Chapter 13 Flashcards
Your company is preparing to enter into a partner relationship with another organization. It will be necessary for the information systems used by each organization to connect and integrate with each other.
Which of the following is of primary importance as you take steps to enter into this partner relationship?
Ensure that all aspects of the relationship are agreed upon in writing
Ensure that the integration process maintains the security of each organization’s network
Identify how data ownership is to be determined
Ensure that both organizations have similar incident-response procedures
Ensure that the integration process maintains the security of each organization’s network
Your organization entered into an interoperability agreement (IA) with another organization a year ago. As a part of this agreement, a federated trust was established between your domain and the partner domain.
The partnership has been in the ongoing operations phase for almost nine months now. As a security administrator, which tasks should you complete during this phase? (Select two.)
Draft an MOU document
Disable user and groups accounts used by the partner organization to access your organization’s data
Negotiate the BPO agreement
Conduct periodic vulnerability assessments
Verify compliance with the IA documents
Conduct periodic vulnerability assessments
Verify compliance with the IA documents
When you inform an employee that he or she is being terminated, which of the following is the most important activity?
Give him or her two weeks’ notice
Allow him or her to complete their current work projects
Allow him or her to collect their personal items
Disable his or her network access
Disable his or her network access
Which of the following is defined as a contract that prescribes the technical support or business parameters a provider bestows to its client?
Certificate practice statement
Final audit report
Mutual aid agreement
Service level agreement
Service level agreement
What is a service level agreement (SLA)?
A guarantee of a specific level of service.
An agreement to support another company in the event of a disaster.
A contract with an ISP for a specific level of bandwidth.
A contract with a legal entity to limit your asset-loss liability.
A guarantee of a specific level of service.
In a high-security environment, which of the following is the most important concern when removable media is no longer needed?
Labeling
Reuse
Destruction
Purging
Destruction
How often should change-control management be implemented?
Only when a production system is altered greatly.
At regular intervals throughout the year.
Only when changes are made that affect senior management.
Any time a production system is altered.
Any time a production system is altered.
Which of the following is the primary purpose of change control?
Keep senior management apprised of the organization’s state of security
Increase security
Prevent unmanaged change
Create detailed documentation
Prevent unmanaged change
Change control should be used to oversee and manage changes over which aspect of an organization?
Physical environment
Personnel and policies
Every aspect
IT hardware and software
Every aspect
Your company has developed and implemented countermeasures for the greatest risks to their assets. However, there is still some risk left. What is the remaining risk called?
Loss
Residual risk
Risk
Exposure
Residual risk
You have conducted a risk analysis to protect a key company asset. You identify the following values:
Asset value = 400
Exposure factor = 75
Annualized rate of occurrence = .25
What is the annualized loss expectancy (ALE)?
25
75
100
175
475
75
What is the average number of times that a specific risk is likely to be realized in a single year?
Annualized rate of occurrence
Estimated maximum downtime
Exposure factor
Annualized loss expectancy
Annualized rate of occurrence
When analyzing assets, which analysis method assigns financial values to assets?
Quantitative
Qualitative
Acceptance
Transfer
Quantitative
Which of the following best defines single loss expectancy (SLE)?
The total monetary loss associated with a single occurrence of a threat.
The total cost of all countermeasures associated with protecting against a given vulnerability.
The monetary value of a single employee’s loss of productivity due to a successful attack.
The statistical probability of a malicious event.
The total monetary loss associated with a single occurrence of a threat.
A file server with data is consider which of the following asset types?
Intangible
Neither tangible nor intangible
Tangible
Both tangible and intangible
Both tangible and intangible
What is the primary goal of business continuity planning?
Protect an organization from major computer services failure
Minimize the organization’s risk of service delays and interruptions
Minimize decision-making during the development process
Maintain business operations with reduced or restricted infrastructure capabilities or resources
Maintain business operations with reduced or restricted infrastructure capabilities or resources
A broken water pipe that floods the reception area would be considered which type of threat?
Disaster
Natural
External
Internal
Natural
When should a hardware device be replaced in order to minimize downtime?
Only after its first failure
Just before its MTBF is reached
Once every year
When its performance drops below 75% efficiency
Just before its MTBF is reached
Which of the following terms describes the actual time required to successfully recover operations in the event of an incident?
Maximum tolerable downtime (MTD)
Recovery time objective (RTO)
Recovery point objective (RPO)
Mean time to repair (MTTR)
Recovery time objective (RTO)
You have been receiving a lot of phishing emails sent from the domain kenyan.msn.pl. Links within these emails open new browser windows at youneedit.com.pl.
You want to make sure that these emails never reach your inbox, but you also want to make sure that emails from other senders are not affected.
What should you do?
Add msn.pl to the email blacklist.
Add kenyan.msn.pl to the email blacklist.
Add pl to the email blacklist.
Add youneedit.com.pl to the email blacklist.
Add kenyan.msn.pl to the email blacklist.
You install a new Linux distribution on a server in your network. The distribution includes a Simple Mail Transfer Protocol (SMTP) daemon that is enabled by default when the system boots. The SMTP daemon does not require authentication to send email messages.
Which type of email attack is this server susceptible to?
Viruses
Open SMTP relay
Phishing
Sniffing
Open SMTP relay
Which of the following BEST describes an email security gateway?
It provides a form of identity verification.
It requires the use of a public key certificate.
It monitors emails that originate from an organization.
It accepts mail and forwards it to other mail servers.
It monitors emails that originate from an organization.
Users in your organization receive email messages informing them that suspicious activity has been detected on their bank accounts. They are directed to click a link in the email to verify their online banking username and password. The URL in the link is in the .ru top-level DNS domain.
Which kind of attack has occurred?
Virus
Phishing
Buffer overflow
Open SMTP relay
Phishing
Which of the following BEST describes phishing?
Unwanted and unsolicited email sent to many recipients.
An email server that accepts mail and forwards it to other mail servers.
Malware that often uses email as its distribution mechanism.
A fraudulent email that claims to be from a trusted organization.
A fraudulent email that claims to be from a trusted organization.
Which of the following mechanisms can you use to add encryption to email? (Select two.)
S/MIME
PGP
HTTPS
Reverse DNS
Secure Shell
S/MIME
PGP
If an SMTP server is not properly and securely configured, it can be hijacked and used maliciously as an SMTP relay agent. Which activity could result if this happens?
Virus hoax
Salami attack
Spamming
Data diddling
Spamming
Which type of malicious activity can be described as numerous unwanted and unsolicited email messages sent to a wide range of victims?
Hijacking
Trojan horse
Spamming
Brute force
Spamming
An attacker sends an unwanted and unsolicited email message to multiple recipients with an attachment that contains malware.
Which kind of attack has occurred in this scenario?
Repudiation attack
Phishing
Open SMTP relay
Spam
Spam
