Chapter 1 & 2: Security Fundamentals and Risk Management

Question 1

Which standards organization publishes the 802.X series of networking standards

Answer 1

Institute of Electrical and Electronics Engineers (IEEE)

Question 2

Which standards organization developed many common internet protocols and issues RFCs on protocols/protocol updates?

Answer 2

Internet Engineering Task Force (IETF)

Question 3

Which standards organization is international, creates standards for information technology and security standards and practices, and developed the OSI network model?

Answer 3

International Organization for Standardization (ISO)

Question 4

Which standards organization is a UN agency, allocates radio spectrum, coordinates satellite orbits, and promotes global technical standards related to networking and communication (H.264 MPEG, X.509 digital certificates)

Answer 4

International Telecommunication Union (ITU)

Question 5

Which standards organization is a US government agency which develops and supports standards used by other government organizations? Their standards are often used by other organizations with similar technology needs.

Answer 5

National Institute of Standards and Technology (NIST)

Question 6

Which standards organization is a US signals intelligence agency involved in information gathering, codebreaking and codemaking. They have roles in DES, AES, and SHA.

Answer 6

National Security Agency (NSA)

Question 7

Which standards organization further the state of web application security and provides guidelines, articles, software tools, and others.

Answer 7

Open Web Application Security Project (OWASP)

Question 8

Which standards organization develops and maintains interoperable standards for the WWW?

Answer 8

World Wide Web Consortium (W3C)

Question 9

Which security controls involve organizational policies and training.  They include:
password policies
employee screening
training procedures
compliance with legal regulations

Answer 9

Managerial

Question 10

Which security controls are enforced by technology. They include:
firewalls
authentication systems
encryption protocols

Answer 10

Technical

Question 11

Which security controls are accomplished through employee activities and the execution of policies. They include:
backup management
security assessments
incident response

Answer 11

Operational

Question 12

Which security controls are accomplished through
locks
fences
video surveillance
security guards

Answer 12

Physical

Question 13

Which control is designed to close a gap in an existing control structure?

Answer 13

Preventative

Question 14

Which control is designed to detect an active threat and record as evidence

Answer 14

Detective

Question 15

Which control is designed to minimize the harm caused by a security breach and to prevent recurrence?

Answer 15

Corrective

Question 16

Which control discourages attack or intrusion

Answer 16

Deterrent

Question 17

What is a federal law designed to protect investors from fraudulent corporate accounting practices? It primarily applies to publicly traded companies and public accounting firms that do business in the US and primarily regulates the preservation, auditing and disclosure of financial records and related communications.

Answer 17

Sarbanes-Oxley Act of 2002 (SOX)

Question 18

Which act applies to all federal agencies and requires every agency to develop, document, and implement an information security and protection program, and provides guidelines for doing so?

Answer 18

Federal Information Security Management Act (FISMA)

Question 19

What is a federal law designed to protect health insurance coverage, protects the privacy of patient records, defines PHI, and regulates how it can be used or disclosed.

Answer 19

Health Insurance Portability and Accountability Act (HIPAA)

Question 20

What is a federal privacy law that governs access to educational records, requires that adult student or the parents of minor students have access to their records, and limits how those records can be shared with others?

Answer 20

Family Educational Rights and Privacy Act (FERPA)

Question 21

What act protects the customers of financial institutions by setting minimum standards for financial institutions to safeguard clients and customers personnel information.

Answer 21

Gramm-Leach-Bliley Act (GBLA)

Question 22

What is an EU law governing all individual data relating to EU residents which addresses security, privacy, and export of data.

Answer 22

General Data Protection Regulation (GDPR)

Question 23

What are shared rules developed by the world’s major credit card companies and administered by the PCI council. They regulate how payment information must be stored, processed, and transmitted, and requires vulnerability scanning.

Answer 23

Payment Card Industry Data Security Standard (PCI DSS)

Question 24

What governance framework is a series of documents defining security standards, policies, and procedures for the US government

Answer 24

NIST 800 series

Question 25

Which framework is defined by SP 800-27 using controls in SP 800-53 and uses a six-step cyclical process to identify and manage risks. This framework is mandatory for US government agencies.

Answer 25

NIST Risk Management Framework (RMF)

Question 26

Which framework contains voluntary guidelines for private sector organizations in the US, particularly in critical infrastructure. It focuses on standard guidelines and language for cybersecurity, and is based on industry standards and best practices, but does not contain detailed risk-management procedures, so it should be used in conjunction with RMF.

Answer 26

NIST Cybersecurity Framework (CSF)

Question 27

Which framework is a series of broad risk-management framework guidelines containing information security guidelines for all sorts of organizations.

Answer 27

ISO 27000

Question 28

Which framework is a broad risk-managment framework that applies to all aspects of organizational risks and their effects on business goals. It is meant to be used in conjunction with ISO 27000, and is more focused on organizational leadership.

Answer 28

ISO 31000

Question 29

Which framework includes 20 best practice guidelines for general cybersecurity, initially developed by SANS. Each guideline defines a type of action you can use to reduce security vulnerabilities, and it maps to the NIST CSF, making it a useful tool towards implementing that framework.

Answer 29

Center for Internet Security Critical Security Controls for Effective Cyber Defense (CIS CSC)

Question 30

Which framework is focused on cloud security?

Answer 30

Cloud Security Alliance Cloud Controls Matrix (CSA CCM)

Question 31

Which framework is an auditing standard published by the American Institute for Certified Public Accountant (AICPA). It Ensures accurate, complete and fair financial reporting with a focus on operational controls on information system.

Answer 31

Statement on Standards for Attestation Engagements.

Question 32

Which TCP/IP tool display a variety of network information, including active connections, routing tables and traffic statistics?

Answer 32

netstat

Question 33

Which TCP/IP tool displays the IPv4 ARP cache?

Answer 33

arp

Question 34

Which TCP/IP tool performs a DNS lookup and displays the IP address of a given hostname?

Answer 34

nslookup

Question 35

Which TCP/IP tool is a more powerful alternative to nslookup and is particularly useful for zone transfers.

Answer 35

dig

Question 36

Which TCP/IP tool is used in Windows and is similar to tracert

Answer 36

pathping

Question 37

Which 2 attack tools make arbitrary network connections?

Answer 37

netcat and ncat

Question 38

Which attack tool is a packet crafting utility that can be used for enumeration and exploitation

Answer 38

hping

Question 39

Which attack tool is normally used for secure remote access, but can also create proxy connection to obscure the attackers network location

Answer 39

SSH

Question 40

Which attack tools is a focused proxy application

Answer 40

proxychains

Question 41

Which attack tool is a command-line tool that can transfer data using various protocols. Can be used to upload malicious code or download sensitive files.

Answer 41

curl

Question 42

Which attack tool can replay, or resend, network traffic captured by another tool such as tcpdump or Wireshark

Answer 42

tcpreplay

Question 43

Which attack tool is a port scanner designed for penetration testing?

Answer 43

scanless

Question 44

Medusa, Hydra, Hashcat, John the Ripper, Cain & Abel and patator are all examples of what?

Answer 44

Password cracking tools

Question 45

Which 2 exploitation frameworks are used for general purpose exploits

Answer 45

Metasploit and core impact

Question 46

Which exploitation framework is focused on web applications

Answer 46

w3af

Question 47

Which exploitation framework targets local address resolution protocols

Answer 47

Responder

Question 48

How long it takes for a newly installed device to fail is referred to as what?

Answer 48

Mean time to failure (MTTF)

Question 49

How long it takes to repair a serviceable device is referred to as what?

Answer 49

Mean time to repair (MTTR)

Question 50

The average uptime between failures is referred to as what?

Answer 50

Mean time between failures (MTBF)

Question 51

What is calculated by MTBF + MTTR

Answer 51

Mean time between service incidents (MTBSI)

Question 52

Which type of scan is most likely to cause disruptions?

Answer 52

non-credentialed intrusive scan

Question 53

What is a program that monitors and analyzes network traffic, detecting bottlenecks and problems. Also known as protocol analyzer.

Answer 53

sniffer