

Question 3

What are the three commonly recognized authentication factors?

Answer 3

Something you know, something you have, and something you are

Question 4

What is a cognitive password?

Answer 4

A series of questions about facts or predefined responses that only the subject should know (for example, what is your birth date? What is your mother’s maiden name?)

Question 5

Name at least eight biometric factors.

Answer 5

Fingerprints, face scans, iris scans, retina scans, palm topography, palm geography, heart/pulse pattern, voice pattern, signature dynamics, keystroke patterns

Question 6

What are the issues related to user acceptance of biometric enrollment and throughput rate?

Answer 6

Enrollment times longer than 2 minutes are unacceptable; subjects will typically accept a throughput rate of about 6 seconds or faster.

Question 7

What access control technique employs security labels?

Answer 7

Mandatory access controls. Subjects are labeled as to their level of clearance. Objects are labeled as to their level of classification or sensitivity.

Question 8

The Bell–LaPadula, Biba, and Clark–Wilson access control models were all designed to protect a single aspect of security. Name the corresponding aspect for each model.

Answer 8

Bell–LaPadula protects confidentiality; Biba and Clark–Wilson protect integrity.

Question 9

Name the three types of subjects and their roles in a security environment.

Answer 9

The user accesses objects on a system to perform a work task, the owner is liable for protection of data, the data custodian is assigned to classify and protect data.

Question 10

Explain why the separation of duties and responsibilities is a common security practice.

Answer 10

It prevents any single subject from being able to circumvent or disable security mechanisms.

Question 11

What is the principle of least privilege?

Answer 11

Subjects should be granted only the amount of access to objects that is required to accomplish their assigned work tasks.

Question 12

Name the four key principles upon which access control relies.

Answer 12

Identification, authentication, authorization, accountability

Question 13

How are domains related to decentralized access control?

Answer 13

A domain is a realm of trust that shares a common security policy. This is a form of decentralized access control.

Question 14

Why is monitoring an important part of a security policy?

Answer 14

Monitoring is used to watch for security policy violations and to detect unauthorized or abnormal activities.

Question 15

What are the functions of an intrusion detection system (IDS)?

Answer 15

An IDS automates the inspection of audit logs and real-time system events, detects intrusion attempts, and watches for violations of confidentiality, integrity, and availability.

Question 16

What are the pros and cons of a host-based IDS?

Answer 16

It can pinpoint resources compromised by a malicious user. It can’t detect network-only attacks or attacks on other systems, has difficulty detecting DoS attacks, and can be detected by intruders.

Question 17

What are the pros and cons of a network-based IDS?

Answer 17

It can monitor a large network and can be hardened against attack. It may be unable to handle large data flows, doesn’t work well on switched networks, and can’t pinpoint compromised resources.

Question 18

What are the differences between knowledge-based and behavior-based detection methods used by IDS?

Answer 18

Knowledge-based uses a signature database and tries to match monitored events to that database. Behavior-based learns about the normal activities on your system through watching and learning.

Question 19

What is a honeynet, and what is it used for?

Answer 19

Honeynets are fake networks used to lure intruders in order to create sufficient audit trails for tracking them down and prosecuting. Honeynets contain no real or sensitive data.

Question 20

How does penetration testing improve your system’s security?

Answer 20

Penetration testing is a good way to accurately judge the security mechanisms deployed by an organization.

Question 21

What is a denial-of-service attack?

Answer 21

An attack that prevents the system from receiving, processing, or responding to legitimate traffic or requests for resources and objects

Question 22

What is a spoofing attack?

Answer 22

The attacker pretends to be someone or something other than whom or what they are. They can spoof identities, IP addresses, email addresses, and phone numbers. They often replace the valid source and/or destination IP address and node numbers with false ones.

Question 23

What are countermeasures to spoofing attacks?

Answer 23

Countermeasures to spoofing attacks include patching the OS and software, enabling source/destination verification on routers, and employing an IDS to detect and block attacks.

Question 24

What is a man-in-the-middle attack?

Answer 24

An attack in which a malicious user is positioned between the two endpoints of a communication’s link

Question 25

What is a replay or playback attack?

Answer 25

A malicious user records the traffic between a client and a server and then retransmits them to the server with slight variations of the timestamp and source IP address. It is similar to hijacking.

Question 26

What is a sniffer attack?

Answer 26

Any activity that results in a malicious user obtaining information about a network or the traffic over that network. Data is captured using a sniffer or protocol analyzer.

Question 27

What is a spamming attack?

Answer 27

Directing floods of messages to a victim’s email inbox or other messaging system. Such attacks cause DoS issues by filling up storage space and preventing legitimate messages from being delivered.

Question 28

What are some countermeasures to common attack methods?

Answer 28

Patching software, reconfiguring security, employing firewalls, updating filters, using IDSs/IPSs, improving security policy, using traffic filters, improving physical access control, using system monitoring/auditing

Question 29

Name the seven layers of the OSI model by their layer name and layer number.

Answer 29

Application (7), Presentation (6), Session (5), Transport (4), Network (3), Data Link (2), and Physical (1)

Question 30

List the security features offered by the Network layer of the OSI model.

Answer 30

The Network layer (Layer 3) offers confidentiality, authentication, and integrity.

Question 31

What is the maximum throughput rate and maximum usable distance for 10Base2 cable?

Answer 31

10Base2 cable has a throughput of 10 Mbps and can be run up to distances of 185 meters.

Question 32

Name the common network topologies.

Answer 32

Ring, bus, star, and mesh

Question 33

What are the four layers of the TCP/IP protocols, and how do they relate to the OSI model layers?

Answer 33

The four layers of TCP/IP are Application (layers 5–7 of OSI), Transport (layer 4 of OSI), Internet (layer 3 of OSI), and Link (layers 1 and 2 of OSI).

Question 34

What are the five generation types of firewalls?

Answer 34

Static packet filtering, application-level gateway, stateful inspection, dynamic packet filtering, and kernel proxy

Question 35

Name at least five networking device types other than firewalls.

Answer 35

Routers, switches, hubs, repeaters, bridges, gateways, proxies

Question 36

What is a proxy, and what is it used for?

Answer 36

Any system that performs a function or requests a service on behalf of another system. Proxies are most often used to provide clients with Internet access while protecting their identity.

Question 37

Name at least 10 network and protocol security mechanisms.

Answer 37

IPSec, SKIP, SWIPE, SSL, S/MIME, SET, PEM, PGP, PPP, SLIP, PPTP, L2TP, CHAP, PAP, RADIUS, TACACS, S-RPC

Question 38

Name at least six protocol services used to connect to LAN and WAN communication technologies.

Answer 38

Frame Relay, SMDS, X.25, ATM, HSSI, SDLC, HDLC, ISDN

Question 39

How are PVC, SVC, DTE, and DCE used in a Frame Relay network?

Answer 39

Frame Relay requires the use of a DTE and a DCE at each connection point. PVC is always available; SVC is established using the best paths currently available.

Question 40

What are three remote access authentication mechanisms?

Answer 40

RADIUS, DIAMETER, and TACACS

Question 41

What is tunneling, and why is it used?

Answer 41

A process that protects the contents of packets by encapsulating them in another protocol. This creates the logical illusion of a communications tunnel through an untrusted intermediary network.

Question 42

What is a VPN?

Answer 42

A virtual private network (VPN) is a communication tunnel that provides point-to-point transmission of both authentication and data traffic over an intermediary network.

Question 43

What are the four primary VPN protocols?

Answer 43

PPTP, L2F, L2TP, and IPSec (Note: SSL is a valid VPN protocol as well, but it’s not necessarily recognized on the exam as such.)

Question 44

What are the two modes available through IPSec, and what do they do?

Answer 44

In transport mode, the IP packet data is encrypted, but the header is not. In tunnel mode, the entire IP packet is encrypted, and a new header is added to govern transmission through the tunnel.

Question 45

What is NAT?

Answer 45

Network Address Translation (NAT) allows the private IP addresses defined in RFC 1918 to be used in a private network while still being able to communicate with the Internet.

Question 46

What is transparency?

Answer 46

A characteristic of a service, security control, or access mechanism that ensures it is unseen by users

Question 47

What are some important aspects to consider when designing email security?

Answer 47

Nonrepudiation, access control, message integrity, source authentication, verified delivery, acceptable use policies, privacy, management, and backup and retention policies

Question 48

What is the most serious threat of email?

Answer 48

Email is the most common delivery mechanism for viruses, worms, Trojan horses, documents with destructive macros, and other malicious code.

Question 49

What are possible mechanisms for adding security to email?

Answer 49

S/MIME, MOSS, PEM, and PGP

Question 50

What are elements of effective user training against social-engineering attacks?

Answer 50

Always err on the side of caution whenever communications are odd or unexpected. Always request proof of identity. Classify information for voice communications. Never change passwords over the phone.

Question 51

What are the most common threats against communication systems?

Answer 51

Denial of service, eavesdropping, impersonation, replay, and modification

Question 52

What are some countermeasures to eavesdropping?

Answer 52

Maintaining physical access security, using encryption, employing one-time authentication methods

Question 53

What is an ARP attack?

Answer 53

The modification of ARP mappings. When ARP mappings are falsified, packets are not sent to their proper destination. ARP mappings can be attacked through spoofing. Spoofing provides false MAC addresses for requested IP addressed systems to redirect traffic to alternate destinations.

Question 54

What is privacy?

Answer 54

Prevention of unauthorized intrusion, knowledge that information deemed personal or confidential won’t be shared with unauthorized entities, freedom from being observed without consent

Question 55

What are the requirements for accountability?

Answer 55

Identification, authentication, authorization, and auditing

Question 56

What is nonrepudiation?

Answer 56

Nonrepudiation prevents a subject from claiming not to have sent a message, not to have performed an action, or not to have been the cause of an event.

Question 57

What is layering?

Answer 57

Layering is the use of multiple controls in a series. The use of a multilayered solution allows for numerous controls to be brought to bear against whatever threats come to pass.

Question 58

How is abstraction used?

Answer 58

Abstraction is used to collect similar elements into groups, classes, or roles that are assigned security controls, restrictions, or permissions.

Question 59

What is data hiding?

Answer 59

Data hiding is preventing data from being known by a subject. Keeping a database from being accessed by unauthorized visitors is a form of data hiding.

Question 60

What is change control or change management?

Answer 60

A mechanism used to systematically manage change. Typically, it involves extensive logging, auditing, and monitoring of activities related to security controls and security solutions.

Question 61

What are the goals of change management?

Answer 61

Implementation of changes in an orderly manner, formalized testing, ability to reverse changes, ability to inform users of changes, systematical analysis of changes, minimization of negative impact of changes

Question 62

What is data classification?

Answer 62

Data classification is the primary means by which data is protected based on categories of secrecy, sensitivity, or confidentiality.

Question 63

What criteria are used to classify data?

Answer 63

Usefulness, timeliness, value or cost, maturity or age, lifetime or expiration period, disclosure damage assessment, modification damage assessment, national security implications, storage

Question 64

What is the government/military data classification scheme?

Answer 64

Top secret, secret, confidential, sensitive but unclassified, unclassified

Question 65

What is the commercial business/private sector classification scheme?

Answer 65

Confidential, private, sensitive, public

Question 66

Name at least seven security management concepts and principles.

Answer 66

CIA Triad, confidentiality, integrity, availability, privacy, identification, authentication, authorization, auditing, accountability, and nonrepudiation

Question 67

What are the elements of a termination procedure policy?

Answer 67

Have at least one witness; escort terminated employee off the premises immediately; collect identification, access, or security devices; perform exit interview; disable network account

Question 68

What is the function of the data owner security role?

Answer 68

The data owner is responsible for classifying information for protection within the security solution.

Question 69

What is the data custodian security role?

Answer 69

The data custodian is assigned the tasks of implementing the prescribed protection defined by the security policy and upper management.

Question 70

What is the function of the auditor security role?

Answer 70

The auditor is responsible for testing and verifying that the security policy is properly implemented and the derived security solutions are adequate.

Question 71

What should the documents that make up a formalized security structure include?

Answer 71

Policies, standards, baselines, guidelines, and procedures

Question 72

What is generally involved in the processes of risk management?

Answer 72

Analyzing an environment for risks, evaluating each risk as to its likelihood and damage, assessing the cost of countermeasures, and creating a cost/benefit report to present to upper management

Question 73

What should be considered when establishing the value of an asset?

Answer 73

Cost of purchase, development, maintenance, acquisition, and protection; value to owners/users/competitors; equity value; market valuation; liability of asset loss; and usefulness

Question 74

Name at least five possible threats that should be evaluated when performing a risk analysis.

Answer 74

Viruses; buffer overflows; coding errors; user errors; intruders (physical and logical); natural disasters; equipment failure; misuse of data, resources, or services; loss of data; physical theft, denial of service

Question 75

What is single loss expectancy, and how is it calculated?

Answer 75

The cost associated with a single realized risk against a specific asset. SLE = asset value (AV) * exposure factor (EF). The SLE is expressed in a dollar value.

Question 76

What is annualized loss expectancy, and how is it calculated?

Answer 76

The possible yearly cost of all instances of a specific realized threat against a specific asset. ALE = single loss expectancy (SLE) * annualized rate of occurrence (ARO).

Question 77

What are the basics distinctions between qualitative and quantitative risk analysis?

Answer 77

Quantitative risk analysis assigns real dollar figures to the loss of an asset. Qualitative risk analysis assigns subjective and intangible values to the loss of an asset.

Question 78

What are the four possible responses by upper/senior management to risk?

Answer 78

Reduce/mitigate, assign/transfer, accept, or reject/deny

Question 79

What is residual risk?

Answer 79

Once countermeasures are implemented, the risk that remains is known as residual risk. Residual risk is the risk that management has chosen to accept rather than mitigate.

Question 80

What is total risk?

Answer 80

The amount of risk an organization would face if no safeguards were implemented. A formula for total risk is threats * vulnerabilities * asset value = total risk.

Question 81

What is the controls gap?

Answer 81

The difference between total risk and residual risk. The controls gap is the amount of risk that is reduced by implementing safeguards.

Question 82

What are the three learning levels of security?

Answer 82

Awareness, training, and education

Question 83

What are the three types of plans employed in security management planning?

Answer 83

A strategic plan is a long-term plan that is fairly stable. The tactical plan is a midterm plan that provides more details. Operational plans are short term and highly detailed.

Question 84

How many primary keys may each database table have?

Answer 84

One

Question 85

What type of malicious code spreads through the sharing of infected media?

Answer 85

Viruses

Question 86

What term is used to describe intelligent code objects that perform actions on behalf of a user?

Answer 86

Agent

Question 87

What term is used to describe code sent by a server to a client for execution on the client machine?

Answer 87

Applet

Question 88

What language by Sun Microsystems is often used for applet programming and development?

Answer 88

Java

Question 89

What type of database key enforces relationships between tables?

Answer 89

Foreign key

Question 90

What security principle ensures that multiple records are created in a database table for viewing at different security levels?

Answer 90

Polyinstantiation

Question 91

What process evaluates the technical and nontechnical security features of an IT system?

Answer 91

Certification and accreditation

Question 92

What type of accreditation evaluates the systems and applications at a specific, self-contained location?

Answer 92

Site accreditation

Question 93

In which phase of the Software Capability Maturity Model do you often find hardworking people charging ahead in a disorganized fashion?

Answer 93

Initial

Question 94

In which layer of the ring protection scheme do user applications reside?

Answer 94

Layer 3

Question 95

What system mode requires that the system process only one classification level at a time and all system users have clearance and need to know that information?

Answer 95

Dedicated security mode

Question 96

What is another term for the master boot record?

Answer 96

Boot sector

Question 97

What type of virus embeds itself in application documents?

Answer 97

Macro virus

Question 98

What can antivirus programs do when they encounter a virus infection?

Answer 98

Delete the file, disinfect the file, or quarantine the file.

Question 99

What type of virus modifies itself each time it infects a new system in an attempt to avoid detection?

Answer 99

Polymorphic virus

Question 100

What type of malicious code launches itself when certain conditions (such as a specific date) are met?

Answer 100

Logic bomb

Question 101

What were the mechanisms of action used by Robert T. Morris’s Internet Worm of 1988?

Answer 101

The worm exploited vulnerabilities in the Sendmail debug mode and finger daemon, launched password attacks, and exploited trust relationships between systems.

Question 102

Where are passwords stored in a UNIX system?

Answer 102

In the /etc/passwd or /etc/shadow file

Question 103

What term is used to describe hackers rooting through trash looking for useful information?

Answer 103

Dumpster diving

Question 104

What is the cornerstone of computer security?

Answer 104

Education

Question 105

What are the three phases of the three-way handshake used by TCP/IP?

Answer 105

SYN, SYN/ACK, ACK

Question 106

How does the teardrop attack operate?

Answer 106

It sends overlapping packet fragments to the victim machine.

Question 107

What is the term used to describe a secret method used by a programmer to gain access to the system?

Answer 107

Trap door (or back door)

Question 108

When is the XOR function true?

Answer 108

When only one of the input bits is true

Question 109

What term describes a mathematical function that easily produces output values for each possible combination of inputs but makes it impossible to retrieve the input values?

Answer 109

One-way function

Question 110

True or false? All ciphers are meant to obscure the meaning of a message.

Answer 110

True

Question 111

True or false? All codes are meant to obscure the meaning of a message.

Answer 111

False

Question 112

What occurs when a change in the plain text results in multiple changes spread throughout the cipher text?

Answer 112

Diffusion

Question 113

What is the code name of the project in which the National Security Agency successfully broke a Soviet one-time pad system in the 1940s?

Answer 113

VENONA

Question 114

What type of cipher is the Caesar cipher?

Answer 114

Simple substitution

Question 115

True or false? Modern cryptosystems rely on the secrecy of the encryption algorithm.

Answer 115

False

Question 116

What is the length of the key used by the standard DES algorithm?

Answer 116

56 bits

Question 117

How many rounds of encryption does DES utilize?

Answer 117

16

Question 118

True or false? The IDEA algorithm is available free for noncommercial use.

Answer 118

True

Question 119

What encryption algorithm was selected for the Advanced Encryption Standard (AES)?

Answer 119

Rijndael

Question 120

What is the Diffie-Hellman algorithm is most commonly used for?

Answer 120

Key exchange

Question 121

True or false? The Hashed Message Authentication Code provides nonrepudiation.

Answer 121

False

Question 122

What are the three encryption algorithms supported by the Digital Signature Standard?

Answer 122

DSA, RSA, and ECDSA

Question 123

What ITU standard describes the contents of a digital certificate?

Answer 123

X.509

Question 124

What is the process by which you are issued a digital certificate?

Answer 124

Enrollment

Question 125

Who issues digital certificates?

Answer 125

Certificate authorities (CAs)

Question 126

True or false? PEM provides protection against replay attacks.

Answer 126

False

Question 127

What protocol uses the RSA encryption algorithm to provide encrypted mail support for a number of common commercial email packages?

Answer 127

S/MIME

Question 128

True or false? S-HTTP secures individual messages between a client and a server.

Answer 128

True

Question 129

What cryptographic methods are used by the Secure Electronic Transaction (SET) protocol?

Answer 129

RSA public key cryptography and DES private key cryptography in connection with digital certificates

Question 130

What are the four components of IPSec?

Answer 130

Authentication Header (AH), Encapsulating Security Payload (ESP), IP Payload Compression protocol (IPComp), and Internet Key Exchange (IKE)

Question 131

What type of cryptographic attack is used against algorithms that don’t incorporate temporal protections?

Answer 131

Replay attack

Question 132

What are some common reasons a certificate might need to be revoked?

Answer 132

The certificate was compromised, the certificate was erroneously issued, the certificate details changed, and there was a change of security association.

Question 133

What type of cryptography relies on the use of public and private keys?

Answer 133

Asymmetric

Question 134

What technology allows multiple users to make use of the same process without interfering with each other?

Answer 134

Multithreading

Question 135

What are some of the terms used to describe the CPU mode that gives access to the full range of supported instructions?

Answer 135

System mode, privileged mode, supervisory mode, and kernel mode

Question 136

What is the greatest security risk to RAM modules?

Answer 136

Theft

Question 137

What addressing scheme supplies the CPU with the actual address of the memory location to be accessed?

Answer 137

Direct addressing

Question 138

Magnetic/optical media devices are classified as what type of memory?

Answer 138

Secondary

Question 139

Memory devices designed to retain their data when power is removed are known as .

Answer 139

nonvolatile

Question 140

What two ways can storage devices be accessed?

Answer 140

Randomly and sequentially

Question 141

What is the greatest security risk to computer monitors?

Answer 141

TEMPEST technology

Question 142

What is another term often used for firmware?

Answer 142

Microcode

Question 143

Where are the operating system–independent primitive instructions that a computer needs to start and load the operating system stored?

Answer 143

BIOS

Question 144

What concept ensures that data existing at one level of security is not visible to processes running at different security levels?

Answer 144

Data hiding

Question 145

What are the important factors in personnel management?

Answer 145

Hiring practices, ongoing job performance reviews, and termination procedures

Question 146

What security mechanisms are countermeasures to collusion?

Answer 146

Job rotation, separation of duties, mandatory vacations, workstation change

Question 147

Why is antivirus protection important?

Answer 147

Viruses are the most common form of security breach in the IT world. Any communications pathway can and is being exploited as a delivery mechanism for a virus or other malicious code.

Question 148

What is need to know?

Answer 148

Need to know is the requirement to have access to, knowledge of, or possession of data or a resource in order to perform specific work tasks.

Question 149

What principle states that users should be granted the least amount of access to the secure environment as possible for them to be able to complete their work tasks?

Answer 149

Principle of least privilege

Question 150

What are due care and due diligence?

Answer 150

Due care is using reasonable care to protect the interest of an organization. Due diligence is practicing the activities that maintain the due care effort.

Question 151

How are security and illegal activities related?

Answer 151

A secure environment should provide mechanisms to prevent the committal of illegal activities, which are actions that violate a legal restriction, regulation, or requirement.

Question 152

With what level of security precautions should backup media be treated?

Answer 152

Backup media should be handled with the same security precautions as any other asset with the same data classification.

Question 153

What are the goals of managing backup media?

Answer 153

Preventing disclosure, destruction, or alteration of data.

Question 154

What are the processes that can be applied to used media in order to prepare the media for reuse in various environments?

Answer 154

Erasing, clearing, and overwriting media that will be used in the same classification environments; purging, sanitizing, and degaussing if media is used in different classification environments

Question 155

What are the classifications of security control types?

Answer 155

Preventive, deterrent, detective, corrective, recovery, compensation, directive

Question 156

What is the purpose of auditing?

Answer 156

To ensure compliance with security policy and to detect abnormalities, unauthorized occurrences, or outright crimes

Question 157

What types of activities are labeled as auditing?

Answer 157

Recording of event/occurrence data, examination of data, data reduction, use of event/occurrence alarm triggers, log analysis, logging, monitoring, using alerts, intrusion detection

Question 158

What is the purpose of compliance testing?

Answer 158

To ensure that all of the necessary and required elements of a security solution are properly deployed and functioning as expected

Question 159

How are audit trails used?

Answer 159

To reconstruct an event, to extract information about an incident, to prove or disprove culpability

Question 160

What types of activities can be used as penetration tests?

Answer 160

War dialing, sniffing, eavesdropping, radiation monitoring, dumpster diving, social engineering, port scanning, ping scanning

Question 161

What are some ways to keep inappropriate content to a minimum?

Answer 161

Address the issue in the security policy, perform awareness training, use content filtering tools to filter source or word content.

Question 162

Why is it important to protect against resource waste?

Answer 162

If the storage space, computing power, or networking bandwidth capacity is consumed by inappropriate or non-work-related (non-profit-producing) data, the organization loses money.

Question 163

Why is it important to protect against privilege abuse?

Answer 163

It can cause the disclosure of sensitive information, violating the principle of confidentiality.

Question 164

What countermeasures are moderately effective against errors and omissions?

Answer 164

Input validators and user training

Question 165

How can you protect data against fraud and theft?

Answer 165

The use of access controls (auditing and monitoring, for example) reduce fraud and theft.

Question 166

What are some safeguards against sabotage?

Answer 166

Intensive auditing, monitoring for abnormal or unauthorized activity, keeping lines of communication open between employees and managers, and compensating and recognizing employees for excellence

Question 167

Why isn’t there an effective direct countermeasure against the threat of malicious hackers or crackers?

Answer 167

Most safeguards and countermeasures protect against one specific threat or another, but it is not possible to protect against all possible threats that a cracker represents.

Question 168

What is malicious code?

Answer 168

Malicious code is any script or program that performs an unwanted, unauthorized, or unknown activity on a computer system.

Question 169

True or false? Senior management should be included in the BCP process from the beginning.

Answer 169

True

Question 170

What resource is in greatest demand during the BCP testing, training, and maintenance process?

Answer 170

Manpower

Question 171

What type of decision making is mainly concerned with metrics such as dollar values and downtime?

Answer 171

Quantitative

Question 172

What Business Impact Analysis/Assessment variable is used to describe the longest period of time a resource can be unavailable without causing irreparable harm to the business?

Answer 172

Maximum tolerable downtime (MTD)

Question 173

What is the formula for computing single loss expectancy?

Answer 173

SLE = AV * EF [Single Loss Expectancy = Asset Value * Exposure Factor]

Question 174

What is the formula for computing annualized loss expectancy?

Answer 174

ALE = SLE * ARO [Annualized Loss Expectancy = Single Loss Expectancy * Annual Rate of Occurrence]

Question 175

What are some of the qualitative factors that must be taken into account when assessing the cost of a disaster?

Answer 175

Loss of goodwill among client base, loss of employees after prolonged downtime, social/ethical responsibilities to the community, and negative publicity

Question 176

What is the first thing you should do when a disaster strikes?

Answer 176

Ensure that people are safe

Question 177

What are the two possible responses to a risk?

Answer 177

Acceptance and mitigation

Question 178

Provide two examples of devices that might be used to harden a system.

Answer 178

Computer-safe fire suppression systems and uninterruptible power supplies

Question 179

What is the goal of business continuity planning (BCP)?

Answer 179

To ensure the continuous operation of a business in the face of an emergency situation

Question 180

What are some of the elements that should be included in emergency response guidelines?

Answer 180

Immediate response procedures, notification procedures, and secondary response procedures

Question 181

What are the five steps of the business impact assessment process?

Answer 181

Identification of priorities, risk identification, likelihood assessment, impact assessment, and resource prioritization

Question 182

What process brings order to the chaotic events surrounding the interruption of an organization’s normal activities by an emergency?

Answer 182

Disaster recovery planning (DRP)

Question 183

Name some common natural disasters.

Answer 183

Earthquakes, floods, storms, tornadoes, and fires

Question 184

What organization sponsors the National Flood Insurance Program and is a good source of historical flood information?

Answer 184

Federal Emergency Management Agency (FEMA)

Question 185

What disaster recovery system is often highly dependent on the public water supply?

Answer 185

Fire suppression system

Question 186

What type of disaster recovery separates recovery sites by business teams?

Answer 186

Workgroup recovery

Question 187

What are the three major options for alternative processing sites?

Answer 187

Hot sites, warm sites, and cold sites

Question 188

What type of recovery site is particularly suited to workgroup recovery options?

Answer 188

Mobile site

Question 189

True or false? Organizations participating in a mutual assistance agreement are typically located in the same geographic region.

Answer 189

True

Question 190

True or false? There is an accepted standards document defining the requirements for an electronic vaulting solution.

Answer 190

False

Question 191

What is the most common document type used for emergency response plans?

Answer 191

Checklists

Question 192

What are the three major types of filesystem backups?

Answer 192

Full backups, incremental backups, and differential backups

Question 193

What can be used to protect a company against the failure of a developer to provide adequate support?

Answer 193

Software escrow agreements

Question 194

It is sometimes useful to separate disaster tasks from disaster tasks.

Answer 194

recovery, restoration (in either order)

Question 195

True or false? In most circumstances, it is illegal for an employer to monitor an employee’s email.

Answer 195

False

Question 196

If a witness is not able to uniquely identify an object, how else may it be authenticated in court?

Answer 196

By establishing a chain of evidence

Question 197

What type of evidence is an authenticated computer log?

Answer 197

Documentary evidence

Question 198

What are the three major evidence admissibility requirements?

Answer 198

Evidence must be relevant, material, and competent.

Question 199

What law created the category of mission-critical computer systems?

Answer 199

Government Information Security Reform Act

Question 200

What are the two requirements for acceptance of a trademark application?

Answer 200

The trademark must not be confusingly similar to another trademark, and it must not be descriptive.

Question 201

What are the three requirements for acceptance of a patent application?

Answer 201

The invention must be new, useful, and nonobvious.

Question 202

How long does trade secret protection last?

Answer 202

Indefinitely

Question 203

What type of license agreements are written on the outside of software packaging and require no action from the user other than opening the package?

Answer 203

Shrink-wrap

Question 204

What amendment to the U.S. Constitution forms the basis for privacy rights?

Answer 204

Fourth Amendment

Question 205

What law requires that websites provide parents with the opportunity to review any information collected from their children?

Answer 205

Children’s Online Privacy Protection Act

Question 206

What law grants privacy rights to students enrolled in educational institutions that accept government funding?

Answer 206

Family Educational Rights and Privacy Act

Question 207

Which type of computer crime attacks an organization’s computer system to extract confidential information?

Answer 207

Business attack

Question 208

Which type of computer crime would likely be timed to occur simultaneously with a physical attack to reduce the ability to effectively respond to the physical attack?

Answer 208

Terrorist attack

Question 209

What term refers to any hardware, software, or data that can be used to prove the identity and actions of an attacker?

Answer 209

Evidence

Question 210

What term describes any violation or threatened violation of a security policy?

Answer 210

Incident

Question 211

Which type of incident generally does not cause direct damage to the victim?

Answer 211

Scanning. The purpose of a scanning attack is to collect information. The real damage to the system occurs in later attacks.

Question 212

How do you protect your system from a malicious code incident?

Answer 212

Make sure your security policy restricts the introduction of untested files to your computer system. Have a good scanner with an up-to-date signature database. Frequently scan all files.

Question 213

Which two types of incidents are the easiest to stop by dynamically altering filtering rules?

Answer 213

Scanning and denial of service. They can both potentially be stopped by filtering out the offending packets.

Question 214

What must you do to make sure evidence is kept viable for use in a trial?

Answer 214

You must ensure that the evidence has not changed, and you must be able to validate its integrity.

Question 215

Where should you begin looking to find information about an incident that occurred in the recent past?

Answer 215

The first place to look is in the system and network log files.

Question 216

If an incident has occurred that has violated no laws or regulations, how do you determine whether to report it?

Answer 216

The incident reporting guidelines should be in your security policy.

Question 217

Is adherence to the (ISC)2 Code of Ethics recommended, mandatory, or optional for CISSPs?

Answer 217

Adherence to the (ISC)2 Code of Ethics is mandatory, and acceptance of the Code of Ethics is a condition of certification.

Question 218

What is the leading reason many incidents are not reported?

Answer 218

Because they are not recognized as incidents

Question 219

What are the three main types of physical security controls?

Answer 219

Administrative physical security controls, technical physical security controls, physical controls for physical security

Question 220

What is the primary purpose of lighting as a physical security device?

Answer 220

To discourage casual intruders, trespassers, prowlers, and would-be thieves

Question 221

What are the benefits of security guards?

Answer 221

They are able to adapt and react to any condition or situation, are able to learn and recognize attack patterns, can adjust to a changing environment, and are able to make decisions and judgment calls.

Question 222

What are the disadvantages of security guards?

Answer 222

Not all environments support them; prescreening, bonding, and training is not always effective; they are expensive, subject to illness, take vacations, and are vulnerable to social engineering.

Question 223

What are the benefits and disadvantages of guard dogs?

Answer 223

They can be deployed as a perimeter security control and as detection and deterrent agents, they are costly and require high maintenance, and their use involves insurance and liability issues.

Question 224

What are the 11 electrical terms and definitions you should be aware of?

Answer 224

Fault, blackout, sag, brownout, spike, surge, inrush, noise, transient, clean, ground

Question 225

What are the types of noise or interference and their sources?

Answer 225

Common mode noise is generated by the difference in power between the hot and ground wires. Traverse mode noise is generated by the difference in power between the hot and neutral wires.

Question 226

What are the typical HVAC requirements for a computer room?

Answer 226

A computer room should be kept at 60 to 75 degrees Fahrenheit (15 to 23 degrees Celsius). Humidity in a computer room should be maintained at between 40 and 60 percent.

Question 227

What type of damage occurs when static electricity discharges exceed 40 volts?

Answer 227

Destruction of sensitive circuits

Question 228

What is a Type C fire extinguisher used for, and what is it made of?

Answer 228

A Type C fire extinguisher is for use on electrical devices and uses CO2 or Halon.

Question 229

What are the four types of water-based fire suppression systems?

Answer 229

Wet pipe system, dry pipe system, deluge system, preaction system

Question 230

What are the alternatives for Halon?

Answer 230

FM-200 (HFC-227ea), CEA-410 or CEA 308, NAF-S-III (HCFC Blend A), FE-13 (HCFC-23), Aragon (IG55) or Argonite (IG01), Inergen (IG541), and low-pressure water mists

Question 231

Which security vulnerability conveys information by altering the performance of a system component or modifying a resource’s timing in a predictable manner?

Answer 231

Covert timing channel

Question 232

What is a separate object that is associated with a resource and describes its security attributes?

Answer 232

Security token

Question 233

In the Clark–Wilson security model, what is a procedure that scans data items and confirms their integrity?

Answer 233

Integrity verification procedure (IVP)

Question 234

In the Biba integrity model, what is the Simple Integrity Axiom, which states that a subject cannot read an object of a lower integrity, also called?

Answer 234

No read down

Question 235

Which organization developed the Bell–LaPadula security model?

Answer 235

The U.S. Department of Defense

Question 236

What is the collection of TCB components that work together to implement the reference monitor functions?

Answer 236

Security kernel

Question 237

What does ITSEC call the system that is being evaluated?

Answer 237

The target of evaluation (TOE)

Question 238

What TCSEC category is reserved for systems that have been evaluated but do not meet the requirements of any other category?

Answer 238

Category D (minimal protection)

Question 239

Which IPSec protocol provides integrity, authentication, and nonrepudiation to the secure message exchange?

Answer 239

Authentication Header (AH)

Question 240

Which type of controls considers static attributes of the subject and the object to determine the permissibility of an access?

Answer 240

Mandatory access controls

Question 241

What term is used to refer to the user or process that makes a request to access a resource?

Answer 241

Subject

Question 242

What is the imaginary boundary that separates the TCB from the rest of the system?

Answer 242

Security perimeter

Question 243

What term describes the technical evaluation of each part of a computer system to assess its concordance with security standards?

Answer 243

Certification

Question 244

What is the difference between analog and digital signals?

Answer 244

Analog communications occur with a continuous signal that varies in frequency, amplitude, and so on. Digital communications occur through the use of a state change of on-off pulses.

Question 245

What is the difference between synchronous and asynchronous communications?

Answer 245

Synchronous communications rely upon a timing or clocking mechanism. Asynchronous communications rely on a stop and start delimiter bit to manage transmission of data.

Question 246

What is the difference between baseband and broadband communications?

Answer 246

Baseband technology uses a direct current to support a single communication channel. Broadband technology uses frequency modulation to support multiple simultaneous signals.

Question 247

Describe broadcast, multicast, and unicast communications.

Answer 247

A broadcast supports communications to all possible recipients. A multicast supports communications to multiple specific recipients. A unicast supports only a single communication to one recipient.

Question 248

What is the difference between packet switching and circuit switching?

Answer 248

In circuit switching, a dedicated physical pathway is created between the two parties. Packet switching occurs when the message is broken up into segments and sent across the intermediary network.

Question 249

What are the characteristics of PPP?

Answer 249

The Point-to-Point Protocol (PPP) is an encapsulation protocol designed to support the transmission of IP traffic over dial-up or point-to-point links. PPP supports CHAP and PAP for authentication.

Question 250

What are the characteristics of SLIP?

Answer 250

Serial Line Internet Protocol (SLIP) offers no authentication, supports only half-duplex communications, has no error detection capabilities, and requires manual link establishment and teardown.

Question 251

What is CORBA?

Answer 251

Common Object Request Broker Architecture (CORBA) is an international standard (sanctioned by the International Organization for Standardization) for distributed computing.

Question 252

What’s the most desirable default setting for access control?

Answer 252

Denial. When access is not specifically granted, it should be denied by default. This is also known as implicit deny.

Question 253

What type of approach to security is considered better than a fortress mentality approach?

Answer 253

Defense in depth, multiple layers of security, concentric circles of security

Question 254

What form of password attack consists first of a dictionary attack and then a brute-force attack based on the dictionary list?

Answer 254

A hybrid attack. Sometimes called a one-upped password attack.

Question 255

What is the most acceptable form of biometrics to end users?

Answer 255

Iris scans

Question 256

What is the most unacceptable form of biometric control to end users?

Answer 256

Retina scans

Question 257

What is the stored sample of a biometric factor called?

Answer 257

A reference profile or a reference template

Question 258

With what other forms of single sign-on can Kerberos be combined?

Answer 258

Any or all of them, including SESAME, KryptoKnight, NetSP, thin clients, directory services, and scripted access

Question 259

How is the ticket-granting ticket used by Kerberos generated?

Answer 259

The user’s password is hashed, and a timestamp is added.

Question 260

What is a centralized database of resources available to the network?

Answer 260

A directory service

Question 261

What are examples of rule-based access control?

Answer 261

MAC, RBAC, TBAC

Question 262

What form of access control can combine levels of security domains with compartments of additional control and isolation?

Answer 262

MAC (specifically, a hybrid MAC environment)

Question 263

What form of access control is best suited to those organizations with a high rate of employee turnover?

Answer 263

RBAC

Question 264

When an intrusion is detected, what should be the first response?

Answer 264

Contain or constrain the intrusion.

Question 265

Once an intrusion has occurred, what is the most secure process for restoring the environment?

Answer 265

Format and reinstall from scratch.

Question 266

What form of IDS is easier for an intruder to discover and disable?

Answer 266

Host-based IDS

Question 267

What feature of network infrastructure is also usable as a countermeasure against rogue IDS and sniffers?

Answer 267

Switches

Question 268

What network device works primarily at the Application layer?

Answer 268

Gateway

Question 269

What are the most common causes of network failure?

Answer 269

Cable failures and misconfigurations

Question 270

What type of cabling must be used to comply with building code safety requirements?

Answer 270

Plenum-rated cable

Question 271

How many sockets does TCP have?

Answer 271

65, 536 (2^16) sockets (aka ports), numbered from 0 to 65,535

Question 272

What is the IP header protocol field value for TCP? UDP? ICMP? IGMP?

Answer 272

6, 17, 1, 2

Question 273

What protocol is used by ping, pathping, and traceroute?

Answer 273

ICMP

Question 274

What is the APIPA range?

Answer 274

169.254.0.1 to 169.254.255.254 along with the default Class B subnet mask of 255.255.0.0

Question 275

What port is used by IMAP?

Answer 275

143

Question 276

What port is used by DHCP?

Answer 276

Port 68 for client request broadcast and port 67 for server point-to-point response

Question 277

Network devices at what layer and above separate collision domains?

Answer 277

Layer 2

Question 278

Network devices at what layer and above separate broadcast domains?

Answer 278

Layer 3

Question 279

Which VPN protocol supports multiple simultaneous connections?

Answer 279

IPSec

Question 280

What is the primary weakness of satellite communications?

Answer 280

Large terrestrial footprint

Question 281

What makes the usable throughput of ISDN less than the stated bandwidth?

Answer 281

The D channel is used only for call management, not data.

Question 282

What type of system is a common target of attackers who want to disseminate email spam?

Answer 282

Open relay SMTP servers

Question 283

What is the primary method to improve fax security?

Answer 283

Disable automatic printing of received faxes.

Question 284

What is the form of new system deployment testing called when the new system and the old system are run simultaneously?

Answer 284

Parallel run

Question 285

When an asset no longer needs or warrants a high security sensitivity label, what should occur?

Answer 285

Declassification

Question 286

What is the name of the security management approach in which senior management calls the shots?

Answer 286

Top-down approach

Question 287

What is the cost/benefit analysis equation for countermeasures?

Answer 287

(ALE before safeguard – ALE after implementing the safeguard) – annual cost of safeguard = value of the safeguard to the company

Question 288

What type of relationships can be established with relational databases? With hierarchical databases? With distributed databases?

Answer 288

One-to-one, one-to-many, and many-to-many

Question 289

What are the six basic SQL commands?

Answer 289

Select, Update, Delete, Insert, Grant, and Revoke

Question 290

What is a placeholder for SQL literal values such as numbers or character strings?

Answer 290

Bind variable

Question 291

What database security feature uses locking to prevent simultaneous write access to cells?

Answer 291

Concurrency

Question 292

What database security feature can be used to subvert aggregation, inferencing, and contamination vulnerabilities?

Answer 292

Database partitioning

Question 293

What feature of databases allows two or more rows in the same table to appear to have identical primary key elements but contain different data for use at differing classification levels?

Answer 293

Polyinstantiation

Question 294

What acts as an interface between back-end database systems and user applications?

Answer 294

ODBC

Question 295

What attack collects numerous low-level security items or low-value items and combines them together to create something of a higher security level or value?

Answer 295

Aggregation

Question 296

What is more secure than a data warehouse and designed to store metadata?

Answer 296

Data mart

Question 297

What type of application analyzes business data and presents it in such a way to make business decisions easier for users?

Answer 297

Decision support system

Question 298

What security problem cannot be prevented or compensated for by environmental controls or hardware devices?

Answer 298

Bad coding

Question 299

What is a valid security response when an application violates OS-imposed security, such as interfering with other processes or accessing hardware directly?

Answer 299

Stopping the environment, a STOP error, a BSOD

Question 300

What is it called when programmers decompile vendor code in order to understand the intricate details of its functionality?

Answer 300

Reverse engineering

Question 301

What is the communications to or input of an object?

Answer 301

Message

Question 302

What is the internal code that defines the actions an object performs in response to a message?

Answer 302

Method

Question 303

What are the results or output exhibited by an object based upon processing a message through a method?

Answer 303

Behavior

Question 304

What is the collection of the common methods from a set of objects that is used to define the behavior of those objects?

Answer 304

Class

Question 305

What is it called when an object is an example of a class because the object contains a method from that class?

Answer 305

Instance

Question 306

What characteristic describes an object that exhibits different behaviors based upon the same message and methods because of variances in external conditions?

Answer 306

Polymorphism

Question 307

Highly objects are not as dependent on other objects.

Answer 307

cohesive

Question 308

Lower provides better software design because objects are more independent.

Answer 308

coupling

Question 309

What is a type of bar chart that shows the interrelationships over time between projects and schedules?

Answer 309

Gantt chart

Question 310

What is a project-scheduling tool that is used to judge the size of a software product in development and calculate the standard deviation for risk assessment?

Answer 310

Program Evaluation Review Technique (PERT)

Question 311

What form of testing examines the internal logical structures of a program?

Answer 311

White-box testing

Question 312

What form of testing examines the input and output of a program without focusing on the internal logical structures?

Answer 312

Black-box testing

Question 313

What form of testing examines the extent of the system testing in order to locate untested program logic?

Answer 313

Test data method

Question 314

Which form of antivirus response not only removes the virus from the system but also repairs any related damage?

Answer 314

Cleaning

Question 315

What is the name of the assumption that all algorithms should be public but all keys should remain private?

Answer 315

Kerchoff principle

Question 316

What is the range of valid values of keys for an algorithm called?

Answer 316

Key space

Question 317

What defines the hardware and software requirements of cryptographic modules in use by the federal government?

Answer 317

Federal Information Processing Standards (FIPS-140)

Question 318

What acts as a placeholder variable in mathematical functions and is used in random number generation?

Answer 318

Nonce

Question 319

What is a random bit string (a nonce) that is the same length as the block size that is XORed with the message and adds strength to cryptography systems?

Answer 319

Initialization vector (IV)

Question 320

What is the most significant bit in a string?

Answer 320

The leftmost bit

Question 321

What is it called when a plain-text message generates identical cipher-text messages using the same algorithm but different keys?

Answer 321

Clustering or key clustering

Question 322

What is a concept of communication whereby a specific type of information is exchanged but no real data is exchanged?

Answer 322

Zero-knowledge proof

Question 323

What is the basic idea that the information or privilege required to perform an operation is divided among multiple users (it is an application of separation of duties)?

Answer 323

Split knowledge

Question 324

What is an example of split knowledge employed to protect key escrow?

Answer 324

M of N Control

Question 325

What is a way of measuring the strength of a cryptography system by measuring the effort in terms of cost and/or time?

Answer 325

Work function or work factor

Question 326

What is an example of a polyalphabetic substitution cipher?

Answer 326

Vigenère cipher

Question 327

What attack is often successful against substitution ciphers?

Answer 327

Frequency analysis

Question 328

What attack is often successful against polyalphabetic substitution ciphers?

Answer 328

Period analysis

Question 329

What form of encryption is used to protect communications that occur in real time?

Answer 329

Stream ciphers

Question 330

What form of encryption can provide secure communications between two parties when they have no prior method of communicating securely?

Answer 330

Asymmetric cryptography

Question 331

What modes of DES employ an IV?

Answer 331

CBC, CFB, OFB

Question 332

What are the valid key sizes for RC5?

Answer 332

0 to 2,048 bits

Question 333

If a message is signed and encrypted, what security services are you providing?

Answer 333

Confidentiality, integrity, authenticity/access control, and nonrepudiation

Question 334

Who has the responsibility to ensure that communications are secured?

Answer 334

The sender

Question 335

What protocol is used to provide cryptographically secure wireless network access?

Answer 335

Wireless Application Protocol (WAP)

Question 336

What is the standard that wireless networking technology is based on?

Answer 336

802.11

Question 337

What cryptographic attack attempts to find a weakness in the algorithm?

Answer 337

Analytic attack

Question 338

What cryptographic attack attempts to find a weakness in the software code?

Answer 338

Implementation attack

Question 339

What cryptographic attack attempts to exploit weaknesses in the computer hardware or operating system?

Answer 339

Statistical attack

Question 340

A system is one in which all protection mechanisms work together to process sensitive data for many types of users while maintaining a stable and secure computing environment.

Answer 340

trusted

Question 341

               is simply defined as the degree of confidence in satisfaction of security needs.

Answer 341

Assurance

Question 342

What are the security requests of a client called under Common Criteria?

Answer 342

Protection profile

Question 343

What are the security features of a designed system called under Common Criteria?

Answer 343

Security target

Question 344

What method of verifying or establishing a trusted label of system security requires a DAA?

Answer 344

Accreditation

Question 345

What is the name of the accreditation process of the Department of Defense?

Answer 345

Defense Information Technology Security Certification and Accreditation Process (DITSCAP)

Question 346

What are the three forms of accreditation offered by National Information Assurance Certification and Accreditation Process (NIACAP)?

Answer 346

Site, type, system

Question 347

What is often added to passwords under Linux to make their resultant hash even more secure?

Answer 347

Salts

Question 348

When a disaster strikes but your ability to perform work tasks is only threatened, not actually interrupted, what response should be used?

Answer 348

BCP

Question 349

What is always your top priority when dealing with a disaster of any type or significance?

Answer 349

Safety of personnel

Question 350

What feature of insurance can improve your ability to replace lost or damaged assets?

Answer 350

Actual Cost Value (ACV)

Question 351

What is the most common cause of unplanned downtime?

Answer 351

Hardware failures

Question 352

What are some examples of alternate processing facilities that should be considered when designing a DRP?

Answer 352

Hot, warm, and cold sites; mobile sites; service bureaus; multiple sites; and reciprocal agreements

Question 353

What forms of backup always set the archive bit to 0?

Answer 353

Full and incremental

Question 354

What backup media is appropriate for personal backups but not for network backups?

Answer 354

Writable CDs and DVDs

Question 355

What form of backup, when used to restore data, will always result in some amount of data loss?

Answer 355

Periodic backups

Question 356

What law requires all communications carriers to make wiretaps possible for law enforcement with an appropriate court order regardless of the technology in use?

Answer 356

Communications Assistance for Law Enforcement Act (CALEA) of 1994

Question 357

What law extends the definition of property to include proprietary economic information so that the theft of this information can be considered industrial or corporate espionage?

Answer 357

Economic and Protection of Proprietary Information Act of 1996

Question 358

               controls are your first line of defense, while                 are your last line of defense.

Answer 358

Physical, people

Question 359

What is the functional order of controls when deployed for physical security?

Answer 359

Deterrence, then denial, then detection, then delay

Question 360

What type of lock consists of three elements: an electromagnet, a credential reader, and a door-closed sensor?

Answer 360

Electronic access control (EAC)

Question 361

Reviewing the recorded images from CCTV is what type of security control?

Answer 361

Detective

Question 362

What is the primary difference between memory cards and smart cards?

Answer 362

Processing capability

Question 363

At what stage of a fire is a flame visible?

Answer 363

Stage 3: Flame

Question 364

What is the most common cause of fires in a data center?

Answer 364

Overloaded electrical distribution outlets

Question 365

Where should fire detectors be placed?

Answer 365

In dropped ceilings, raised floors, server rooms, private offices and public areas, HVAC vents, elevator shafts, the basement, and so on

Question 366

What is the most common cause of failure of a water-based suppression system?

Answer 366

Human error

Question 367

Name one or more examples of vector routing protocol.

Answer 367

RIP, IGRP, BGP

Question 368

Name an example of a link state routing protocol.

Answer 368

OSPF

Question 369

At what layer does SSL and TLS function?

Answer 369

Transport layer (OSI layer 4)

Question 370

Name at least four technologies commonly called wireless.

Answer 370

802.11 networking, Bluetooth (802.15), mobile phones, and cordless phones

Question 371

What are the three unlicensed frequencies (at least in the United States as designated by the FCC)?

Answer 371

900 MHz, 2.4 GHz, and 5 GHz

Question 372

Name three wireless frequency access technologies.

Answer 372

FHSS, DSSS, and OFDM

Question 373

What protocol can be used to enable mobile phone access to Internet resources?

Answer 373

Wireless Application Protocol (WAP)

Question 374

What is the IEEE standard for Bluetooth?

Answer 374

802.15

Question 375

What is the IEEE standard for WiMax?

Answer 375

802.16

Question 376

What is another name for the area of Bluetooth connectivity?

Answer 376

Personal area network (PAN)

Question 377

What is the primary security feature of Bluetooth pairing?

Answer 377

A four-digit PIN

Question 378

What two items are required for infrastructure mode wireless networking?

Answer 378

Wireless access points and wireless clients

Question 379

What mode is used when a wireless network link is established without the use of an access point?

Answer 379

Ad hoc or peer-to-peer

Question 380

What is the minimum amount of information needed by a wireless client to connect to a network hosted by a wireless access point?

Answer 380

SSID

Question 381

Name four examples of infrastructure mode wireless networking.

Answer 381

Stand-alone, wired extension, enterprise extended, and bridge

Question 382

How many wireless networking channels exist on devices in the United States? In Europe? In Japan?

Answer 382

United States: 11, Europe: 13, Japan: 17

Question 383

What is the native authentication and encryption scheme of 802.11?

Answer 383

Wired Equivalent Privacy (WEP)

Question 384

Name two alternatives to WEP for 802.11.

Answer 384

WPA and WPA-2 (802.11i)

Question 385

What two forms of authentication are supported by 802.11?

Answer 385

Open System Authentication (OSA) and Shared Key Authentication (SKA)

Question 386

What is the minimum length of a TCP header?

Answer 386

20 bytes

Question 387

How long is a UDP header?

Answer 387

8 bytes

Question 388

What are the four TCP header flags that are used in virtual circuit setup and teardown?

Answer 388

SYN, ACK, FIN, and RES (or RST)

Question 389

What two ICMP type field values are employed in a successful ping activity?

Answer 389

8: echo request, 0: echo reply

Question 390

What is Control Objectives for Information and Related Technology (COBIT)?

Answer 390

A security concept infrastructure used to organize the complex security solution of companies.

Question 391

What form of testing examines the internal logical structures of a program from a developer’s perspective?

Answer 391

White-box testing

Question 392

What form of testing examines the input and output of a program without access to the internal logical structures?

Answer 392

Black-box testing

Question 393

What form of testing examines the input and output of a program with access to the internal logical structures?

Answer 393

Grey-box testing

Question 394

What kinds of items qualify as access controls?

Answer 394

Any hardware, software, or organizational administrative policy or procedure that maintains confidentiality, integrity, and/or accountability also counts as an access control.

Question 395

What is the proper term for ensuring that information is accessible only to authorized parties?

Answer 395

Confidentiality

Question 396

What is the proper term for the assurance that information and security controls used to protect information are accessible and usable when needed?

Answer 396

Availability

Question 397

What is it called when an authorized party indicates its intention to fulfill some contractual obligation and forgoes its right to dispute that fulfillment after the fact?

Answer 397

Nonrepudiation

Question 398

Items of information used to establish or prove authorized identities are known as what kind of factors?

Answer 398

Authentication

Question 399

What kind of access control enforces access policy determined by the owner of the object to which the control applies?

Answer 399

Discretionary access control (DAC)

Question 400

What kind of access control is determined by the system in which the object resides rather than its owner?

Answer 400

Mandatory access control (MAC)

Question 401

Which access control scheme requires organizational roles to be defined along with various task requirements and applicable object permissions?

Answer 401

Role-based access control (RBAC)

Question 402

Which access control scheme requires administrative rules to be defined along with the various conditions under which they apply as well as applicable object permissions?

Answer 402

Rule-based access control

Question 403

What is the practice of defense in depth called when it involves a multilayered security infrastructure that includes multiple combined individual applications and processes?

Answer 403

Concentric circle strategy

Question 404

What is the term for exercising reasonable care in protecting organizational assets and interests, including development of a formalized security structure consisting of policies, procedures, and protocols?

Answer 404

Due care

Question 405

When users are granted only the minimum access necessary to complete some task or process, what principle is involved?

Answer 405

The principle of least privilege

Question 406

What kinds of processes must be applied when confidential storage media is prepared for reuse in questionably secure environments?

Answer 406

Declassification

Question 407

What is the name for the demagnetization process used to erase disk drives or tapes to wipe out all previously stored data?

Answer 407

Degaussing

Question 408

What kind of control does any security tool provide when it’s used to guide the security implementation within an organization?

Answer 408

Directive control

Question 409

What kind of control does any mechanism, tool, or practice provide if it deters or mitigates undesirable actions or events?

Answer 409

Preventive control

Question 410

What kind of control should be used to verify the effectiveness of other security controls?

Answer 410

Detective control

Question 411

What kind of check should be applied to ensure that all necessary elements of a security solution are properly deployed and functioning as expected?

Answer 411

Compliance checking

Question 412

What do you call a person who is trained in responsible network security methods, who employs a philosophy of nondestructive and nonintrusive penetration testing, but who may also use underground or “black-hat” tools?

Answer 412

Ethical hacker

Question 413

What is the proper name for a criminal act committed against an organization by a current or former employee who exploits knowledge gained on the job in its perpetration?

Answer 413

Sabotage

Question 414

What is the proper name for the illegal intent behind obtaining and profiting from sensitive information that belongs to some third party (government, corporation, individual, and so on)?

Answer 414

Espionage

Question 415

When a person attempts to deceive an insider within an organization to divulge sensitive information or to perform sensitive actions on their behalf, what might this be called?

Answer 415

Social engineering

Question 416

When a penetration test team is privy to detailed information about organizational assets, including hardware and software inventory, but not to other information (accounts, users, naming conventions, and so on), how might this team be described?

Answer 416

Partial-knowledge team

Question 417

When a penetration test team is privy only to what it itself can learn about the target organizations for the test, how might this team be described?

Answer 417

Zero-knowledge team (performs black-box testing)

Question 418

What term identifies the data extraction technique whereby elements of data are extracted from a much larger body of data to construct a meaningful representation of its overall contents?

Answer 418

Sampling

Question 419

What governs how long records are kept to substantiate system security assessments and support system analysis?

Answer 419

Record retention

Question 420

What does BCP stand for, and what does it mean?

Answer 420

Business continuity planning (BCP) is the preventive practice of establishing and planning for threats to business flow, including natural and unnatural risk and threats to daily operations.

Question 421

What does DRP stand for, and what does it mean?

Answer 421

Disaster recovery planning (DRP) is the practice of establishing and executing recovery actions as part of an emergency response following a disaster.

Question 422

What term describes damage from disruptive and irresistible forces of nature (such as earthquakes, floods, storms, and so on)?

Answer 422

Natural disaster

Question 423

What term describes damage resulting from arson, human error, acts of terrorism, or power outages and other utility failures?

Answer 423

Man-made disaster

Question 424

What kind of strategy drives defining practices, policies, and procedures to restore a business to normal operation in the wake of some kind of outage or disaster?

Answer 424

Recovery strategy

Question 425

What label applies to a partial standby facility for which power and other infrastructure elements are available, but for which no operational computing facilities are supplied in advance of a disaster?

Answer 425

Cold site

Question 426

What label applies to a standby facility that is ready to take over for a primary facility as soon as notice is received that the primary facility has gone down?

Answer 426

Hot site

Question 427

What label applies to a site that is already provisioned with hardware and software to take over for a primary facility but that needs to obtain and install a backup or image of client-specific data before going online?

Answer 427

Warm site

Question 428

How might you describe a site housed in self-contained transportable units with all the control, hardware, and software elements necessary to establish an operational, safe computing environment?

Answer 428

Mobile site

Question 429

What roles can a service bureau play in disaster recovery?

Answer 429

Service bureaus lease computer time via contractual agreements and can meet an organization’s entire IT needs in the event of disaster or catastrophic failure.

Question 430

What is critical path analysis?

Answer 430

A systematic effort to identify relationships between mission-critical applications, processes, and operations and all of the necessary supporting elements

Question 431

Name three examples of administrative physical security controls.

Answer 431

Facility construction and selection, site management, personnel controls, security awareness training, emergency response, and procedures

Question 432

Name three examples of technical physical security controls.

Answer 432

Access controls; intrusion detection; alarm systems; closed-circuit television (CCTV); monitoring systems; heating, ventilation, and air conditioning (HVAC) systems; power supplies; fire detection and suppression systems

Question 433

Name at least three physical controls for physical security.

Answer 433

Fencing, lighting, locks, construction materials, mantraps, watchdogs, guards

Question 434

What term describes the act of gathering information about a system by observing the display or watching an operator at the keyboard?

Answer 434

Shoulder surfing

Question 435

What term describes the act of using another person’s security ID to gain unauthorized entry into a facility?

Answer 435

Masquerading

Question 436

When one person follows another though a secured gate or doorway without presenting identification or otherwise being authenticated, what is this entry technique called?

Answer 436

Piggybacking

Question 437

What kinds of system is designed to detect intrusions, breaches, or attack attempts as they are underway or after the fact?

Answer 437

Intrusion detection system (IDS)

Question 438

What does UPS stand for, and what does it mean?

Answer 438

An uninterruptible power supply (UPS) is a type of self-charging battery that can be used to supply consistent clean power to sensitive equipment.

Question 439

What does EMI stand for, and what does it mean?

Answer 439

Electromagnetic interference refers to any noise generated by electric current and can affect any means of data transmission or storage that relies on electromagnetic transport mechanisms.

Question 440

Describe the models of systems development.

Answer 440

The waterfall model is a sequential development process that results in the development of a finished product. Developers may step back only one phase in the process if errors are discovered. The spiral model uses several iterations of the waterfall model to produce a number of fully specified and tested prototypes. Agile development models place an emphasis on the needs of the customer and quickly developing new functionality that meets those needs in an iterative fashion.

Question 441

Describe the purpose of software development maturity models.

Answer 441

Maturity models help software organizations improve the maturity and quality of their software processes by implementing an evolutionary path from ad hoc, chaotic processes to mature, disciplined software processes.

Question 442

What are the important elements of change and configuration management?

Answer 442

The three basic components of change control are request control, change control, and release control.

Question 443

What is TEMPEST?

Answer 443

TEMPEST is a standard for the study and control of electronic signals produced by various types of electronic hardware, such as computers, televisions, phones, and so on. Its primary goal is to prevent EMI and RFI radiation from leaving a strictly defined area to eliminate the possibility of external radiation monitoring, eavesdropping, and signal sniffing.

Question 444

What is static software testing?

Answer 444

Static testing evaluates the security of software without running it by analyzing either the source code or the compiled application. Static analysis usually involves the use of automated tools designed to detect common software flaws, such as buffer overflows.

Question 445

What type of software testing is most appropriate when the tester does not have access to the underlying source code?

Answer 445

Dynamic testing

Question 446

What does malicious code often create on an infected system to allow the developers of the malicious code to remotely access the system at a later time?

Answer 446

Back door

Question 447

What name is given to the cryptographic concept of making the relationship between the plain text and the key so complex that an attacker can’t use known plain text attacks to determine the key?

Answer 447

Confusion

Question 448

What type of organizations need to comply with PCI DSS?

Answer 448

Those that store, process, or transmit credit card account information.

Question 449

What trend makes it especially important to incorporate an assessment of security controls in contracting and procurement reviews?

Answer 449

The increased use of third-party and cloud services

Question 450

What are the branches of forensic analysis?

Answer 450

Media analysis, network analysis, software analysis, and hardware/embedded device analysis

Question 451

What is it when a user has more access, privilege, or permission than their assigned work tasks dictate?

Answer 451

Excessive privileges (also known as the violation of least privilege)

Question 452

What is it called when a user accumulates privileges over time as their job roles and assigned tasks changes but unneeded privileges are not revoked?

Answer 452

Creeping privileges

Question 453

Which access control scheme requires administrative rules to be defined along with the various conditions under which they apply as well as applicable object permissions?

Answer 453

Rule-based access control

Question 454

Name at least three physical controls for physical security.

Answer 454

Fencing, lighting, locks, construction materials, mantraps, watchdogs, guards

Question 455

What term is used to refer to the user or process that makes a request to access a resource?

Answer 455

Subject

Question 456

What kind of control does any mechanism, tool, or practice provide if it deters or mitigates undesirable actions or events?

Answer 456

Preventive control

Question 457

What process identifies the actual value of assets so that assets can be prioritized?

Answer 457

Asset valuation

Question 458

What process identifies and categorizes potential threats?

Answer 458

Threat modeling

Question 459

What process is used to identify weaknesses?

Answer 459

Vulnerability analysis

Question 460

When evaluating access control attacks, what are three primary elements that must be identified?

Answer 460

Assets, threats, and vulnerabilities

Question 461

A group of attackers is sponsored by a government. They are highly motivated, skilled, and patient and focused on a single target. What is this group called?

Answer 461

Advanced Persistent Threat (APT)

Question 462

What is often added to passwords to make their resultant hash secure and resistant to rainbow attacks?

Answer 462

Salts

Question 463

What is a nonstatistical sampling method that only records or alerts on events that exceed a threshold?

Answer 463

Clipping levels

Question 464

What is a group of records from one or more databases or logs that can be used to reconstruct events after an incident?

Answer 464

Audit trail

Question 465

What is the purpose of an access review and audit?

Answer 465

Checks to ensure that users do not have excessive privileges and that accounts are managed appropriately

Question 466

What can a user entitlement review detect?

Answer 466

Violation of the principle of least privilege policy, as incidents of excessive privileges or creeping privileges

Question 467

What types of accounts are focused on during a user entitlement review?

Answer 467

Privileged accounts such as administrator or root user accounts

Question 468

Who should have access to audit reports?

Answer 468

Only people who have a need to know

Question 469

What determines how often an audit should be performed?

Answer 469

Risk

Question 470

What policy requires users to spend at least a week away from their jobs on an annual basis to help prevent fraud?

Answer 470

Mandatory vacations

Question 471

What method will remove all data with assurances that it cannot be removed using any known methods?

Answer 471

Purging, sanitization, or destruction

Question 472

What methods can be used to protect mobile devices such as a smart phone?

Answer 472

Encryption, GPS, password-protected screen locks, and remote wipe

Question 473

What can be used to remove data on a lost smart phone?

Answer 473

Remote wipe

Question 474

What should be done before disposing of a desktop computer at the end of its lifecycle?

Answer 474

Sanitization

Question 475

What is the term that identifies data on a disk after the data has supposedly been erased?

Answer 475

Data remanence

Question 476

What are the steps of a patch management program?

Answer 476

Evaluate, test, apply, and audit patches

Question 477

What can be used to verify patches have been applied?

Answer 477

Vulnerability scanner

Question 478

What should be done to verify patches have been applied?

Answer 478

Audit patches, or use a vulnerability scanner to verify patches have been applied

Question 479

What tool can check for weaknesses in systems?

Answer 479

Vulnerability scanner

Question 480

What would be completed to check an entire organization for weaknesses?

Answer 480

Vulnerability assessment

Question 481

What does imaging provide in relation to configuration management?

Answer 481

Baseline

Question 482

What helps prevent outages that can occur from unauthorized modifications?

Answer 482

Change management

Question 483

What helps prevent inadvertent weakening of security from unauthorized outages?

Answer 483

Change management

Question 484

What are the five steps in incident response quoted in the CISSP CIB?

Answer 484

Detection, Response, Reporting, Recovery, and Remediation and Review

Question 485

In which stage of incident response should a root cause analysis be conducted?

Answer 485

Remediation and Review

Question 486

While containing an incident, what is the next important consideration?

Answer 486

Protection of evidence

Question 487

An attack has a negative effect on the confidentiality, integrity, or availability of an organization’s assets. What is this called?

Answer 487

Computer security incident

Question 488

What is it called when malware is installed on a user’s system after visiting a website?

Answer 488

Drive-by download

Question 489

What three generic elements can help prevent malware infections?

Answer 489

Education, policies, and tools

Question 490

An attacker has launched an attack using a vulnerability known only to him. What is this called?

Answer 490

Zero-day exploit

Question 491

What type of attack disrupts the TCP three-way handshake?

Answer 491

SYN flood attack

Question 492

What are computers in a botnet commonly called?

Answer 492

Zombies

Question 493

What is the best protection against a computer joining a botnet?

Answer 493

Up-to-date antivirus software

Question 494

What type of IDS detects attacks based on known methods?

Answer 494

Knowledge-based (also called signature-based or pattern-matching)

Question 495

What type of IDS detects attacks based by comparing it to a baseline?

Answer 495

Behavior-based (also called statistical-intrusion detection or anomaly detection)

Question 496

After a network is upgraded, what must be done with a behavior-based IDS?

Answer 496

Upgrade the baseline

Question 497

What is required before starting a penetration test?

Answer 497

Knowledge and consent of management

Question 498

What is often the first step of a penetration test?

Answer 498

Vulnerability test or vulnerability scan

Question 499

When a penetration test team is privy to detailed information about organizational assets, including hardware and software inventory, but not to other information (accounts, users, naming conventions, and so on), how might this team be described?

Answer 499

Partial-knowledge team (performs gray-box testing)

Question 500

A penetration testing team has full knowledge about a target. What is this team called?

Answer 500

Full-knowledge team (performs white-box testing)