CH 3 - Security Foundations Flashcards
To remove malware from the network before it gets to the endpoint, you would use which of the following?
A. Packer filter
B. Application layer gateway
C. Unified threat management appliance
D. Stateful firewall
C.
Unified threat management appliance
If you were on a client engagement and discovered that you left an external hard drive with essential data on it at home, which security principle would you be violating?
A. Confidentiality
B. Integrity
C. Nonrepudiation
D. Availability
D.
Availability
How would you calculate risk?
A. Probability * loss value
B. Probability * mitigation factor
C. (Loss value + mitigation factor) * (loss value / probability)
D. Probability * mitigation factor
A.
Probability * loss value
Which of the following is one factor of a defense-in-depth approach to network design?
A. Switches
B. Using Linux on the desktop
C. Optical cable connections
D. Access control lists on routers
D.
Access control lists on routers
How would you ensure that confidentiality is implemented in an organization?
A. Watchdog processes
B. Encryption
C. Cryptographic hashes
D. Web servers
B.
Encryption
An intrusion detection system can perform which of the following functions?
A. Block traffic
B. Filter traffic based on headers
C. Generate alerts on traffic
D. Log system messages
C.
Generate alerts on traffic
Which of these would be an example of a loss of integrity?
A. User making changes to a file and saving it
B. Bad blocks flagged on disk
C. Credit cards passed in cleartext
D. Memory failures causing disk drivers to run incorrectly
D.
Memory failures causing disk drivers to run incorrectly
What would you use a
Security Information Event Manager (SIEM) for?
A. Aggregating and Providing search for log data
B. Managing security projects
C. Escalating security events
D. Storing open source intelligence
A.
Aggregating and providing search for log data
Why is it important to store system logs remotely?
A. Local systems can’t handle it
B. Bandwidth is faster than disks
C. Attackers might delete local logs
D. It will defend against attacks
C.
Attackers might delete local logs
What would be necessary for a TCP conversation to be considered established by a stateful firewall?
A. Final acknowledgment message
B. Three-way handshake complete
C. Sequence numbers aligned
D. SYN message received
B.
Three-way handshake complete
What is the purpose of a security policy?
A. To provide high-level guidance on the role of security
B. To provide specific direction to security workers
C. To increase the bottom line of a company
D. To align standards and practices
A.
To provide high-level guidance on the role of security
What additional properties does the Parkerian Hexad offer over the CIA triad?
A. Confidentiality, awareness, authenticity
B. Utility, awareness, possession
C. Utility, possession, authenticity
D. Possession, control, authenticity
C.
Utility, Possession, Authenticity
What important event can be exposed by enabling auditing?
A. System shutdown
B. Service startup
C. Package installation
D. User login
D.
User login
What can an intrusion prevention system do that an intrusion detection system can’t?
A. Generate alerts
B. Block or reject network traffic
C. Complete the three-way handshake to bogus messages
D. Log packets
B.
Block or reject network traffic
Which of these is an example of an application layer gateway?
A. Web application firewall
B. Runtime application self-protection
C. Java applet
D. Intrusion prevention system
A.
Web application firewall
