Chapter 1: Confidentiality, Integrity, Availability, and Non-repudiation

Question 1

What are the three main goals of the CIA Triad?

Answer 1

• Confidentiality
• Integrity
• Availability

Question 2

{BLANK} ensures that only authorized individuals have access to information and resources.

Answer 2

Confidentiality

Question 3

What are the major threats to confidentiality?

Answer 3

• Snooping
• Dumpster Diving
• Eavesdropping
• Wiretapping
• Social Engineering

Question 4

The individual engaging in {BLANK} wanders around your ofiice or other facility and simply looks to see what information they can gather.

Answer 4

Snooping

Question 5

What can organizations do to protect against snooping?

Answer 5

Enforce a clean desk policy

Question 6

{BLANK} attacks also look for senstive materials, but the attacker doesn’t walk around the office; instead, they look through the trash, trying to find senstive documents that an employee threw in the garbage or recycling bin.

Answer 6

Dumpster Diving

Question 7

What can organizations do to protect against dumpster diving?

Answer 7

Using a paper shredder

Question 8

What are the two types of eavesdropping?

Answer 8

• Physical
• Electronic

Question 9

In a physical eavesdropping attack, the attacker simply positions themselves where they can overhear conversations, such as in a cafeteria or hallway, and then listens for sensitive information.

How can an organization protect against this type of attack?

Answer 9

By putting rules in place limiting where sensitive conversations may take place.

Question 10

Electronic eavesdropping attacks are also known as wiretapping. They occur when an attacker gains access ro a network and monitors the data being sent elctronically within an office.

What can an organization do to protect against this type of attack?

Answer 10

They can use encryption to protect information being sent over the network.

Question 11

In a {BLANK} attack, the attacker uses psychological tricks to persuade an employee to give them sensitive information or access to internal systems.

Answer 11

Social Engineering

Question 12

What is the best defense against social engineering?

Answer 12

The best defense against this attack is educating users to recognize the dangers of social engineering and empower them to intervene when they suspect an attack i staking place.

Question 13

{BLANK} means there aren’t any unauthorized changes to information.

Answer 13

Integrity

Question 14

What are the major threats to integrity?

Answer 14

• Unauthorized modification of information
• Impersonation attacks
• Man-in-the-middle (MitM) attacks
• Replay attacks

Question 15

The {BLANK} occurs when an attacker gains access to a system and makes changes that violate a security policy.

Answer 15

Unauthorized Modification of Information

Question 16

Whats is the best way to protect against unathorized modification of information?

Answer 16

Following the priciple of least privilege.

Organizations should carefully consider the permissions that each employee needs to perform their job and then limit employees to the smallest set of permissions possible.

Question 17

In an {BLANK} attack, the attacker pretends to be someone other than who they actually are.

The best defense these attacks is strongt user education.

Answer 17

Impersonation

Question 18

Sometime impersonation attacks are electronic. In a {BLANK}, the attacker intercepts network traffic as a user is logging into a system and pretends to be that system. They then sit in the middle of the communication, relaying information between the user and the system while they monitor everything that is occuring.

Answer 18

Man-in-the-middle (MitM) attack

Question 19

In a {BLANK}, the attacker doesn’t get in the middle of the communication but finds a way to observe a legitimate user logging into a system. They then capture the information used to log in to the system and later replay it on the network to gain access.

Answer 19

Relay Attack

Question 20

What is the best defense against replay and MitM attacks?

Answer 20

The use of encryption to protect communications.

Question 21

{BLANK} controls ensure that information and systems remain available to authorized users when needed. They protect against disruptions to normal system operation or data availability.

Answer 21

Availability

Question 22

What are the major threats to availability?

Answer 22

• Denial-of-service attacks
• Power outages
• Hardware Failures
• Destruction of Equipment
• Service Outages

Question 23

{BLANK} occur when a malicious individual bombards a system with an overwhelming amount of network traffic.

Answer 23

Denial-of-Service (DoS) attack

Question 24

How can an organization protect its systems against a DoS attack?

Answer 24

By using firewalls that block illegitimate request and by partnering with your Internet service provider to block DoS attacks before the reach your network.

Question 25

What can an organization do to protect against power outages?

Answer 25

By having redundant power sources and backup generatiors that supply power to your system when commerical power is not available.

Question 26

What can an organization do to protect against hardware failures?

Answer 26

By building a system that has built-in redundancy so that if one component fails, another is ready to pick up the slack.

Question 27

What can an organization do to protect destruction of equipment?

Answer 27

They can protect against small-scale destruction with redundant systems and for large-scale disasters, they can have backup data centers in remote locations or in a cloud that can keep running when your primary data center is disrupted.

Question 28

What can an organization do to protect against service outages?

Answer 28

By building systems that are resilient in the face of errors and hardware failures.

Question 29

{BLANK} is a security goal that prevents someone from falsely denying that something is true.

Answer 29

Non-repudiation

Question 30

The {BLANK} references the three main goals of information security: confidentiality, intergrity, and availability.

Answer 30

CIA Triad

Question 31

{BLANK} protects senstive information from unauthorized access.

Answer 31

Confidentiality

Question 32

{BLANK} protects information and systems from unauthorized modification.

Answer 32

Integrity

Question 33

{BLANK} ensures that authorized users have access to information when they need it.

Answer 33

Availability

Question 34

{BLANK} uses technical measures to ensure that a user is not able to later deny they took some action.

Answer 34

Non-repudiation

Question 35

Which one of the following security risks would most likely be considered an availability issue?

A. Replay attack
B. Power outage
C. Social enineering
D. Snooping

Answer 35

Power outage

Question 36

What are the three major obectives of sysbersecurity programs?

A. Confidentialy, integrity, and availability
B. Confidentialy, integrity, and authorization
C. Confidentialy, infrastructure, and availability
D. Communications, infrastructure, and authorization

Answer 36

Confidentialy, integrity, and availability