Exam SET C Flashcards
1
Q
Which of the following languages is NOT an object-oriented language? A. Lisp B. C++ C. Simula 67 D. Smalltalk
A
Answer: A
Explanation: Lisp, for list processing, is a functional language that processes symbolic expressions rather than numbers. It is used in the artificial intelligence field. The languages cited in the other answers are object-oriented languages.
2
Q
What does the prudent man rule require?
A. Senior officials to guarantee that all precautions have been taken and that no breaches of security can occur
B. Senior officials to post performance bonds for their actions
C. Senior officials to perform their duties with the care that ordinary, prudent people would exercise under similar circumstances
D. Senior officials to follow specified government standards
A
Answer: C
Explanation: *Answer “Senior officials to post performance bonds for their actions” is a distracter and is not part of the prudent man rule. * Answer “Senior officials to guarantee that all precautions have been taken and that no breaches of security can occur” is incorrect because it is not possible to guarantee that breaches of security can never occur. * Answer “Senior officials to follow specified government standards” is incorrect because the prudent man rule does not refer to a specific government standard but relates to what other prudent persons would do.
3
Q
A standard that uses the Object Request Broker (ORB) to implement exchanges among objects in a heterogeneous, distributed environment is called:
A. An Interface Definition Language (IDL)
B. Open Architecture
C. The Object Management Group (OMG) Object Model
D. A Common Object Request Broker Architecture (CORBA)
A
Answer: D
Explanation: * the OMG Object Model provides standard means for describing the externally visible characteristics of objects. *Answer Open Architecture is a distracter. *IDL is a standard interface language that is used by clients to request services from objects.
4
Q
Which choice below is the BEST description of the criticality prioritization goal of the Business Impact Assessment (BIA) process?
A. The identification and prioritization of every critical business unit process
B. The estimation of the maximum down time the business can tolerate
C. The presentation of the documentation of the results of the BIA
D. The identification of the resource requirements of the critical business unit processes
A
Answer: A
Explanation: The correct answer is “The identification and prioritization of every critical business unit process”. The three primary goals of a BIA are criticality prioritization, maximum down time estimation, and identification of critical resource requirements. *Answer “The presentation of the documentation of the results of the BIA” is a distracter.
5
Q
Conducting a search without the delay of obtaining a warrant if destruction of evidence seems imminent is possible under: A. Exigent Circumstances. B. Proximate Causation. C. Prudent Man Rule. D. Federal Sentencing Guidelines.
A
Answer: A
Explanation: The other answers refer to other principles, guidelines, or rules.
6
Q
Which TCSEC security class category below specifies trusted recovery controls? A. B3 B. C2 C. B2 D. B1
A
Answer: A
Explanation: TCSEC security categories B3 and A1 require the implementation of trusted recovery. Trusted recovery is the procedures and/or mechanisms provided to assure that, after an ADP system failure or other discontinuity, recovery without a protection compromise is obtaineD. A system failure represents a serious security risk because security controls may be bypassed when the system is not functioning normally. Trusted recovery has two primary activities: preparing for a system failure (backup) and recovering the system. Source: DoD 5200.28-STD Department of Defense Trusted Computer System Evaluation Criteria.
7
Q
Which of the following would NOT be considered a penetration testing technique? A. Sniffing B. Scanning C. War dialing D. Data manipulation
A
Answer: D
Explanation: The correct answer is Data manipulation. Data manipulation describes the corruption of data integrity to perform fraud for personal gain or other reasons. External penetration testing should not alter the data in any way. The other three are common penetration techniques.
8
Q
Which choice below is the BEST description of an audit trail?
A. Audit trails are used to detect penetration of a computer system and to reveal usage that identifies misuse.
B. An audit trail is a device that permits simultaneous data processing of two or more security levels without risk of compromise.
C. An audit trail mediates all access to objects within the network by subjects within the network.
D. Audit trails are used to prevent access to sensitive systems by unauthorized personnel.
A
Answer: A
Explanation: An audit trail is a set of records that collectively provide documentary evidence of processing used to aid in tracing from original transactions forward to related records and reports, and/or backward from records and reports to their component source transactions. Audit trails may be limited to specific events or may encompass all of the activities on a system. User audit trails can usually log: All commands directly initiated by the user All identification and authentication attempts Files and resources accessed It is most useful if options and parameters are also recorded from commands. It is much more useful to know that a user tried to delete a log file (e.g., to hide unauthorized actions) than to know the user merely issued the delete command, possibly for a personal data file. *Answer “An audit trail is a device that permits simultaneous data processing of two or more security levels without risk of compromise.” is a description of a multilevel devicE. A multilevel device is a device that is used in a manner that permits it to process data of two or more security levels simultaneously without risk of compromisE. To accomplish this, sensitivity labels are normally stored on the same physical medium and in the same form (i.e., machine-readable or human-readable) as the data being processed. *Answer “An audit trail mediates all access to objects within the network by subjects within the network.” refers to a network reference monitor, an access control concept that refers to an abstract machine that mediates all access to objects within the network by subjects within the network. * Answer “Audit trails are used to prevent access to sensitive systems by unauthorized personnel.” is incorrect, because audit trails are detective, and the answer describes a preventative process, access control. Source: NCSC-TG-001 A Guide to Understanding Audit in Trusted Systems and DoD 5200.28-STD Department of Defense Trusted Computer System Evaluation Criteria.
9
Q
In object-oriented programming, when all the methods of one class are passed on to a subclass, this is called: A. Delegation B. Inheritance C. Multiple Inheritance D. Forward chaining
A
Answer: B Explanation: In inheritance, all the methods of one class, called a superclass, are inherited by a subclass. Thus, all messages understood by the superclass are understood by the subclass. In other words, the subclass inherits the behavior of the superclass. *Answer Forward chaining is a distracter and describes data-driven reasoning used in expert systems. *Multiple inheritancedescribes the situation where a subclass inherits the behavior of multiple superclasses. *Answer delegation, is an alternative to inheritance in an object-oriented system. With delegation, if an object does not have a method to satisfy a request it has received, it can delegate the request to another object.
10
Q
What type of security controls operate on the input to a computing system, on the data being processed, and the output of the system? A. Numerical controls B. Data controls C. Normative controls D. Application controls
A
Answer: D
Explanation: The correct answer is Application controls. The other answers are distracters.
11
Q
Which choice below refers to a business asset?
A. Protection devices or procedures in place that reduce the effects of threats
B. Events or situations that could cause a financial or operational impact to the organization
C. Competitive advantage, credibility, or good will
D. Personnel compensation and retirement programs
A
Answer: C
Explanation: Assets are considered the physical and financial assets that are owned by the company. Examples of business assets that could be lost or damaged during a disaster are: Revenues lost during the incident On-going recovery costs Fines and penalties incurred by the event. Competitive advantage, credibility, or good will damaged by the incident *Answer “Events or situations that could cause a financial or operational impact to the organization” is a definition for a threat. *Answer “Protection devices or procedures in place that reduce the effects of threats” is a description of mitigating factors that reduce the effect of a threat, such as a UPS, sprinkler systems, or generators. *Answer “Personnel compensation and retirement programs” is a distracter. Source: Contingency Planning and Management, Contingency Planning 101 by Kelley Goggins, March, 1999.
12
Q
A distributed object model that has similarities to the Common Object Request Broker Architecture (CORBA) is:
A. Distributed Data Model
B. Inference Model
C. Distributed Component Object Model (DCOM)
D. The Chinese Wall Model
A
Answer: C
Explanation: DCOM is the distributed version of COM that supports remote objects as if the objects reside in the clients address space. ACOM client can access a COM object through the use of a pointer to one of the objects interfaces and, then, invoking methods through that pointer. As discussed in Question 24, CORBA is a distributed object framework developed by the Object Management Group. * the Chinese Wall Model (D.C. Brewer & M.J. Nash, Chinese Wall Model, Proceedings of the 1989 IEEE Computer Society Symposium on Security and Privacy, pp. 215-228, 1989), uses internal rules to compartmentalize areas in which individuals may work to prevent disclosure of proprietary information and to avoid conflicts of interest. The Chinese Wall model also incorporates the principle of separation of duty. * Answers Inference Model and Distributed Data Model are distracters.
13
Q
The process of analyzing large data sets in a data warehouse to find non-obvious patterns is called: A. Data scanning B. Data administration C. Derived data D. Data mining
A
Answer: D
Explanation: For example, mining of consumer-related data may show a correlation between the number of children under four years old in a household and the fathers preferences in aftershave lotion. *Answer Data scanning is a distracter. *Data administrationdescribes the degree of managements dedication to the data warehouse concept. *Answer derived data, is data that is obtained through the processing of raw data.
14
Q
In an expert system, the process of beginning with a possible solution and using the knowledge in the knowledge base to justify the solution based on the raw input data is called: A. Forward chaining B. Dynamic reasoning C. A blackboard solution D. Backward chaining
A
Answer: D
Explanation: Backward chaining is generally used when there are a large number of possible solutions relative to the number of inputs. *Answer Dynamic reasoning is a distracter. Answer forward chaining, is the reasoning approach that can be used when there is a small number of solutions relative to the number of inputs. The input data is used to reason forward to prove that one of the possible solutions in a small solution set is the correct one. *The blackboard is an expert system reasoning methodology in which a solution is generated by the use of a virtual blackboard wherein information or potential solutions are placed on the blackboard by a plurality of individuals or expert knowledge sources. As more information is placed on the blackboard in an Aiterative process, a solution is generated.
15
Q
Which of the following are alid legal issues associated with computer crime? Select three
A. It may be difficult to prove criminal intent.
B. It may be difficult to obtain a trail of evidence of activities performed on the computer.
C. It may be difficult to show causation.
D. Electronic Data Interchange (EDI) makes it easier to relate a crime to an individual.
A
Answer: A,B,C
Explanation: EDI makes it more difficult to tie an individual to transactions since EDI involves computer-to-computer data interchanges and this makes it more difficult to trace the originator of some transactions. *Answer “It may be difficult to prove criminal intent” is a valid legal issue since it may be very difficult to prove criminal intent by a person perusing computer files and then causing damage to the files. The damage may have not been intentional. *Answer “It may be difficult to obtain a trail of evidence of activities performed on the computer” describes the situation of trying to track activities on a computer where the information is volatile and may have been destroyed. * In answer “It may be difficult to show causation”, common law refers to causation of the criminal act. Causation is particularly difficult to show in instances where a virus or other malicious code erases itself after causing damage to vital information.
16
Q
The Kennedy-Kassebaum Act is also known as: A. HIPAA B. RICO C. EU Directive D. OECD
A
Answer: A
Explanation: The others refer to other laws or guidelines.
17
Q
Which choice below is NOT an element of BCP plan approval and implementation?
A. Executing a disaster scenario and documenting the results
B. Obtaining senior management approval of the results
C. Creating an awareness of the plan
D. Updating the plan regularly and as needed
A
Answer: A
Explanation: Answer “Executing a disaster scenario and documenting the results” is a distracter, although it could be considered a loose description of disaster recovery plan testing. The other three choices are primary elements of BCP approval, implementation, and maintenance.
18
Q
Which statement below MOST accurately describes configuration control?
A. Assuring that only the proposed and approved system changes are implemented
B. Tracking the status of current changes as they move through the configuration control process
C. Verifying that all configuration management policies are being followed
D. The decomposition process of a verification system into CIs
A
Answer: A
Explanation: Configuration control is a means of assuring that system changes are approved before being implemented, only the proposed and approved changes are implemented, and the implementation is complete and accuratE. This involves strict procedures for proposing, monitoring, and approving system changes and their implementation. Configuration control entails central direction of the change process by personnel who coordinate analytical tasks, approve system changes, review the implementation of changes, and supervise other tasks such as documentation. *Answer “The decomposition process of a verification system into CIs” is configuration identification. The decomposition process of a verification system into Configuration Items (CIs) is called configuration identification. A CI is a uniquely identifiable subset of the system that represents the smallest portion to be subject to independent configuration control procedures. Answer “Tracking the status of current changes as they move through the configuration control process” is configuration accounting. Configuration accounting documents the status of configuration control activities and, in general, provides the information needed to manage a configuration effectively. It allows managers to trace system changes and establish the history of any developmental problems and associated fixes. Configuration accounting also tracks the status of current changes as they move through the configuration control process. Configuration accounting establishes the granularity of recorded information and thus shapes the accuracy and usefulness of the audit function. *Answer “Verifying that all configuration management policies are being follow” is configuration audit. Configuration audit is the quality assurance component of configuration management. It involves periodic checks to determine the consistency and completeness of accounting information and to verify that all configuration management policies are being followeD. A vendors configuration management program must be able to sustain a complete configuration audit by an NCSC review team. Source: NCSC-TG-014, Guidelines for Formal Verification Systems.
19
Q
Which of the following best defines social engineering?
A. Gathering information from discarded manuals and printouts
B. Illegal copying of software
C. Destruction or alteration of data
D. Using people skills to obtain proprietary information
A
Answer: D
Explanation: Using people skills to obtain proprietary information. *Answer “Illegal copying of software” is software piracy * answer “Gathering information from discarded manuals and printouts” is dumpster diving; *answer “Destruction or alteration of data” is a violation of integrity.
20
Q
18 USC. ß2001 (1994) refers to:
A. Article 18, US Code, Section 2001, 1994 edition.
B. Title 18, University of Southern California, Article 2001, 1994 edition.
C. Title 2001 of the US Code, Section 18, 1994 edition.
D. Title 18, Section 2001 of the US Code, 1994 edition.
A
Answer: D
Explanation:
21
Q
Asystem that exhibits reasoning similar to that of humans knowledgeable in a particular field to solve a problem in that field is called: A. An expert system. B. A data warehouse. C. A neural network. D. A smart system.
A
Answer: A
Explanation: Answer a smart system is a distracter. A data warehouse, is a repository of information from heterogeneous databases that is available to users for making queries. A neural network is a self-learning system that bases its operation on the model of the functioning of biological neurons.
22
Q
Which choice below is NOT a recommended step to take when resuming normal operations after an emergency?
A. Conduct an investigation.
B. Re-occupy the damaged building as soon as possible.
C. Account for all damage-related costs.
D. Protect undamaged property.
A
Answer: B
Explanation: Re-occupying the site of a disaster or emergency should not be undertaken until a full safety inspection has been done, an investigation into the cause of the emergency has been completed, and all damaged property has been salvaged and restored. During and after an emergency, the safety of personnel must be monitored, any remaining hazards must be assessed, and security must be maintained at the scene. After all safety precautions have been taken, an inventory of damaged and undamaged property must be done to begin salvage and restoration tasks. Also, the site must not be re-occupied until all investigative processes have been completed. Detailed records must be kept of all disaster-related costs and valuations must be made of the effect of the business interruption. Source: Emergency Management Guide for Business and Industry, Federal Emergency Management Agency,
August 1998.
23
Q
In the software life cycle, validation:
A. Refers to the work product satisfying software maturity levels.
B. Refers to the work product satisfying the real-world requirements and concepts.
C. Refers to the work product satisfying generally accepted principles.
D. Refers to the work product satisfying derived specifications.
A
Answer: B
Explanation: In the software life cycle, validation is the work product satisfying the real-world requirements and concepts. The other answers are distracters
24
Q
What is the responsibility of the contingency planner regarding LAN
backup and recovery if the LAN is part of a building server environment?
A. Recovering client/server systems owned and supported by internal staff
B. Identifying essential business functions
C. Classifying the recovery time frame of the business unit LAN
D. Getting a copy of the recovery procedures from the building server administrator
A
Answer: D
Explanation: When any part of the LAN is not hosted internally, and is part of a building server environment, it is the responsibility of the contingency planner to identify the building server administrator, identify for him the recovery time frame required for your business applications, obtain a copy of the recovery procedures, and participate in the validation of the buildings server testing. If all or part of the business is not in the building server environment, then the other three choices are also the responsibility of the contingency planner. Source: Contingency Planning and Management, Contingency Planning 101, by Kelley Goggins, March 1999.
25
```
Which standard defines the International Standard for the Common Criteria?
A. CSC-STD-002-85
B. IS15408
C. BS7799
D. DoD 5200.28-STD
```
Answer: B
Explanation: ISO/IEC 15408-1 is the International Standards version of the Common CriteriA. The ISO approved and published the CC text as the new International Standard (IS) 15408 on December 1, 19994. As of this writing the Common Criteria version is 2.1. Answer b is the Code of Practice for Information Security Management (BS7799) developed by the British Standards Institute. The BS7799 standard effectively comes in two parts: ISO/IEC 17799:2000 (Part 1) is the standard code of practice and can be regarded as a comprehensive catalogue of recommended security policy. BS7799-2:1999 (Part 2) is a standard specification for an Information Security Management System (ISMS). An ISMS is the means by which Senior Management monitors and controls their security, minimizing the residual business risk and ensuring that security continues to fulfill corporate, customer, and legal requirements.5
*Answer DoD 5200.28-STD is the Orange Book, the DoD Trusted Computer System Evaluation Criteria. *Answer CSC-STD-002-85 is the Green Book, the DoD Password Management Guidelines. Source: The Common Criteria Project.
26
```
Which task below would normally be a function of the security administrator, not the system administrator?
A. Reviewing audit data
B. Managing print queues
C. Adding and removing system users
D. Installing system software
```
Answer: A
Explanation: Reviewing audit data should be a function separate from the day-to-day administration of the system.
27
Which statement below is accurate about the concept of Object Reuse?
A. Object reuse protects against physical attacks on the storage medium.
B. Object reuse applies to removable media only.
C. Object reuse controls the granting of access rights to objects.
D. Object reuse ensures that users do not obtain residual information from system resources.
Answer: D
Explanation: Object reuse mechanisms ensure system resources are allocated and reassigned among authorized users in a way that prevents the leak of sensitive information, and ensure that the authorized user of the system does not obtain residual information from system resources. Object reuse is defined as The reassignment to some subject of a storage medium (e.g., page frame, disk sector, magnetic tape) that contained one or more objects. To be securely reassigned, no residual data can be available to the new subject through standard system mechanisms.7 The object reuse requirement of the TCSEC is intended to assure that system resources, in particular storage media, are allocated and reassigned among system users in a manner which prevents the disclosure of sensitive information. Answer a is incorrect. Object reuse does not necessarily protect against physical attacks on the storage medium. Answer c is also incorrect, as object reuse applies to all primary and secondary storage media, such as removable media, fixed media, real and virtual main memory (including registers), and cache memory. Answer d refers to authorization, the granting of access rights to a user, program, or process. Source: NCSC-TG-018, A Guide To Understanding Object Reuse in Trusted Systems [Light Blue Book].
28
Relative to legal evidence, which one of the following correctly describes the difference between an expert and a nonexpert in delivering an opinion?
A. An expert can offer an opinion based on personal expertise and facts, but a nonexpert can testify only as to facts.
B. Anonexpert can offer an opinion based on personal expertise and facts, but an expert can testify only as to facts.
C. An expert can offer an opinion based on personal expertise and facts, but a nonexpert can testify only as to personal opinion.
D. An expert can offer an opinion based on facts only, but a nonexpert can testify only as to personal opinion.
Answer: A
Explanation: The other answers are distracters.
29
Which choices below are commonly accepted definitions for a disaster? Select three.
A. A suddenly occurring event that has a long-term negative impact on social life
B. An emergency that is beyond the normal response resources of the entity
C. An occurrence or imminent threat to the entity of widespread or severe damage, injury, loss of life, or loss of property
D. An occurrence that is outside the normal computing function
Answer: A,B,C
Explanation: The disaster/emergency management and business continuity community consists of many different types of entities, such as governmental (federal, state, and local), nongovernmental (business and industry), and individuals. Each entity has its own focus and its own definition of a disaster. The correct answers are examples of these various definitions of disasters. A very common definition of a disaster is a suddenly occurring or unstoppable developing event that: Claims loss of life, suffering, loss of valuables, or damage to the environment. Overwhelms local resources or efforts. Has a long-term impact on social or natural life that is always negative in the beginning. Source: NFPA 1600 Standard on Disaster/Emergency Management and Business Continuity, National Fire Protection Association, 2000 edition.
30
```
What principle requires corporate officers to institute appropriate protections regarding the corporate intellectual property?
A. Least privilege
B. Need-to-know
C. Separation of duties
D. Due care
```
Answer: C
Explanation: The correct answer is Separation of duties. The Federal Sentencing Guidelines state, The officers must exercise due care or reasonable care to carry out their responsibilities to the organization. The other answers are information security principles but are distracters in this instance.
31
```
Which choice below is an example of a potential hazard due to a technological event, rather than a human event?
A. Enemy attack
B. Financial collapse
C. Sabotage
D. Mass hysteria
```
Answer: B
Explanation: A financial collapse is considered a technological potential hazard, the other three are human events. Of the three categories of potential hazards (natural, technological, and human), technological events could include:
Hazard material release (HazMat)
Explosion or fire (non-arson)
Fuel shortage Structure collapse
Utility failure Severe air pollution
Source: NFPA 1600 Standard on Disaster/Emergency Management and Business Continuity, National Fire Protection Association, 2000 edition.
32
```
In a distributed environment, a surrogate program that performs services in one environment on behalf of a principal in another environment is called:
A. A proxy.
B. A slave.
C. An agent.
D. A virtual processor.
```
Answer: C
Explanation: The correct answer is An agent. * Proxy is similar in nature but might hide the characteristics of the principal it is representing. Answers A slave and A virtual processor are distracters.
33
When is the disaster considered to be officially over?
A. When the organization has processing up and running at the alternate site
B. When all of the elements of the business have returned to normal functioning at the original site
C. When the danger has passed and the disaster has been contained
D. When all employees have been financially reimbursed for their expenses
Answer: B
Explanation: The correct answer is: when all of the elements of the business have returned to normal functioning at the original site. Its important to remember that a threat to continuity exists when processing is being returned to its original site after salvage and cleanup has been done.
34
What could be a major disadvantage to a mutual aid or reciprocal
type of backup service agreement?
A. The use of prefabricated buildings makes recovery easier.
B. It is free or at a low cost to the organization.
C. Annual testing by the Info Tech department is required to maintain the site.
D. In a major emergency, the site might not have the capacity to handle the operations required.
Answer: D
Explanation: The site might not have the capacity to handle the operations required during a major disruptive event. While mutual aid might be a good system for sharing resources during a small or isolated outage, a major natural or other type of disaster can create serious resource contention between the two organizations.
35
Which of the following are computer investigation issues? S
A. The time frame for investigation is compressed.
B. An expert may be required to assist.
C. The information is intangible.
D. Evidence is easy to obtain.
Answer: A,B,C
Explanation: In many instances, evidence is difficult to obtain in computer crime investigations.
36
Which choice below BEST describes a threat as defined in the Operations Security domain?
A. A potential incident that could cause harm
B. A weakness in a system that could be exploited
C. A company resource that could be lost due to an incident
D. The minimization of loss associated with an incident
Answer: A
Explanation: Incorrect answer: * "A weakness in a system that could be exploited" describes a vulnerability * "A company resource that could be lost due to an incident" describes an asset * "The minimization of loss associated with an incident" describes risk management.
37
What key professional or professionals are required to develop an expert system?
A. Domain expert and object designer
B. Knowledge engineer and object designer
C. Knowledge engineer and domain expert
D. Domain expert
Answer: C
Explanation: The knowledge engineer usually has a computer-related and expert system background, but does not have the knowledge of the specific discipline or domain being addressed by the expert system. For example, the expert system being developed may be a medical diagnostic system requiring input from diagnostic specialists and other types of physicians. These individuals are the domain experts. It is the job of the knowledge engineer to elicit the critical knowledge from the domain expert and incorporate it into the expert system knowledge base. The term object designer in the answers is a distracter.
38
Which choice below is NOT a common element of user account administration?
A. Establishing, issuing, and closing user accounts
B. Authorizing the request for a users system account
C. Tracking users and their respective access authorizations
D. Periodically verifying the legitimacy of current accounts and access authorizations
Answer: B
Explanation:
For proper separation of duties, the function of user account establishment and maintenance should be separated from the function of initiating and authorizing the creation of the account. User account management focuses on identification, authentication, and access authorizations. This is augmented by the process of auditing and otherwise periodically verifying the legitimacy of current accounts and access authorizations. Also, there are considerations involved in the timely modification or removal of access and associated issues for employees who are reassigned, promoted, or terminated, or who retire. Source: National Institute of Standards and Technology, An Introduction to Computer Security: The NIST Handbook Special Publication 800-12.
39
Which choice does NOT describe an element of configuration management?
A. Configuration management reports the status of change processing.
B. Configuration management is the decomposition process of a verification system into Configuration Items (CIs).
C. Configuration management documents the functional and physical characteristics of each configuration item.
D. Configuration management involves information capture and version control.
Answer: B
Explanation: Configuration management is a discipline applying technical and administrative direction to: Identify and document the functional and physical characteristics of each configuration item for the system Manage all changes to these characteristics Record and report the status of change processing and implementation Configuration management involves process monitoring, version control, information capture, quality control, bookkeeping, and an organizational framework to support these activities. The configuration being managed is the verification system plus all tools and documentation related to the configuration process. Source: NCSC-TG-014-89, Guidelines for Formal Verification Systems [Purple Book].
40
A database management system (DBMS) is useful in situations where:
A. Rapid development of applications is required and preprogrammed functions can be used to provide those applications along with other support features such as security, error recovery, and access control.
B. The operations to be performed on the data are modified infrequently and the operations are relatively straightforward.
C. Data are processed infrequently and results are not urgently needed.
D. Large amounts of data are to be processed in time-critical situations.
Answer: A
Explanation: A DBMS is called for when the required skilled programming resources are not available, information to be stored and accessed is common to many organizational business units, the processing requirements change frequently and timely responses are required for queries on the data.
41
```
In an object-oriented system, the situation wherein objects with a common name respond differently to a common set of operations is called:
A. Polyinstantiation.
B. Delegation.
C. Polyresponse.
D. Polymorphism.
```
Answer: D
Explanation: Delegation is the forwarding of a request by one object to another object. Answer Polyresponse is a distracter. Polyinstantiationis the development of a detailed version of an object from another object. The new object uses values that are different from those in the original object.
42
The simplistic model of software life cycle development assumes that:
A. Each phase is identical to a completed milestone.
B. Iteration will be required among the steps in the process.
C. Software development requires reworking and repeating some of the phases.
D. Each step can be completed and finalized without any effect from the later stages that might require rework.
Answer: D
Explanation: Each step can be completed and finalized without any effect from the later stages that might require rework. *Answer "Iteration will be required among the steps in the process" is incorrect because no iteration is allowed for in the model. *Answer "Each phase is identical to a completed milestone" is incorrect because it applies to the modified Waterfall model. *Answer "Software development requires reworking and repeating some of the phase" is incorrect because no iteration or reworking is considered in the model.
43
Why are maintenance accounts a threat to operations controls?
A. Maintenance might require physical access to the system by vendors or service providers.
B. Maintenance accounts are commonly used by hackers to access network devices.
C. Maintenance personnel could slip and fall and sue the organization.
D. Maintenance account information could be compromised if printed reports are left out in the open.
Answer: B
Explanation: Maintenance accounts are login accounts to systems resources, primarily networked devices. They often have the factory-set passwords that are frequently distributed through the hacker community.
44
```
The security term that is concerned with the same primary key existing at different classification levels in the same database is:
A. Polymorphism.
B. Inheritance.
C. Polyinstantiation.
D. Normalization.
```
```
Answer: C
Explanation: The security term that is concerned with the same primary key existing at different classification levels in the same database is polyinstantiation. Answer Polymorphism is incorrect because polymorphism is defined as objects of many different classes that are related by some common superclass; thus, any object denoted by this name is able to respond to some common set of operations in a different way. Answer Normalization is incorrect because normalization refers to removing redundant or incorrect data from a database. Answer Inheritance is incorrect because inheritance refers to methods from a class inherited by another subclass.
```
45
```
Which general TCSEC security class category describes that mandatory access policies be enforced in the TCB?
Exhibit:
A. A
B. B
C. C
D. D
```
Answer: B
Explanation: The Trusted Computer System Evaluation Criteria [Orange Book] defines major hierarchical classes of security by the letters D (least secure) through A (most secure): D. Minimal protection C. Discretionary protection (C1&C2) B. Mandatory protection (B1, B2, B3) A. Verified protection; formal methods (A1) Source: DoD 5200.28-STD Department of Defense Trusted Computer System Evaluation Criteria.
46
What does the Spiral Model depict?
A. Aspiral that incorporates various phases of software development
B. Aspiral that models the behavior of biological neurons
C. The operation of expert systems D. Information security checklists
Answer: A
Explanation: The correct answer is a a spiral that incorporates various phases of software development. The other answers are distracters.
47
Which choice describes the Forest Green Book?
A. It is a Rainbow series book that defines the secure handling of storage media.
B. It is a Rainbow series book that defines guidelines for implementing access control lists.
C. It does not exist; there is no Forest Green Book.
D. It is a tool that assists vendors in data gathering for certifiers.
Answer: A
Explanation: The Forest Green book is a Rainbow series book that defines the secure handling of sensitive or classified automated information system memory and secondary storage media, such as degaussers, magnetic tapes, hard disks, floppy disks, and cards. The Forest Green book details procedures for clearing, purging, declassifying, or destroying automated information system (AIS) storage media to prevent data remanence. Data remanence is the residual physical representation of data that has been erased in some way. After storage media is erased there may be some physical characteristics that allow data to be reconstructed. * Answer "It is a tool that assists vendors in data gathering for certifiers." is the Blue Book, NCSCTG-019 Trusted Product Evaluation Questionnaire Version-2. The Blue book is a tool to assist system developers and vendors in gathering data to assist evaluators and certifiers assessing trusted computer systems. * Answer "It is a Rainbow series book that defines guidelines for implementing access control lists." is the Grey/Silver Book, NCSC-TG-020A, the Trusted UNIX Working Group (TRUSIX) Rationale for Selecting Access Control. The Grey/Silver book defines guidelines for implementing access control lists (ACLs) in the UNIX system. Source: NCSC-TG- 025 A Guide to Understanding Data Remanence in Automated Information Systems, NCSC-TG-020A Trusted UNIX Working Group (TRUSIX) Rationale for Selecting Access Control, and NCSC-TG-019 Trusted Product Evaluation Questionnaire Version-2.
48
Which choice below is incorrect regarding when a BCP, DRP, or emergency
management plan should be evaluated and modified?
A. Annually, in a scheduled review.
B. Never; once it has been tested it should not be changed.
C. After an emergency or disaster response.
D. After training drills, tests, or exercises.
Answer: B
Explanation:
Emergency management plans, business continuity plans, and disaster recovery plans should be regularly reviewed, evaluated, modified, and updated. At a minimum, the plan should be reviewed at an annual audit. It should also be re-evaluated: After tests or training exercises, to adjust any discrepancies between the test results and the plan After a disaster response or an emergency recovery, as this is an excellent time to amend the parts of the plan that were not effective When personnel, their responsibilities, their resources, or organizational structures change, to familiarize new or reorganized personnel with procedures When polices, procedures, or infrastructures change Source: Emergency Management Guide for Business and Industry Federal Emergency Management Agency, August, 1998 and NFPA 1600 Standard on Disaster/Emergency Management and Business Continuity National Fire Protection Association, 2000 edition.
49
Which one of the following are recommended practices regarding electronic monitoring of employees email? Select three.
A. Inform all that e-mail is being monitored by means of a prominent log-in banner.
B. Explain who is authorized to read monitored email.
C. Provide individuals being monitored with a guarantee of email privacy.
D. Apply monitoring in a consistent fashion.
Answer: A,B,D
Explanation: No guarantee of e-mail privacy should be provided or implied by the employer.
50
What is configuration control?
A. Identifying and documenting the functional and physical characteristics of each configuration item
B. Recording the processing of changes
C. Controlling the quality of the configuration management procedures
D. Controlling changes to the configuration items and issuing versions of configuration items from the software library
Answer: D
Explanation: Configuration control is controlling changes to the configuration items and issuing versions of configuration items from the software library. Answer "Identifying and documenting the functional and physical characteristics of each configuration item" is the definition of configuration identification. Answer "Recording the processing of changes" is the definition of configuration status accounting, and answer "Controlling the quality of the configuration management procedures" is the definition of configuration audit.
51
Which statement below is NOT true about the post-disaster salvage
team?
A. The salvage team identifies sources of expertise to employ in the recovery of equipment or supplies.
B. The salvage team may be given the authority to declare when operations can resume at the disaster site.
C. The salvage team must return to the site as soon as possible regardless of the residual physical danger.
D. The salvage team manages the cleaning of equipment after smoke damage.
Answer: C
Explanation: Salvage cannot begin until all physical danger has been removed or mitigated and emergency personnel have returned control of the site to the organization.
52
Which statement is true regarding the disbursement of funds during and after a disruptive event?
A. Authorized, signed checks should be stored securely off-site for access by lower-level managers in the event senior-level or financial management is unable to disburse funds normally.
B. In the event senior-level or financial management is unable to disburse funds normally, the company will need to file for bankruptcy.
C. No one but the finance department should ever disburse funds during or after a disruptive event.
D. Because access to funds is rarely an issue during a disaster, no special arrangements need to be made.
Answer: A
Explanation:
53
When should security isolation of the incident scene start?
A. As soon as the disaster plan is implemented
B. Immediately after the emergency is discovered
C. After all personnel have been evacuated
D. When hazardous materials have been discovered at the site
Answer: B
Explanation: Isolation of the incident scene should begin as soon as the emergency has been discovered. Authorized personnel should attempt to secure the scene and control access; however, no one should be placed in physical danger to perform these functions. Its important for life safety that access be controlled immediately at the scene, and only by trained personnel directly involved in the disaster response. Additional injury or exposure to recovery personnel after the initial incident must be tightly controlled. Source: Emergency Management Guide for Business and Industry, Federal Emergency Management Agency, August, 1998.
54
Which choice below is NOT a common example of exercising due care or due diligence in security practices?
A. Implementing employee casual Friday
B. Implementing security awareness and training programs
C. Implementing controls on printed documentation
D. Implementing employee compliance statements
Answer: A
Explanation: The correct answer is "Implementing employee casual Friday". The concepts of due care and due diligence require that an organization engage in good security practices relative to industry standards.
55
```
Another model that allows two software components to communicate with each other independent of their platforms operating systems and languages of implementation is:
A. Basic Object Model (BOM)
B. Sandbox
C. Common Object Model (COM)
D. Spiral Model
```
Answer: C
Explanation: As in the object-oriented paradigm, COM works with encapsulated objects. Communications with a COM object are through an interface contract between an object and its clients that defines the functions that are available in the object and the behavior of the object when the functions are calleD. *Answer a sandbox, is an access control-based protection mechanism. It is commonly applied to restrict the access rights of mobile code that is downloaded from a Web site as an applet. The code is set up to run in a sandbox that blocks its access to the local workstations hard disk, thus preventing the code from malicious activity. The sandbox is usually interpreted by a virtual machine such as the Java Virtual MachinE. *Answer BOM is a distracter. * Spiral Model refers to the software development life cycle.
56
Which choice below would NOT be a good reason to test the disaster
recovery plan?
A. Testing allows processing to continue at the database shadowing facility.
B. Testing prepares and trains the personnel to execute their emergency duties.
C. Testing identifies deficiencies in the recovery procedures.
D. Testing verifies the processing capability of the alternate backup site.
Answer: A
Explanation: The correct answer is "Testing allows processing to continue at the database shadowing facility.". It is a distracter. The other three answers are good reasons to test the disaster recovery plan.
57
```
In general, computer-based evidence is considered:
A. Secondary.
B. Conclusive.
C. Hearsay.
D. Circumstantial.
```
Answer: C
Explanation: The correct answer is Hearsay. Answer Conclusive refers to incontrovertible evidence; answer Circumstantial refers to inference from other, intermediate facts; and answer Secondary refers to a copy of evidence or oral description of its content.
58
In general, computer crimes fall into two major categories and two additional related categories. Which of the following categories are of these four? Select three.
A. Crimes using the computer
B. Crimes associated with the prevalence of computers
C. The computer as a target of the crime
D. Malfeasance by computer
Answer: A,B,C
Explanation: Malfeasance by computer is an act involving a computer that is technically and ethically improper, but may or may not be illegal. Some of these activities may not be considered illegal by the user and
may be unintentional. Examples of such behavior are: Using a password that you have been given by someone else to have access to their computer and using that password to view files that were not intended for your perusal Giving a copy of a software package that you purchased to a member of your family for personal use (In most instances, this is illegal based on software licenses.) Using the computer at your place of employment to store some information related to an outside business activity Answers a, b, and d are valid categories of computer crime. The fourth category is a crime where the computer is incidental to other crimes. Examples in these four categories are: The computer is a target of the crime. Sabotage or theft of intellectual property, disruption of business operations, illegal access to government and personal information, and falsifying or changing records. Crimes using the computer. Theft of money from financial accounts, credit card fraud, fraud involving stock transfers, billing charges illegally to another party, and telecommunications fraud. Crimes associated with the prevalence of computers. Violation of copyright restrictions on commercial software packages, software piracy and software counterfeiting. The computer is incidental to other crimes. (In this category, the crime could be committed without the computer, but the computer permits the crime to be committed more efficiently and in higher volume.) Money laundering, keeping records and books of illegal activity and illegal gambling.
59
Which choice below most accurately describes a business impact analysis (BIA)?
A. Activities designed to return an organization to an acceptable operating condition
B. A management-level analysis that identifies the impact of losing an entitys resources
C. A prearranged agreement between two or more entities to provide assistance
D. A program that implements the strategic goals of the organization
Answer: B
Explanation: A business impact analysis (BIA) measures the effect of resource loss and escalating losses over time in order to provide the entity with reliable data upon which to base decisions on hazard mitigation and continuity planning. A BIA is performed as one step during the creation of a Business Continuity Plan (BCP). A common five-step approach to a BCP could consist of: BCP project scope creation Business impact assessment Recovery strategy development Recovery plan development Implementation, testing, and maintenance. Answer a is a definition of a disaster/emergency management program. Answer c describes a mutual aid agreement. Answer d is the definition of a recovery program. Source: NFPA 1600 Standard on Disaster/Emergency Management and Business Continuity, National Fire Protection Association, 2000 edition and Handbook of Information Security Management, by Micki Krause and Harold F. Tipton, Auerback, 1999 edition.
60
Which statement is accurate about trusted facility management?
A. The TCB shall support separate operator and administrator functions for B2 systems and above.
B. The role of a security administrator shall be identified and auditable in B2 systems and above.
C. The TCB shall support separate operator and administrator functions for C2 systems and above.
D. The role of a security administrator shall be identified and auditable in C2 systems and above.
Answer: A
Explanation: Trusted Facility Management has two different requirements, one for B2 systems and another for B3 systems. The B2 requirements state: the TCB shall support separate operator and administrator functions. The B3 requirements are as follows: The functions performed in the role of a security administrator shall be identifieD. System administrative personnel shall only be able to perform security administrator functions after taking a distinct auditable action to assume the security administrator role on the system. Non-security functions that can be performed in the security administration role shall be limited strictly to those essential to performing the security role effectively.6 Source: NCSC-TG-O15, Guide To Understanding Trusted Facility Management [Brown Book].
61
```
Which one of the following is NOT one of the maturity levels of the Software Capability Maturity Model (CMM)?
A. Fundamental
B. Managed
C. Defined
D. Repeatable
```
Answer: A
Explanation: The correct answer is Fundamental, a distracter. The first level of the Software CMM is the Initiating level. At this level, processes are performed on an ad hoc basis. Answer the Repeatable level is the second maturity level in the model. In the third level, Defined, management practices are institutionalized and technical procedures are integrated into the organizational structure. The Managed level has both product and processes quantitatively controlled. The fifth level of the Software CMM is the Optimized level, where continuous process improvement is institutionalized.
62
Which statement is true regarding company/employee relations during and after a disaster?
A. Senior-level executives are the only employees who should receive continuing salaries during the disruptive event.
B. The organizations responsibility to the employees families ends when the disaster stops the business from functioning.
C. The organization has a responsibility to continue salaries or other funding to the employees and/or families affected by the disaster.
D. Employees should seek any means of obtaining compensation after a disaster, including fraudulent ones.
Answer: C
Explanation: The organization has an inherent responsibility to its employees and their families during and after a disaster or other disruptive event. The company must be insured to the extent it can properly compensate its employees and families. Alternatively, employees do not have the right to obtain compensatory damages fraudulently if the organization cannot compensate.
63
Which of the following is a key principle in the evolution of computer crime laws in many countries?
A. The definition of property was extended to include electronic information.
B. Unauthorized acquisition of computer-based information without the intent to resell is not a crime.
C. All members of the United Nations have agreed to uniformly define and prosecute computer crime.
D. Existing laws against embezzlement, fraud, and wiretapping cannot be applied to computer crime.
Answer: A
Explanation: * Answer "All members of the United Nations have agreed to uniformly define and prosecute computer crime" is incorrect because all nations do not agree on the definition of computer crime and corresponding punishments. * Answer "Existing laws against embezzlement, fraud, and wiretapping cannot be applied to computer crime" is incorrect because the existing laws can be applied against computer crime. * Answer "Unauthorized acquisition of computer-based information without the intent to resell is not a crime" is incorrect because in some countries, possession without intent to sell is considered a crime.
64
```
An off-the-shelf software package that implements an inference engine, a mechanism for entering knowledge, a user interface, and a system to provide explanations of the reasoning used to generate a solution is
called:
A. A knowledge base
B. A knowledge acquisition system
C. An expert system shell
D. A neural network
```
Answer: C
Explanation: An expert system shell provides the fundamental building blocks of an expert system and supports the entering of domain knowledge. Thus, for an application that is not complex and does not require the custom development of the components of an expert system, an expert system shell is a useful tool that will save development time. *A knowledge base is a component of an expert system. *. A neural network is another type of artificial intelligence system that uses the neurons of the brain as a model and solves problems using nonlinear pattern-matching techniques and learning approaches. *A knowledge acquisition system refers to the means of identifying and acquiring the knowledge to be entered into the knowledge base. In simple terms, it is trying to determine how an expert thinks when developing a solution to a problem.
65
```
Which of the following criteria are used to evaluate suspects in the commission of a crime?
A. Means, Object, and Motive
B. Motive, Intent, and Ability
C. Motive, Means, and Opportunity
D. Means, Intent, and Motive
```
Answer: C
Explanation:
66
Which choice below is the correct definition of a Mutual Aid Agreement?
A. A management-level analysis that identifies the impact of losing an entitys resources
B. An appraisal or determination of the effects of a disaster on human, physical, economic, and natural resources
C. Activities taken to eliminate or reduce the degree of risk to life and property
D. A prearranged agreement to render assistance to the parties of the agreement
Answer: D
Explanation: Amutual aid agreement is used by two or more parties to provide for assistance if one of the parties experiences an emergency. It is expected that the other parties will assist the affected party in various ways, perhaps by making office space available, or computing time or resources, or supplying manpower if needed. While mutual aid agreements may be a very cost-effective solution for disaster recovery, it does not provide for full operations redundancy. An example of a problem with a total reliance on mutual aid would be the event that affects all parties to the agreement, thereby rendering the agreement useless. While they are an effective means to provide some resources to the organization in an emergency, they in themselves are not a replacement for a full disaster recovery plan, including alternate computer processing sites. *Answer "A management-level analysis that identifies the impact of losing an entitys resources" describes a business continuity plan.
*Answer "An appraisal or determination of the effects of a disaster on human, physical, economic, and natural resources" describes a damage assessment *answer "Activities taken to eliminate or reduce the degree of risk to life and property" describes risk mitigation.
Source: NFPA 1600 Standard on Disaster/Emergency Management and Business Continuity, National Fire Protection Association, 2000 edition, and Emergency Management Guide for Business and Industry, Federal Emergency Management Agency, August 1998.
67
Which of the following would best describe a cold backup site?
A. A computer facility available with electrical power and HVAC and some file/print servers, although the applications are not installed or configured and all of the needed workstations may not be on site or ready to begin processing
B. A computer facility with no electrical power or HVAC
C. A computer facility with electrical power and HVAC but with no workstations or servers on-site prior to the event and no applications installed
D. A computer facility with electrical power and HVAC, all needed applications installed and configured on the file/print servers, and enough workstations present to begin processing
Answer: C
Explanation: A computer facility with electrical power and HVAC, with workstations and servers available to be brought on-site when the event begins and no applications installed, is a cold site. * Answer "A computer facility with electrical power and HVAC, all needed applications installed and configured on the file/print servers, and enough workstations present to begin processing" is a hot site *answer "A computer facility available with electrical power and HVAC and some file/print servers, although the applications are not installed or configured and all of the needed workstations may not be on site or ready to begin processing" is a warm site. *Answer "A computer facility with no electrical power or HVAC" is just an empty room.
68
According to the Internet Activities Board (IAB), an activity that causes which of the following is considered a violation of ethical behavior on the Internet?
A. Wasting resources
B. Using a computer to bear false witness
C. Using a computer to steal
D. Appropriating other peoples intellectual output
Answer: A
Explanation: The correct answer is Wasting resources. The other answers are ethical considerations of other organizations.
69
Which choices below are roles or responsibility of the person designated to manage the contingency planning process? Select three
A. Providing direction to senior management
B. Ensuring the identification of all critical business functions
C. Integrating the planning process across business units
D. Providing stress reduction programs to employees after an event
.
Answer: A,B,C
Explanation: Contingency planners have many roles and responsibilities when planning business continuity, disaster recovery, emergency management, or business resumption processes. In addition to correct answers some of these roles and responsibilities can include: Ensuring executive management compliance with the contingency plan program Providing periodic management reports and status Coordinating and integrating the activation of emergency response organizations Answer "Providing stress reduction programs to employees after an event", providing stress reduction programs to employees after an event, is a responsibility of the human resources area. Source: Contingency Planning and Management, Contingency Planning 101, by Kelley Goggins, March 1999
70
```
Which of the following is NOT considered a natural disaster?
A. Flood
B. Tsunami
C. Earthquake
D. Sabotage
```
Answer: D
Explanation:
71
Which choice below is the BEST description of a Protection Profile (PP), as defined by the Common Criteria (CC)?
A. A reusable definition of product security requirements
B. An intermediate combination of security requirement components
C. A statement of security claims for a particular IT security product
D. The IT product or system to be evaluated
Answer: A
Explanation: The Common Criteria (CC) is used in two ways: As a standardized way to describe security requirements for IT products and systems As a sound technical basis for evaluating the security features of these products and systems The CC defines three useful constructs for building IT security requirements: the Protection Profile (PP), the Security Target (ST), and the PackagE. The PP is an implementation-independent statement of security needs for a set of IT security products. The PP contains a set of security requirements and is intended to be a reusable definition of product security requirements that are known to be useful and effectivE. APP gives consumers a means of referring to a specific set of security needs and communicating them to manufacturers and helps future product evaluation against those needs. Answer a defines the Security Target (ST). The ST is a statement of security claims for a particular IT security product or system. The ST parallels the structure of the PP, though it has additional elements that include product-specific detailed information. An ST is the basis for agreement among all parties as to what security the product or system offers, and therefore the basis for its security evaluation. *Answer "An intermediate combination of security requirement components" describes the PackagE. The Package is an intermediate combination of security requirements components. The package permits the expression of a set of either functional or assurance requirements that meet some particular need, expressed as a set of security objectives. *Answer "The IT product or system to be evaluated" describes the Target of Evaluation (TOE). The TOE is an IT product or system to be evaluated, the security characteristics of which are described in specific terms by a corresponding ST, or in more general terms by a PP. This evaluation consists of rigorous analysis and testing performed by an accredited, independent laboratory. The scope of a TOE evaluation is set by the Evaluation Assurance Level (EAL) and other requirements specified in the ST. Part of this process is an evaluation of the ST itself, to ensure that it is correct, complete, and internally consistent and can be used as the baseline for the TOE evaluation. Source: Common Criteria Project.
72
Which choice below best describes the function of change control?
A. To assign parts of security-sensitive tasks to more than one individual
B. To ensure that system changes are implemented in an orderly manner
C. To guarantee that an operator is only given the privileges needed for the task
D. To guarantee that transaction records are retained IAW compliance requirements
Answer: B
Explanation: The correct answer is "To ensure that system changes are implemented in an orderly manner". Answer "To guarantee that an operator is only given the privileges needed for the task" describes least privilege. Answer "To guarantee that transaction records are retained IAW compliance requirements" describes record retention. Answer "To assign parts of security-sensitive tasks to more than one individual" describes separation on duties.
73
```
Which choice below represents the most important first step in creating a business resumption plan?
A. Analyzing the business impact
B. Obtaining senior management support
C. Performing a risk analysis
D. Planning recovery strategies
```
Answer: B
Explanation: The business resumption, or business continuity plan, must have total, highly visible senior management support. Senior management must agree on the scope of the project, delegate resources for the success of the project, and support the timeline and training efforts. Source: Contingency Planning and Management, Contingency Planning 101, by Kelley Goggins, March 1999.
74
A pen register is a:
A. Device that records the caller-ID of incoming calls
B. Device that records the URLs accessed by an individual
C. Device that identifies the cell in which a mobile phone is operating
D. Device that records all the numbers dialed from a specific telephone line
Answer: D
Explanation: (Electronic Privacy Information Center, Approvals for Federal Pen Registers and Trap and Trace Devices 1987-1998, www.epic. org). Gathering information as to which numbers are dialed from a
specific telephone line is less costly and ime-consuming than installing a wiretap and recording the information. * There is also equipment that can record the information listed in answers "Device that identifies the cell in which a mobile phone is operating" and "Device that records the URLs accessed by an individual". * The device referred to in answer "Device that records the caller-ID of incoming calls" is called a trap-and-trace device. All of the answers in this question are a subset of the category of traffic analysis wherein patterns and frequency associated with communications are studied instead of the content of the communications.
75
In an object-oriented system, polymorphism denotes:
A. Objects of many different classes that are unrelated but respond to some common set of operations in the same way.
B. Objects of many different classes that are related by some common superclass; thus, all objects denoted by this name can respond to some common set of operations in identical fashion.
C. Objects of many different classes that are related by some common superclass; thus, any object denoted by this name can respond to some common set of operations in a different way.
D. Objects of the same class; thus, any object denoted by this name can respond to some common set of operations in the same way.
```
Answer: C
Explanation: Objects of many different classes that are related by some common superclass that are able to respond to some common set of operations in a different way.
The other answers are incorrect by the definition of polymorphism.
```
76
Because the development of new technology usually outpaces the law, law enforcement uses which traditional laws to prosecute computer criminals?
A. Conspiracy and elimination of competition
B. Immigration
C. Embezzlement, fraud, and wiretapping
D. Malicious mischief
Answer: C
Explanation: *Answer Malicious mischief is not a law *answer Immigration is not applicable because it applies to obtaining visas and so on *answer Conspiracy and elimination of competition is not correct because the crimes in answer "Embezzlement, fraud, and wiretapping" are more commonly used to prosecute computer crimes.
77
Which statement below is NOT correct about reviewing user accounts?
A. User account reviews can examine conformity with the concept of least privilege.
B. User account reviews cannot be conducted by outside auditors.
C. User account reviews may be conducted on a system-wide basis.
D. User account reviews may be conducted on an application-byapplication basis.
Answer: B
Explanation: It is necessary to regularly review user accounts on a system. Such reviews may examine the levels of access each individual has, conformity with the concept of least privilege, whether all accounts are still active, whether management authorizations are up-to-date, or whether required training has been completed, for example. These reviews can be conducted on at least two levels: on an application-by-application basis or on a systemwide basis. Both kinds of reviews can be conducted by, among others, in-house systems personnel (a selfaudit), the organizations internal audit staff, or external auditors. Source: National Institute of Standards and Technology, An Introduction to Computer Security: The NIST Handbook Special Publication 800-12.
78
The Federal Sentencing Guidelines:
A. Established a category of sensitive information called Sensitive But Unclassified (SBU).
B. Prohibit altering, damaging, or destroying information in a federal interest computer.
C. Hold senior corporate officers personally liable if their organizations do not comply with the law.
D. Prohibit eavesdropping or the interception of message contents.
Answer: C
Explanation: *Answer "Prohibit altering, damaging, or destroying information in a federal interest computer" is part of the US Computer Fraud and Abuse Act. * Answer "Prohibit eavesdropping or the interception of message contents" is part of the US Electronic Communications Privacy Act. Answer "Established a category of sensitive information called Sensitive But Unclassified (SBU)" is part of the US Computer Security Act.
79
In the software life cycle, verification:
A. Evaluates the product in development against the specification.
B. Evaluates the product in development against real-world requirements.
C. Evaluates the product in development against similar products.
D. Evaluates the product in development against general baselines.
Answer: A
Explanation: In the software life cycle, verification evaluates the product in development against the specification. Answer "Evaluates the product in development against real-world requirements" defines validation.
80
Inappropriate computer activities could be described as:
A. Data scavenging through the resources available to normal system users.
B. Theft of information or trade secrets for profit or unauthorized disclosure.
C. Computer behavior that might be grounds for a job action or dismissal.
D. Loss incurred unintentionally though the lack of operator training.
Answer: C
Explanation: The correct answer is "Computer behavior that might be grounds for a job action or dismissal". While all of the activities described are considered in the broad category of inappropriate activities, this description is used to define a narrower category of inappropriate activities. Answer "Loss incurred unintentionally though the lack of operator training." is defined as accidental loss. Answer "Theft of information or trade secrets for profit or unauthorized disclosure." is considered intentionally illegal computer activity. Answer "Data scavenging through the resources available to normal system users."is a keyboard attack, a type of data scavenging attack using common tools or utilities
81
What does normalizing data in a data warehouse mean?
A. Data is restricted to a range of values.
B. Numerical data is divided by a common factor.
C. Data is converted to a symbolic representation.
D. Redundant data is removed.
Answer: D
Explanation: The correct answer is removing redundant data.
82
```
Which of the following is NOT a component of configuration management?
A. Configuration control
B. Configuration status accounting
C. Configuration review
D. Configuration audit
```
Answer: C
Explanation: The correct answer is "Configuration review", a distracter. *Answer configuration control involves controlling changes to configuration items and issuingversions of configuration items from the software library. *Configuration status accountingis the processing of changes. * Configuration audit is the process of controlling the quality of configuration management procedures.
83
The Common Object Model (COM) that supports the exchange of objects among programs was formerly known as:
A. An Object Request Broker (ORB).
B. The Distributed Common Object Model (DCOM).
C. Object Rationalization and Linking (ORL).
D. Object Linking and Embedding (OLE).
Answer: D
Explanation: The correct answer is OLE. Answer DCOM defines the standard for sharing objects in a networked environment. Answer ORL is a distracter. An ORB is a locator and distributor of objects across networks.
84
What is a neural network?
A. A series of networked PCs performing artificial intelligence tasks
B. A hardware or software system that emulates the functioning of biological neurons
C. A collection of computers that are focused on medical applications
D. A hardware or software system that emulates the reasoning of a human expert
Answer: B
Explanation: A neural network is a hardware or software system that emulates the functioning of biological neurons. Answer "A hardware or software system that emulates the reasoning of a human expert" refers to an expert system. The other answers are distracters.
85
Why is it so important to test disaster recovery plans frequently?
A. Natural disasters can change frequently.
B. The businesses that provide subscription services might have changed ownership.
C. Employees might get bored with the planning process.
D. A plan is not considered viable until a test has been performed.
Answer: D
Explanation: A plan is not considered functioning and viable until a test has been performed. An untested plan sitting on a shelf is useless and might even have the reverse effect of creating a false sense of security. While the other answers are good reasons to test, they are not the primary reason.
86
```
The Object Request Architecture (ORA) is a high-level framework for a distributed environment. It consists of four components. Which of the following items is NOT one of those components?
A. Object Services
B. Application Objects
C. Application Services
D. Object Request Brokers (ORBs)
```
Answer: C
Explanation: The other answers plus Common Facilities comprise the ORA. The ORA is a product of the Object Management Group (OMG), which is a nonprofit consortium in Framingham, Massachusetts that was put together in 1989 to promote the use of object technology in distributed computing systems (www.omg.org). *The ORB is the fundamental building block of ORA and manages the communications between the ORAentities. The purpose of the ORB is to support the interaction of objects in heterogeneous, distributed environments. The objects may be on different types of computing platforms. *Object Services, supports the ORB in creating and tracking objects as well as performing access control functions.
*Application Objects and Common Facilities support the end user and use the system services to perform their functions.
87
```
Which of the following is NOT a Software CMM maturity level?
A. Initial
B. Behavioral
C. Managed
D. Repeatable
```
Answer: B Explanation: The word behavioral is a distracter. The five software process maturity levels are: Initial the software process is ad hoc and most processes are undefined. Repeatable fundamental project management processes are in place. Defined the software process for both management and engineering functions is documented, standardized, and integrated into the organization. Managed the software process and product quality are measured, understood, and controlled. Optimizing continuous process improvement is being performed.
88
If C represents the cost of instituting safeguards in an information system and L is the estimated loss resulting from exploitation of the corresponding vulnerability, a legal liability exists if the safeguards are not implemented when:
A. C/L = a constant
B. C>L
C. C
Answer: C
Explanation: The correct answer is C
89
```
Which of the following is NOT considered an element of a backup alternative?
A. Remote journaling
B. Warm site
C. Electronic vaulting
D. Checklist
```
Answer: D
Explanation: The correct answer is Checklist. A checklist is a type of disaster recovery plan test. Electronic vaulting is the batch transfer of backup data to an off-site location. Remote journaling is the parallel processing of transactions to an alternate site. A warm site is a backup processing alternative.
90
In configuration management, what is a software library?
A. A controlled area accessible only to approved users who are restricted to the use of an approved procedure
B. A set of versions of the component configuration items
C. A collection of software build lists
D. A repository of backup tapes
Answer: A
Explanation: In configuration management, a software library is a controlled area accessible only to approved users who are restricted to the use of approved procedure. Answer "A set of versions of the component configuration items" is incorrect because it defines a build list. Answer "A repository of backup tapes" is incorrect because it defines a backup storage facility. Answer "A collection of software build lists" is a distracter.
91
The European Union (EU) has enacted a Conditional Access Directive (CAD) that addresses which of the following?
A. Access to and use of copyrighted material
B. Unauthorized access to Internet subscription sites and pay TV services
C. Reverse engineering
D. Use of copyrighted material by libraries
Answer: B
Explanation: The focus of the CAD is on access to services as opposed to access to works. As of this writing, the EU is discussing a directive focusing on copyrights, but it has not been finalizeD. It is anticipated that this directive will be similar to the US DMCA(Question 7). The other answers are copyright issues that will be addressed by the EU Copyright Directive or by other related directives.
92
Which choice below is NOT considered an appropriate role for senior
management in the business continuity and disaster recovery process?
A. Delegate recovery roles
B. Closely control media and analyst communications
C. Publicly praise successes
D. Assess the adequacy of information security during the disaster recovery
Answer: D
Explanation: The tactical assessment of information security is a role of information management or technology management, not senior management. In addition to the elements of answers a, b, and c above, senior management has many very important roles in the process of disaster recovery, including: Remaining visible to employees and stakeholders Directing, managing, and monitoring the recovery Rationally amending business plans and projections Clearly communicating new roles and responsibilities Senior management must resist the temptation to participate handson in the recovery effort, as these efforts should be delegated. Information or technology management has more tactical roles to play, such as: Identifying and prioritizing mission-critical applications Continuously reassessing the recovery sites stability Recovering and constructing all critical data Source: Business Recovery Checklist, KPMG LLP 2001.
93
Cyclic redundancy checks, structured walkthroughs, and hash totals are
examples of what type of application controls?
A. Corrective consistency controls
B. Preventive security controls
C. Preventive consistency controls
D. Detective accuracy controls
Answer: D
Explanation: Cyclic redundancy checks, structured walkthroughs, and hash totals are examples of detective accuracy controls. The other answers do not apply by the definition of the types of controls.
94
Which choice below is NOT an example of intentionally inappropriate operator activity?
A. Using unauthorized access levels to violate information confidentiality
B. Making errors when manually inputting transactions
C. Using the companys system to store pornography
D. Conducting private business on the company system
Answer: B
Explanation: While "Making errors when manually inputting transactions" is most certainly an example of a threat to a systems integrity, it is considered unintentional loss, not an intentional activity.
95
Which choices below are considered an appropriate roles for Financial
Management in the business continuity and disaster recovery process? Select three
A. Tracking the recovery costs
B. Monitoring employee morale and guarding against employee burnout
C. Reassessing cash flow projections
D. Formally notifying insurers of claims
Answer: A,C,D
Explanation: Monitoring employee morale and guarding against employee burnout during a disaster recovery event is the proper role of human resources. Other emergency recovery tasks associated with human resources could include: Providing appropriate retraining Monitoring productivity of personnel Providing employees and family with counseling and support In addition to the correct answers above, during an emergency, the financial area is responsible for: Re-establishing accounting processes, such as payroll, benefits, and accounts payable Re-establishing transaction controls and approval limits Source: Business Recovery Checklist, KPMG LLP 2001, and Contingency Planning and Management, Contingency Planning 101, by Kelley Goggins, March 1999.
96
Which statement below is the most accurate about the results of the disaster recovery plan test?
A. The plan should not be changed no matter what the results of the test.
B. If no deficiencies were found during the test, then the plan is probably perfect.
C. The results of the test should be kept secret.
D. If no deficiencies were found during the test, then the test was probably flawed.
Answer: D
Explanation: The purpose of the test is to find weaknesses in the plan. Every plan has weaknesses. After the test, all parties should be advised of the results and the plan updated to reflect the new information.
97
Which choice below would NOT be a common element of a transaction
trail?
A. Why the transaction was processed
B. The date and time of the transaction
C. Who processed the transaction
D. At which terminal the transaction was processed
Answer: A
Explanation: Why the transaction was processed is not initially a concern of the audit log, but we will investigate it later. The other three elements are all important information that the audit log of the transaction should record.
98
In 1996, the World Intellectual Property Organization (WIPO) sponsored a treaty under which participating countries would standardize treatment of digital copyrights. One of the items of standardization was the
prohibition of altering copyright management information (CMI) that is included with the copyrighted material. CMI is:
A. Licensing and ownership information
B. A listing of Public keys
C. An encryption algorithm
D. Product description information
Answer: A
Explanation: The other answers are distracters. The WIPO digital copyright legislation that resulted in the US was the 1998 Digital Millennium Copyright Act (DMCA). In addition to addressing answer d, the DMCAprohibits trading, manufacturing, or selling in any way that is intended to bypass copyright protection mechanisms. It also addresses Internet Service Providers (ISPs) that unknowingly support the posting of copyrighted material by subscribers. If the ISP is notified that the material is copyrighted, the ISP must remove the material. Additionally, if the posting party proves that the removed material was of lawful use, the ISP must restore the material and notify the copyright owner within 14 business days. Two important rulings regarding the DMCA were made in 2001. The rulings involved DeCSS, which is a program that bypasses the Content Scrambling System (CSS) software used to prevent viewing of DVD movie disks on unlicensed platforms. In a trade secrecy case [DVD-CCA v. Banner], the California Appellate Court overturned a lower court ruling that an individual who posted DeCSS on the Internet had revealed the trade secret of CSS. The appeals court has reversed an injunction on the posting of DeCSS, stating that the code is speech-protected by the First Amendment. The second case [Universal City v. Reimerdes] was the first constitutional challenge to DMCA anti-circumvention rules. The case involved Eric Corley, the publisher of the hacker magazine 2600 MagazinE. Corley was covering the DeCSS situation and, as part of that coverage, posted DeCSS on his publications Web site. The trial and appellate courts both ruled that the posting violated the DMCA and was, therefore, illegal. This ruling upheld the DMCA. It appears that there will be more challenges to DMCA in the future.
99
When should the public and media be informed about a disaster?
A. When any emergency occurs at the facility, internally or externally
B. When the publics health or safety is in danger
C. When the disaster has been contained
D. Whenever site emergencies extend beyond the facility
Answer: D
Explanation: When an emergency occurs that could potentially have an impact outside the facility, the public must be informed, regardless of whether there is any immediate threat to public safety. The disaster recovery plan should include determinations of the audiences that may be affected by an emergency, and procedures to communicate with them. Information the public will want to know could include public safety or health concerns, the nature of the incident, the remediation effort, and future prevention steps. Common audiences for information could include: The media Unions and contractors Shareholders Neighbors Employees families and retirees Since the media is such an important link to the public, disaster plans and tests must contain procedures for addressing the media and communicating important information. A trained spokesperson should be designated, and established communications procedures should be prepared. Accurate and approved information should be released in a timely manner, without speculation, blame, or obfuscation. Source: Emergency Management Guide for Business and Industry, Federal Emergency Management Agency, August, 1998
100
Which choices below are valid reasons for testing the
disaster recovery plan? Select three
A. Testing verifies the accuracy of the recovery procedures.
B. Testing identifies deficiencies within the recovery procedures.
C. Testing provides the contingency planner with recent documentation.
D. Testing prepares the personnel to properly execute their emergency duties.
Answer: A,B,D
Explanation: The correct answers are all excellent reasons for testing a disaster recovery plan. Until a disaster recovery plan has been tested thoroughly, no plan can be considered complete. Since the functionality of the plan directly determines the ability of an organization to survive a business interrupting event, testing is the only way to have some degree of confidence that the plan will work. *Answer "Testing provides the contingency planner with recent documentation" is a distracter. Source: The International Handbook of Computer Security, by Jae K. Shim, Anique A. Qureshi, and Joel G. Siegel (The Glenlake Publishing Co. Ltd, 2000).
101
```
Discovery, recording, collection, and preservation are part of what process related to the gathering of evidence?
A. The chain of evidence
B. Admissibility of evidence
C. Relevance of evidence
D. The evidence life cycle
```
Answer: D
Explanation: The correct answer is The evidence life cycle. The evidence life cycle covers the evidence gathering and application process. * Answer "Admissibility of evidence" refers to certain requirements that evidence must meet to be admissible in court. * Answer "The chain of evidence" the chain of evidence, is comprised of steps that must be followed to protect the evidence. * Relevance of evidence is one of the requirements of evidence admissibility.
102
```
A device that is used to monitor Internet Service Provider (ISP) data
traffic is called:
A. Carnivore
B. Escrowed encryption
C. Echelon
D. Key manager
```
Answer: A
Explanation: Carnivore is a device used by the US FBI to monitor ISP traffiC. (S.P. Smith, et. al., Independent Technical Review of the Carnivore System Draft report, US Department of Justice Contract # 00-C-328 IITRI, CR-022- 216, Nov 17, 2000). Answer b, Echelon, refers to a cooperative, worldwide signal intelligence system that is run by the NSA of the United States, the Government Communications Head Quarters (GCHQ) of England, the Communications Security Establishment (CSE) of Canada, the Australian Defense Security Directorate (DSD), and the General Communications Security Bureau (GCSB) of New Zealand. These organizations are bound together under a secret 1948 agreement, UKUSA, [European Parliament, Development of Surveillance Technology and the Risk of Abuse of Economic Information, Luxembourg (April 1999), PE 166.184/Part 3 /4]. Answer c is a distracter and is discussed in the questions and answers of Chapter 4, Cryptography. Answer d is a distracter.
103
Which of the following is an example of mobile code?
A. Embedded code in control systems
B. Code derived following the spiral model
C. Embedded code in PCs
D. Java and ActiveX code downloaded into a Web browser from the World Wide Web (WWW)
Answer: D
Explanation: An example of mobile code is Java and ActiveX code downloaded into a Web browser from the World Wide WeB. The other answers are incorrect because they are types of code that are not related to mobile code.
104
Which statement below is the BEST example of separation of duties?
A. Getting users to divulge their passwords.
B. An activity that checks on the system, its users, or the environment.
C. One person initiates a request for a payment and another authorizes that same payment.
D. A data entry clerk may not have access to run database analysis reports.
Answer: C
Explanation: Separation of duties refers to dividing roles and responsibilities so that a single individual cannot subvert a critical process. In financial systems, no single individual should normally be given the authority to issue checks. Checks and balances need to be designed into both the process as well as the specific, individual positions of personnel who will implement the process. *Answer "An activity that checks on the system, its users, or the environment" describes system monitoring. *Answer "Getting users to divulge their passwords" is social engineering, a method of subverting system controls by getting users or administrators to divulge information about systems, including their passwords. *Answer "A data entry clerk may not have access to run database analysis reports" describes least privilege. Least privilege refers to the security objective of granting users only those accesses they need to perform their official duties. Least privilege does not mean that all users will have extremely little functional access; some employees will have significant access if it is required for their position. It is important to make certain that the implementation of least privilege does not interfere with the ability to have personnel substitute for each other without undue delay. Without careful planning, access control can interfere with contingency plans. Source: National Institute of Standards and Technology, An Introduction to Computer Security: The NIST Handbook Special Publication 800-12.
105
In the legal field, there is a term that is used to describe a computer system so that everyone can agree on a common definition. The term describes a computer for the purposes of computer security as any assembly of electronic equipment, hardware, software and firmware
configured to collect, create, communicate, disseminate, process, store and control data or information. This definition includes peripheral items such as keyboards, printers, and additional memory. The term that corresponds to this definition is:
A. An automated information system (AIS)
B. A microprocessor
C. A central processing unit (CPU)
D. An arithmetic logic unit (ALU)
Answer: A
Explanation: In some ways, this terminology harkens back to the days of large mainframe computers, but the term AIS is used in the legal community to refer to a computer system. Answer a, CPU, refers to the portion of a computer that performs arithmetic and logical operations on datA. To support these operations, the CPU incorporates a hardware arithmetic logic unit or ALU (answer c). The CPU is synonymous with the word processor. If the CPU is integrated onto a silicon chip, it is called a microprocessor (answer b). If the CPU is connected with memory and Input/Output (I/O) through a set of wires called a bus, the resulting combination is called a computer. This concept is shown in Figure.
106
```
The communication to an object to carry out an operation in an object oriented system is called a:
A. Note.
B. Method.
C. Message.
D. Behavior.
```
Answer: C
Explanation: Answer Note is a distracter. A method is the code that defines the actions an object performs in response to a messagE. Behavior is the result exhibited by an object upon receipt of a message.
107
Which media control below is the BEST choice to prevent data remanence on magnetic tapes or floppy disks?
A. Applying a concentration of hydriodic acid (55% to 58% solution) to the gamma ferric oxide disk surface
B. Overwriting the media with new application data
C. Degaussing the media
D. Making sure the disk is re-circulated as quickly as possible to prevent object reuse
Answer: C
Explanation: Degaussing is recommended as the best method for purging most magnetic mediA. Degaussing is a process whereby the magnetic
ISC CISSP Exam
"Pass Any Exam. Any Time." - www.actualtests.com 1029
media is erased, i.e., returned to its initial virgin statE. Erasure via degaussing may be accomplished in two ways: In AC erasure, the media is degaussed by applying an alternating field that is reduced in amplitude over time from an initial high value (i.e., AC-powered) In DC erasure, the media is saturated by applying a unidirectional field (i.e., DC-powered or by employing a permanent magnet) Another point about degaussing: Degaussed magnetic hard drives will generally require restoration of factory-installed timing tracks, so data purging is recommendeD. Also, physical destruction of CDROM or WORM media is required. *Answer " Overwriting the media with new application data" is not recommended because the application may not completely overwrite the old data properly, and strict configuration controls must be in place on both the operating system and the software itselF. Also, bad sectors on the media may not permit the software to overwrite old data properly. To satisfy the DoD clearing requirement, it is sufficient to write any character to all data locations in question (purging). To purge the media, the DoD requires overwriting with a pattern, then its complement, and finally with another pattern; e.g., overwrite first with 0011 0101, followed by 1100 1010, then 1001 0111. The number of times an overwrite must be accomplished depends on the storage media, sometimes on its sensitivity, and sometimes on differing DoD component requirements, but seven times is often recommended. *Answer "Applying a concentration of hydriodic acid (55% to 58% solution) to the gamma ferric oxide disk surface" is a rarely used method of media destruction, and acid solutions should be used in a well-ventilated area only by qualified personnel. *Answer "Making sure the disk is re-circulated as quickly as possible to prevent object reuse" is wrong. Source: NCSC-TG-025 A Guide to Understanding Data Remanence in Automated Information Systems.
108
A client/server implementation approach in which any platform may act as a client or server or both is called:
A. Peer-to-peer
B. Simple file transfer
C. Graphical User Interface (GUI)
D. Application Programming Interface (API)
Answer: A
Explanation: In answer Simple file transfer, a workstation or PC uses terminal emulation software and a client application program to receive data from a host machine. For answer API, an API defines how the client and server appear to each other and supports the exchange of information without either entity knowing the details of a particular resource that is accessed using the API. One example is the Generalized Security Application Programming Interface (GSAPI) that applications can use to access security services. Answer GUI, the GUI approach, is similar to the API implementation and employs a user interface such as SQL to access a server database.
109
Which of the following is NOT a European Union (EU) principle?
A. Data should be collected in accordance with the law.
B. Information collected about an individual cannot be disclosed to other organizations or individuals unless authorized by law or by consent of the individual.
C. Transmission of personal information to locations where equivalent personal data protection cannot be assured is permissible.
D. Data should be used only for the purposes for which it was collected and should be used only for reasonable period of time.
Answer: C
Explanation: The transmission of data to locations where equivalent personal data protection cannot be assured is NOT permissible. The other answers are EU principles.
110
Which term below MOST accurately describes the Trusted Computing Base (TCB)?
A. A piece of information that represents the security level of an object
B. A computer that controls all access to objects by subjects
C. Formal proofs used to demonstrate the consistency between a systems specification and a security model
D. The totality of protection mechanisms within a computer system
Answer: D
Explanation: The Trusted Computing Base (TCB) The totality of protection mechanisms within a computer system, including hardware, firmware, and software, the combination of which is responsible for enforcing a security policy. A TCB consists of one or more components that together enforce a unified security policy over a product or system. The ability of a trusted computing base to correctly enforce a security policy depends solely on the mechanisms within the TCB and on the correct input by system administrative personnel of parameters (e.g., a users clearance) related to the security policy. *Answer "A computer that controls all access to objects by subjects" describes the reference monitor concept. The reference monitor is an access control concept that refers to an abstract machine that mediates all accesses to objects by subjects. The Security Kernel consists of the hardware, firmware, and software elements of a Trusted Computing Base (or Network Trusted Computing Base partition) that implement the reference monitor concept. It must mediate all accesses, be protected from modification, and be verifiable as correct. *Answer "A piece of information that represents the security level of an object" refers to a sensitivity label. Asensitivity label is a piece of information that represents the extra security level of an object and describes the sensitivity (e.g., classification) of the data in the object. Sensitivity labels are used by the TCB as the basis for mandatory access control decisions. *Answer "Formal proofs used to demonstrate the consistency between a systems specification and a security model" describes formal verification. This is the process of using formal proofs to demonstrate the consistency (design verification) between a formal specification of a system and a formal security policy model or (implementation verification) between the formal specification and its program implementation. Source: DoD 5200.28-STD Department of Defense Trusted Computer System Evaluation Criteria
111
What is considered the major disadvantage to employing a hot site for disaster recovery?
A. The site is immediately available for recovery.
B. Maintaining the site is expensive.
C. Annual testing is required to maintain the site.
D. Exclusivity is assured for processing at the site.
Answer: B
Explanation: The correct answer is the expense of maintaining the site. A hot site is commonly used for those extremely time-critical functions that the business must have up and running to continue operating, but the expense of duplicating and maintaining all of the hardware, software, and application elements is a serious resource drain to most organizations
112
```
What is a subject-oriented, integrated, time-variant, non-volatile collection of data in support of managements decision-making process?
A. Data mart
B. Data model
C. Data warehouse
D. Data model
```
Answer: C
Explanation: This definition of a data warehouse is that of Bill Inmon, a pioneer in the field. To create a data warehouse, data is taken from an operational database, redundancies are removed, and the data is cleaned up in general. This activity is referred to as normalizing the data. Then the data is placed into a relational database and can be analyzed using On-Line Analytical Processing (OLAP) and statistical modeling tools. The data warehouse can be used as a Decision Support System (DSS), for example, by performing a time series analysis of the data. The data in the data warehouse must be maintained to ensure that it is timely and valid. The term data scrubbing refers to maintenance of the data warehouse by deleting information that is unreliable or no longer relevant. *A data mart, answer a, is a database that is comprised of data or relations that have been extracted from the data warehouse. Information in the data mart is usually of interest to a particular group of people. For example, a data mart may be developed for all health care-related data. *Answers Data model and Data model are distracters, although a data model, in this context, sometimes refers to the result of analyzing relationships among enterprise-wide data items.
113
Which choice below does NOT accurately describe a task of the Configuration Control Board?
A. The CCB assures that the changes made are approved, tested, documented, and implemented correctly.
B. The CCB should meet periodically to discuss configuration status accounting reports.
C. The CCB is responsible for documenting the status of configuration control activities.
D. The CCB is responsible for assuring that changes made do not jeopardize the soundness of the verification system.
Answer: C
Explanation: All analytical and design tasks are conducted under the direction of the vendors corporate entity called the Configuration Control Board (CCB). The CCB is headed by a chairperson who is responsible for assuring that changes made do not jeopardize the soundness of the verification system and assures that the changes made are approved, tested, documented, and implemented correctly. The members of the CCB should interact periodically, either through formal meetings or other available means, to discuss configuration management topics such as proposed changes, configuration status accounting reports, and other topics that may be of interest to the different areas of the system development. These interactions should be held to keep the entire system team updated on all advancements or alterations in the verification system. Answer b describes configuration accounting. Configuration accounting documents the status of configuration control activities and, in general, provides the information needed to manage a configuration effectively. The configuration accounting reports are reviewed by the CCB. Source: NCSC-TG-014-89, Guidelines for Formal Verification Systems.
114
Which choice below MOST accurately describes partitioned security
mode?
A. The only state in which certain privileged instructions may beexecuted.
B. A system containing information accessed by personnel with different security clearances.
C. All personnel have the clearance but not necessarily formal access approval.
D. All personnel have the clearance and formal access approval.
```
Answer: C
Explanation: A partitioned security mode is a mode of operation wherein all personnel have the clearance but not necessarily formal access approval and need-to-know for all information contained in the system. *Answer "All personnel have the clearance and formal access approval" is a compartmented security modE. A compartmented security mode is a mode of operation wherein all personnel have a valid personnel clearance, formal access approval and signed nondisclosure agreements, and valid need-to-know for that information to which he/she is to have access. *Answer "The only state in which certain privileged instructions may beexecuted" is executive statE. Executive state is one of several states in which a system may operate and the only one in which certain privileged instructions may be executeD. Such instructions cannot be executed when the system is operating in other (e.g., user) states. Synonymous with supervisor state. *Answer "A system containing information accessed by personnel with different security clearances" is multilevel securE. Multilevel secure is a class of system containing information with different sensitivities that simultaneously permits access by users with different security clearances and needs-to-know, but prevents users from obtaining access to information for which they lack authorization. Source: DoD 5200.28-STD Department of Defense Trusted Computer System Evaluation Criteria.
```
115
The SEI Software Capability Maturity Model is based on the premise that:
A. The quality of a software product is a direct function of the quality of its associated software development and maintenance processes.
B. The maturity of an organizations software processes cannot be measured.
C. Software development is an art that cannot be measured by conventional means.
D. Good software development is a function of the number of expert programmers in the organization.
Answer: A
Explanation: The quality of a software product is a direct function of the quality of its associated software development and maintenance processes. *Answer "Good software development is a function of the number of expert programmers in the organization" is false because the SEI Software CMM relates the production of good software to having the proper processes in place in an organization and not to expert programs or heroes. *Answer "The maturity of an organizations software processes cannot be measured" is false because the Software CMM provides means to measure the maturity of an organizations software processes. *Answer " Software development is an art that cannot be measured by conventional means" is false because the Software CMM provides means to measure the maturity of an organizations software processes.
116
The main differences between a software process assessment and a software capability evaluation are:
A. Software process assessments and software capability evaluations are essentially identical, and there are no major differences between the two.
B. Software capability evaluations determine the state of an organizations current software process and are used to gain support from within the organization for a software process improvement program; software process assessments are used to identify contractors who are qualified to develop software or to monitor the state of the software process in a current software project.
C. Software process assessments are used to develop a risk profile for source selection; software capability evaluations are used to develop an action plan for continuous process improvement.
D. Software process assessments determine the state of an organizations current software process and are used to gain support from within the organization for a software process improvement program; software capability evaluations are used to identify contractors who are qualified to develop software or to monitor the state of the software process in a current software project.
Answer: D
Explanation: The other answers are distracters. If, in answer "Software process assessments are used..." the terms software process assessments and software capability evaluations were interchanged, that result would also be correct. It would then read, Software capability evaluations are used to develop a risk profile for source selection; software process assessments are used to develop an action plan for continuous process improvement.
117
```
Which minimum TCSEC security class category specifies trusted distribution controls?
A. B2
B. B3
C. C2
D. A1
```
```
Answer: D
Explanation: Trusted distribution is defined by the Orange Book as a requirement of A1 TCB assurancE. Trusted distribution includes procedures to ensure that all of the TCB configuration items, such as the TCB software, firmware, hardware, and updates, distributed to a customer site arrive exactly as intended by the vendor without any alterations. Any alteration to the TCB at any time during the system life cycle could result in a violation of the system security policy. Assurance that the system security policy is correctly implemented and operational throughout the system life cycle is provided by different TCSEC requirements. At TCSEC class Al, trusted distribution, in conjunction with configuration management, provides assurance that the TCB software, firmware, and hardware, both original and updates, are received by a customer site exactly as specified by the vendors master copy. Trusted distribution also ensures that TCB copies sent from other than legitimate parties are detecteD. Source: NCSC-TG-008 A Guide to Understanding Trusted Distribution in Trusted Systems [Lavender Book].
```
118
A trade secret:
A. Provides the owner with a legally enforceable right to exclude others from practicing the art covered for a specified time period.
B. Is a word, name, symbol, color, sound, product shape, or device used to identify goods and to distinguish them from those made or sold by others.
C. Protects original works of authorship.
D. Secures and maintains the confidentiality of proprietary technical or business-related information that is adequately protected from disclosure by the owner.
Answer: D
Explanation: This defines a trade secret. *Answer "Provides the owner with a legally enforceable right to exclude others from practicing the art covered for a specified time period" refers to a patent. *Answer "Protects original works of authorship" refers to a copyright. *Answer "Is a word, name, symbol, color, sound, product shape, or device used to identify goods and to distinguish them from those made or sold by others" refers to a trademark.
119
Which choice below is NOT a security goal of an audit mechanism?
A. Review employee production output records B. Deter perpetrators attempts to bypass the system protection
mechanisms
C. Review patterns of access to individual objects
D. Discover when a user assumes a functionality with privileges greater than his own
Answer: A
Explanation: The audit mechanism of a computer system has five important security goals: 1. The audit mechanism must allow the review of patterns of access to individual objects, access histories of specific processes and individuals, and the use of the various protection mechanisms supported by the system and their effectiveness.2 2. Allow discovery of both users and outsiders repeated attempts to bypass the protection mechanisms. 3. Allow discovery of any use of privileges that may occur when a user assumes a functionality with privileges greater than his or her own, i.e., programmer to administrator. In this case, there may be no bypass of security controls, but nevertheless, a violation is made possible. 4. Act as a deterrent against perpetrators habitual attempts to bypass the system protection mechanisms. However, to act as a deterrent, the perpetrator must be aware of the audit mechanisms existence and its active use to detect any attempts to bypass system protection mechanisms. 5. Supply an additional form of user assurance that attempts to bypass the protection mechanisms that are recorded and discovered.3 Even if the attempt to bypass the protection mechanism is successful, the audit trail will still provide assurance by its ability to aid in assessing the damage done by the violation, thus improving the systems ability to control the damage.
Source: NCSC-TG-001 AGuide to Understanding Audit in Trusted Systems [Tan Book], and Gligor, Virgil D., Guidelines for Trusted Facility Management and Audit, University of Maryland, 1985.
120
Investigating and prosecuting computer crimes is made more difficult because:
A. Evidence cannot be preserved.
B. Evidence is mostly intangible.
C. Evidence is hearsay and can never be introduced into a court of law.
D. Backups may be difficult to find.
Answer: B
Explanation: The correct answer is "Evidence is mostly intangible". * Answer "Backups may be difficult to find" is incorrect because if backups are done, they usually can be located. * Answer "Evidence cannot be preserved" is incorrect because evidence can be preserved using the proper procedures. * Answer "Evidence is hearsay and can never be introduced into a court of law" is incorrect because there are exceptions to the hearsay rule
121
The discipline of identifying the components of a continually evolving system for the purposes of controlling changes to those components and
maintaining integrity and traceability throughout the life cycle is called:
A. Configuration management
B. Request control
C. Change control
D. Release control
Answer: A
Explanation: This is demonstrated in Configuration management of computer-based systems, British Standards Institution, 1984.
The other answers are components of the maintenance activity of software life cycle models. In general, one can look at the maintenance phase as the progression from request control, to change control, to release control. *Answer request control is involved with the users requests for changes to the softwarE. *Change controlinvolves the analysis and understanding of the existing code, and the design of changes, and corresponding test procedures. *Answer release control involves deciding which requests are to be implemented in the new release, performing the changes and conducting testing
122
```
Imprisonment is a possible sentence under:
A. Neither civil nor criminal law
B. Both civil and criminal law
C. Civil (tort) law
D. Criminal law
```
Answer: D
Explanation: The correct answer is Criminal law. It is the only one of the choices where imprisonment is possible.
123
According to FEMA, which choice below is NOT a recommended way to purify water after a disaster?
A. Distilling the water for twenty minutes
B. Adding 16 drops per gallon of household liquid bleach to the water
C. Adding water treatment tablets to the water
D. Boiling from 3 to 5 minutes
Answer: C
Explanation: FEMA recommends that water treatment products sold in camping or surplus stores should not be used, unless the only active ingredient is 5.25 percent hypochloritE. When adding liquid bleach, it should contain 5.25 percent hypochlorite and no other added cleaners or scents. Distilling the water is the most highly recommended method, as it also removes other chemicals and heavy metals, as well as most microbes. Source: Emergency Water and Food Procedures, Federal Emergency Management Agency, April, 1997.
124
```
Which element of Configuration Management listed below involves the use of Configuration Items (CIs)?
A. Configuration Identification
B. Configuration Control
C. Configuration Audit
D. Configuration Accounting
```
Answer: A
Explanation:
Configuration management entails decomposing the verification system into identifiable, understandable, manageable, trackable units known as Configuration Items (CIs). A CI is a uniquely identifiable subset of the system that represents the smallest portion to be subject to independent configuration control procedures. The decomposition process of a verification system into CIs is called configuration identification. CIs can vary widely in size, type, and complexity. Although there are no hard-and-fast rules for decomposition, the granularity of CIs can have great practical importancE. A favorable strategy is to designate relatively large CIs for elements that are not expected to change over the life of the system, and small CIs for elements likely to change more frequently. *Answer "Configuration Accounting", configuration accounting, documents the status of configuration control activities and in general provides the information needed to manage a configuration effectively. It allows managers to trace system changes and establish the history of any developmental problems and associated fixes. Answer "Configuration Audit", configuration audit, is the quality assurance component of configuration management. It involves periodic checks to determine the consistency and completeness of accounting information and to verify that all configuration management policies are being followed. Answer "Configuration Control", configuration control, is a means of assuring that system changes are approved before being implemented, only the proposed and approved changes are implemented, and the implementation is complete and accurate. Source: NCSC-TG-014-89, Guidelines for Formal Verification Systems.
125
Which of the following is NOT a characteristic of a client in the client/server model?
A. May be diskless
B. Systems backup and database protection
C. Extensive user interface
D. Data entry screens
Answer: B
Explanation: In the client/server model, the server is the data storage resource and is responsible for data backups and protection/maintenance of the database. Answer "May be diskless" refers to a diskless workstation or PC at the client side. By not providing local data storage capabilities at the client side, security is increased since the data is less vulnerable at a protected server location. Also, because the client is the users path into the network, the client must have extensive, user friendly interfaces such as described in answers Extensive user interface and Data entry screens.
126
```
Which of the following is NOT one of the five disaster recovery plan testing types?
A. Mobile
B. Checklist
C. Full Interruption
D. Simulation
```
Answer: A
Explanation: The correct answer is mobile. The other three are proper examples of elements of the five disaster recovery plan testing types.
127
Which statement below is NOT correct regarding the role of the recovery
team during the disaster?
A. The recovery team must be the same as the salvage team as they perform the same function.
B. The recovery team is often separate from the salvage team as they perform different duties.
C. The recovery team will need full access to all backup media.
D. The recovery teams primary task is to get predefined critical business functions operating at the alternate processing site.
Answer: A
Explanation: The recovery team performs different functions from the salvage team. The recovery teams primary mandate is to get critical processing re-established at an alternate site. The salvage teams primary mandate is to return the original processing site to normal processing environmental conditions.
128
Information Warfare is:
A. Developing weapons systems based on artificial intelligence technology.
B. Signal intelligence.
C. Attacking the information infrastructure of a nation to gain military and/or economic advantages.
D. Generating and disseminating propaganda material.
Answer: C
Explanation: * Answer "Developing weapons systems based on artificial intelligence technology" is a distracter and has to do with weapon systems development. * Answer "Generating and disseminating propaganda material" is not applicable. Answer "Signal intelligence" is the conventional acquisition of information from radio signal
129
A neural network learns by using various algorithms to:
A. Fire the rules in knowledge base.
B. Adjust the weights applied to the data.
C. Emulate the thinking of an expert.
D. Emulate an inference engine.
Answer: B
Explanation: The correct answer is A neural network learns by using various algorithms to adjust the weights applied to the data. The other answers are terminology referenced in expert systems
130
In the Capability Maturity Model (CMM) for software, the definition describes the range of expected results that can be achieved by following a software process is that of:
A. Software process capability
B. Structured analysis/structured design (SA/SD)
C. Software process maturity
D. Software process performance
Answer: A Explanation:
A software process is a set of activities, methods, and practices that are used to develop and maintain software and associated products. Software process capability is a means of predicting the outcome of the next software project conducted by an organization. * Answer software process performance, is the result achieved by following a software process. Thus, software capability is aimed at expected results while software performance is focused on results that have been achieved. *Software process maturity is the extent to which a software process is: Defined Managed Measured Controlled Effective Software process maturity, then, provides for the potential for growth in capability of an organization. An immature organization develops software in a crisis mode, usually exceeds budgets and time schedules, and software processes are developed in an ad hoc fashion during the project. In a mature organization, the software process is effectively communicated to staff, the required processes are documented and consistent, software quality is evaluated, and roles and responsibilities are understood for the project. Answer SA/SD is a distracter.
131
```
What is the number one priority of disaster response?
A. Protecting the hardware
B. Protecting the software
C. Transaction processing
D. Personnel safety
```
Answer: D
Explanation: The correct answer is Personnel safety. The number one function of all disaster response and recovery is the protection of the safety of people; all other concerns are vital to business continuity but are secondary to personnel safety.
132
```
Which task below would normally be considered a BCP task, rather than a DRP task?
A. Recovery procedures
B. Life safety processes
C. Project scoping
D. Restoration procedures
```
Answer: C
Explanation: Although many processes in making business continuity plans are similar to processes in creating disaster recovery plans, several differences exist. Business continuity planning processes that are unique to BCP could include: Project scoping and assigning roles Creating business impact and vulnerability assessments Choosing alternate processing sites whereas unique disaster recovery/emergency management processes could include: Implementing relocation procedures to the alternate site Plan testing and training Recovering data Salvaging damaged equipment Source: CISSP Examination Textbooks, Volume One: Theory, by S. Rao Vallabhaneni, SRV Professional Publications first edition 2000 and Handbook of Information Security Management, by Micki Krause and Harold F. Tipton, Auerback, 1999 edition.
133
In configuration management, a configuration item is:
A. A component whose state is to be recorded and against which changes are to be progressed.
B. The version of the operating system that is operating on the workstation that provides information security services.
C. Aseries of files that contains sensitive information.
D. The network architecture used by the organization.
Answer: A
Explanation: Acomponent whose state is to be recorded and against which changes are to be progressed
The other answers are incorrect by the definition of a configuration item.
134
Which one of the following conditions must be met if legal electronic monitoring of employees is conducted by an organization?
A. Employees must be unaware of the monitoring activity.
B. All employees must agree with the monitoring policy.
C. The organization must have a policy stating that all employees are regularly notified that monitoring is being conducted.
D. Results of the monitoring cannot be used against the employee.
Answer: C
Explanation: * Answer "Employees must be unaware of the monitoring activity" is incorrect because employees must be made aware of the monitoring if it is to be legal * answer "All employees must agree with the monitoring policy" is incorrect because employees do not have to agree with the policy
* answer "Results of the monitoring cannot be used against the employee" is incorrect because the results of monitoring might be used against the employee if the corporate policy is violated.
135
```
Which book of the Rainbow series addresses the Trusted Network Interpretation (TNI)?
A. Red Book
B. Purple Book
C. Orange Book
D. Green Book
```
Answer: A
Explanation: The Red Book is one book of the Rainbow Series, a six-foot-tall stack of books on evaluating Trusted Computer Systems according to the National Security Agency. The term Rainbow Series comes from the fact that each book is a different color. The Trusted Network Interpretation (TNI) extends the evaluation classes of the Trusted Systems Evaluation Criteria (DOD 5200.28-STD) to trusted network systems and components. * the Orange Book, is the main book of the Rainbow Series and most of the other books elaborate on the information contained in this book. The Orange Book is the DoD Trusted Computer System Evaluation Criteria [DOD 5200.28]1. * the Green Book, is CSC-STD-002-85, the DoD Password Management Guidelines. * the Purple Book, is NCSC-TG-014, Guidelines for Formal Verification Systems. Source: NCSC-TG-005 Trusted Network Interpretation [Red Book] and DoD Trusted Computer System Evaluation Criteria [DOD 5200.28-Orange Book.]
136
Which statement below is the BEST definition of need-to-know?
A. Need-to-know requires that the operator have the minimum knowledge of the system necessary to perform his task.
B. Need-to-know ensures that no single individual (acting alone) can compromise security controls.
C. Need-to-know grants each user the lowest clearance required for their tasks.
D. Need-to-know limits the time an operator performs a task.
Answer: A
Explanation: The concept of need-to-know means that, in addition to whatever specific object or role rights a user may have on the system, the user has also the minimum amount of information necessary to perform his job function.
* Answer "Need-to-know ensures that no single individual (acting alone) can compromise security controls." is separation of duties, assigning parts of tasks to different personnel. *Answer "Need-to-know grants each user the lowest clearance required for their tasks." is least privilege, the user has the minimum security level required to perform his job function. *Answer "Need-to-know limits the time an operator performs a task." is rotation of duties, wherein the amount of time an operator is assigned a security-sensitive task is limited before being moved to a different task with a different security classification.
137
```
The US Government Tempest program was established to thwart which one of the following types of attacks?
A. Emanation Eavesdropping
B. Denial of Service
C. Software Piracy
D. Dumpster Diving
```
Answer: A
Explanation: The correct answer is Emanation Eavesdropping. The Tempest program required shielding and other emanation reducing safeguards to be employed on computers processing classified data. The other answers are types of attacks against computers, but are not the focus of the Tempest program.
138
The concept of Due Care states that senior organizational management must ensure that:
A. Certain requirements must be fulfilled in carrying out their responsibilities to the organization.
B. Other management personnel are delegated the responsibility for information system security.
C. All risks to an information system are eliminated.
D. The cost of implementing safeguards is greater than the potential resultant losses resulting from information security breaches.
Answer: A
Explanation: * Answer "All risks to an information system are eliminated" is incorrect because all risks to information systems cannot be eliminated * answer "Other management personnel are delegated the responsibility for information system security" is incorrect because senior management cannot delegate its responsibility for information system security under due care * answer "The cost of implementing safeguards is greater than the potential resultant losses resulting from information security breaches" is incorrect because the cost of implementing safeguards should be less than or equal to the potential resulting losses relative to the exercise of due care.
139
What is the purpose of the Business Impact Assessment (BIA)?
A. To define a strategy to minimize the effect of disturbances and to allow for the resumption of business processes
B. To emphasize the organizations commitment to its employees and vendors
C. To create a document to be used to help understand what impact a disruptive event would have on the business
D. To work with executive management to establish a DRP policy
Answer: C
Explanation: The correct answer is: to create a document to be used to help understand what impact a disruptive event would have on the business. Answer "To define a strategy to minimize the effect of disturbances and to allow for the resumption of business processes" is the definition of business continuity planning.
140
In software engineering, the term verification is defined as:
A. To establish the fitness or worth of a software product for its operational mission
B. A complete, validated specification of the required functions, interfaces, and performance for the software product
C. A complete, verified specification of the overall hardware-software architecture, control structure, and data structure for the product
D. To establish the truth of correspondence between a software product and its specification
Answer: D
Explanation: In the Waterfall model (W.W. Royce, Managing the Development of Large Software Systems: Concepts and Techniques, Proceedings, WESCON, August 1970). * answer "A complete, validated specification of the required functions, interfaces, and performance for the software product" defines the term requirements. *Similarly, answer "To establish the fitness or worth of a software product for its operational mission", defines the term validation, and answer d is the definition of product design. In summary, the steps of the Waterfall model are: System feasibility Software plans and requirements Product design Detailed design Code Integration Implementation Operations and maintenance In this model, each phase finishes with a verification and validation (V&V) task that is designed to eliminate as many problems as possible in the results of that phase.
141
```
Which choice below is NOT one of the four major aspects of configuration management?
A. Configuration auditing
B. Configuration product evaluation
C. Configuration identification
D. Configuration status accounting
```
Answer: B
Explanation: The four major aspects of configuration management are: Configuration identification Configuration control Configuration status accounting Configuration auditing These aspects are described earlier in this chapter. Answer " Configuration product evaluation" is a distracter. Source: NCSC-TG-014-89, Guidelines for Formal Verification Systems [Purple Book].
142
```
Which of the following is NOT one of the primary goals of a BIA?
A. Downtime estimation
B. Criticality prioritization
C. Personnel safety
D. Resource requirements
```
Answer: C
Explanation: The correct answer is Personnel safety. Personnel safety is the primary priority of BCP and DRP, not BIA.
143
Which choice below most accurately describes a business continuity program?
A. A standard that allows for rapid recovery during system interruption and data loss
B. A determination of the effects of a disaster on human, physical, economic, and natural resources
C. A program that implements the mission, vision, and strategic goals of the organization
D. Ongoing process to ensure that the necessary steps are taken to identify the impact of potential losses and maintain viable recovery
Answer: D
Explanation: A business continuity program is an ongoing process supported by senior management and funded to ensure that the necessary steps are taken to identify the impact of potential losses, maintain viable recovery strategies and recovery plans, and ensure continuity of services through personnel training, plan testing, and maintenance. Answer "A program that implements the mission, vision, and strategic goals of the organization" describes a disaster/emergency management program. A disaster/ emergency management program, like a disaster recovery program, is a program that implements the mission, vision, and strategic goals and objectives as well as the management framework of the program and organization. *Answer "A determination of the effects of a disaster on human, physical, economic, and natural resources" describes a damage assessment. A damage assessment is an appraisal or determination of the effects of a disaster on human, physical, economic, and natural resources. *Answer "A standard that allows for rapid recovery during system interruption and data loss" is a distracter. Source: NFPA1600 Standard on Disaster/Emergency Management and Business Continuity, National Fire Protection Association, 2000 edition.
144
```
What is a data dictionary?
A. A validation reference source
B. A database for system developers
C. A library of objects
D. A database of security terms
```
Answer: B
Explanation: A data dictionary is a database for system developers. The other answers are distracters
145
```
Which choice below is NOT considered a potential hazard resulting from natural events?
A. Forest fire
B. Urban fire
C. Arson
D. Earthquake/land shift
```
Answer: C
Explanation: According to the NFPA, arson is an example of a potential hazard caused by a human event. Fires, in themselves, are considered natural events, like forest fires, range fires, urban or city fires, unless arson is thought to be the source of the blazE. Of the three categories of potential hazards (natural, technological, and human), human events could include: General strikes Terrorism Sabotage Mass hysteria Civil unrest Source: NFPA 1600 Standard on Disaster/Emergency Management and Business Continuity, National Fire Protection Association, 2000
edition.
146
Which choice below is NOT an example of a software control?
A. Routinely testing the backup data for accuracy
B. Implementing a formal application upgrade process
C. Controlling diagnostic ports on networked equipment
D. Employing anti-virus management and tools
Answer: C
Explanation: The correct answer is "Controlling diagnostic ports on networked equipment". This is an example of a hardware control. The other three are examples of software controls.
147
Which choices below are emergency management procedure directly related to financial decision making? Select three.
A. Establishing procedures for the continuance of payroll
B. Establishing program procurement procedures
C. Establishing critical incident stress procedures
D. Establishing accounting procedures to track the costs of emergencies
Answer: A,B,D
Explanation: The correct answers are all examples of emergency management procedures which must be established by the financial department to ensure that fiscal decisions are executed in accordance with authority levels and accounting practices. *Answer "Establishing critical incident stress procedures" is an example of a procedure that should be developed by the human resources department. The quality of employee morale and well-being can include psychological needs as well as physical needs, and the role of the human resources department is critical in monitoring and managing immediate, short-term, and long-term employee stress. Source: NFPA 1600 Standard on Disaster/Emergency Management and Business Continuity, National Fire Protection Association, 2000 edition.
148
Which statement below is accurate about Evaluation Assurance Levels (EALs) in the Common Criteria (CC)?
A. A security level equal to the security level of the objects to which the subject has both read and write access
B. Requirements that specify the security behavior of an IT product or system
C. A statement of intent to counter specified threats
D. Predefined packages of assurance components that make up security confidence rating scale
Answer: D
Explanation: An Evaluation Assurance Level (EAL) is one of seven increasingly rigorous packages of assurance requirements from CC Part 3. Each numbered package represents a point on the CCs predefined assurance scalE. An EAL can be considered a level of confidence in the security functions of an IT product or system. The EALs have been developed with the goal of preserving the concepts of assurance drawn from the source criteria, such as the Trusted Computer System Evaluation Criteria (TCSEC), Information Technology Security Evaluation Criteria (ITSEC), or Canadian Trusted Computer Evaluation Criteria (CTCPEC), so that results of previous evaluations remain relevant. EAL levels 2Ö7 are generally equivalent to the assurance portions of the TCSEC C2-A1 scale, although exact TCSEC mappings do not exist. *Answer "A security level equal to the security level of the objects to which the subject has both read and write access" is the definition of Subject Security Level. Asubjects security level is equal to the security level of the objects to which it has both read and write access. A subjects security level must always be dominated by the clearance of the user with which the subject is associated. * Answer "A statement of intent to counter specified threats" describes a Security Objective, which is a statement of intent to counter specified threats and/or satisfy specified organizational security policies and assumptions. *Answer "Requirements that specify the security behavior of an IT product or system" describes Security Functional Requirements. These are requirements, preferably from CC Part 2, that when taken together specify the security behavior of an IT product or system. Source: CC Project and DoD 5200.28-STD.
149
```
Which disaster recovery/emergency management plan testing type below is considered the most cost-effective and efficient way to identify areas of overlap in the plan before conducting more demanding training exercises?
A. Evacuation drill
B. Table-top exercise test
C. Full-scale exercise
D. Walk-through drill
```
Answer: B
Explanation: In a table-top exercise, members of the emergency management group meet in a conference room setting to discuss their responsibilities and how they would react to emergency scenarios. Disaster recovery/emergency management plan testing scenarios have several levels, and can be called different things. The primary hierarchy of disaster/emergency testing plan types is shown below. Checklist review. Plan is distributed and reviewed by business units for its thoroughness and effectiveness. Table-top exercise or structured walk-through test. Members of the emergency management group meet in a conference room setting to discuss their responsibilities and how they would react to emergency scenarios by stepping through the plan. Walk-through drill or simulation test. The emergency management group and response teams actually perform their emergency response functions by walking through the test, without actually initiating recovery procedures. More thorough than the table-top exercise. Functional drills. Test specific functions such as medical response, emergency notifications, warning and communications procedures, and equipment, although not necessarily all at once. Also includes evacuation drills, where personnel walk the evacuation route to a designated area where procedures for accounting for the personnel are tested. Parallel test or full-scale exercise. A real-life emergency situation is simulated as closely as possible. Involves all of the participants that would be responding to the real emergency, including community and external organizations. The test may involve ceasing some real production processing. Source: Emergency Management Guide for Business and Industry, Federal Emergency Management Agency, August 1998 and Computer Security Basics, by Deborah Russell and G.T. Gangemi, Sr. (OReilly, 1992).
150
In a system life cycle, information security controls should be:
A. Designed during the product implementation phase.
B. Specified after the coding phase.
C. Part of the feasibility phase.
D. Implemented prior to validation.
Answer: C
Explanation: In the system life cycle, information security controls should be part of the feasibility phase. The other answers are incorrect because the basic premise of information system security is that controls should be included in the earliest phases of the software life cycle and not added later in the cycle or as an afterthought.
151
Which of the following is NOT true regarding software unit testing?
A. The test data is part of the specifications.
B. Testing should check for out-of-range values and other bounds conditions.
C. Correct test output results should be developed and known beforehand.
D. Live or actual field data is recommended for use in the testing procedures.
Answer: D
Explanation: Live or actual field data are NOT recommended for use in testing because they do not thoroughly test all normal and abnormal situations and the test results are not known beforehand. The other answers are true of testing.
152
Which of the following actions by the US government are NOT permitted or required by the US Patriot Act, signed into law on October 26, 2001?
A. Search and seizure of information on live systems (including routers and servers), backups, and archives
B. Monitoring of Internet communications
C. Reporting of cash and wire transfers of $5,000 or more
D. Subpoena of electronic records
Answer: C
Explanation: Wire and cash transfers of $10,000 or more in a single transaction must be reported to government officials.
Actions in answers "Subpoena of electronic records", "Monitoring of Internet communications", and c are permitted under the Patriot Act.
In answers "Subpoena of electronic records" and "Monitoring of Internet communications", the government has new powers to subpoena electronic records and to monitor Internet traffic. In monitoring information, the government can require the assistance of ISPs and network operators. This monitoring can even extend into individual organizations. In the Patriot Act, Congress permits investigators to gather information about electronic mail without having to show probable cause that the person to be monitored had committed a crime or was intending to commit a crime. In answer c, the items cited now fall under existing search and seizure laws. A new twist is delayed notification of a search warrant. Under the Patriot Act, if it suspected that notification of a search warrant would cause a suspect to flee, a search can be conducted before notification of a search warrant is given. In a related matter, the US and numerous other nations have signed the Council of Europes Cybercrime Convention. In the US, participation in the Convention has to be ratified by the Senate. In essence, the Convention requires the signatory nations to spy on their own residents, even if the action being monitored is illegal in the country in which the monitoring is taking place.
153
```
The equation Z = f [wn in ], where Z is the output, wn are weighting functions, and in is a set of inputs describes:
A. An artificial neural network (ANN)
B. A knowledge-based system
C. An expert system
D. A knowledge acquisition system
```
Answer: A
Explanation: The equation defines a single layer ANN as shown in Figure.
Each input, in, is multiplied by a weight, wn , and these products are fed into a summation transfer function, , that generates an output, Z. Most neural networks have multiple layers of summation and weighting functions, whose interconnections can also be changed. There are a number of different learning paradigms for neural networks, including reinforcement learning and back propagation. In reinforcement learning a training set of inputs is provided to the ANN along with a measure of how close the network is coming to a solution. Then, the weights and connections are readjusted. In back propagation, information is fed back inside the neural network from the output and is used by the ANN to make weight and connection adjustments. *Answers An expert system and A knowledge-based system are distracters that describe systems that use knowledge-based rules of experts to solve problems using an inferencing mechanism. *A knowledge acquisition system refers to the means of identifying and acquiring the knowledge to be entered into the knowledge base of an expert system.
154
Which choice below is NOT an example of a media control?
A. Printing to a printer in a secured room
B. Conducting background checks on individuals
C. Sanitizing the media before disposition
D. Physically protecting copies of backup media
Answer: B
Explanation: The answer is a personnel control. Most support and operations staff have special access to the system. Some organizations conduct background checks on individuals filling these positions to screen out possibly untrustworthy individuals. *Answer "Sanitizing the media before disposition": The process of removing information from media before disposition is called sanitization. Three techniques are commonly used for media sanitization: overwriting, degaussing, and destruction. *Answer "Printing to a printer in a secured room": It may be necessary to actually output data to the media in a secure location, such as printing to a printer in a locked room instead of to a general-purpose printer in a common area. *Answer "Physically protecting copies of backup media": Physical protection of copies of backup media stored offsite should be accorded a level of protection equivalent to media containing the same information stored onsite. Source: National Institute of Standards and Technology, An Introduction to Computer Security: The NIST Handbook Special Publication 800-12.
155
```
The chain of evidence relates to:
A. Handling and controlling evidence.
B. Making a disk image.
C. DNA testing.
D. Securing laptops to desks during an investigation.
```
Answer: A
Explanation: * Answer "Securing laptops to desks during an investigation" relates to physical security *answer "DNA testing" is a type of biological testing * answer "Signal intelligence" is part of the act of gathering evidence.
156
```
Which of the following is NOT a category of law under the Common Law System?
A. Administrative/Regulatory law
B. Criminal law
C. Civil law
D. Derived law
```
Answer: D
Explanation: The correct answer is Derived law. It is a distracter, and all of the other answers are categories under common law.
157
```
Which choice below is considered the HIGHEST level of operator privilege?
A. Read/Write
B. Read Only
C. Access Change
D. Write Only
```
Answer: C
Explanation: The correct answer is Access Change. The three common levels of operator privileges, based on the concept of least privilege, are: Read Only Lowest level, view data only Read/Write View and modify data Access Change Highest level, right to change data/operator permissions Answer d is a distracter.
158
In the modified Waterfall Model:
A. Product verification and validation are not included.
B. The model was reinterpreted to have phases begin at project milestones.
C. The model was reinterpreted to have phases end at project milestones.
D. Unlimited backward iteration is permitted.
Answer: C
Explanation: The modified Waterfall model was reinterpreted to have phases end at project milestones. Answer "Unlimited backward iteration is permitted" is false because unlimited backward iteration is not permitted in the modified Waterfall model. Answer "The model was reinterpreted to have phases begin at project milestones" is a distracter. Answer "Product verification and validation are not included" is false because verification and validation are included.
159
Which choice below is the MOST accurate description of a warm site?
A. A backup processing facility with adequate electrical wiring and air conditioning, but no hardware or software installed
B. A backup processing facility with all hardware and software installed and 100% compatible with the original site, operational within hours
C. A mobile trailer with portable generators and air conditioning
D. A backup processing facility with most hardware and software installed, which can be operational within a matter of days
Answer: D
Explanation: The three most common types of remote off-site backup processing facilities are hot sites, warm sites, and cold sites. They are primarily differentiated by how much preparation is devoted to the site, and therefore how quickly the site can be used as an alternate processing site
160
What phase of the object-oriented software development life cycle is described as emphasizing the employment of objects and methods rather
than types or transformations as in other software approaches?
A. Object-oriented requirements analysis
B. Object-oriented programming
C. Object-oriented design
D. Object-oriented analysis
Answer: B
Explanation: Answer "Object-oriented requirements analysis" defines classes of objects and their interactions. Answer "Object-oriented analysis", object-oriented analysis, is the process of understanding and
modeling of a specific problem within a problem domain. Object-oriented design is design in which the object is the basic unit of modularity and objects are instantiations of a class.
161
Responsibility for handling computer crimes in the United States is assigned to:
A. The Federal Bureau of Investigation (FBI) and the Secret Service.
B. The Central Intelligence Agency (CIA).
C. The National Security Agency (NSA).
D. The FBI only.
Answer: A
Explanation: The correct answer is "The Federal Bureau of Investigation (FBI) and the Secret Service", making the other answers incorrect.
162
What is the difference between a parallel disaster recovery plan test
and a full interruption disaster recovery plan test?
A. There is no difference; both terms mean the same thing.
B. Functional business unit representatives meet to review the plan to ensure it accurately reflects the organizations recovery strategy.
C. While a parallel test tests the processing functionality of the alternate site, the full-interruption test actually replicates a disaster by halting production.
D. While a full-interruption test tests the processing functionality of the alternate site, the parallel test actually replicates a disaster by halting
production.
Answer: C
Explanation: parallel test tests the processing functionality of the alternate site, whereas the full-interruption test actually replicates a disaster by halting production. *Answer "Functional business unit representatives meet to review the plan to ensure it accurately reflects the organizations recovery strategy" is the definition of a checklist test type.
163
Which choice below MOST accurately describes a Covert Storage Channel?
A. A process that manipulates observable system resources in a way that affects response time
B. An information transfer that involves the direct or indirect writing of a storage location by one process and the direct or indirect reading of the storage location by another process
C. A communication channel that allows a process to transfer information in a manner that violates the systems security policy
D. An information transfer path within a system
Answer: B
Explanation: A covert storage channel typically involves a finite resource (e.g., sectors on a disk) that is shared by two subjects at different security levels. One way to think of the difference between covert timing channels and covert storage channels is that covert timing channels are essentially memoryless, whereas covert storage channels are not. With a timing channel, the information transmitted from the sender must be sensed by the receiver immediately, or it will be lost. However, an error code indicating a full disk which is exploited to create a storage channel may stay constant for an indefinite amount of time, so a receiving process is not as constrained by time. *Answer "A process that manipulates observable system resources in a way that affects response time" is a partial description of a covert timing channel. A covert timing channel is a covert channel in which one process signals information to another by modulating its own use of system resources (e.g., CPU time) in such a way that this manipulation affects the real response time observed by the second process. *Answer "An information transfer path within a system" is a generic definition of a channel. A channel may also refer to the mechanism by which the path is effected. *Answer "A communication channel that allows a process to transfer information in a manner that violates the systems security policy" is a higher-level definition of a covert channel. While a covert storage channel fits this definition generically.
Source: DoD 5200.28-STD Department of Defense Trusted Computer System Evaluation Criteria and NCSC-TG-030, A Guide To Understanding Covert Channel Analysis of Trusted Systems [Light Pink Book].
164
The Spiral Model of the software development process (B.W. Boehm, A Spiral Model of Software Development and Enhancement, IEEE Computer, May, 1988) uses the following metric relative to the spiral:
A. The angular dimension represents cumulative cost
B. The radial dimension represents cumulative cost
C. The radial dimension represents progress made in completing each cycle
D. The radial dimension represents the cost of each phase
.
Answer: B
Explanation: The radial dimension represents cumulative cost and the angular dimension represents progress made in completing each cycle of the spiral. The spiral model is actually a meta-model for software development processes. Asummary of the stages in the spiral is as follows: The spiral begins in the top, left-hand quadrant by determining the objectives of the portion of the product being developed, the alternative means of implementing this portion of the product, and the constraints imposed on the application of the alternatives. Next, the risks of the alternatives are evaluated based on the objectives and constraints. Following this step, the relative balances of the perceived risks are determined. The spiral then proceeds to the lower right-hand quadrant where the development phases of the projects begin. A major review completes each cycle and then the process begins anew for succeeding phases of the project. Typical succeeding phases are software product design, integration and test plan development, additional risk analyses, operational prototype, detailed design, code, unit test, acceptance test, and implementation. The other answers are distracters
165
```
Another type of artificial intelligence technology involves genetic algorithms. Genetic algorithms are part of the general class known as:
A. Suboptimal computing
B. Biological computing
C. Evolutionary computing
D. Neural networks
```
Answer: C
Explanation: Evolutionary computing uses the Darwinian principles of survival of the fittest, mutation, and the adaptation of successive generations of populations to their environment. The genetic algorithm implements this process through iteration of generations of a constant-size population of items or individuals. Each individual is characterized by a finite string of symbols called genomes. The genomes are used to represent possible solutions to a problem in a fixed search space. For example, if the fixed population of the first generation of individuals consists of random binary numbers, and the problem is to find the minimum binary number that can be represented by an individual, each binary number is assigned a fitness value based on the individuals binary number value. The smaller the binary number represented by a parent individual, the higher level of fitness that is assigned to it. Through cross breeding among the numbers (known as crossover), mutations of the numbers, and pairing of numbers with high fitness ratings, the smallest value that can be represented by the number of bits in the binary number will emerge in later generations.
*Answer neural networks, is incorrect and has been discussed extensively in previous questions in this chapter. *Answer Suboptimal computing is a distracter and answer biological computing, refers to computation performed by using certain characteristics of living organisms.
166
Which choice below would NOT be considered a benefit of employing incident-handling capability?
A. An individual acting alone would not be able to subvert a security process or control.
B. It enhances internal communications and the readiness of the organization to respond to incidents.
C. Security training personnel would have a better understanding of users knowledge of security issues.
D. It assists an organization in preventing damage from future incidents.
Answer: A
Explanation: The primary benefits of employing an incident-handling capability are containing and repairing damage from incidents and preventing future damagE. Additional benefits related to establishing an incidenthandling capability are: Enhancement of the risk assessment process. An incidenthandling capability will allow organizations to collect threat data that may be useful in their risk assessment and safeguard selection processes (e.g., in designing new systems). Statistics on the numbers and types of incidents in the organization can be used in the risk-assessment process as an indication of vulnerabilities and threats. Enhancement of internal communications and the readiness of the organization to respond to any type of incident, not just computer security incidents. Internal communications will be improved, management will be better organized to receive communications, and contacts within public affairs, legal staff, law enforcement, and other groups will have been preestablished. Security training personnel will have a better understanding of users knowledge of security issues. Trainers can use actual incidents to vividly illustrate the importance of computer security. Training that is based on current threats and controls recommended by incident-handling staff provides users with information more specifically directed to their current needs, thereby reducing the risks to the organization from incidents. *Answer "An individual acting alone would not be able to subvert a security process or control" is a benefit of employing separation of duties controls. Source: National Institute of Standards and Technology, An Introduction to Computer Security: The NIST Handbook Special Publication 800-12.
167
```
What is searching for data correlations in the data warehouse called?
A. Configuration management
B. Data warehousing
C. A data dictionary
D. Data mining
```
Answer: D
Explanation: Searching for data correlations in the data warehouse is called data mining. Answer Data warehousing is incorrect because data warehousing is creating a repository of information from heterogeneous databases that is available to users for making queries. Answer A data dictionary is incorrect because a data dictionary is a database for system developers. Answer Configuration management is incorrect because configuration management is the discipline of identifying the components of a continually evolving system for the purposes of controlling changes to those components and maintaining integrity and traceability throughout the life cycle.
168
Which choice below is NOT an accurate description or element of remote sensing technology?
A. RS intelligence may be integrated into geographic information systems (GIS) to produce mapbased products
B. Photographic, radar, infrared, or multi-spectral imagery from landbased tracking stations
C. Photographic, radar, infrared, or multi-spectral imagery from geostationary or orbiting satellites
D. Photographic, radar, infrared, or multi-spectral imagery from manned or unmanned aircraft
Answer: B
Explanation: Remote sensing is the acquisition of information via aerial or satellite sensors. The most critical category of information to capture immediately following a disaster is accurate and timely intelligence about the scope, extent, and impact of the event. Intelligent and effective decisions hinge on the credible characterization of the situation. If the disaster is extensive enough, it may cause serious damage to the telephone or wireless infrastructure and ground communications may be unusable to accurately assess the situation. Remote sensing systems can provide a highly effective alternative means of gathering intelligence about the event. *Answer "Photographic, radar, infrared, or multi-spectral imagery from manned or unmanned aircraft" describes remote sensing using aerial-derived information. *Answer "Photographic, radar, infrared, or multi-spectral imagery from geostationary or orbiting satellites" describes satellite-derived remote sensing. *Answer "RS intelligence may be integrated into geographic information systems (GIS) to produce map-based products" describes a common use of the remote sensing data. Source: Remote Sensing in Federal Disaster Areas, Standard Operating Procedures, FEMA 9321.1-PR, June 1999
169
The Federal Intelligence Surveillance Act (FISA) of 1978, the Electronic Communications Privacy Act (ECPA) of 1986, and the Communications Assistance for Law Enforcement Act (CALEA) of 1994 are legislative
acts passed by the United States Congress. These acts all address what major information security issue?
A. Computer fraud
B. Wiretapping
C. Unlawful use of and access to government computers and networks
D. Malicious code
Answer: B
Explanation: These laws reflected different views concerning wiretapping as technology progresseD. The Federal Intelligence Surveillance Act (FISA) of 1978 limited wiretapping for national security purposes as a result of the record of the Nixon Administration in using illegal wiretaps. The Electronic Communications Privacy Act (ECPA) of 1986 prohibited eavesdropping or the interception of message contents without distinguishing between private or public systems. The Communications Assistance for Law Enforcement Act (CALEA) of 1994 required all communications carriers to make wiretaps possible in ways approved by the FBI.
170
```
Which of the following is NOT a common term in object-oriented systems?
A. Method
B. Behavior
C. Function
D. Message
```
Answer: C
Explanation: *Answer behavior, is a characteristic of an object. The object is defined as a collection of operations that, when selected, reveal or manipulate the state of the object. Thus, consecutive invocations of an object may result in different behaviors, based on the last operations selected. *Answer message, is a request sent to an object to carry out a particular operation. *A method is the codethat describes what the object will do when sent a message.
171
Which choices below are most accurate regarding the information needed to define the continuity strategy? Select all that apply.
A. The strategy needs to define personnel roles in implementing continuity.
B. A strategy needs to be defined to preserve computing elements, such as hardware, software, and networking elements.
C. The strategy needs to address facility use during a disruptive event.
D. None of the other alternatives apply.
Answer: A,B,C
Explanation:
172
Which of the following items is NOT a component of a knowledge based system (KBS)?
A. Knowledge base
B. Procedural code
C. Interface between the user and the system
D. Inference Engine
Answer: B
Explanation: Procedural code in a procedural language implies sequential execution of instructions based on the von Neumann architecture of a CPU, Memory, and Input/Output device. Variables are part of the sets of instructions used to solve a particular problem and, thus, the data are not separate from the statements. Such languages have control statements such as goto, ifthenelse and so on. The program execution is iterative and corresponds to a sequence of state changes in a state machine. *Answer knowledge base, refers to the rules and facts of the particular problem domain. *The inference engine takes the inputs to the KBS and uses the knowledge base to infer new facts and to solve the problem. *Answer "Interface between the user and the system" refers to the interface between the user and the system through which the data are entered, displayed, and output.
173
```
A database that comprises tools to support the analysis, design, and development of software and support good software engineering practices is called a:
A. Database management system (DBMS)
B. Data model
C. Data dictionary
D. Data type dictionary
```
Answer: C
Explanation: Computer Aided Software Engineering (CASE) tools and an Integrated Project Support Environment (IPSE) are terms used to describe similar
software engineering support environments. *Answer data model, is a basic system of constructs used in describing reality, (Kent, W., Data and Reality, North Holland, 1978). *A DBMS is a system that supports the creation, use, and administration of a database system. * Answer a data type dictionary, refers to a collection of items on which certain operations, such as insert, delete, and search, are to be performed. This arrangement of items is in contrast to a priority queue, in which the collection of items is arranged in order of priority and the relevant operations to be performed are insert, find-max, and delete-max.
174
Which one of the following items are true concerning the Platform for Privacy Preferences (P3P) developed by the World Wide Web Consortium (W3C)? Select three.
A. It does not provide the site privacy practices to users in machine-readable format.
B. It allows Web sites to express their privacy practices in a standard format that can be retrieved automatically and interpreted easily by user agents.
C. It allows users to be informed of site practices in human-readable format.
D. It automates decision-making based on the sites privacy practices when appropriate.
Answer: B,C,D
Explanation: In addition to the capabilities in the correct answers, P3P does provide the site privacy practices to users in machine-readable format.
175
Which choice below is NOT an element of proper media control?
A. Accurately and promptly marking all data storage media
B. Assuring the accuracy of the backup data
C. The proper environmental storage of the media
D. The safe and clean handling of the media
Answer: B
Explanation: "Assuring the accuracy of the backup data" is an example of a software integrity control, although the other three elements of media control listed apply to the backup tapes themselves.
176
What is a data warehouse?
A. A repository of information from heterogeneous databases
B. A remote facility used for storing backup tapes
C. A hot backup building
D. A table in a relational database system
Answer: A
Explanation: The correct answer is a repository of information from heterogeneous databases. Answers "A remote facility used for storing backup tapes" and "A hot backup building" describe physical facilities for backup and recovery of information systems, and answer "A table in a relational database system" describes a relation in a relational database.
177
Which term below BEST describes the concept of least privilege?
A. Active monitoring of facility entry access points.
B. Each user is granted the lowest clearance required for their tasks.
C. A formal separation of command, program, and interface functions.
D. A combination of classification and categories that represents the sensitivity of information.
Answer: B
Explanation: The least privilege principle requires that each subject in a system be granted the most restrictive set of privileges (or lowest clearance) needed for the performance of authorized tasks. The application of this principle limits the damage that can result from accident, error, or unauthorized use. Applying this principle may limit the damage resulting from accidents, errors, or unauthorized use of system resources. *Answer "A formal separation of command, program, and interface functions." describes separation of privilege, which is the separation of functions, namely between the commands, programs, and interfaces implementing those functions, such that malicious or erroneous code in one function is prevented from affecting the code or data of another function. *Answer "A combination of classification and categories that represents the sensitivity of information." is a security level. A security level is the combination of hierarchical classification and a set of non-hierarchical categories that represents the sensitivity of information. *Answer "Active monitoring of facility entry access points." is a distracter. Source: DoD 5200.28STD Department of Defense Trusted Computer System Evaluation Criteria.
178
What is a method in an object-oriented system?
A. The code defining the actions that the object performs in response to a message
B. A guide to the programming of objects
C. The means of communication among objects
D. The situation where a class inherits the behavioral characteristics of more that one parent class
```
Answer: A
Explanation: method in an object-oriented system is the code that defines the actions that the object performs in response to a message. Answer "The means of communication among objects" is incorrect because it defines a message. Answer "A guide to the programming of objects" is a distracter. Answer "The situation where a class inherits the behavioral characteristics of more that one parent class" refers to multiple inheritance.
```
179
```
Which of the following refers to a US Government program that reduces or eliminates emanations from electronic equipment?
A. ECHELON
B. TEMPEST
C. ECHO
D. CLIPPER
```
Answer: B
Explanation: Answer CLIPPER refers to the US government Escrowed Encryption Standard. Answer ECHELON refers to the large-scale monitoring of RF transmissions. Answer ECHO is a distracter.
180
Which choice below is the first priority in an emergency?
A. Notifying external support resources for recovery and restoration
B. Warning customers and contractors of a potential interruption of service
C. Communicating with employees families the status of the
emergency
D. Protecting the health and safety of everyone in the facility
Answer: D
Explanation: Life safety, or protecting the health and safety of everyone in the facility is the first priority in an emergency or disaster. Evacuation routes, assembly areas, and accounting for personnel (head counts and last-known locations) are the most important function of emergency procedures, before anything else. Once all personnel have been accounted for and emergency teams have arrived to prevent further damage or hazard, family members should be notified of the status of the event. Providing restoration and recovery, and implementing alternative production methods also comes later. Source: Emergency Management Guide for Business and Industry, Federal Emergency Management Agency, August, 1998.
181
```
Which choice below BEST describes the type of control that a firewall exerts on a network infrastructure?
A. Detective control
B. Preventative control
C. Corrective control
D. Application control
```
Answer: B
Explanation: A firewall is primarily intended to prevent unauthorized access.
182
Which of the following is NOT a characteristic of a distributed data processing (DDP) approach?
A. Consists of multiple processing locations that can provide alternatives for computing in the event of a site becoming inoperative.
B. Data stored at multiple, geographically separate locations is easily available to the user.
C. Distances from user to processing resource are transparent to the user.
D. Security is enhanced because of networked systems.
Answer: D
Explanation: Security is more of a concern in distributed systems since there are vulnerabilities associated with the network and the many locations from which unauthorized access to the computing resources can occur. The other answers are characteristics of a DDP architecture.
183
```
A refinement to the basic Waterfall Model that states that software should be developed in increments of functional capability is called:
A. Functional development
B. Incremental development
C. Functional refinement
D. Incremental refinement
```
Answer: B
Explanation: The advantages of incremental development include the ease of testing increments of functional capability and the opportunity to incorporate user experience into a successively refined product. The other answers are distracters.
184
Which statement below is NOT true regarding the relationship of the organization with the media during and after a disaster?
A. The company should be honest and accurate about what they know about the event and its effects.
B. The organization must avoid dealing with the media at all costs during and after the disruptive event.
C. The companys response should be delivered by a credible, informed spokesperson.
D. The organization should establish a unified organizational response to the media during and after the disruptive event.
Answer: B
Explanation:
185
```
An expert system that has rules of the form If w is low and x is high then y is intermediate, where w and x are input variables and y is the output variable, is called a:
A. Fuzzy expert system
B. Realistic expert system
C. Neural network
D. Boolean expert system
```
Answer: A
Explanation: A fuzzy expert system is an expert system that uses fuzzy membership functions and rules, instead of Boolean logic, to reason about data. Thus, fuzzy variables can have an approximate range of values instead of the binary True or False used in conventional expert systems. When it is desired to convert the fuzzy output to a single value, defuzzification is used. One approach to defuzzification is the CENTROID method. With this method, a value of the output variable is computed by finding the variable value of the center of gravity of the membership function for the fuzzy output value. Answers Neural network and Realistic expert system are distracters, and answer Boolean expert system is incorrect since it refers to Boolean values of one or zero.
186
```
Which entity of the US legal system makes common laws?
A. Judicial branch
B. Administrative agencies
C. Executive branch
D. Legislative branch
```
Answer: A
Explanation: The correct answer is Judicial branch. The judicial decisions made in the courts generate common law. Answer a, administrative agencies, create administrative laws and the legislative branch, answer b, generates statutory laws. The executive branch, answer c, does not make laws
187
Which choice below is the BEST description of operational assurance?
A. Operational assurance has the benefit of containing and repairing damage from incidents.
B. Operational assurance is the process of performing pre-employment background screening.
C. Operational assurance is the process of examining audit logs to reveal usage that identifies misuse.
D. Operational assurance is the process of reviewing an operational system to see that security controls are functioning correctly.
Answer: D
Explanation: Operational assurance is the process of reviewing an operational system to see that security controls, both automated and manual, are functioning correctly and effectively. Operational assurance addresses whether the systems technical features are being bypassed or have vulnerabilities and whether required procedures are being followed. To maintain operational assurance, organizations use two basic methods: system audits and monitoring. Asystem audit is a one-time or periodic event to evaluate security. Monitoring refers to an ongoing activity that examines either the system or the users. *Answer "Operational assurance is the process of examining audit logs to reveal usage that identifies misuse" is a description of an audit trail review. Answer "Operational assurance has the benefit of containing and repairing damage from incidents" is a description of a benefit of incident handling. The main benefits of proper incident handling are containing and repairing damage from incidents, and preventing future damagE. *Answer "Operational assurance is the process of performing pre-employment background screening" describes a personnel control. Source: National Institute of Standards and Technology, An Introduction to Computer Security: The NIST Handbook Special Publication 800-12.
188
The basic version of the Construction Cost Model (COCOMO), which proposes quantitative, life-cycle relationships, performs what function?
A. Estimates software development effort and cost as a function of the size of the software product in source instructions modified by manpower buildup and productivity factors
B. Estimates software development effort and cost as a function of the size of the software product in source instructions modified by hardware and input functions
C. Estimates software development effort based on user function categories
D. Estimates software development effort and cost as a function of the size of the software product in source instructions
Answer: D
Explanation: The Basic COCOMO Model (B.W. Boehm, Software Engineering Economics, Prentice-Hall, Englewood Cliffs, New Jersey, 1981) proposes the following equations: The number of man-months (MM) required to develop the most common type of software product, in terms of the number of thousands of delivered source instructions (KDSI) in the software product MM = 2.4 (KDSI)1.05 The development schedule (TDEV) in months TDEV = 2.5(MM)0.38 In addition, Boehm has developed an intermediate COCOMO Model that also takes into account hardware constraints, personnel quality, use of modern tools, and other attributes and their aggregate impact on overall project costs. A detailed COCOMO Model, by Boehm, accounts for the effects of the additional factors used in the intermediate model on the costs of individual project phases.
189
In developing an emergency or recovery plan, which choice below
would NOT be considered a short-term objective?
A. Minimum resources needed to accomplish the restoration
B. The organizations strategic plan
C. Priorities for restoration
D. Acceptable downtime before restoration
Answer: B
Explanation: The organizations strategic plan is considered a long-term goal. In developing plans, consideration should be given to both shortterm and long-term goals and objectives. Short-term goals can include:
Vital personnel, systems, operations, and equipment Priorities for restoration and mitigation Acceptable downtime before restoration to a minimum level of operations Minimum resources needed to accomplish the restoration Long-term goals and objectives can include: The organizations strategic plan Management and coordination of activities Funding and fiscal management Management of volunteer, contractual, and entity resources Source: NFPA 1600 Standard on Disaster/Emergency Management and Business Continuity, National Fire Protection Association, 2000 edition.
190
What is enticement?
A. Encouraging the commission of a crime when there was initially no intent to commit a crime
B. Luring the perpetrator to an attractive area or presenting the perpetrator with a lucrative target after the crime has already been initiated
C. Assisting in the commission of a crime
D. Encouraging the commission of one crime over another
Answer: B
Explanation: The correct answer is "Luring the perpetrator to an attractive area or presenting the perpetrator with a lucrative target after the crime has already been initiated", the definition of enticement. *Answer "Encouraging the commission of a crime when there was initially no intent to commit a crime" is the definition of entrapment. The other answers are distracters.
191
```
Liability of senior organizational officials relative to the protection of the organizations information systems is prosecutable under:
A. Criminal law.
B. Civil law.
C. Financial law.
D. International law.
```
Answer: B
Explanation:
192
The software maintenance phase controls consist of:
A. Request control, configuration control, and change control.
B. Request control, release control, and access control.
C. Request control, change control, and release control.
D. Change control, security control, and access control.
Answer: C
Explanation: The software maintenance phase controls consist of request control, change control, and release control by definition. The other answers are, therefore, incorrect.
