Domain 4: Physical (Environment) Security Flashcards

1
Q

What is a Mantrap?

A

A Preventive physical control with two doors; each door requires a separate form of authentication to open.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a Bollard?

A

A post designed to stop a car, typically deployed in front of a building entrance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a Tailgating?

A

Following an authorized person into a building without providing credentials.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a Smart Card?

A

A physical access control device containing an integrated circuit.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the paramount concern for teh physical and environmental domain and trumps all other considerations?

A

Physical Safety of people

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the purpose of perimeter defense?

A

The help prevent, detect and correct unauthorized physical access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is defense in depth?

A

Any one defense may fail so critical assets should have multiple physical security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Name four Physical “Defense in depth” measures.

A

Fences
Doors
Walls
Locks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What tytpe of controls do fences facilitate?

A

Can range from simple deterrents to preventive devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the design purpose of a fence?

A

Design them to steer ingress and egress to controlled points

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the four Classes of Gates?

A

I: Residential (Home Use); ornamental; deterrence

II: Commercial / General Use (Parking Grarge)

III: Industrial / Limited Access (Loading dock)

IV: Restricted Access (Prison)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Where should a gate go on the perimeter?

A

Gates should be placed at controlled points at the perimeter.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How do you steer people to a gate?

A

Secure sites use fences and topography to steer traffic to these points.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What type of control is a light?

A

Detective

and

Deterrent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a lumen?

A

Lumen: the amount of light one candle creates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How did we historoically measure Light ?

A

Light was historically measured in foot candles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How is a lumen measured?

A

One lumen = on lumen per square foot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What light unit measurement is replacing the Lumen?

A

Lux

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a Lux equal to?

A

Lux = one lumen per square meter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What does CCTV stand for?

A

CCTV (Closed Circuit Television):

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What type of control is a CCTV (Closed Circuit Television)?

A

Detective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is a ;imitation of CCTV (Closed Circuit Television)?

A

Uses the normal light spectrum and requires sufficient visibility to illuminate the field of vision

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What type of CCTV (Closed Circuit Television) system allows you to see in the dark by seeing heat

A

Infrared

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Older tube cameras in CCTV (Closed Circuit Television) systems are analog or digital?

A

Analog

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

MModern CCTV (Closed Circuit Television) systems use what kind of cameras?

A

Digital Charged Couple Discharge cameras

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What does the acronym, CCD, stand for in regard to CCTV (Closed Circuit Television) systems?

A

Charged Couple Discharge cameras which are digital

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What does the mechanical irise in a cmera do?

A

Act as human irises; controlling the amount of light that enters the lens by changing the size of the aperture.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Is the aperture larger or smaller at low light conditions?

A

The aperture is larger at low light conditions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

In regards to CCTV systems, what is Depth of Field?

A

Depth of Field: the area in focus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

In regards to CCTV systems, what is Field of View?

A

Field of View: the entire area viewed by the camera

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

In regards to CCTV systems, what does more light make possible?

A

Smaller aperture

Larger Depth of Field (more of the image in focus)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

In regards to CCTV systems, how does low light affect the system?

A

Wide aperture used is low light conditions

lowers depth of field (smaller area of focus)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

In regards to CCTV systems, what does Pan do?

A

Pan: move horizontally

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

In regards to CCTV systems, what does Tilt do?

A

Tilt: move vertically

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

In regards to CCTV systems, what are the three typical views you can get?

A

Fixed: one camera

Autoscan: show one for a few seconds and then show a different camer

Multiplexing: multiple camera feeds on one display

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

In regards to CCTV systems, what are the three typical vstorage systems?

A

Magnetic Tape (VHS) for tube cameras

DVR (Digital Video Recorder) for digital cameras

NVR (Network Video Recorder)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

In regards to CCTV systems, what does DVR stand for?

A

DVR (Digital Video Recorder) for digital cameras

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

In regards to CCTV systems, what does NVR stand for?

A

NVR (Network Video Recorder)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

In regards to CCTV systems, what is the advantage of DVR (Digital Video Recorders) over NVRs (network Video Recoders)?

A

NVR has the advantage for centralized storage of all video.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is the difference between CRTs (Cathode Ray Tube) cameras and CRT displays.

A

CRT Tube Cameras are older model cameras and CRT displays project images on a screen.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What type of control is a lock?

A

Preventative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Name the three types of locks.

A

Mechanical

Electronic

Combination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is one limitation to key locks?

A

Keys can be shared or copied which lowers the accountability of key locks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

How does a key lock work?

A

Inserting the correct key makes the pins align with the Shear Line allowing the lock tumbler (Plug) to turn.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

How does a warded lock work?

A

Uses a set of obstructions, or wards,

to prevent the lock from opening unless the correct key is inserted.

The correct key has notches or slots corresponding to the obstructions in the lock, allowing it to rotate freely inside the lock.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is a limitation to a warded lock?

A

a well-designed skeleton key can successfully open a wide variety of warded locks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

How does a Spring Bolt / Dead Bolt lock work?

A

A locking mechanism that automatically “springs” in and out of the strike plate of the door jamb.

A locking mechanism that mechanically rotates in and out of the strike plate of the door jamb.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

With a spring bolt exposed, can you close the door?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

With a dead bolt exposed, can you close the door?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What is lock picking?

A

The art of opening a lock without a key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

How are lock picks used?

A

Lock Picks can be used to lift the pins in a pin tumbler lock

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is lock Bumping:?

A

Lock Bumping: Use a shaved down key that will fit into the lock. Attacker fits the key into the lock and whacks it a few times to cause the pins to jump and the attacker quickly turns the key and opens the lock.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

can all locks be picked or bumped?

A

All locks can be picked or bumped. The question is how long will it take.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What is a Master Key?

A

The master key opens all locks in a given zone.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is a Core Key?

A

The core key is used to remove the lock core in interchangeable locks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Name three controls you can use to protect the Master Key and the Core Key.

A

1: Keep the key in a secure place
2: Only allow a few critical employees access
3: Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Name four limitations to combination locks?

A

1: Limited accountability due to shared combinations.
2: Prolonged use of Buttons or keypads can cause wear on the most used buttons.
3: Prone to brute force attack
4: Prone to shoulder surfing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Name three uses for Smart Cards?

A

1: Keys for electronics locks
2: credit card purchases (many international cards)
3: Dual-factor authentication systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What does the “Smart” mean in Smart Cards?

A

“Smart” means that card contains a computer circuit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What is another name for Smart Cards?

A

Also called Integrated Circuit cards (ICC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

IN regards to Smart Cards, what does ICC stand for?

A

Integrated Circuit cards (ICC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

In regards to Smart Cards, what are two methods for communicating witht electronic locks ?

A

1: Contact (where the card must be inserted)
2: Contactless (wirelessly)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

In regards to Contactless Smart Cards, what is one technology example?

A

Radio Frequency Identification (RFID)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

In regards to Contactless Smart Cards, how does Radio Frequencey Identification (RFID) work?

A

1: Cards contain RFID Tags (Transponders)
2: Read by RDIF transceivers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What are Smart Cards used for?

A

Used in combination electronic locks to provide physical access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Whay are Smart Cards better than mechanical locks?

A

better then mechanical locks because of audit capability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What is the difference between a Smart Cards and a Magnetic Stripe card?

A

The stripe in a magnetic stripe card is passive; read only.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

In regard to Smart Card systems. what is the Common Access Card (CAC)?

A

A multipurpose Smart Card deployed by the US Department of Defense.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

In regard to Smart Card systems. what does CAC stand for?

A

Common Access Card

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

In regard to Smart Card systems. name the three functions of the DOD Common Access Card

A

1: physical access control
2: dual-factor authentication
3: Digitally signing documents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

In regard to Smart Card systems. how does the DOD Common Access Card work?

A

Stores cryptographic certificates as part of the DOD’s Public Key Infrastructure (PKI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

What is Tailgating/Piggybacking

A

An unauthorized person follows an authorized person into the building after the authorized person unlocks the door.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

In regards toTailgating/Piggybacking, what is one example of using Social Engineering to improve the success rate?

A

Added social engineering element (carrying large boxes) may aid the attacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

What type of control is a Mantrap?

A

A preventive physical control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

What is a Mantrap?

A

A preventive physical control with two doors.

The first door must close and lock before the second door can open

Each door requires a separate form of authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

What is a turnstile designed to do?

A

Designed to prevent tailgating

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

What is the most important design characteristics in a turnstile and a mantrap?

A

Both must be designed to allow safe egress during emergencies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Name two things that you can use Contraband Checks for

A

Used to detect incoming metals, weapons, explosives and illegal drugs.

Used to detect outgoing sensitive data

Example: Port Blocking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

In regards to motion detectors, how do Ultrasonic and Microwave systems work

A

like Doppler radar

A wave of energy is sent out and the echo is returned. If an echo returns more quickly then it normally does, that indicates something has stepped in front of the sensor.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

In regards to motion detectors, how does Photoelectric systems work?

A

Sends a beam of light across a monitored space to a sensor. If the beam is broken, the sensor alerts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

In regards to motion detectors,

What is the common characteristic of Ultrasonic, Microwave and Photoelectric sensors

A

They are all active sensors; they actively send energy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

In regards to motion detectors,

What is one example of a passive sensor?

A

Passive Inared (PIR): detects energy created by the human body.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

In regards to motion detectors,

What does PIR stand for?

A

Passive Inared (PIR): detects energy created by the human body.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

In regards to motion detectors,

What is the difference between physical intrusion detection and network intrusion detection?

A

Motion Detectors provide physical Intrusion Detection.

Network Intrusion Detection detect attacks on the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

In regards to perimeter alarms,

How doe Magnetic door and window alarms work?

A

They include matched pairs of sensors on the device that an electric circuit flows through. If the circuit is broken, the alarm sounds.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

In regards to perimeter defense of doors,

Name five design charateristics

A

1: Door hinges should face inward
2: Egress must be unimpeded during emergencies
3: No gaps in the door
4: Doors with motion sensors should not have mail slots
5: Externally-facing emergency doors should be marked for Emergency Use Only and equipped with panic bars that alarm if anybody opens them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

In regards to perimeter defense of Walls and Ceilings,

Name four design charateristics

A

1: Internal motion sensors should be bolted securely to a fixed sturdy ceiling or wall to prevent an attacker to cause it to move
2: Should be slab-to-slab.
3: Should be strong enough to resist cutting (Sheetrock – gypsum can be easily cut)

4; Fire Rating: The amount of time required to fail due to a fire not less than one hour

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

In regards to perimeter defense of glass windows and doors,

what type of control should be in place?

A

compensating control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

In regards to perimeter defense of glass windows and doors,

Name five types of compensating control materials that you might consider

A

1: Bullet proof
2: Explosive-resistant
3: Wire mesh
4: Polycarbonate (Lexan)
5: Acrylic (Plexiglass)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

In regards to perimeter defense of glass windows and doors,

Name five types of compensating control materials that you might consider

A

1: Bullet proof
2: Explosive-resistant
3: Wire mesh
4: Polycarbonate (Lexan)
5: Acrylic (Plexiglass)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

In regards to perimeter defense of Walls and Ceilings,

what is a fire rating?

A

The amount of time required to fail due to a fire

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

In regards to perimeter defense of Walls and Ceilings,

what is The National Fire Protection Agency (NFPA) 75?

A

Standard for the Protection of Information Technology Equipment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

In regards to perimeter defense of Walls and Ceilings,

what is the Standard for the Protection of Information Technology Equipment

A

The National Fire Protection Agency (NFPA) 75

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

In regards to perimeter defense,

what are the six Access Control types?

A

1: Preventive
2: Detective
3: Corrective
4: Recovery
5: Deterrent
6: Compensating

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

In regards to perimeter defense,

name four things that a guad does

A

1: Inspection of Access Credentials
2: Monitoring of CCTVs
3: Monitoring of Environmental Controls
4: Incident response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

In regards to perimeter defense,

what is the difference between a d professional guard and a non-professional guard?

A

Professional Guards have attended advanced training

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

In regards to perimeter defense,

what is Pseudo Guard?

A

Pseudo Guard means an unarmed guard.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

In regards to perimeter defense,

how do you ensure that teh guard is doing what needs to be done?

A

Guard orders should be complete and clear and trained routinely.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

In regards to perimeter defense,

what is a guard dog good for?

A

Perimeter Defense guarding rigid turf.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

In regards to perimeter defense,

what type of control is a guard dog ?

A

Deterrent and Detective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

In regards to perimeter defense,

what is a risk to using guard dogs?

A

Legal Liability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

In regards to perimeter defense,

name two methods of restricting areas

A

1: Areas may be restricted by space (authorized personnel Only)
2: Areas may be restricted by time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

In regards to perimeter defense,

name three examples of how to restrict by time

A

1: Electronic badges automatically expire
2: Printing the valid date in bold on the badge
3: Using different colored badges for different days of the week

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

When building a secure facility, what are the three steps?

A

1: Site Selection
2: Design
3: Configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

What is the most important characteristic to remember when building a secure facility?

A

Physical safety of personnel is the top priority for every decision.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

In regards to Site Selectrion Issues,

what does greenfield mean?

A

(undeveloped land) process of choosing a site to construct a building.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

In regards to Site Selectrion Issues,

what does topography mean?

A

The physical shape of the land.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

In regards to physical securityi design Issues,

name two things you can use topography for?

A

1: Steer ingress and egress to controlled points
2: Alter the topography as a defensive measure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

In regards to physical securityi configuration Issues,

name two things you can to conrol for power outages

A

1: Uninterruptable Power supplies for short term power failure
2: Generators for longer term power failure.

110
Q

In regards to physical securityi design Issues,

should you consider crime rates?

A

yes

111
Q

In regards to physical securityi design Issues,

can design compensate for poor site selection?

A

No

112
Q

In regards to physical security design Issues,

should you externally mark your data center or make it obvious who owns it and what the purpose of the facility is?

A

No

113
Q

In regards to physical security design Issues,

Why is shared tanancy a problem?

A

Weakens your defenses because you are that mercy of your neighbor.

114
Q

In regards to physical security design Issues,

name three specific weknesses for for shared tanancy relatinship.

A

1: Shared Wall may act as a launch point to attack critical areas.
2: Wireless attacks and wireless interference.
3: Shared Demarc

115
Q

In regards to physical security design Issues,

What is a Shared Demarc?

A

Most buildings have one entry point where power and internet come into the building.

116
Q

In regards to physical security design Issues,

What is the main problem with Shared Demarcs?

A

Access to the Demarc areas allows attacks on CIA of all circuits.

117
Q

In regards to physical security design Issues,

Name three controls to deploy for Shared Demarcs?

A

1: Strong physical access control including authenticating and authorizing all access.
2: Accountability controls should be built to reconstruct any event.
3: For very secure sites, construct multiple segregated demarks.

118
Q

In regards to system defense Issues,

assuming the attacker has physical access to a device, what controls can you deploy to mitigate the risk?

A

1: Asset Tracking
2: Port Controls
3: Drive and Tape Encryption
4: Offsite Media Storage
5: Media Cleaning and Destruction

119
Q

In regards to system defense Issues,

name three characteristics of a detailed asset tracking system

A

1: Support regulatory compliance by identifying where all regulated data is in a system.
2: Show exactly where equipment and data resides for Terminated employees
3: Track serial numbers and model numbers

120
Q

In regards to system defense Issues,

when should you encrypt data?

A

Recommended for all mobile and media containing sensitive information which may leave a site

May also be used for static systems which do not move.

121
Q

In regards to system defense Issues,

why is Whole-disk encryption for mobile device hard drives recommended?

A

Partially encrypted solutions, Encrypted File Folders or partitions often run the risk of exposing sensitive data stored in temp files.

122
Q

In regards to system defense Issues,

Can Disk encryption can occur in hardware and software

A

Yes

123
Q

In regards to system defense Issues,

Why is encrypting PII a good idea?

A

Many breach notification laws concerning PII contain exclusions for lost data that is encrypted.

124
Q

In regards to system defense Issues,

Is encrypting only a good idea for certain industries?

A

No - it is critical to highlight the importance of encrypting PII on mobile devices regardless of industry.

125
Q

In regards to system defense Issues,

where should you store backups of sensitive data

A

offsite

126
Q

In regards to system defense Issues,

If you outsource Media Storage and Transportation, Name two characteristics that the firm should posess

A

1: Bonded and insured
2: Emploies secure vehicles and secure facilities.

127
Q

In regards to system defense Issues,

What is a key characteristic of an offsite storage location?

A

Ensure the storage site is will not be impacted by the same disasters as the primary site.

128
Q

In regards to system defense Issues,

What is Media Cleaning and Destruction?

A

Prevent Object Reuse by securely cleaning or destroying all forms of media.

129
Q

In regards to system defense Issues,

What types of Media need Cleaning and Destruction?

A

physical (paper) or electronic.

130
Q

In regards to system defense Issues,

What is Dumpster Diving?

A

Dumpster Diving is searching for information by rummaging through unsecured trash.

131
Q

In regards to system defense Issues,

Should Media Cleaning and Destruction follow a formal policy?

A

Yes

132
Q

In regards to system defense Issues,

During Media Cleaning and Destruction activities, name 4 items to track in order to Document all activity?

A

1; Log serial numbers of any hard drives,

2: Log the data they contained
3: Log the date of cleaning or destruction
4: Log the name of the person performing these actions.

133
Q

In regards to system defense Issues,

What does a paper shredder do?

A

Cuts paper to prevent reuse

134
Q

In regards to system defense Issues,

What does a Strip-Cut paper shredder do?

A

cuts paper into vertical strips

135
Q

In regards to system defense Issues,

What does a Cross-Cut paper shredder do?

A

cuts bot horizontally and vertically.

136
Q

In regards to system defense Issues,

What is more secure: a Cross-Cut paper shredder or a Strip-Cut paper shredder?

A

Cross-Cut paper shredder

137
Q

In regards to system defense Issues,

Are paper shredders guarnateed to prevent reuse?

A

No - Given enough time, attackers can recover shredded documents.

138
Q

In regards to system defense Issues,

Does deleting a file destroy the infomration completely?

A

No - Deleting a file removes the entry from the File Allocation Table (FAT) and marks the data blocks as unallocated, but the data is still there until overwritten.

139
Q

In regards to system defense Issues,

Does Reformatting a disk destroy the infomration completely?

A

No - Reformatting a disk destroys the old FAT and replaces it with a new one, but the data is still there.

140
Q

In regards to system defense Issues,

what is Data Remanence

A

Data Remanence: there are “remnants “of data left behind.

141
Q

In regards to system defense Issues,

what is Overwriting?

A

Overwriting writes over every character of a file or an entire disk drive.

142
Q

In regards to system defense Issues,

what is Electronic Shredding?

A

Electronic Shredding (Wiping) overwrites the file’s data before removing the FAT entry.

143
Q

In regards to system defense Issues,

what is another name for Electronic Shredding?

A

Wiping

144
Q

In regards to system defense Issues,

Are there any known commercial tools which can recover data overwritten in a single pass.

A

No - There are no known commercial tools which can recover data overwritten in a single pass.

145
Q

In regards to system defense Issues,

What are two limitation to overwriting media?

A

1: You cannot tell if a drive has been securely overwritten by looking at it. Errors made during the process can lead to data loss.
2: It also may be impossible to overwrite damage media.

146
Q

In regards to system defense Issues,

What are Degaussing and Destruction controls used for?

A

Controls used to prevent object reuse attacks against magnetic media such as magnetic tape and disk drives.

147
Q

In regards to system defense Issues,

How does Degaussing work?

A

Destroys the integrity of the magnetic media by exposing them to s a strong magnetic field; usually so damaged that a drive can no longer be formatted.

148
Q

In regards to system defense Issues,

How does Destruction work?

A

Destroys the integrity of the media by physically destroying the media itself.

149
Q

In regards to system defense Issues,

Name three methods of Destruction

A

1: Incineration
2: Pulverizing
3: Acid baths

150
Q

In regards to system defense Issues,

Name two reasons why destruction is better than overwriting

A

1: It may not be possible to overwrite damaged media
2: Some magnetic media can only be written once

151
Q

What is the primary purpose of environmental controls?

A

Designed to provide a safe environment for personnel and equipment.

152
Q

In terms of environmental controls

Name the three primary controls.

A

1: Power
2: HVAC
3: Fire Safety

153
Q

In terms of environmental controls

What is the Top priority for any data center (Selecting, building and designing)

A

Power

154
Q

In terms of environmental controls

Name the six types of Electrical Faults.

A

1: Blackout: Prolonged Loss of Power
2: Brownout: Prolonged Low Voltage
3: Fault: Short Loss of Power
4: Surge: Prolonged High Voltage
5: Spike: Temporary high coltage
6: Sag: Temporary low voltage

155
Q

In terms of environmental controls

What is a Blackout?

A

Prolonged Loss of Power

156
Q

In terms of environmental controls

What is a Brownout?

A

Prolonged Low Voltage

157
Q

In terms of environmental controls

What is a Fault?

A

Short Loss of Power

158
Q

In terms of environmental controls

What is a Surge?

A

Prolonged High Voltage

159
Q

In terms of environmental controls

What is a Spike?

A

Temporary high Voltage

160
Q

In terms of environmental controls

What is a Sag?

A

Temporary low voltage

161
Q

In terms of environmental controls

Electrical Faules affect which compponents of Confidentiality - Integrity - Availability (CIA)

A

Confidentiality - Integrity

162
Q

In terms of environmental controls

What are the names for the two power loss electrical faults (Short and Prolonged)

A

1: Blackout: Prolonged Loss of Power
2: Fault: Short Loss of Power

163
Q

In terms of environmental controls

What are the names for the two low voltage electrical faults (Temporary and Prolonged)

A

1: Brownout: Prolonged Low Voltage
2: Sag: Temporary low voltage

164
Q

In terms of environmental controls

What are the names for the two high voltage electrical faults (Temporary and Prolonged)

A

1: Surge: Prolonged High Voltage
2: Spike: Temporary high Voltage

165
Q

In terms of environmental controls

What do Surge Protectors, UPSs and Generators do?

A

Provide protection against electrical failures.

166
Q

In terms of environmental controls

What does a Surge Protectors do?

A

Protects equipment from damage due to electrical surges

167
Q

In terms of environmental controls

How does a surge protector work?

A

Contains a circuit or fuse which is tripped during a power spike or surge shorting the power or regulating it down to acceptable levels

168
Q

In terms of environmental controls

what does UPS stand for?

A

Uninterruptible Power Supplies

169
Q

In terms of environmental controls

Name three things that a UPS does?

A

1: Provide temp backup power in the event of a power outage
2: May also clean the power protecting against spikes and surges and other faults
3: Can be used to bridge to generator power

170
Q

In terms of environmental controls

How does a UPS work?

A

Power is provided by battery or fuel cells

171
Q

In terms of environmental controls

What is a limitation to a UPS?

A

Provides power for a limited time

172
Q

In terms of environmental controls

What does a Generators do?

A

Provides power for longer outages and will run as long as fuel is available.

173
Q

In terms of environmental controls

Name five design characteristics to deploy a generator

A

1: Store fuel onsite for the period the generator is expected to run
2: Refueling strategies should consider a disaster’s effect on fuel supply and delivery
3: Always place generators above potential floodwaters
4: Make every effort to place them in areas unlikely to be impacted by other natural disasters.
5: Make sure you do the maintenance before the disaster.

174
Q

In terms of environmental controls

What is EMI (Electromagnetic Interference)

A

Electricity generates magnetism so any electrical conductor emits EMI.

175
Q

In terms of environmental controls

What does EMI stand for?

A

Electromagnetic Interference

176
Q

In terms of environmental controls

Name three cable types that EMI affects?

A

1: Circuits
2: Power Cables
3: Network Cables

177
Q

In terms of environmental controls

What is crosstalk?

A

Poorly shielded or run too close together can cause crosstalk where magnetism form one cable crosses over to the other

178
Q

In terms of environmental controls

Which compnents of Confidentiality - Integrity - Availability (CIA) does crosstalk affect?

A

Confidentiality

Integrity

179
Q

In terms of environmental controls

Name two mitigation controls for crosstalk

A

1: Never route power cables close to network cables
2: Cable choice matters

180
Q

In terms of environmental controls

Name four types of network cable

A

1: Unshielded twisted pair (UTP)
2: Shielded Twisted Pair (STP) or
3: coaxial cable
4: Fiber Optic Cable

181
Q

In terms of environmental controls

Of the four types of network cable, which one is not affected by EMI?

A

Fiber Optic Cable

182
Q

In terms of environmental controls

What does HVAC stand for?

A

Heating, ventilation and Air Conditioning

183
Q

In terms of environmental controls

What do HVAC systems do?

A

Controls that keep the air at a reasonable temp and humidity.

184
Q

In terms of environmental controls

How do HVAC systems work?

A

Closed loop; recirculating treated air; helps to reduce dust and other airborne contaminants

185
Q

In terms of environmental controls

What do Positive Pressure Drains do?

A

Air and water are expelled from the building.

186
Q

In terms of environmental controls

Name two charateristics of Positive Pressure Drains

A

1: Untreated air should never be inhaled into the building
2: Water should drain away from the building

187
Q

In terms of environmental controls

What is a comon malfunction to a Positive Pressure Drain system?

A

Condensation water pooling into the building often going under raised floors undetected.

188
Q

In terms of environmental controls

What should you document for a Positive Pressure Drain system?

A

Document the Location of all gas, water and positive drains

189
Q

In terms of environmental controls

What are HVAC systems designed to do?

A

HVAC units are designed to maintain optimum heat and humidity levels for computers.

190
Q

In terms of environmental controls

What is the recommneded hummidity level for a data center?

A

40-55%

191
Q

In terms of environmental controls

What is the recommneded Set Point Temp for a data center?

A

68-77 Degrees F

20-25 Degrees C

192
Q

In terms of environmental controls

What causes static?

A

Low humidity

193
Q

In terms of environmental controls

What is static?

A

an electrical discharge to balance a positive and a negative electrical imbalance

194
Q

In terms of environmental controls

Why is static a problem for datacenters?

A

Sudden static discharge can cause damage to computer equipment

195
Q

In terms of environmental controls

Name five mitigation controls to reduce the risk of static.

A

1: Proper humidity
2: Proper grounding
3: Anti-static sprays
4: Wrist straps
5: Work Surfaces

196
Q

In terms of environmental controls

Why is high humidity a problem in datacenters?

A

High Humidity may cause water in the air to condense onto and into equipment causing corrosion. Mitigate with

197
Q

In terms of environmental controls

How do you mitigate the risk of high humidity in datacenters?

A

proper humidity controls

198
Q

In terms of environmental controls

What are the two risks of Airborne Contaminants to datacenters?

A

1: Built up dust can cause overheating and static buildup.
2: Other contaminants can cause corrosion or damaging chemical reactions

199
Q

In terms of environmental controls

Name two controls to mitigate the risk of Airborne Contaminants in a datacenters?

A

1: HVAC: Positive pressure keeps untreated air from entering the system
2: HEPA (High Efficiency Particulate Air) Filters in the HVAC system.

200
Q

In terms of environmental controls

What does HEPA stand for?

A

HEPA (High Efficiency Particulate Air)

201
Q

In terms of environmental controls

What are the three detectors of fire?

A

1: Heat
2: Flame
3: Smoke Detectors

202
Q

In terms of environmental controls

How does a heat detector work?

A

May trigger when a specific temp is exceeded or when the temp change rate increases.

203
Q

In terms of environmental controls

How does a flame detector work?

A

Detects infrared or ultra-violet light emitted in fire.

204
Q

In terms of environmental controls

What is a limitation to flame detectors?

A

Drawback: require line-of-sight to detect; smoke alarms to don’t have this limitation.

205
Q

In terms of environmental controls

What are the two types of smoke alarms?

A

1: Ionization
2: Photoelectric

206
Q

In terms of environmental controls

How do both Ionization and Photoelectric fire alrms work?

A

Both alarm when smoke interrupts the radioactivity of light, lowering or blocking the electric charge.

207
Q

In terms of environmental controls

How does the Ionization Smoke Alarm generate an electrical charge?

A

Ionization-based smoke detectors contain a small radioactive source which creates a small electrical charge.

208
Q

In terms of environmental controls

How does the Photoelectric Smoke Alarm generate an electrical charge?

A

Photoelectric-based smoke detectors contain an LED (Light Emitting Diode) and a photoelectric sensor that generates a small charge when receiving light.

209
Q

In terms of environmental controls

Is either the Photoelectric Smoke Alarm or the Ionization Smake alarm better then the other?

A

No

210
Q

In terms of environmental controls

What is one limitation to smoke alarms?

A

Excessive dust may cause smoke alarms to alert.

211
Q

In terms of environmental controls

Name two ways that a Fire Detector alarms

A

1: Locally
2: Centrally monitored by a fire alarm system.

212
Q

In terms of environmental controls

Why would a Fire Detector use an audible alarm as well as flashing lights

A

in order to warn deaf and blind people

213
Q

In terms of environmental controls

What is the difference between Safety Training and Safety Awareness

A

Training teaches new skill sets.

Awareness changes behavior

214
Q

In terms of environmental controls

Why is Physical security training and awareness critical

A

because of the possible stakes: injury or loss of life.

Safety is the primary goal of all physical security controls.

215
Q

In terms of environmental controls

What are two key characteristics for all Evacuation Routes

A

1: Establish meeting points where all people meet in the event of an emergency. These are critical so that people do not go back into a dangerous situation to rescue somebody who is actually safe at another location.
2: Special care should be given to any personnel with handicaps.

216
Q

In terms of Evacuation Roles and Procedures

What does the Safety Warden do?

A

Ensures that all personnel safely evacuate the building in the event of an emergency or drill.

217
Q

In terms of Evacuation Roles and Procedures

What does the Meeting Point Leader do?

A

Ensures that all personnel are accounted for.

218
Q

In terms of ABCD Fires and Suppression

What does this symbol mean and how do you extinguish these kinds of fires?

A

Class A: Ordinary Combustibles

Common combustibles such as wood and paper

Most Common

Extinguished with water or soda acid.

219
Q

In terms of ABCD Fires and Suppression

What does this symbol mean and how do you extinguish these kinds of fires?

A

Class B: Flammable Liquids

Burning alcohol, oil or other petroleum products such as gasoline.

Extinguished with gas or soda acid; never water.

220
Q

In terms of ABCD Fires and Suppression

What does this symbol mean and how do you extinguish these kinds of fires?

A

Class C: Electrical Equipment

Electrical fires occur in equipment or wiring

Conductive fires

Extinguishing agent must be non-conductive (any type of gas) but not soda acid (soda acid can conduct electricity.

221
Q

In terms of ABCD Fires and Suppression

What does this symbol mean and how do you extinguish these kinds of fires?

A

Class D: Combustible Metals

Extinguish with dry powder

222
Q

In terms of ABCD Fires and Suppression

What is a Class K Fire and how do you extinguish these kinds of fires?

A

Class K: Kitchen Fires

Burning Oil or grease

Extinguish with wet chemicals

223
Q

In terms of ABCD Fires and Suppression

What are the differences between the US and European coding scheme

A

A - B - D are the Same

Ordinary - Liquid - Combustable Metals

US uses B for Liquids and flammable gases

Euro use B for Liquids and C for flammable gases

US uses C for Electrical

Euro uses E for Electrical

US uses K for Kitchens

Euro uses F for Kitchens

224
Q

In terms of ABCD Fires and Suppression

When choosing a Fire suppression agent, what is the one thing you should always do?

A

Always consult local fire code before implementing a fire suppression system.

225
Q

In terms of ABCD Fires and Suppression

What is preferred: preventing a fire over extinguishing one.

A

preventing a fire

226
Q

In terms of ABCD Fires and Suppression

What are the four methods to suppress a fire?

A

1: Fire Temperature Reduction
2: Oxygen supply reduction
3: Fuels reduction
4: Chemical Interference

227
Q

In terms of ABCD Fires and Suppression

What is is usually the recommended fire suppression agent , in the absence of electricity, and is the safest for people.

A

Water

228
Q

In terms of ABCD Fires and Suppression

How does water suppress fire?

A

Suppresses fire by lowering the temperature below the Kindling Point (Ignition Point)

229
Q

In terms of ABCD Fires and Suppression

Besides lower the fire temp, what else does a Sprinkler Systems do?

A

Alerts people to evacuate.

230
Q

In terms of ABCD Fires and Suppression

What is the primary goal of fire safety.

A

Safe Evacuation

231
Q

In terms of ABCD Fires and Suppression

What is a Wet Pipe?

A

water right up to the sprinkler heads.

232
Q

In terms of Fire Suppression

What is a bulb?

A

Each head will open independently as the trigger temp is exceeded.

233
Q

In terms of Fire Suppression

What do the Different bulb colors indicate?

A

Different colors to indicate ceiling temp trigger

Orange: (135 F / 57 C)
Red: (155 F / 68 C)
Yellow: (175 F / 79 C)
Green: (200 F / 93 C)
Blue: (286 F / 141 C)

234
Q

In terms of Fire Suppression

What Dry Pipe?

A

Filled with compressed air.

Water held back by a valve that remains closed as long as sufficient air pressure exists.

Used in areas where water may freeze like parking garages.

235
Q

In terms of Fire Suppression

What is a deluge?

A

Deluge: Similar to dry pipes except that the sprinkler heads are larger

236
Q

In terms of Fire Suppression

What is a Pre-Action?

A

A combination of wet, dry or deluge systems and require two separate triggers to release water.

Can be single interlock systems or double interlock systems .

237
Q

In terms of Fire Suppression

What is a Single interlock system?

A

Single interlock systems release water into the pipes when a fire alarm triggers. The water releases when the heads open.

238
Q

In terms of Fire Suppression

What is a Double interlock system?

A

Double interlock systems use compressed air (like dry pipes). The water will not enter the system until both the fire alarm triggers and the sprinkler head opens.

239
Q

In terms of Fire Suppression

Name two reasons to use a pre-action system?

A

1: In areas where water may freeze like parking garages.
2: In areas where accidental discharge is costly like museums.

240
Q

In terms of Fire Suppression

How does a Soda Acid Fire Suppression system work?

A

Lowers Fire Temp

Used in Class A Fires

Pressurized cylinders filled with Sodium Bicarbonate and water.

A glass vial of acid suspened at the top.

Break the vial and mix the acid with the liquid causes a chemical reaction that would create gas pressurizing the cylinder.

Also creates a foam that float on the surface of some liquid fires and starves the oxygen supply.

241
Q

In terms of Fire Suppression

How does a Dry Powder Fire Suppression system work?

A

Lowers Fire Temp

Used in Class D Fires (combustable metals)

Usually made of Sodium Chloride

242
Q

In terms of Fire Suppression

What are two typical flammable metals?

A

1: Sodium
2: Magnesium

243
Q

In terms of Fire Suppression

How does a Wet Chemical fire suppression system work?

A

Lowers Fire Temp

Used in Class D/F Fires (Kitchen Fires)

Also work on common combustible fires.

Usually Potassium Acetate mixed with water

Covers the grease or oil with a soapy film

244
Q

In terms of Fire Suppression

How does a Halon or Halon Substitutesl fire suppression system work?

A

Lowers Fire Temp

Used in Class B/B, B/C and C/E Fires (Liquid, Flmamable Gases and Electrical Equipment)

Many believe they work like CO2 and extinguish the fire through oxygen starvation. This is a secondary affect and minor.

These systems are designed to allow enough oxygen to support human life.

245
Q

In terms of Fire Suppression

What is the 1989 Montreal Accord (Protocol)?

A

Montreal Protocol on Substances that deplete the Ozone Layer.

Halon has ozone-depleting properties.

Developed countries agreed to ban production and consumption of new halon by 1 Jan 1994.

Existing systems could be used.

Re-cycled halon can also be used.

246
Q

In terms of Fire Suppression

Why are Halon systems no longer being used?

A

No longer recommended due to their age; any existing system is over 15 years old. There are better substitutes.

247
Q

In terms of Fire Suppression

Name four Halon replacements

A

1: Argon
2: FE-13: Newest and safest; can be breathed in concentrations as high as 30%. Others only 10-15%.
3: FM-200
4: Inergen

248
Q

In terms of Fire Suppression

What is the newest and safest Halon Substitute?

A

FE-13: Newest and safest; can be breathed in concentrations as high as 30%. Others only 10-15%.

249
Q

In terms of Fire Suppression

How does CO2 work?

A

Reduces Oxygen supply

Used in Class B/C and C/E Fires (Liquid, Flmamable Gases and Electrical Equipment)

250
Q

In terms of Fire Suppression

What is a countdown timer?

A

Count-Down Timers: Visible and Audible timer before gas-based systems are released to allow for personnel evacuation or to stop the release in time due to false alarm.

251
Q

In terms of Fire Suppression

What is the risk to using CO2?

A

Risk: Odorless and colorless; humans can suffocate if they are exposed to too much.

Recommended only for areas that have no humans.

Any human entering a CO2 should be trained and probably should use oxygen tanks.

252
Q

In terms of Fire Suppression

True or False: All Environmental controls and safety procedures must ensure that the safety of all personnel, including those with handicaps.

A

True

253
Q

In terms of Fire Suppression

True or False: Always consider “Hire an Expert” as a valid choice.

A

True

254
Q

In terms of Fire Suppression

True or False: The safest answer is always the best answer.

A

True

255
Q

In terms of Fire Suppression

True or False: The most legal answer is always the best answer.

A

True

256
Q

In terms of Fire Suppression

True or False: The most ethical answer is always the best answer.

A

True

257
Q

In terms of Fire Suppression

True or False: TThe fairest answer is always the best answer.

A

True

258
Q

Low humidity in a data center can cause what problem?

A: Corrosion
B: Airborne Contaminant
C: Heat
D: Static Electricity

A

D: Static Electricity

259
Q

2: What should not be used to extinguish a Class C (US) Fire?

A: Soda Acid
B: CO2
C: Inergen
D: FE-13

A

A: Soda Acid

260
Q

3: What is the primary drawback in using dogs as a perimeter control?

A: Training
B: Cost
C: Liability
D: Appearance

A

C: Liability

261
Q

4: What type of network cable should be used to eliminate the chance of crosstalk?

A: Shielded Twisted pair
B: Unshielded Twisted Pair
C: Coaxial
D: Fiber Optic

A

D: Fiber Optic

262
Q

5: Which of the following is an administrative control

A: Locks
B: Asset Tracking
C: Biometrics
D: Fire Alarms

A

B: Asset Tracking

263
Q

6: Which halon replacement is considered the safest, breathable in concentration up to 30%

A; Inergen
B: FE-13
C: Fm-200
D: Argon

A

B: FE-13

264
Q

7: What is the most important goal of fire suppression systems?

A: Preservation of critical data
B: Safety of personnel
C: Building Integrity
D: Quickly extinguishing a fire

A

B: Safety of personnel

265
Q

8: EMI issues such as crosstalk primarily impact which aspect of security?

A: Confidentiality
B: Integrity
C: Availability
D: Authentication

A

B: Integrity

266
Q

9: What is the recommended agent for extinguishing a kitchen grease fire?

A: Dry Powder
B: Soda Acid
C: Wet Powder
D: Wet Chemical

A

D: Wet Chemical

267
Q

10: What is the most important step to perform while selecting a fire suppression system?

A: Industry research
B: Visit sites with controls you are considering
C: Have an expert consult local fire codes
D: call your insurance company

A

C: Have an expert consult local fire codes

268
Q

11: A CRT device is different from a CCD device in what way?

A: A CRT is an analog display; a CCD is a digital camera
B: A CRT is digital display; a CCD is a analog camera
C: A CRT is an analog camera; a CCD is a digital camera
D: A CRT is a digital camera; a CCD is an analog camera

A

C: A CRT is an analog camera; a CCD is a digital camera

269
Q

13: What type of sprinkler system would be best for the art gallery?

A: Wet Pipe
B: Dry Pipe
C: Deluge
D: Preaction

A

D: Preaction

270
Q

14: You need to discard magnetic hard drives containing PII. Which method for removing PII from magnetic hard drives is considered best?

A: Overwrite every sector on each drive with zeros
B: delete sensitive files
C: Degauss and Destroy
D: reformat the drives

A

C: Degauss and Destroy

271
Q

15: How do dry pipe systems work?

A: The sprinkler heads are open; water releases when the deluge valve is opened by a fire alarm.
B: The release water into the pipes when a fire alarm triggers. The water releases once the sprinkler heads open
C: The pipes contain water which is released when the sprinkler heads open.
D: The water is held back by a valve which remains closed as long as sufficient air pressure remains in the pipes. The valve opes once the sprinkler head opens and air pressure drops.

A

D: The water is held back by a valve which remains closed as long as sufficient air pressure remains in the pipes. The valve opes once the sprinkler head opens and air pressure drops.