IS3340 CHAPTER 7

Question 1

A evaluation of a collection of one or more objects is called an ___?

Answer 1

AUDIT

Question 2

A collection of configuration settings often collected and saved for the purposes of comparing to other similar collections of configuration settings is called ___?
A structured collection, or collection of specific item versions.

Answer 2

BASELINE

Question 3

An easy-to-use tool that evaluates the current security state of computers in accordance with Microsoft security recommendations is called __?

Answer 3

MICROSOFT BASELINE SECURITY ANALYZER (MBSA)

Question 4

A graphical user interface framework that provides a centralized method to manage software components on Windows computers and is called ___?

Answer 4

MICROSOFT MANAGEMENT CONSOLE (MMC)

Question 5

A security scanner from Shavlik that scans and analyzes the patch status of product MBSA does not support is called ___?
This also has a Limited version.

Answer 5

NETCHK PROTECT

Question 6

A consumer-based vulnerability scanner from Secunia that searches for vulnerable or out-of-date programs and plug-ins is called ___?
This runs in a Web browser and does not need to be installed on the computer it is scanning.

Answer 6

ONLINE SOFTWARE INSPECTOR (OSI)

Question 7

The process of comparing real computer configurations with known baselines for the purpose of documenting the pertinent differences with secure settings and similarities to insecure settings is called ___?

Answer 7

PROFILING

Question 8

A tool that helps administrators to analyze a computer and compare its configuration settings against a baseline is called ___?

Answer 8

SECURITY CONFIGURATION AND ANALYSIS (SCA)

Question 9

A text file that contains a list of configuration settings is called ___?

Answer 9

SECURITY TEMPLATE

Question 10

An administrative program designed to run in the MMC is called ___?

Answer 10

SNAP-IN

Question 11

1. A baseline is the initial settings in a newly installed system.
   TRUE OR FALSE

Answer 11

FALSE

Question 12

2. A baseline, also called a ___, is a collection of settings at a specific point in time.

Answer 12

Snapshot

Question 13

3. Which Microsoft tool analyzes a computer’s settings and compares its configuration to a baseline?
4. SCA
5. MBSA
6. NetChk
7. OSI

Answer 13

SCA

Question 14

4. Stored settings that comprise a baseline are stored in which type of files?
5. Baseline configuration
6. Baseline database
7. Security template
8. Security object

Answer 14

Security template

Question 15

5. The Security Configuration and Analysis tool operates as a snap-in to the ___?

Answer 15

MMC

Question 16

6. Which command line tool provides the same scanning capability as SCA?
7. secedit
8. mbsacli
9. scacli
10. mbsaedit

Answer 16

secedit

Question 17

7. Which of the following products does MBSA NOT analyze?
8. IIS
9. SQL Server
10. Adobe Acrobat
11. Windows 7

Answer 17

Adobe Acrobat

Question 18

8. MBSA automatically ranks vulnerabilities by severity.

TRUE OR FALSE

Answer 18

TRUE

Question 19

9. Which command line tool provides the same scanning capability as MBSA?
10. secedit
11. mbsacli
12. scacli
13. mbsaedit

Answer 19

.

Question 20

10. Which security scanner looks for weak passwords?
11. SCA
12. OSI
13. NetChk Protect
14. MBSA

Answer 20

MBSA

Question 21

11. What does NetChk Protect Limited do that MBSA does not do?
12. Scans the latest Microsoft products
13. Scans legacy Microsoft products
14. Scans all Microsoft products
15. Scans selected Microsoft products

Answer 21

Scans legacy Microsoft products

Question 22

12. Which security scanner runs in a Web browser and doesn’t require that you install a product before scanning?
13. NetChk Protect Limited
14. MBSA
15. OSI
16. PSI

Answer 22

OSI

Question 23

13. Which of the following statements best describe the relationship between profiling and auditing?
14. Auditing is often a part of profiling
15. Profiling is often a part of auditing
16. Profiling and auditing are interchangeable terms
17. If auditing is in place profiling is not necessary

Answer 23

Profiling is often a part of auditing

Question 24

14. When designing an audit strategy, you should log access attempts on the ___ number of objects.

Answer 24

Minimum

Question 25

15. What is the main purpose of an audit?
16. Uncover problems
17. Catch errors
18. Validate compliance
19. Standardize configurations

Answer 25

Validate compliance