Chapter 13

Question 1

The second step in a vulnerability assessment is to determine the assets that need to be protected.

(T/F)

Answer 1

False

Question 2

Which item below is the standard security checklist against which systems are evaluated for a security posture?

a) control
b) baseline
c) profile
d) threat

Answer 2

b) baseline

Question 3

What security goal do the following common controls address: hashing, digital signatures, certificates, nonrepudiation tools?

a) safey
b) availability
c) confidentiality
d) integrity

Answer 3

d) integrity

Question 4

What is the name of the process that basically takes a snapshot of the current security of an organization?

a) risk assessment
b) threat analysis
c) threat assessment
d) vulnerability appraisal

Answer 4

d) vulnerability appraisal

Question 5

If a user uses the operating system’s “delete” command to erase data, what type of data removal procedure was used?

a) degaussing
b) purging
c) data sanitation
d) wiping

Answer 5

b) purging

Question 6

Which of the following is used to replicate attacks during a vulnerability assessment by providing a structure of exploits and monitoring tools?

a) replication image
b) penetration framework
c) assessment image
d) exploitation framework

Answer 6

d) exploitation framework

Question 7

List at least four things that a vulnerability scanner can do.

Answer 7

four things:

1) alernt when new systems are added to the network
2) detect when an application is compromised or subverted
3) detect when an internal system begins to port scan other systems
4) maintain log of all interactive network sessions

Question 8

A risk management assessment is a systematic and methodical evaluation of the security posture of the enterprise.

(T/F)

Answer 8

False

Question 9

An administrator needs to view packets and decode and analyze their contents. What type of application should the adminstrator use?

a) protocol analyzer
b) threat profiler
c) application analyzer
d) system analyzer

Answer 9

a) protocol analyzer

Question 10

A port in what state below implies that an applicatio or service assigned to that port is listening for any instructions?

a) open port
b) close port
c) interruptible system
d) empty port

Answer 10

a) open port

Question 11

At what point in a vulnerability assessment would an attack tree be utilized?

a. Vulnerability appraisal
b. Risk assessment
c. Risk mitigation
d. Threat evaluation

Answer 11

d. Threat evaluation

Question 12

Which of the following is NOT true about privacy?

a. Today, individuals can achieve any level of privacy that is desired.
b. Privacy is difficult due to the volume of data silently accumulated by technology.
c. Privacy is freedom from attention, observation, or interference based on your decision.
d. Privacy is the right to be left alone to the degree that you choose.

Answer 12

a. Today, individuals can achieve any level of privacy that is desired.

Question 13

Which of the following is NOT a risk associated with the use of private data?

a. Individual inconveniences and identity theft
b. Associations with groups
c. Statistical inferences
d. Devices being infected with malware

Answer 13

d. Devices being infected with malware

Question 14

Which of the following is NOT an issue raised regarding how private data is gathered and used?

a. The data is gathered and kept in secret.
b. By law, all encrypted data must contain a “backdoor” entry point.
c. Informed consent is usually missing or is misunderstood.
d. The accuracy of the data cannot be verified.

Answer 14

b. By law, all encrypted data must contain a “backdoor” entry point.

Question 15

Which of the following is a systematic and methodical evaluation of the exposure of assets to attackers, forces of nature, and any other entity that could cause potential harm?

a. Vulnerability assessment
b. Penetration test
c. Vulnerability scan
d. Risk appraisal

Answer 15

a. Vulnerability assessment

Question 16

Which of these should NOT be classified as an asset?

a. Business partners
b. Buildings
c. Employee databases
d. Accounts payable

Answer 16

d. Accounts payable

Question 17

Which of the following command-line tools tests a connection between two network devices?

a. Netstat
b. Ping
c. Nslookup
d. Ifconfig

Answer 17

b. Ping

Question 18

Which statement regarding vulnerability appraisal is NOT true?

a. Vulnerability appraisal is always the easiest and quickest step.
b. Every asset must be viewed in light of each threat.
c. Each threat could reveal multiple vulnerabilities.
d. Each vulnerability should be cataloged.

Answer 18

a. Vulnerability appraisal is always the easiest and quickest step.

Question 19

Which of the following constructs scenarios of the types of threats that assets can face to learn who the attackers are, why they attack, and what types of attacks may occur?

a. Vulnerability prototyping
b. Risk assessment
c. Attack assessment
d. Threat modeling

Answer 19

d. Threat modeling

Question 20

Which of the following tools is a Linux command-line protocol analyzer?

a. Wireshark
b. Tcpdump
c. IP
d. Arp

Answer 20

b. Tcpdump

Question 21

Which of the following is a command-line alternative to Nmap?

a. Netcat
b. Statnet
c. Mapper
d. Netstat

Answer 21

a. Netcat

Question 22

Which of these is NOT a state of a port that can be returned by a port scanner?

a. Open
b. Busy
c. Blocked
d. Closed

Answer 22

b. Busy

Question 23

Which of the following data sensitivity labels is the highest level of data sensitivity?

a. Ultra
b. Confidential
c. Private
d. Secret

Answer 23

b. Confidential

Question 24

Which of the following data sensitivity labels has the lowest level of data sensitivity?

a. Unrestricted
b. Public
c. Free
d. Open

Answer 24

b. Public

Question 25

Which of the following is NOT a function of a vulnerability scanner? a. Detects which ports are served and which ports are browsed for each individual system b. Alerts users when a new patch cannot be found c. Maintains a log of all interactive network sessions d. Detects when an application is compromised

Answer 25

b. Alerts users when a new patch cannot be found

Question 26

Which of the following must be kept secure as mandated by HIPAA? a. PII b. PHI c. PHIL d. PLILP

Answer 26

b. PHI

Question 27

Which statement regarding a honeypot is NOT true? a. It is typically located in an area with limited security. b. It is intentionally configured with security vulnerabilities. c. It cannot be part of a honeynet. d. It can direct an attacker's attention away from legitimate servers.

Answer 27

c. It cannot be part of a honeynet.

Question 28

Which of the following sends "probes" to network devices and examines the responses to evaluate whether a specific device needs remediation? a. Active scanner b. Probe scanner c. Passive scanner d. Remote scanner

Answer 28

a. Active scanner

Question 29

If a tester is given the IP addresses, network diagrams, and source code of customer applications, the tester is using which technique? a. Black box b. White box c. Gray box d. Blue box

Answer 29

b. White box

Question 30

If a software application aborts and leaves the program open, which control structure is it using? a. Fail-safe b. Fail-secure c. Fail-open d. Fail-right

Answer 30

c. Fail-open

Question 31

NIDS is an advanced version of NIPS. (T/F)

Answer 31

False

Question 32

The security administrator for a large organization receives numerous alerts from a network-biased intrusion detection system (NIDS) of a possible worm infection spreading through the network via network shares. Before taking any drastic action to solve this problem such as blocking file sharing, what should first be done? a) call an emergency change management meeting to ensure the solution will not have unforeseen negative affects b) block file sharing immediately because this is an emergency that could lead to a widespread data compromise c) research best practices with respet to stopping the worm and implement the solution without delay d) perform a pilot study of the solution and monitor for adverse affects e) look for a less radical solution

Answer 32

a) call an emergency change management meeting to ensure the solution will not have unforeseen negative affects

Question 33

For what purpose should the network traffic log be analyzed? a) to facilitate security management b) to capture network packets c) to check for suspicious traffic d) to check processor performance e) to store the dump file offsite

Answer 33

c) to check for suspicious traffic