Chapter 1 Flashcards
Ian recently earned his security certification and has been offered a promotion to a position that requires him to analyze and design security solutions as well as identifying users’ needs. Which of these generally recognized security positions has Ian been offered?
Security administrator
Security technician
Security officer
Security manager
Security administrator
Alyona has been asked by her supervisor to give a presentation regarding reasons why security attacks continue to be successful. She has decided to focus on the issue of widespread vulnerabilities. Which of the following would Alyona NOT include in her presentation?
Large number of vulnerabilities
End-of-life systems
Lack of vendor support
Misconfigurations
Misconfigurations
Tatyana is discussing with her supervisor potential reasons why a recent attack was successful against one of their systems. Which of the following configuration issues would NOT covered?
Default configurations
Weak configurations
Vulnerable business processes
Misconfigurations
Vulnerable business processes
What is a race condition?
When a vulnerability is discovered and there is a race to see if it can be patched before it is exploited by attackers.
When two concurrent threads of execution access a shared resource simultaneously, resulting in unintended consequences.
When an attack finishes its operation before antivirus can complete its work.
When a software update is distributed prior to a vulnerability being discovered.
When two concurrent threads of execution access a shared resource simultaneously, resulting in unintended consequences.
Which of the following is NOT true regarding security?
Security is a goal.
Security includes the necessary steps to protect from harm.
Security is a process.
Security is a war that must be won at all costs.
Security is a war that must be won at all costs.
Which of the following ensures that only authorized parties can view protected information?
Authorization
Confidentiality
Availability
Integrity
Confidentiality
Which of the following is NOT a successive layer in which information security is achieved?
Products
People
Procedures
Purposes
Purposes
Complete this definition of information security: That which protects the integrity, confidentiality, and availability of information .
on electronic digital devices and limited analog devices that can connect via the Internet or through a local area network.
through a long-term process that results in ultimate security.
using both open-sourced as well as supplier-sourced hardware and software that interacts appropriately with limited resources.
through products, people, and procedures on the devices that store, manipulate, and transmit the information.
through products, people, and procedures on the devices that store, manipulate, and transmit the information.
Which of the following is an enterprise critical asset?
System software
Information
Outsourced computing services
Servers, routers, and power supplies
Information
Gunnar is creating a document that explains risk response techniques. Which of the following would he NOT list and explain in his document?
Extinguish risk
Transfer risk
Mitigate risk
Avoid risk
Extinguish risk
Which act requires banks and financial institutions to alert their customers of their policies in disclosing customer information?
Sarbanes-Oxley Act (Sarbox)
Financial and Personal Services Disclosure Act
Health Insurance Portability and Accountability Act (HIPAA)
Gramm-Leach-Bliley Act (GLBA)
Gramm-Leach-Bliley Act (GLBA)
An organization that practices purchasing products from different vendors is demonstrating which security principle?
Obscurity
Diversity
Limiting
Layering
Diversity
What is an objective of state-sponsored attackers?
To right a perceived wrong
To amass fortune over of fame
To spy on citizens
To sell vulnerabilities to the highest bidder
To spy on citizens(?)
Signe wants to improve the security of the small business where she serves as a security manager. She determines that the business needs to do a better job of not revealing the type of computer, operating system, software, and network connections they use. What security principle does Signe want to use?
Obscurity
Layering
Diversity
Limiting
Obscurity
What are industry-standard frameworks and reference architectures that are required by external agencies known as?
Compulsory
Mandatory
Required
Regulatory
Regulatory
