IS 3120 CHAPTER 15

Question 1

A collection of all the vulnerable points of a system

Answer 1

Attack surface

Question 2

The security requirement that information be available to authorized users when they want it.

Answer 2

Availability

Question 3

Process that results in a list of activities necessary for an organization to conduct business operations.

Answer 3

Business impact analysis (BIA).

Question 4

Multiple countermeasures that an attacker must compromise to reach any protected resource. It is often described as a series of concentric rings around protected resources.

Answer 4

Defense in depth.

Question 5

A separate network that allows connections from external networks and internal LANs; in most cases, it is separated from each network by a firewall.

Answer 5

Demilitarized zone (DMZ)

Question 6

A program or dedicated hardware device that inspects network traffic passing through it. It then denies or permits that traffic based on a set of rules determined from a stored configuration.

Answer 6

Firewall

Question 7

A special team formed to handle security incidents when they occur.

Answer 7

Incident response team (IRT)

Question 8

The security principle that users possess only the minimum access privileges that need to compete their assigned tasks.

Answer 8

Least privilege

Question 9

.A method that ranks risks relative to one another

Answer 9

Qualitative risk analysis

Question 10

A method that associates a dollar value, or cost, with each risk.

Answer 10

Quantitative risk analysis

Question 11

The likelihood that an attack will successfully expo it a vulnerability.

Answer 11

Risk

Question 12

The process of identifying and addressing all risks.

Answer 12

Risk management

Question 13

Any event that results in a violation of any of the “CIA” (confidentiality, integrity, and availability)

Answer 13

Security breach

Question 14

A countermeasure that protects resources from attack.

Answer 14

Security control

Question 15

An analysis that identifies known vulnerabilities for which there are no security controls in place.

Answer 15

Security gap analysis

Question 16

The three basic properties of information security: confidentiality, integrity, and availability.

Answer 16

Security triad

Question 17

Any action that could damage an asset

Answer 17

Threat

Question 18

Any weakness in a system that makes it possible for a threat to cause it harm.

Answer 18

Vulnerability

Question 19

1. The right mix of security controls can make a network completely secure.
   TRUE OR FALSE

Answer 19

FALSE

Question 20

2. The CIA triad includes which three security properties?
3. Consistency, integrity, authorization
4. Confidentiality, isolated, authorization
5. Confidentiality, integrity, availability
6. consistency, isolated, availability

Answer 20

Confidentiality, integrity, availability

Question 21

3. Which security property assures that only authorized users can modify sensitive information?
4. Confidentiality
5. Integrity
6. Consistency
7. Isolated

Answer 21

Integrity

Question 22

4. Which term describes the cumulative opportunities for attackers to compromise a system?
5. Risks
6. Present threats
7. Known vulnerabilities
8. Attack surface

Answer 22

Attack surface

Question 23

5. A ___ is any event that results in a violation of any of the CIA security properties.

Answer 23

Security Breach

Question 24

6. An eavesdropping attack violates which CIA property?
7. Confidentiality
8. Integrity
9. Consistency
10. Isolated

Answer 24

Confidentiality

Question 25

7. Which term best describes any event that could damage an asset?
8. Event
9. Threat
10. Risk
11. Vulnerability

Answer 25

Threat

Question 26

8. Which term best describes any weakness in a system that can allow an attack to clause harm?
9. Event
10. Threat
11. Risk
12. Vulnerability

Answer 26

Vulnerability

Question 27

9. A ___ risk assessment ranks risks relative to one another.

Answer 27

Qualitative

Question 28

10. Which of the following courses of action is best if the cost to mitigate a risk exceeds the expected loss if the risk is realized?
11. Mitigate
12. Assign
13. Accept
14. Avoid

Answer 28

Accept

Question 29

11. Insurance is a common form of which type of risk handling?
12. Mitigate
13. Assign
14. Accept
15. Avoid

Answer 29

Assign

Question 30

12. Which of the following best describes the principle of least privilege?
13. Allow users only the minimum access required to complete assigned tasks
14. Allow users the maximum access allowed for their job function
15. Restrict users from accessing any data they do not need to know
16. Ensure users have at least the minimum access required to complete assigned tasks

Answer 30

Allow users only the minimum access required to complete assigned tasks