Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IS3110 RISK MANAGEMENT > IS3110 CHAP 2 > Flashcards

IS3110 CHAP 2 Flashcards

1
Q

What is a security policy?

  1. A rigid set of rules that must be followed explicitly to be effective
  2. A technical control used to enforce security
  3. A physical control used to enforce security
  4. A document created by senior management that identifies the role of security in the organization
A

A document created by senior management that identifies the role of security in the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

You want to ensure that users are granted only the rights to perform actions required for their jobs. What should you use?

  1. Principle of least privilege
  2. Principle of need to know
  3. Principle of limited rights
  4. Separation of duties
A

Principle of least privilege

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

You want to ensure that users are granted only the persuasions needed to access data required to perform their jobs. What should you use?

  1. Principle of least privilege
  2. Principle of need to know
  3. Principle of limited rights
  4. Principle of limited permissions
A

Principle of need to know

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which of the following security principles divides job responsibilities to reduce fraud?

  1. Need to know
  2. Least privilege
  3. Separation of duties
  4. Mandatory vacations
A

Separation of duties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What can you use to ensure that unauthorized changes are not made to systems?

  1. Input validation
  2. Patch management
  3. Version control
  4. Configuration management
A

Configuration management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are two types of intrusion detection systems?

  1. Intentional and unintentional
  2. Natural and manmade
  3. Host-based and network-based
  4. Technical and physical
A

Host-based and network-based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

A technical control prevents unauthorized personnel from having physical access to a secure area or secure system.
TRUE OR FALSE

A

FALSE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What allows an attacker to gain additional privileges on a system by sending unexpected code to the system?

  1. Buffer overflow
  2. MAC flood
  3. Input validation
  4. Spiders
A

Buffer overflow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is hardening a server?

  1. Securing it from the default configuration
  2. Ensuring it cannot be powered down
  3. Locking it in a room that is hard to access
  4. Enabling necessary protocols and services
A

Securing it from the default configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which of the following steps could be taken to harden a server?

  1. Removing unnecessary services and protocols
  2. Keeping the server up to date
  3. Changing defaults
  4. Enabling local firewalls
  5. All the above
A

All the above

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which government agency includes the Information Technology Laboratory and published SP 800-30?

  1. NIST
  2. DHS
  3. NCSD
  4. US-CERT
A

NIST

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

ITL and ITIL are different names for the same thing.

TRUE OR FALSE

A

FALSE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which US government agency regularly publishes alerts and bulletins related to security threats?

  1. NIST
  2. FBI
  3. US-CERT
  4. The MITRE Corporation
A

US-CERT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

The CVE list is maintained by ___?

A

The MITRE Corporation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the standard used to create Information Security Vulnerability names?

  1. CVE
  2. MITRE
  3. DISA
  4. CSI
A

CVE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The amount that can be attacked on a server. Every additional service or protocol running or enabled increased the surface. By disabling services or protocols that are not needed, you reduce the surface

A

ATTACK SURFACE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

A common exploit used against public-facing servers. Buffer overflow can occur when an attacker sends more data or different data than is expected. Attackers can use it to gain additional privileges on the system

A

BUFFER OVERFLOW

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Standards used to ensure that systems are configured similarly. Additionally, you can perform compliance auditing regularly to ensure that systems have not been improperly modified.

A

CONFIGURATION MANAGEMENT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

A philosophy centered on the principle that security requires continuous effort. You put controls into place. Later, you perform checks and audits to ensure they are still working as expected.

A

CONTINUOUS MONITORING

20
Q

A buffer zone separating the Internet from the internal network. A DMZ is often created with two separate firewalls. You then place public-facing servers such as Web servers or email servers in the DMZ

A

DEMILITARIZED ZONE (DMZ)

21
Q

An attack designed to prevent a system from providing a service. This is launched from a single client.

A

DENIAL OF SERVICE (DoS)

22
Q

A major department in the US government. It is charged with protecting the United States from threats and emergencies.

A

DEPARTMENT OF HOMELAND SECURITY (DHS)

23
Q

A DoS attack launched from multiple clients at the same time. These attacks often include zombies controlled in a botnet.

A

DISTRIBUTED DENIAL OF SERVICE (DDoS)

24
Q

The act of initiating a vulnerability. It occurs when a command or program is executed to take advantage of a weakness. Some examples are buffer overflows, DoS attacks and DDoS attacks.

A

EXPLOIT

25
Q

The day after Patch Tuesday. After patches are released, attackers attempt to reverse-engineer the patches to learn the vulnerabilities. They then create attacks to expo it the vulnerabilities before the patches are widely applied.

A

EXPLOIT WEDNESDAY

26
Q

The act of making server more secure from the default. Defaults are changed. The attack surface is reduced. The system is kept up to date

A

HARDENING A SERVER

27
Q

Acts that are hostile to the organization. Intentional threats come from criminals, vandals, disgruntled employees, hackers, and others.

A

INTENTIONAL THREATS

28
Q

A system that can monitor a network and send an alert if an intrusion is detected. Both host-based ___ and network-based IDS (NIDS) systems are commonly used. A passive IDS logs and alerts on events. An active IDS can block a detected attack.

A

INTRUSION DETECTION SYSTEM (IDS)

29
Q

A division of the Department of Homeland Security. NCSD and Department of Homeland Security work together with private, public, and international parties to secure cyberspace. They particularly focus on America’s cyber assets.

A

NATIONAL CYBER SECURITY DIVISION (NCSD)

30
Q

A division of the US Department of Commerce. Its mission is to promote US innovation and industrial competitiveness. The information Technology Laboratory (ITL) is within ___. ITL publishes special publications that are widely used in IT risk management.

A

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST)

31
Q

Ensuring that patches are deployed when needed. Software regularly develops busts. When that happens, vendors release patches to correct the problems. ___ ensures that appropriate patches are deployed. Many bugs present serious security risks, so if the patches are’t deployed, the systems become vulnerable.

A

PATCH MANAGEMENT

32
Q

The day that Microsoft released patches for Microsoft products. ___ is the second Tuesday of every month.

A

PATCH TUESDAY

33
Q

Controls that restrict physical access to areas or systems. Examples include locked rooms, guards, and cameras.

A

PHYSICAL CONTROLS

34
Q

A security principle that grants users only the minimum rights and permissions needed to perform their job. This is similar to the need to know principle. however, the need to know principle focuses only on permissions for data, not rights.

A

PRINCIPLE OF LEAST PRIVILEGE

35
Q

A security principle that grants users access only to the data they need to perform their job. This is similar to the least-privilege principle. However, the least-privilege principle includes rights and permissions, while the need to know principle focuses only on permissions for data.

A

PRINCIPLE OF NEED TO KNOW

36
Q

An attacker without much knowledge about programming and the potential harm it may cause. The idea is that some hacking tools are so easy to use, a kid can use them.

A

SCRIPT KIDDIE

37
Q

A written policy created by senior management. it identifies resources and plans to implement security in the organization. It will usually includes individual policies such as a password policy, and acceptable use policy, and a firewall policy.

A

SECURITY POLICY

38
Q

A principle that ensures that a single person does not control all the functions of a critical process. It is designed to prevent fraud, theft, and errors.

A

SEPARATION OF DUTIES

39
Q

An attack on a Web site that accesses a database. The attacker uses Structured Query Language (SQL) code to retrieve or modify data in the database. You can prevent SQL injection attacks with sound development practices.

A

SQL INJECTION ATTACK

40
Q

A common DoS attack, where the attacker withholds the third packet in a three-way handshake. When the attacker does this repeatedly in a short time period, the server’s resources are consumed and the server can crash.

A

SYN FLOOD ATTACK

41
Q

Controls that use technology to reduce vulnerabilities. Examples include anti-virus software, intrusion detection systems, access controls, and firewalls.

A

TECHNICAL CONTROLS

42
Q

When a threat expo its a vulnerability, this results in a harmful event or a loss.

A

THREAT/VULNERABILITY PAIR

43
Q

Threats that don;t have a perpetrator. They include threats in the following categories: environmental, human, accidents, and failures.

A

UNINTENTIONAL THREATS

44
Q

Part of the National Cyber Security Division. The US-CERT provides response support and defense against cyber attackers. Their focus is on the protection of federal government resources. They also collaborate and share information with state and local governments, and other public and private sectors.

A

UNITED STATES COMPUTER EMERGENCY READINESS TEAM (US-CERT)

45
Q

A process that ensures that changes to files are controlled and tracked. Version control is often used with application development. Programmers check out a module or file, make their changes, and then check the file back in.

A

VERSION CONTROL

IS3110 RISK MANAGEMENT (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions