OPT Flashcards
- What is the final step of a quantitative risk analysis?
A. Determine asset value.
B. Assess the annualized rate of occurrence.
C. Derive the annualized loss expectancy.
D. Conduct a cost/benefit analysis.
D. The final step of a quantitative risk analysis is conducting a cost/benefit analysis to
determine whether the organization should implement proposed countermeasure(s).
- Match the following numbered wireless attack terms with their appropriate lettered
descriptions:
Wireless attack terms - Rogue access point
- Replay
- Evil twin
- War driving
Descriptions
A. An attack that relies on an access point to spoof a legitimate access point’s SSID and Mandatory Access Control (MAC) address
B. An access point intended to attract new connections by using an apparently legitimate SSID
C. An attack that retransmits captured communication to attempt to gain access to a targeted system
D. The process of using detection tools to find wireless networks
BCAD
- Under the Digital Millennium Copyright Act (DMCA), what type of offenses do not require prompt action by an internet service provider after it receives a notification of infringement claim from a copyright holder?
A. Storage of information by a customer on a provider’s server
B. Caching of information by the provider
C. Transmission of information over the provider’s network by a customer
D. Caching of information in a provider search engine
C
4. FlyAway Travel has offices in both the European Union (EU) and the United States and transfers personal information between those offices regularly. They have recently received a request from an EU customer requesting that their account be terminated. Under the General Data Protection Regulation (GDPR), which requirement for processing personal information states that individuals may request that their data no longer be disseminated or processed? A. The right to access B. Privacy by design C. The right to be forgotten D. The right of data portability
C. The right to be forgotten, also known as the right to erasure, guarantees the data subject the ability to have their information removed from processing or use. It may be tied to consent given for data processing; if a subject revokes consent for processing, the data controller may need to take additional steps, including erasure.
5. Which one of the following is not one of the three common threat modeling techniques? A. Focused on assets B. Focused on attackers C. Focused on software D. Focused on social engineering
D. The three common threat modeling techniques are focused on attackers, software, and assets. Social engineering is a subset of attackers.
6. Which one of the following elements of information is not considered personally identifiable information that would trigger most United States (U.S.) state data breach laws? A. Student identification number B. Social Security number C. Driver’s license number D. Credit card number
A. Most state data breach notification laws are modeled after California’s law, which covers Social Security number, driver’s license number, state identification card number, credit/debit card numbers, bank account numbers (in conjunction with a PIN or password), medical records, and health insurance information.
7. In 1991, the Federal Sentencing Guidelines formalized a rule that requires senior executives to take personal responsibility for information security matters. What is the name of this rule? A. Due diligence rule B. Personal liability rule C. Prudent man rule D. Due process rule
C. The prudent man rule requires that senior executives take personal responsibility for ensuring the due care that ordinary, prudent individuals would exercise in the same situation. The rule originally applied to financial matters, but the Federal Sentencing Guidelines applied them to information security matters in 1991.
9. What United States government agency is responsible for administering the terms of privacy shield agreements between the European Union and the United States under the EU GDPR? A. Department of Defense B. Department of the Treasury C. State Department D. Department of Commerce
D. The US Department of Commerce is responsible for implementing the EU-U.S. Privacy Shield Agreement. This framework replaced an earlier framework known as Privacy Shield, which was ruled insufficient in the wake of the NSA surveillance disclosures.
10. Yolanda is the chief privacy officer for a financial institution and is researching privacy issues related to customer checking accounts. Which one of the following laws is most likely to apply to this situation? A. GLBA B. SOX C. HI PAA D. FERPA
A. The Gramm-Leach-Bliley Act (GLBA) contains provisions regulating the privacy of customer financial information. It applies specifically to financial institutions.
11. Tim’s organization recently received a contract to conduct sponsored(贊助) research as a government contractor(政府承包商). What law now likely applies to the information systems involved in this contract? A. FISMA B. PCI DSS C. HI PAA D. GISRA
A. The Federal Information Security Management Act (FISMA) specifically applies to government contractors. The Government Information Security Reform Act (GISRA) was the precursor to FISMA and expired in November 2002. HIPAA and PCI DSS apply to healthcare and credit card information, respectively.
12. Chris is advising travelers from his organization who will be visiting many different countries overseas. He is concerned about compliance with export control laws(出口管制法律). Which of the following technologies is most likely to trigger these regulations? A. Memory chips B. Office productivity applications C. Hard drives D. Encryption software
D. The export of encryption software to certain countries is regulated under US export control laws.
15. Which one of the following control categories does not accurately describe a fence(圍欄) around a facility? A. Physical B. Detective C. Deterrent D. Preventive
B. A fence does not have the ability to detect intrusions. It does, however, have the ability to prevent and deter an intrusion. Fences are an example of a physical control.
- Tony is developing a business continuity plan and is having difficulty prioritizing resources because of the difficulty of combining information about tangible and intangible assets.
What would be the most effective risk assessment approach for him to use?
A. Quantitative risk assessment
B. Qualitative risk assessment
C. Neither quantitative nor qualitative risk assessment
D. Combination of quantitative and qualitative risk assessment
D. Tony would see the best results by combining elements of quantitative and qualitative risk assessment. Quantitative risk assessment excels at analyzing financial risk, while qualitative risk assessment is a good tool for intangible risks. Combining the two techniques provides a well-rounded risk picture.
17. What law provides intellectual property protection to the holders of trade secrets? A. Copyright Law B. Lanham Act C. Glass-Steagall Act D. Economic Espionage Act
D. The Economic Espionage Act(經濟間諜法) imposes fines and jail sentences on anyone found guilty of stealing trade secrets from a US corporation. It gives true teeth to the intellectual property rights of trade secret owners.
18. Which one of the following principles imposes a standard of care upon an individual that is broad and equivalent to what one would expect from a reasonable person under the circumstances? A. Due diligence B. Separation of duties C. Due care D. Least privilege
C. The due care principle states that an individual should react in a situation using the same level of care that would be expected from any reasonable person. It is a very broad standard. The due diligence principle is a more specific component of due care that states that an individual assigned a responsibility should exercise due care to complete it accurately and in a timely manner.
22. Which one of the following actions might be taken as part of a business continuity plan? A. Restoring from backup tapes B. Implementing RAID C. Relocating to a cold site D. Restarting business operations
B. RAID technology provides fault tolerance for hard drive failures and is an example of a business continuity action. Restoring from backup tapes, relocating to a cold site, and restarting business operations are all disaster recovery actions.
#
A. Restoring from backup tapes
- Which one of the following organizations would not be automatically subject to the terms of HIPAA if they engage in electronic transactions?#重點在問誰不受影響
A. Healthcare provider
B. Health and fitness application developer
C. Health information clearinghouse
D. Health insurance plan
B. A health and fitness application developer would not necessarily be collecting or processing healthcare data, and the terms of HIPAA do not apply to this category of business. HIPAA regulates three types of entities—healthcare providers, health information clearinghouses(健康信息交換所), and health insurance plans—as well as the business associates of any of those covered entities.
31. Renee is designing the long-term security plan for her organization and has a three- to five-year planning horizon. What type of plan is she developing? A. Operational B. Tactical C. Summary D. Strategic
D. Strategic plans have a long-term planning horizon of up to five years in most cases.
Operational and tactical plans have shorter horizons of a year or less.
32. What government agency is responsible for the evaluation and registration of trademarks? A. USPTO B. Library of Congress C. TVA D. NIST
A. The United States Patent and Trademark Office (USPTO) bears responsibility for the registration of trademarks.
33. The Acme Widgets Company is putting new controls in place for its accounting department. Management is concerned that a rogue accountant may be able to create a new false vendor and then issue checks to that vendor as payment for services that were never rendered. What security control can best help prevent this situation? A. Mandatory vacation B. Separation of duties C. Defense in depth D. Job rotation
B. When following the separation of duties principle, organizations divide critical tasks into discrete components and ensure that no one individual has the ability to perform both actions. This prevents a single rogue individual from performing that task in an unauthorized manner.
34. Which one of the following categories of organizations is most likely to be covered by the provisions of FISMA? A. Banks B. Defense contractors C. School districts D. Hospitals
B. The Federal Information Security Management Act (FISMA) applies to federal government agencies and contractors(承包商). Of the entities listed, a defense contractor is the most likely to have government contracts subject to FISMA.
38. Florian receives a flyer from a federal agency announcing that a new administrative law will affect his business operations. Where should he go to find the text of the law? A. United States Code B. Supreme Court rulings C. Code of Federal Regulations D. Compendium of Laws
C. The Code of Federal Regulations (CFR) contains the text of all administrative laws promulgated by federal agencies. The United States Code contains criminal and civil law.
Supreme Court rulings contain interpretations of law and are not laws themselves. The Compendium of Laws does not exist.
40. Which one of the following individuals would be the most effective organizational owner for an information security program? A. CISSP-certified analyst B. Chief information officer (CIO) C. Manager of network security D. President and CEO
B. The owner of information security programs may be different from the individuals responsible for implementing the controls. This person should be as senior an individual as possible who is able to focus on the management of the security program. The president and CEO would not be an appropriate choice because an executive at this level is unlikely to have the time necessary to focus on security. Of the remaining choices, the CIO is the most senior position who would be the strongest advocate at the executive level.
- Which one of the following issues is not normally addressed in a service-level agreement (SLA)?
A. Confidentiality of customer information
B. Failover time
C. Uptime
D. Maximum consecutive downtime
A. SLAs do not normally address issues of data confidentiality. Those provisions are normally included in a nondisclosure agreement (NDA).
46. Joan is seeking to protect a piece of computer software that she developed under intellectual property law. Which one of the following avenues of protection would not apply to a piece of software? A. Trademark B. Copyright C. Patent D. Trade secret
A. Trademarks protect words and images that represent a product or service and would not protect computer software.
48. You are also concerned about the availability of data stored on each office’s server. You would like to add technology that would enable continued access to files located on the server even if a hard drive in a server fails. What integrity control allows you to add robustness without adding additional servers? A. Server clustering B. Load balancing C. RAID D. Scheduled backups
C. RAID uses additional hard drives to protect the server against the failure of a single device. Load balancing and server clustering do add robustness but require the addition of a server. Scheduled backups protect against data loss but do not provide immediate access to data in the event of a hard drive failure.
- What law serves as the basis for privacy rights in the United States?
A. Privacy Act of 1974
B. Fourth Amendment
C. First Amendment
D. Electronic Communications Privacy Act of 1986
B. The Fourth Amendment directly prohibits government agents from searching private property without a warrant and probable cause. The courts have expanded the interpretation of the Fourth Amendment to include protections against other invasions of privacy.
52. An accounting employee at Doolittle Industries was recently arrested for participation in an embezzlement scheme. The employee transferred money to a personal account and then shifted funds around between other accounts every day to disguise the fraud for months. Which one of the following controls might have best allowed the earlier detection of this fraud? A. Separation of duties B. Least privilege C. Defense in depth D. Mandatory vacation
D. Mandatory vacation programs require that employees take continuous periods of time off each year and revoke their system privileges during that time. This will hopefully disrupt any attempt to engage in the cover-up actions necessary to hide fraud and result in exposing the threat. Separation of duties, least privilege, and defense in depth controls all may help prevent the fraud in the first place but are unlikely to speed the detection of fraud that has already occurred.
53. Which one of the following is not normally considered a business continuity task? A. Business impact assessment B. Emergency response guidelines C. Electronic vaulting D. Vital records program
C. Electronic vaulting(電子存儲) is a data backup task that is part of disaster recovery, not business continuity, efforts.
- Who should receive initial business continuity plan training in an organization?
A. Senior executives
B. Those with specific business continuity roles
C. Everyone in the organization
D. First responders
C. Everyone in the organization should receive a basic awareness training for the business continuity program. Those with specific roles, such as first responders and senior executives, should also receive detailed, role-specific training.
57. James is conducting a risk assessment for his organization and is attempting to assign an asset value to the servers in his data center. The organization’s primary concern is ensuring that it has sufficient funds available to rebuild the data center in the event it is damaged or destroyed. Which one of the following asset valuation methods would be most appropriate in this situation? A. Purchase cost B. Depreciated cost C. Replacement cost D. Opportunity cost
C. If the organization’s primary concern is the cost of rebuilding the data center, James should use the replacement cost method to determine the current market price for equivalent servers.
- The Computer Security Act of 1987 gave a federal agency responsibility for developing computer security standards and guidelines for federal computer systems. What agency did the act give this responsibility to?
A. National Security Agency
B. Federal Communications Commission
C. Department of Defense
D. National Institute of Standards and Technology
D. The Computer Security Act of 1987 gave the National Institute of Standards and Technology (NIST) responsibility for developing standards and guidelines for federal computer systems. For this purpose, NIST draws upon the technical advice and assistance of the National Security Agency where appropriate.
61. What is the formula used to determine risk? A. Risk = Threat * Vulnerability B. Risk = Threat / Vulnerability C. Risk = Asset * Threat D. Risk = Asset / Threat
A. Risks exist when there is an intersection of a threat and a vulnerability. This is described using the equation Risk = Threat * Vulnerability.
62. The following graphic shows the NIST risk management framework with step 4 missing. What is the missing step? A. Assess security controls. B. Determine control gaps. C. Remediate control gaps. D. Evaluate user activity
A. The fourth step of the NIST risk management framework is assessing security controls.
- Which one of the following components should be included in an organization’s emergency response guidelines?
A. List of individuals who should be notified of an emergency incident
B. Long-term business continuity protocols
C. Activation procedures for the organization’s cold sites
D. Contact information for ordering equipment
A. The emergency response guidelines should include the immediate steps an organization should follow in response to an emergency situation. These include immediate response procedures, a list of individuals who should be notified of the emergency and secondary response procedures for first responders. They do not include long-term actions such as activating business continuity protocols, ordering equipment, or
activating DR sites.
- Which one of the following actions is not normally part of the project scope and planning phase of business continuity planning?
A. Structured analysis of the organization
B. Review of the legal and regulatory landscape
C. Creation of a BCP team
D. Documentation of the plan
D. The project scope and planning phase includes four actions: a structured analysis of the organization, the creation of a BCP team, an assessment of available resources, and an analysis of the legal and regulatory landscape.
#
Phase 1: Project Scoping and Planning
Business analysis from crisis point of view
Creation of the BCP Team with Approval from senior management
Assessment of resources available to participate in continuity processes
Legal and Regulatory requirements analysis
Business Organizational Analysis
Phase 2: Business Impact Analysis
Phase 3: Continuity Planning - Recovery Strategies and Continuity Development
Phase 4: Approval and Implementation
Phase 5: Testing and Maintenance
Exercise, Test, Drill and Maintain the BCP.
Maintenance includes updating documentation as processes and controls change.
69. Becka recently signed a contract with an alternate data processing facility that will provide her company with space in the event of a disaster. The facility includes HVAC, power, and communications circuits but no hardware. What type of facility is Becka using? A. Cold site B. Warm site C. Hot site D. Mobile sit
A. A cold site includes the basic capabilities required for data center operations: space, power, HVAC, and communications, but it does not include any of the hardware required to restore operations.
70. What is the threshold for malicious damage to a federal computer system that triggers the Computer Fraud and Abuse Act? A. $500 B. $2,500 C. $5,000 D. $10,000
C. The Computer Fraud and Abuse Act (CFAA) makes it a federal crime to maliciously cause damage in excess of $5,000 to a federal computer system during any one-year period.
72. Which one of the following laws requires that communications service providers cooperate with law enforcement requests? A. ECPA B. CALEA C. Privacy Act D. HITECH Act
B. The Communications Assistance to Law Enforcement Act (CALEA) requires that all communications carriers make wiretaps possible for law enforcement officials who have an appropriate court order.
73. Every year, Gary receives privacy notices in the mail from financial institutions where he has accounts. What law requires the institutions to send Gary these notices? A. FERPA B. GLBA C. HI PAA D. HITECH
B. The Gramm-Leach-Bliley Act (GLBA) places strict privacy regulations on financial institutions, including providing written notice of privacy practices to customers.
76. Which one of the following stakeholders is not typically included on a business continuity planning team? A. Core business function leaders B. Information technology staff C. CEO D. Support departments
C. While senior management should be represented on the BCP team, it would be highly unusual for the CEO to fill this role personally.
77. Ben is designing a messaging system for a bank and would like to include a feature that allows the recipient of a message to prove to a third party that the message did indeed come from the purported originator. What goal is Ben trying to achieve? A. Authentication B. Authorization C. Integrity D. Nonrepudiation
D. Nonrepudiation allows a recipient to prove to a third party that a message came from a purported source. Authentication would provide proof to Ben that the sender was authentic, but Ben would not be able to prove this to a third party.
- Which one of the following is not a goal of a formal change management program?
A. Implement change in an orderly fashion.
B. Test changes prior to implementation.
C. Provide rollback plans for changes.
D. Inform stakeholders of changes after they occur.
D. Stakeholders should be informed of changes before, not after, they occur. The other items listed are goals of change management programs.
80. Ben is responsible for the security of payment card information stored in a database. Policy directs that he remove the information from the database, but he cannot do this for operational reasons. He obtained an exception to policy and is seeking an appropriate compensating control to mitigate the risk. What would be his best option? A. Purchasing insurance B. Encrypting the database contents C. Removing the data D. Objecting to the exception
B. Ben should encrypt the data to provide an additional layer of protection as a compensating control. The organization has already made a policy exception, so he should not react by objecting to the exception or removing the data without authorization. Purchasing insurance may transfer some of the risk but is not a mitigating control.
84. Helen is the owner of a website that provides information for middle and high school students preparing for exams. She is concerned that the activities of her site may fall under the jurisdiction of the Children’s Online Privacy Protection Act (COPPA). What is the cutoff age below which parents must give consent in advance of the collection of personal information from their children under COPPA? A. 13 B. 15 C. 17 D. 18
A. COPPA requires that websites obtain advance parental consent for the collection of personal information from children under the age of 13.
- Alan is performing threat modeling and decides that it would be useful to decompose the system into the key elements shown here. What tool is he using?
A. Vulnerability assessment
B. Fuzzing
C. Reduction analysis
D. Data modeling
C. In reduction analysis, the security professional breaks the system down into five key elements: trust boundaries, data flow paths, input points, privileged operations, and details about security controls.
- Match the following numbered laws or industry standards to their lettered description:
Laws and industry standards - GLBA
- PCI DSS
- HI PAA
- SOX
Descriptions
A. A U.S. law that requires covered financial institutions to provide their customers with
a privacy notice on a yearly basis
B. A U.S. law that requires internal controls assessments, including IT transaction flows
for publicly traded companies
C. An industry standard that covers organizations that handle credit cards
D. A U.S. law that provides data privacy and security requirements for medical
information
ACDB
91. Which type of business impact assessment tool is most appropriate when attempting to evaluate the impact of a failure on customer confidence? A. Quantitative B. Qualitative C. Annualized loss expectancy D. Reduction
B. Qualitative tools are often used in business impact assessment to capture the impact on intangible factors such as customer confidence, employee morale, and reputation.
93. Which one of the following security programs is designed to provide employees with the knowledge they need to perform their specific work tasks? A. Awareness B. Training C. Education D. Indoctrination
B. Security training is designed to provide employees with the specific knowledge they need to fulfill their job functions. It is usually designed for individuals with similar job functions.
95. Ryan is a security risk analyst for an insurance company. He is currently examining a scenario in which a malicious hacker might use a SQL injection attack to deface a web server due to a missing patch in the company’s web application. In this scenario, what is the threat? #ch11Q77 #ch12Q82 A. Unpatched web application B. Web defacement C. Malicious hacker D. Operating system
C. Risks are the combination of a threat and a vulnerability. Threats are the external forces seeking to undermine security, such as the malicious hacker in this case.
Vulnerabilities are the internal weaknesses that might allow a threat to succeed. In this case, the missing patch is the vulnerability. In this scenario, if the malicious hacker (threat) attempts a SQL injection attack against the unpatched server (vulnerability), the result is website defacement.
102. STRIDE, PASTA, and VAST are all examples of what type of tool? A. Risk assessment methodologies B. Control matrices C. Threat modeling methodologies D. Awareness campaign tools
C. STRIDE, Process for Attack Simulation and Threat Analysis (PASTA), and Visual, Agile, and Simple Threat (VAST) modeling are all threat modeling methodologies. STRIDE was designed for applications and operating systems (but can be used more broadly), PASTA is a risk-centric(以風險為中心) modeling system, and VAST is a threat modeling concept based on Agile project management and programming techniques.
105. Which of the following is not typically included in a prehire screening process? A. A drug test B. A background check C. Social media review D. Fitness evaluation
D. A fitness evaluation is not a typical part of a hiring process. Drug tests, background checks, and social media checks are all common parts of current hiring practices.
- Greg’s company recently experienced a significant data breach involving the personal data of many of their customers. Which breach laws should they review to ensure that they are taking appropriate action?
A. The breach laws in the state where they are headquartered
B. The breach laws of states they do business in
C. Only federal breach laws
D. Breach laws only cover government agencies, not private businesses
B. In general, companies should be aware of the breach laws in any location where they do business. US states have a diverse collection of breach laws and requirements, meaning that in this case, Greg’s company may need to review many different breach laws to determine which they may need to comply with if they conduct business in the state or with the state’s residents.
- Lawrence has been asked to perform vulnerability scans and a risk assessment of systems.
Which organizational process are these more likely to be associated with?
A. A merger
B. A divestiture
C. A layoff
D. A financial audit
A. When organizations merge, it is important to understand the state of the security for both organizations. Running vulnerability scans and performing a risk assessment are both common steps taken when preparing to merge two (or more!) IT environments.
110. Laura has been asked to perform an SCA. What type of organization is she most likely in? A. Higher education B. Banking C. Government D. Healthcare
C. A security controls assessment (SCA) most often refers to a formal US government process for assessing security controls and is often paired with a Security Test and Evaluation (ST&E) process. This means that Laura is probably part of a government organization or contractor.
2. Control Objectives for Information and Related Technology (COBIT) is a framework for information technology (IT) management and governance. Which data management role is most likely to select and apply COBIT to balance the need for security controls against business requirements? A. Business owners B. Data processors C. Data owners D. Data stewards
A. Business owners have to balance the need to provide value with regulatory, security, and other requirements. This makes the adoption of a common framework like COBIT attractive. Data owners are more likely to ask that those responsible for control selection identify a standard to use. Data processors are required to perform specific actions under regulations like the EU GDPR. Finally, in many organizations, data stewards are internal roles that oversee how data is used.
- How can a data retention policy help to reduce liabilities(減少負債)?
A. By ensuring that unneeded data isn’t retained
B. By ensuring that incriminating data is destroyed
C. By ensuring that data is securely wiped so it cannot be restored for legal discovery
D. By reducing the cost of data storage required by law
A. A data retention policy can help to ensure that outdated data is purged, removing potential additional costs for discovery. Many organizations have aggressive retention policies to both reduce the cost of storage and limit the amount of data that is kept on hand and discoverable. Data retention policies are not designed to destroy incriminating data, and legal requirements for data retention must still be met.
- Ben has been tasked with identifying security controls for systems covered by his organization’s information classification system. Why might Ben choose to use a security baseline?
A. It applies in all circumstances, allowing consistent security controls.
B. They are approved by industry standards bodies, preventing liability.
C. They provide a good starting point that can be tailored to organizational needs.
D. They ensure that systems are always in a secure state.
C. Security baselines provide a starting point to scope and tailor security controls to your organization’s needs. They aren’t always appropriate to specific organizational needs, they cannot ensure that systems are always in a secure state, and they do not prevent liability(責任).
10. What term is used to describe overwriting media to allow for its reuse in an environment operating at the same sensitivity level? A. Clearing B. Erasing C. Purging D. Sanitization
A. Clearing describes preparing media for reuse. When media is cleared, unclassified data is written over all addressable locations on the media. Once that’s completed, the media can be reused. Erasing is the deletion of files or media. Purging is a more intensive form of clearing for reuse in lower-security areas, and sanitization is a series of processes that removes data from a system or media while ensuring that the data is unrecoverable by any means.
11. Which of the following classification levels is the United States (U.S.) government’s classification label for data that could cause damage but wouldn’t cause serious or grave damage? A. Top S ecret B. Secret C. Confidential D. Classified
C. The US government uses the label Confidential for data that could cause damage if it was disclosed without authorization. Exposure of Top Secret data is considered to potentially cause grave damage, while Secret data could cause serious damage. Classified is not a level in the US government classification scheme.
- What issue is common to spare sectors and bad sectors on hard drives as well as overprovisioned space on modern SSDs?
A. They can be used to hide data.
B. They can only be degaussed.
C. They are not addressable, resulting in data remanence.
D. They may not be cleared, resulting in data remanence.
D. Spare sectors, bad sectors, and space provided for wear leveling on SSDs (overprovisioned space) may all contain data that was written to the space that will not be cleared when the drive is wiped. Most wiping utilities only deal with currently addressable space on the drive. SSDs cannot be degaussed, and wear leveling space cannot be reliably used to hide data. These spaces are still addressable by the drive, although they may not be seen by the operating system.
For questions 14–16, please refer to the following scenario:
Your organization regularly handles three types of data: information that it shares with customers, information that it uses internally to conduct business, and trade secret information that offers the organization significant competitive advantages. Information shared with customers is used and stored on web servers, while both the internal business data and the trade secret information are stored on internal file servers and employee workstations.
14. What civilian data classifications best fit this data?
A. Unclassified, confidential, top secret
B. Public, sensitive, private
C. Public, sensitive, proprietary(專有)
D. Public, confidential, private
C. Information shared with customers is public, internal business could be sensitive or private, and trade secrets are proprietary. Thus, public, sensitive, proprietary matches this most closely. Confidential is a military classification, which removes two of the remaining options, and trade secrets are more damaging to lose than a private classification would allow.
For questions 14–16, please refer to the following scenario:
Your organization regularly handles three types of data: information that it shares with customers, information that it uses internally to conduct business, and trade secret information that offers the organization significant competitive advantages. Information shared with customers is used and stored on web servers, while both the internal business data and the trade secret information are stored on internal file servers and employee workstations.
15. What technique could you use to mark your trade secret information in case it was released or stolen and you need to identify it?
A. Classification
B. Symmetric encryption
C. Watermarks
D. Metadata
C. A watermark is used to digitally label data and can be used to indicate ownership. Encryption would have prevented the data from being accessed if it was lost, while classification is part of the set of security practices that can help make sure the right controls are in place. Finally, metadata is used to label data and might help a data loss prevention system flag it before it leaves your organization.
- Why is it cost effective to purchase high-quality media to contain sensitive data?
A. Expensive media is less likely to fail.
B. The value of the data often far exceeds the cost of the media.
C. Expensive media is easier to encrypt.
D. More expensive media typically improves data integrity.
B. The value of the data contained on media often exceeds the cost of the media, making more expensive media that may have a longer life span or additional capabilities like encryption support a good choice. While expensive media may be less likely to fail, the reason it makes sense is the value of the data, not just that it is less likely to fail. In general, the cost of the media doesn’t have anything to do with the ease of encryption, and data integrity isn’t ensured by better media.
19. Chris is responsible for workstations throughout his company and knows that some of the company’s workstations are used to handle proprietary information. Which option best describes what should happen at the end of their lifecycle for workstations he is responsible for?#工作站在生命週期結束時應該發生什麼 A. Erasing B. Clearing C. Sanitization D. Destruction
C. Sanitization is a combination of processes that ensure that data from a system cannot be recovered by any means. Erasing and clearing are both prone to mistakes and technical problems that can result in remnant data and don’t make sense for systems that handled proprietary information. Destruction is the most complete method of ensuring that data cannot be exposed, and some organizations opt to destroy the entire workstation, but that is not a typical solution due to the cost involved.
23. The CIS benchmarks(基準) are an example of what practice? A. Conducting a risk assessment B. Implementing data labeling C. Proper system ownership D. Using security baselines
D. The CIS benchmarks are an example of a security baseline. A risk assessment would help identify which controls were needed, and proper system ownership is an important part of making sure baselines are implemented and maintained. Data labeling can help ensure that controls are applied to the right systems and data.
- The government defense contractor that Saria works for has recently shut down a major research project and is planning on reusing the hundreds of thousands of dollars of systems and data storage tapes used for the project for other purposes. When Saria reviews the company’s internal processes, she finds that she can’t reuse the tapes and that the manual says they should be destroyed. Why isn’t Saria allowed to degauss and then reuse the tapes to save her employer money?#就在考你英文
A. Data permanence may be an issue.
B. Data remanence is a concern.
C. The tapes may suffer from bitrot.
D. Data from tapes can’t be erased by degaussing.
B. Many organizations require the destruction of media that contains data at higher levels of classification. Often the cost of the media is lower than the potential costs of data exposure, and it is difficult to guarantee that reused media doesn’t contain remnant data. Tapes can be erased by degaussing, but degaussing is not always fully effective. Bitrot describes the slow loss of data on aging media, while data permanenceis a term
sometimes used to describe the life span of data and media.
- Fred’s organization allows downgrading of systems for reuse after projects have been finished and the systems have been purged. What concern should Fred raise about the reuse of the systems from his Top Secret classified project for a future project classified as Secret?
A. The Top Secret data may be commingled with the Secret data, resulting in a need to relabel the system.
B. The cost of the sanitization process may exceed the cost of new equipment.
C. The data may be exposed as part of the sanitization process.
D. The organization’s DLP system may flag the new system due to the difference in data
labels.
B. Downgrading systems and media is rare due to the difficulty of ensuring that sanitization is complete. The need to completely wipe (or destroy) the media that systems use means that the cost of reuse is often significant and may exceed the cost of purchasing a new system or media. The goal of purging is to ensure that no data remains, so commingling data should not be a concern, nor should the exposure of the data; only staff with the proper clearance should handle the systems! Finally, a DLP system should flag data based on labels, not on the system it comes from.
- Which of the following concerns should not be part of the decision when classifying data?
A. The cost to classify the data#.分類數據的成本
B. The sensitivity of the data
C. The amount of harm that exposure of the data could cause
D. The value of the data to the organizatio
A. Classification should be conducted based on the value of the data to the organization, its sensitivity, and the amount of harm that could result from exposure of the data. Cost should be considered when implementing controls and is weighed against the damage that exposure would create.
35. Which of the following is the least effective method of removing data from media? A. Degaussing B. Purging C. Erasing D. Clearing
C. Erasing, which describes a typical deletion process in many operating systems, typically removes only the link to the file and leaves the data that makes up the file itself. The data will remain in place but not indexed until the space is needed and it is overwritten. Degaussing works only on magnetic media, but it can be quite effective on it. Purging and clearing both describe more elaborate removal processes.#典型刪除過程，只刪除文件的鏈接並保留構成文件本身的數據
36. Match each of the numbered data elements shown here with one of the lettered categories. You may use the categories once, more than once, or not at all. If a data element matches more than one category, choose the one that is most specific. Data elements 1. Medical records 2. Credit card numbers 3. Social Security numbers 4. Driver’s license numbers Categories A. PCI DSS B. PHI C. PII
BACC
Medical records are an example of protected health information (PHI). Credit card numbers are personally identifiable information (PII), but they are also covered by the Payment Card Industry Data Security Standard (PCI DSS), which is a more specific category governing only credit card information and is a better answer. Social Security numbers and driver’s license numbers are examples of PII.
38. Lauren’s employer asks Lauren to classify patient X-ray data that has an internal patient identifier associated with it but does not have any way to directly identify a patient. The company’s data owner believes that exposure of the data could cause damage (but not exceptional damage) to the organization. How should Lauren classify the data? A. Public B. Sensitive C. Private D. Confidential
C. We know that the data classification will not be the top level classification of “Confidential” because the loss of the data would not cause severe damage. This means we have to choose between private (PHI) and sensitive (confidential). Calling this private due to the patient’s personal health information fits the classification scheme, giving us the correct answer.
- Chris is responsible for his organization’s security standards and has guided the selection and implementation of a security baseline for Windows PCs in his organization. How can Chris most effectively make sure that the workstations he is responsible for are being checked for compliance and that settings are being applied as necessary?
A. Assign users to spot-check baseline compliance.
B. Use Microsoft Group Policy.
C. Create startup scripts to apply policy at system start.
D. Periodically review the baselines with the data owner and system owners.
B. Group Policy provides the ability to monitor and apply settings in a security baseline. Manual checks by users and using startup scripts provide fewer reviews and may be prone to failure, while periodic review of the baseline won’t result in compliance being checked.
44. What term is used to describe a set of common security configurations, often provided by a third party? A. Security policy B. Baseline C. DSS D. NIST SP 800-53
B. A baseline is a set of security configurations that can be adopted and modified to fit an organization’s security needs. A security policy is written to describe an organization’s approach to security, while DSS is the second half of the Payment Card Industry Data Security Standard. The NIST SP-800 series of documents address computer security in a variety of areas.
- Joe works at a major pharmaceutical research(大型製藥研發) and development company and has been tasked with writing his organization’s data retention policy. As part of its legal requirements, the organization must comply with the U.S. Food and Drug Administration’s Code of Federal Regulations Title 21. To do so, it is required to retain records with electronic signatures. Why would a signature be part of a retention requirement?
A. It ensures that someone has reviewed the data.
B. It provides confidentiality.
C. It ensures that the data has not been changed.
D. It validates who approved(批准) the data.
D. Electronic signatures, as used in this rule, prove that the signature was provided by the intended signer. Electronic signatures as part of the FDA code are intended to ensure that electronic records are “trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper.” Signatures cannot provide confidentiality or integrity and don’t ensure that someone has reviewed the data.
49. What protocol is preferred over Telnet for remote server administration(管理) via the command line? A. SCP B. SFTP C. WDS D. SSH
D. Secure Shell (SSH) is an encrypted protocol for remote login and command-line access. SCP and SFTP are both secure file transfer protocols, while WDS is the acronym for Windows Deployment Services, which provides remote installation capabilities for Windows operating systems.
52. Alex works for a government agency that is required to meet U.S. federal government requirements for data security. To meet these requirements, Alex has been tasked with making sure data is identifiable by its classification level. What should Alex do to the data? A. Classify the data. B. Encrypt the data. C. Label the data. D. Apply DRM to the data.
C. Data labels are crucial to identify the classification level of information contained on the media. Digital rights management (DRM) tools provide ways to control how data is used, while encrypting it can help maintain the confidentiality and integrity of the data. Classifying the data is necessary to label it, but it doesn’t automatically place a label on the data.
- Ben is following the National Institute of Standards and Technology (NIST) Special Publication 800-88 guidelines for sanitization and disposition as shown here. He is handling information that his organization classified as sensitive, which is a moderate security categorization in the NIST model. If the media is going to be sold as surplus, what process does Ben need to follow?
A. Destroy, validate, document
B. Clear, purge, document
C. Purge, document, validate
D. Purge, validate, document
D. The NIST SP 800-88 process for sanitization and disposition shows that media that will be reused and was classified at a moderate level should be purged and then that purge should be validated. Finally, it should be documented.
For questions 57–59, please refer to the following scenario:
Chris has recently been hired into a new organization. The organization that Chris belongs to uses the following classification process:
1. Criteria are set for classifying data.#設定分類數據的標準
2. Data owners are established for each type of data.
3. Data is classified.
4. Required controls are selected for each classification.
5. Baseline security standards are selected for the organization.
6. Controls are scoped and tailored.
7. Controls are applied and enforced.
8. Access is granted and managed.
57. If Chris is one of the data owners for the organization, what steps in this process is he most likely responsible for?
A. He is responsible for steps 3, 4, and 5.
B. He is responsible for steps 1, 2, and 3.
C. He is responsible for steps 5, 6, and 7.
D. All of the steps are his direct responsibility.
A. Chris is most likely to be responsible for classifying the data that he owns as well as assisting with or advising the system owners on security requirements and control selection. In an organization with multiple data owners, Chris is unlikely to set criteria for classifying data on his own. As a data owner, Chris will also not typically have direct responsibility for scoping, tailoring, applying, or enforcing those controls.
For questions 57–59, please refer to the following scenario:
Chris has recently been hired into a new organization. The organization that Chris belongs to uses the following classification process:
1. Criteria are set for classifying data.#設定分類數據的標準
2. Data owners are established for each type of data.
3. Data is classified.
4. Required controls are selected for each classification.
5. Baseline security standards are selected for the organization.
6. Controls are scoped and tailored.
7. Controls are applied and enforced.
8. Access is granted and managed.
58. Chris manages a team of system administrators. What data role are they fulfilling if they conduct steps 6, 7, and 8 of the classification process?
A. They are system owners and administrators.
B. They are administrators and custodians.
C. They are data owners and administrators.
D. They are custodians and users.
B. The system administrators are acting in the roles of data administrators who grant access and will also act as custodians who are tasked with the day-to-day application of security controls. They are not acting as data owners who own the data itself. Typically, system administrators are delegated authority by system owners, such as a department head, and of course they are tasked with providing access to users.
For questions 57–59, please refer to the following scenario:
Chris has recently been hired into a new organization. The organization that Chris belongs to uses the following classification process:
1. Criteria are set for classifying data.#設定分類數據的標準
2. Data owners are established for each type of data.
3. Data is classified.
4. Required controls are selected for each classification.
5. Baseline security standards are selected for the organization.
6. Controls are scoped and tailored.
7. Controls are applied and enforced.
8. Access is granted and managed.
59. If Chris’s company operates in the European Union and has been contracted to handle the data for a third party, what role is his company operating in when it uses this process to classify and handle data?
A. Business owners
B. Mission owners
C. Data processors
D. Data administrators
C. Third-party organizations that process personal data on behalf of a data controller are known as data processors. The organization that they are contracting with would act in the role of the business or mission owners, and others within Chris’s organization would have the role of data administrators, granting access as needed to the data based on their operational procedures and data classification.
- Which of the following is not one of the European Union’s General Data Protection Regulation (GDPR) principles?
A. Information must be processed fairly.#必須公平處理信息
B. Information must be deleted within one year of acquisition.
C. Information must be maintained securely.
D. Information must be accurate.
B. The GDPR does include requirements that data be processed fairly, maintained securely, and maintained accurately. It does not include a requirement that information be deleted within one year, although it does specify that information should not be kept longer than necessary.
- Ben’s company, which is based in the European Union, hires a third-party organization that processes data for it. Who has responsibility to protect the privacy of the data and ensure that it isn’t used for anything other than its intended purpose?
A. Ben’s company is responsible.
B. The third-party data processor is responsible.
C. The data controller is responsible.
D. Both organizations bear equal responsibility
D. Under EU regulations,both the organization sharing data and the third-party data processor bear responsibility for maintaining the privacy and security of personal information.
62. Major Hunter, a member of the armed forces(武裝部隊), has been entrusted with information that, if exposed, could cause serious damage to national security. Under U.S. government classification standards, how should this data be classified?#考英文&情境判斷，這個人有點重要但還沒到會毀滅國家 A. Unclassified B. Top S ecret C. Confidential D. Secret
D. The U.S. government specifies Secret as the classification level for information that, if disclosed, could cause serious harm to national security. Top Secret is reserved for information that could cause exceptionally grave harm, while confidential data could be expected to cause less harm. Unclassified is not an actual classification but only indicates that the data may be released to unclassified individuals. Organizations may still restrict access to unclassified information.
63. When a computer is removed from service and disposed of, the process that ensures that all storage media has been removed or destroyed is known as what? A. Sanitization B. Purging C. Destruction D. Declassification
A. Sanitization is the combination of processes used to remove data from a system or media. When a PC is disposed of, sanitization includes the removal or destruction of drives, media, and any other storage devices it may have. Purging, destruction, and declassification are all other handling methods.
64. Linux systems that use bcrypt are using a tool based on what DES alternative encryption scheme? A. 3DES B. AES C. Diffie–Hellman D. Blowfish
D. Bcrypt is based on Blowfish (the b is a key hint here). AES and 3DES are both replacements for DES, while Diffie-Hellman is a protocol for key exchange.
- Susan works in an organization that labels all removable media with the classification level of the data it contains, including public data. Why would Susan’s employer label all media instead of labeling only the media that contains data that could cause harm if it was exposed?
A. It is cheaper to order all prelabeled media.
B. It prevents sensitive media from not being marked by mistake.
C. It prevents reuse of public media for sensitive data.
D. Labeling all media is required by HIPAA.
B. Requiring all media to have a label means that when unlabeled media is found, it should immediately be considered suspicious. This helps to prevent mistakes that might leave sensitive data unlabeled. Prelabeled media is not necessarily cheaper (nor may it make sense to buy!), while reusing public media simply means that it must be classified based on the data it now contains. HIPAA does not have specific media labeling requirements.
- Why is declassification rarely chosen as an option for media reuse?
A. Purging is sufficient for sensitive data.
B. Sanitization is the preferred method of data removal.
C. It is more expensive than new media and may still fail.
D. Clearing is required first.
C. Ensuring that data cannot be recovered is difficult,and the time and effort required to securely and completely wipe media as part of declassification can exceed the cost of new media.
Sanitization, purging, and clearing may be part of declassification, but they are not reasons that it is not frequently chosen as an option for organizations with data security concerns.
69. Incineration(焚燒), crushing, shredding, and disintegration all describe what stage in the lifecycle of media? A. Sanitization B. Degaussing C. Purging D. Destruction
D. Destruction is the final stage in the lifecycle of media and can be done via disintegration, incineration, or a variety of other methods that result in the media and data being nonrecoverable. Sanitization is a combination of processes used when data is being removed from a system or media. Purging is an intense form of clearing, and degaussing uses strong magnetic fields to wipe data from magnetic media.
- The European Union (EU) General Data Protection Regulation (GDPR) does not include which of the following key elements?
A. The need to collect information for specified, explicit, and legitimate purposes
B. The need to ensure that collection is limited to the information necessary to achieve the stated purpose
C. The need to protect data against accidental destruction
D. The need to encrypt information at rest
D. The GDPR does include the need to collect information for specified, explicit, and legitimate purposes; the need to ensure that collection is limited to the information necessary to achieve the stated purpose; and the need to protect data against accidental destruction. It does not include a specific requirement to encrypt information at rest.
- Charles has been asked to downgrade the media used for storage of private data for his organization. What process should Charles follow?
A. Degauss the drives, and then relabel them with a lower classification level.
B. Pulverize the drives, and then reclassify them based on the data they contain.
C. Follow the organization’s purging process, and then downgrade and replace labels.
D. Relabel the media, and then follow the organization’s purging process to ensure that the media matches the label.
C. If an organization allows media to be downgraded, the purging process should be followed, and then the media should be relabeled. Degaussing may be used for magnetic media but won’t handle all types of media. Pulverizing would destroy the media, preventing reuse, while relabeling first could lead to mistakes that result in media that hasn’t been purged entering use.
- Which of the following tasks are not performed by a system owner per NIST SP 800-18?
A. Develops a system security plan
B. Establishes rules for appropriate use and protection of data
C. Identifies and implements security controls
D. Ensures that system users receive appropriate security training
B. The data owner sets the rules for use and protection of data. The remaining options all describe tasks for the system owner, including implementation of security controls.
- NIST SP 800-60 provides a process shown in the following diagram to assess information systems. What process does this diagram show?
A. Selecting a standard and implementing it
B. Categorizing and selecting controls
C. Baselining and selecting controls
D. Categorizing and sanitizing
B. In the NIST SP 800-60 diagram, the process determines appropriate categorization levels resulting in security categorization and then uses that as an input to determine controls. Standard selection would occur at an organizational level, while baselining occurs when systems are configured to meet a baseline. Sanitization would require the intentional removal of data from machines or media.
- What is the best way to secure files that are sent from workstation A via the internet service (C) to remote server E?
A. Use AES at rest at point A, and use TLS in transit via B and D.
B. Encrypt the data files and send them.
C. Use 3DES and TLS to provide double security.
D. Use full disk encryption at A and E, and use SSL at B and D.
B. Sending a file that is encrypted before it leaves means that exposure of the file in transit will not result in a confidentiality breach and the file will remain secure until decrypted at location E. Since answers A, C, and D do not provide any information about what happens at point C, they should be considered insecure, as the file may be at rest at point C in an unencrypted form.
- Susan needs to provide a set of minimum security requirements for email. What steps should she recommend for her organization to ensure that the email remains secure?
A. All email should be encrypted.
B. All email should be encrypted and labeled.
C. Sensitive email should be encrypted and labeled.
D. Only highly sensitive email should be encrypted.
C. Encrypting and labeling sensitive email will ensure that it remains confidential and can be identified. Performing these actions only on sensitive email will reduce the cost and effort of encrypting all email, allowing only sensitive email to be the focus of the organization’s efforts. Only encrypting highly sensitive email not only skips labeling but might expose other classifications of email that shouldn’t be exposed.
79. What term describes the process of reviewing baseline security controls and selecting only the controls that are appropriate for the IT system you are trying to protect? A. Standard creation B. CIS benchmarking C. Baselining D. Scoping
D. Scoping is performed when you match baseline controls to the IT system you’re working to secure. Creation of standards is part of the configuration process and may involve the use of baselines. Baselining can mean the process of creating a security baseline or configuring systems to meet the baseline. CIS, the Center for Internet Security, provides a variety of security baselines.
80. What data role does a system that is used to process data have? A. Mission owner B. Data owner C. Data processor D. Custodian
C. Systems used to process data are data processors. Data owners are typically CEOs or other very senior staff, custodians are granted rights to perform day-to-day tasks when handling data, and mission owners are typically program or information system owners.
81. Which one of the following is not considered PII under U.S. federal government regulations? A. Name B. Social security number C. Student ID number D. ZIP code
D. Personally identifiable information includes any information that can uniquely identify an individual. This would include name, Social Security number, and any other unique identifier (including a student ID number). ZIP code, by itself, does not uniquely identify an individual.
82. What type of health information is the Health Insurance Portability and Accountability Act required to protect? A. PII B. PHI C. SHI D. HPHI
B. Protected health information, or PHI, includes a variety of data in multiple formats, including oral and recorded data, such as that created or received by healthcare providers, employers, and life insurance providers. PHI must be protected by HIPAA. PII is personally identifiable information. SHIand HPHIare both made-up acronyms.
84. Lauren’s multinational company wants to ensure compliance with the EU GDPR. Which principle of the GDPR states that the individual should have the right to receive personal information concerning himself or herself and share it with another data controller? A. Onward transfer B. Data integrity C. Enforcement D. Data portability#可移植性
D. The principle of data portability says that the data subject has the right to receive personal information and to transfer that information to another data controller. The principle of data integrity states that data should be reliable and that information should not be used for purposes other than those that users are made aware of by notice and that they have accepted through choice. Enforcement is aimed at ensuring that compliance with principles is assured. Onward transfer limits transfers to other organizations that comply with the principles of notice and choice.
85. What is the best method to sanitize a solid-state drive (SSD)? A. Clearing B. Zero fill C. Disintegration D. Degaussing
C. Due to problems with remnant data, the US National Security Agency requires physical destruction of SSDs. This process, known as disintegration#崩解, results in very small fragments via a shredding process. Zero fill wipes a drive by replacing data with zeros, degaussing uses magnets to wipe magnetic media, and clearing is the process of preparing media for reuse.
For questions 86–88, please refer to the following scenario:
As shown in the following security lifecycle diagram (loosely based on the NIST reference architecture), NIST uses a five-step process for risk management. Using your knowledge of data roles and practices, answer the following questions based on the NIST framework process.
- What data role will own responsibility for step 1, the categorization of information systems; to whom will they delegate(委派) step 2; and what data role will be responsible for step 3?
A. Data owners, system owners, custodians
B. Data processors, custodians, users
C. Business owners, administrators, custodians
D. System owners, business owners, administrators
A. The data owner bears responsibility for categorizing information systems and delegates selection of controls to system owners, while custodians implement the controls. Users don’t perform any of these actions, while business owners are tasked with ensuring that systems are fulfilling their business purpose.
For questions 86–88, please refer to the following scenario:
As shown in the following security lifecycle diagram (loosely based on the NIST reference architecture), NIST uses a five-step process for risk management. Using your knowledge of data roles and practices, answer the following questions based on the NIST framework process.
87. If the systems that are being assessed all handle credit card information (and no other sensitive data), at what step would the PCI DSS first play an important role?
A. Step 1
B. Step 2
C. Step 3
D. Step 4
B. PCI DSS provides a set of required security controls and standards. Step 2 would be guided by the requirements of PCI DSS. PCI DSS will not greatly influence step 1 because all of the systems handle credit card information, making PCI DSS apply to all systems covered. Steps 3 and 4 will be conducted after PCI DSS has guided the decisions in step 2.
For questions 86–88, please refer to the following scenario:
As shown in the following security lifecycle diagram (loosely based on the NIST reference architecture), NIST uses a five-step process for risk management. Using your knowledge of data roles and practices, answer the following questions based on the NIST framework process.
88. What data security role is primarily responsible for step 5?
A. Data owners
B. Data processors
C. Custodians
D. User
C. Custodians are tasked with the day-to-day monitoring of the integrity and security of data. Step 5 requires monitoring, which is a custodial(監管) task. A data owner may grant rights to custodians but will not be responsible for conducting monitoring. Data processors process data on behalf of the data controller, and a user simply uses the data via a computing system.
- Susan’s organization performs a zero fill on hard drives before they are sent to a third-party organization to be shredded. What issue is her organization attempting to avoid?
A. Data remanence while at the third-party site
B. Mishandling of drives by the third party
C. Classification mistakes
D. Data permanence
B. Susan’s organization is limiting its risk by sending drives that have been sanitized before they are destroyed. This limits the possibility of a data breach if drives are mishandled by the third party, allowing them to be stolen, resold, or simply copied. The destruction of the drives will handle any issues with data remanence, while classification mistakes are not important if the drives have been destroyed. Data permanence and the life span of the data are not important on a destroyed drive.
90. Embedded data used to help identify the owner of a file is an example of what type of label? A. Copyright notice B. DLP C. Digital watermark#數字水印 D. Steganography
C. A digital watermark is used to identify the owner of a file or to otherwise label it. A copyright notice provides information about the copyright asserted on the file, while data loss prevention (DLP) is a solution designed to prevent data loss. Steganography is the science of hiding information, often in images or files.
94. Which data role is tasked with granting appropriate access to staff members? A. Data processors B. Business owners C. Custodians D. Administrators
D. Administrators have the rights to assign permissions to access and handle data.
Custodians are trusted with day-to-day data handling tasks. Business owners are typically system or project owners, and data processors are systems used to process data.
- Which California law requires conspicuously posted privacy policies on commercial websites that collect the personal information of California residents?
A. The Personal Information Protection and Electronic Documents Act
B. The California Online Privacy Protection Act
C. California Online Web Privacy Act
D. California Civil Code 1798.82
B. The California Online Privacy Protection Act (COPPA) requires that operators of commercial websites and services post a prominently displayed privacy policy if they collect personal information on California residents.
The Personal Information Protection and Electronic Documents Act is a Canadian privacy law, while California Civil Code 1798.82 is part of the set of California codes that requires breach notification. The California Online Web Privacy Act does not exist.
99. Ed has been asked to send data that his organization classifies as confidential and proprietary via email. What encryption technology would be appropriate to ensure that the contents of the files attached to the email remain confidential as they traverse the internet? A. SSL B. TLS C. PGP D. VPN
C. PGP, or Pretty Good Privacy (or its open-source alternative, GPG) provide strong encryption of files, which can then be sent via email. Email traverses multiple servers and will be unencrypted at rest at multiple points along its path as it is stored and forwarded to its destination.
1. Matthew is the security administrator for a consulting firm and must enforce access controls that restrict users’ access based upon their previous activity. For example, once a consultant accesses data belonging to Acme Cola, a consulting client, they may no longer access data belonging to any of Acme’s competitors. What security model best fits Matthew’s needs? A. Clark-Wilson B. Biba C. Bell-LaPadula D. Brewer-Nash
D. The Brewer-Nash model allows access controls to change dynamically based upon a user’s actions. It is often used in environments like Matthew’s to implement a “Chinese wall” between data belonging to different clients.
當主體無法讀取位於不同數據集中的另一個對象時，主體才能寫入對象。 它的創建是為了提供可根據用戶之前的操作動態更改的訪問控制。 該模型的主要目標是通過用戶的訪問嘗試來防止利益衝突。
- Referring to the figure shown here, what is the earliest stage of a fire where it is possible to use detection technology to identify it?
A. Incipient#初期
B. Smoke
C. Flame
D. Heat
A. Fires may be detected as early as the incipient stage. During this stage, air ionization takes place, and specialized incipient fire detection systems can identify these changes to provide early warning of a fire. #早在初期階段就可以檢測到火災。 在此階段，空氣電離發生，專門的初期火災探測系統可以識別這些變化，以提供火災的早期預警。
3. Ralph is designing a physical security infrastructure for a new computing facility that will remain largely unstaffed. He plans to implement motion detectors in the facility but would also like to include a secondary verification control for physical presence. Which one of the following would best meet his needs? A. CCTV B. IPS C. Turnstiles D. Faraday cages
A. Closed-circuit television (CCTV) systems act as a secondary verification mechanism for physical presence because they allow security officials to view the interior of the facility when a motion alarm sounds to determine the current occupants and their activities.
4. Harry would like to retrieve a lost encryption key from a database that uses m of n control, with m = 4 and n = 8. What is the minimum number of escrow agents required to retrieve the key? A. 2 B. 4 C. 8 D. 12
B. In an M of n control system, at least M of n possible escrow agents must collaborate to retrieve an encryption key from the escrow database. #秘密共享用於希望在N股之間分配秘密的情況，使得其中的M
6. Bob is a security administrator with the federal government and wishes to choose a digital signature approach that is an approved part of the federal Digital Signature Standard under FIPS 186-4. Which one of the following encryption algorithms is not an acceptable choice for use in digital signatures? A. DSA B. HAVAL C. RSA D. ECDSA
B. The Digital Signature Standard approves three encryption algorithms for use in digital signatures: the Digital Signature Algorithm (DSA); the Rivest, Shamir, Adleman (RSA) algorithm; and the Elliptic Curve DSA (ECDSA) algorithm. HAVAL is a hash function, not an encryption algorithm. While hash functions are used as
part of the digital signature process, they do not provide encryption.
9. Helen is a software engineer and is developing code that she would like to restrict to running within an isolated sandbox for security purposes. What software development technique is Helen using? A. Bounds B. Input validation C. Confinement D. TCB
C. The use of a sandbox is an example of confinement, where the system restricts the access of a particular process to limit its ability to affect other processes running on the same system.
10. What concept describes the degree of confidence that an organization has that its controls satisfy security requirements? A. Trust B. Credentialing C. Verification D. Assurance
D. Assurance is the degree of confidence that an organization has that its security controls are correctly implemented. It must be continually monitored and reverified.
- In the figure shown here, Sally is blocked from reading the file due to the Biba integrity model. Sally has a Secret security clearance, and the file has a Confidential classification.
What principle of the Biba model is being enforced?
A. Simple Security Property
B. Simple Integrity Property
C. *-Security Property
D. *-Integrity Property
B. The Simple Integrity Property states that an individual may not read a file classified at a lower security level than the individual’s security clearance.#不要讀到不乾淨的
14. Sonia recently removed an encrypted hard drive from a laptop and moved it to a new device because of a hardware failure. She is having difficulty accessing encrypted content on the drive despite the fact that she knows the user’s password. What hardware security feature is likely causing this problem? A. TCB B. TPM C. NIACAP D. RSA
B. The Trusted Platform Module (TPM) is a hardware security technique that stores an encryption key on a chip on the motherboard and prevents someone from accessing an encrypted drive by installing it in another computer.
15. Chris wants to verify that a software package that he downloaded matches the original version. What hashing tool should he use if he believes that technically sophisticated attackers may have replaced the software package with a version containing a backdoor? A. MD5 B. 3DES C. SHA1 D. SHA 256
D. Intentional collisions have been created with MD5, and a real-world collision attack against SHA 1 was announced in early 2017. 3DES is not a hashing tool, leaving SHA 256 (sometimes called SHA 2) as the only real choice that Chris has in this list.#選安全的
22. What type of fire suppression system fills with water when the initial stages of a fire are detected and then requires a sprinkler head heat activation before dispensing(發放) water? A. Wet pipe B. Dry pipe C. Deluge D. Preaction
D. A preaction fire suppression system activates in two steps. The pipes fill with water once the early signs of a fire are detected. The system does not dispense water until heat sensors on the sprinkler heads trigger the second phase.
26. How many bits of keying material does the Data Encryption Standard use for encrypting information? A. 56 bits B. 64 bits C. 128 bits D. 256 bits
A. DES uses a 64-bit encryption key, but only 56 of those bits are actually used as keying material in the encryption operation. The remaining 8 bits are used to detect tampering or corruption of the key.
29. Under the Common Criteria, what element describes the security requirements for a product? A. TCSEC B. ITSEC C. PP D. ST
C. Protection Profiles (PPs) specify the security requirements and protections that must be in place for a product to be accepted under the Common Criteria.
- Referring to the figure shown here, what is the name of the security control indicated by the arrow?
A. Mantrap
B. Turnstile
C. Intrusion prevention system
D. Portal
A. Mantraps use a double set of doors to prevent piggybacking by allowing only a single individual to enter a facility at a time.
- Which one of the following does not describe a standard physical security requirement for wiring closets(配線間)?
A. Place only in areas monitored by security guards.
B. Do not store flammable items in the closet.
C. Use sensors on doors to log entries.
D. Perform regular inspections of the closet.
A. While it would be ideal to have wiring closets in a location where they are monitored by security staff, this is not feasible in most environments. Wiring closets must be distributed geographically in multiple locations across each building used by an organization.#理想的，但在大多數環境中這是不可行的
37. What is the minimum number of independent parties necessary to implement the Fair Cryptosystems(公平密碼系統) approach to key escrow? A. 1 B. 2 C. 3 D. 4
B. In the Fair Cryptosystem approach to key escrow, the secret keys used in communications are divided into two or more pieces, each of which is given to an independent third party.
38. In what state does a processor’s scheduler place a process when it is prepared to execute but the CPU is not currently available? A. Ready B. Running C. Waiting D. Stopped
A. The Ready state is used when a process is prepared to execute but the CPU is not available. The Running state is used when a process is executing on the CPU. The Waiting state is used when a process is blocked waiting for an external event. The Stopped state is used when a process terminates.
- Alan is reviewing a system that has been assigned the EAL1 evaluation assurance level under the Common Criteria. What is the degree of assurance that he may have about the system?
A. It has been functionally tested.
B. It has been structurally tested.
C. It has been formally verified, designed, and tested.
D. It has been methodically designed, tested, and reviewed.
A. EAL1 assurance applies when the system in question has been functionally tested. It is the lowest level of assurance under the Common Criteria.
#EAL(Evaluation Assurance Level of CC)
EAL1:Functionally tested
EAL2:Structurally tested
EAL3:Methodically tested & checked
EAL4:Methodically designed, tested & reviewed
EAL5:Semi-formally designed & tested
EAL6:Semi-formally verified designed & tested
EAL7:Formally verified designed & tested
40. Which one of the following components is used to assign classifications to objects in a mandatory access control system? A. Security label B. Security token C. Security descriptor D. Security capability
A. Administrators and processes may attach security labels to objects that provide information on an object’s attributes. Labels are commonly used to apply classifications in a mandatory access control system.
45. James is working with a Department of Defense system(國防部系統) that is authorized to simultaneously handle information classified at the Secret and Top Secret levels. What type of system is he using? A. Single state B. Unclassified C. Compartmented D. Multistate
D. Multistate systems are certified to handle data from different security classifications simultaneously by implementing protection mechanisms that segregate data appropriately.
- Kyle is being granted access to a military computer system that uses System High mode.
What is not true about Kyle’s security clearance requirements?
A. Kyle must have a clearance for the highest level of classification processed by the system, regardless of his access.
B. Kyle must have access approval for all information processed by the system.
C. Kyle must have a valid need to know for all information processed by the system.
D. Kyle must have a valid security clearance.
C. For systems running in System High mode, the user must have a valid security clearance for all information processed by the system, access approval for all information processed by the system, and a valid need to know for some, but not necessarily all, information processed by the system.
50. In an infrastructure as a service (IaaS) environment where a vendor supplies a customer with access to storage services, who is normally responsible for removing sensitive data from drives that are taken out of service(已停止使用)? A. Customer’s security team B. Customer’s storage team C. Customer’s vendor management team D. Vendor
D. In an infrastructure as a service environment, security duties follow a shared responsibility model. Since the vendor is responsible for managing the storage hardware, the vendor would retain responsibility for destroying or wiping drives as they are taken out of service. However, it is still the customer’s responsibility to validate that the vendor’s sanitization procedures meet their requirements prior to utilizing the vendor’s storage services.
51. Which one of the following is an example of a code, not a cipher?#在問機制 A. Data Encryption Standard B. “One if by land; two if by sea” C. Shifting letters by three D. Word scramble
B. The major difference between a code and a cipher is that ciphers alter messages at the character or bit level, not at the word level. DES, shift ciphers, and word scrambles all work at the character or bit level and are ciphers. “One if by land; two if by sea” is a message with hidden meaning(某些人才看得懂，但和密碼無關) in the words and is an example of a code.
52. Which one of the following systems assurance processes provides an independent thirdparty evaluation of a system’s controls that may be trusted by many different organizations? A. Certification B. Definition C. Verification D. Accreditation
C. The verification process is similar to the certification process in that it validates security controls. Verification may go a step further by involving a third-party testing service and compiling results that may be trusted by many different organizations. Accreditation is the act of management formally accepting an evaluating system, not evaluating the system itself.
54. Harold is assessing the susceptibility of his environment to hardware failures and would like to identify the expected lifetime of a piece of hardware. What measure should he use for this? A. MTTR B. MTTF C. RTO D. MTO
B. The mean time to failure (MTTF) provides the average amount of time before a device of that particular specification fails.
55. What type of fire extinguisher(滅火器) is useful only against common combustibles(可燃物)? A. Class A B. Class B C. Class C D. Class D
A. Class A fire extinguishers are useful only against common combustible materials. They use water or soda acid as their suppressant(抑製劑). Class B extinguishers are for liquid fires. Class C extinguishers are for electrical fires, and Class D fire extinguishers are for combustible metals(可燃金屬). #1可燃，2水水，3電火，4電金
- Gordon is concerned about the possibility that hackers may be able to use the Van Eck radiation phenomenon(輻射現象) to remotely read the contents of computer monitors in his facility.
What technology would protect against this type of attack?
A. TCSEC
B. SCSI
C. GHOST
D. TEMPEST
D. The TEMPEST program creates technology that is not susceptible to Van Eck phreaking attacks because it reduces or suppresses natural electromagnetic emanations(電磁輻射).
- In the diagram shown here of security boundaries within a computer system, what component’s name has been replaced with XXX?
A. Kernel
B. TCB
C. Security perimeter
D. User execution
B. The Trusted Computing Base (TCB) is a small subset of the system contained within the kernel that carries out critical system activities.
61. Sherry conducted an inventory(清點) of the cryptographic technologies in use within her organization and found the following algorithms and protocols in use. Which one of these technologies should she replace because it is no longer considered secure?#考英文 A. MD5 B. 3DES C. PGP D. WPA2
A. The MD5 hash algorithm has known collisions and, as of 2005, is no longer considered secure for use in modern environments.
62. What action can you take to prevent accidental data disclosure due to wear leveling on an SSD device before reusing the drive? A. Reformatting B. Disk encryption C. Degaussing D. Physical destruction
B. Encrypting data on SSD drives does protect against wear leveling. Disk formatting does not effectively remove data from any device. Degaussing is only effective for magnetic media. Physically destroying the drive would not permit reuse.
64. A hacker recently violated the integrity of data in James’s company by modifying a file using a precise timing attack. The attacker waited until James verified the integrity of a file’s contents using a hash value and then modified the file between the time that James verified the integrity and read the contents of the file. What type of attack took place? A. Social engineering B. TOCTOU C. Data diddling D. Parameter checking
B. In a time of check to time of use (TOCTOU) attack, the attacker exploits the difference in time between when a security control is verified and the data protected by the control is actually used.
66. What is the minimum fence height that makes a fence difficult to climb easily, deterring most intruders? A. 3 feet B. 4 feet C. 5 feet D. 6 feet
D. Fences designed to deter more than the casual intruder should be at least 6 feet high. If a physical security system is designed to deter even determined intruders, it should be at least 8 feet high and topped with three strands of barbed wire.
68. What physical security control broadcasts false emanations constantly to mask the presence of true electromagnetic emanations from computing equipment? A. Faraday cage B. Copper-infused windows C. Shielded cabling D. White noise
D. While all of the controls mentioned protect against unwanted electromagnetic emanations, only white noise is an active control. White noise generates false emanations that effectively “jam” the true emanations from electronic equipment.
70. Alice has read permissions on an object, and she would like Bob to have those same rights. Which one of the rules in the Take-Grant protection model would allow her to complete this operation? A. Create rule B. Remove rule C. Grant rule D. Take rule
C. The grant rule allows a subject to grant rights that it possesses on an object to another subject(擁有的權利授予另一個主體).
71. As part of his incident response process, Charles securely wipes the drive of a compromised machine and reinstalls the operating system (OS) from original media. Once he is done, he patches the machine fully and applies his organization’s security templates before reconnecting the system to the network. Almost immediately after the system is returned to service, he discovers that it has reconnected to the same botnet it was part of before. Where should Charles look for the malware that is causing this behavior? A. The operating system partition B. The system BIOS or firmware C. The system memory D. The installation media
D. The system Charles is remediating may have a firmware or BIOS infection, with malware resident on the system board. While uncommon, this type of malware can be difficult to find and remove. Since he used original media, it is unlikely that the malware came from the software vendor. Charles wiped the system partition, and the system would have been rebooted before being rebuilt, thus clearing system memory.
72. Which one of the following computing models allows the execution of multiple concurrent tasks within a single process? A. Multitasking B. Multiprocessing C. Multiprogramming D. Multithreading
D. Multithreading permits multiple tasks to execute concurrently within a single process. These tasks are known as threads and may be alternated between without switching processes.
73. Alan intercepts an encrypted message and wants to determine what type of algorithm was used to create the message. He first performs a frequency analysis and notes that the frequency of letters in the message closely matches the distribution of letters in the English language. What type of cipher was most likely used to create this message? A. Substitution cipher B. AES C. Transposition cipher D. 3DES
C. This message was most likely encrypted with a transposition cipher. The use of a substitution cipher, a category that includes AES and 3DES, would change the frequency distribution so that it did not mirror that of the English language.
74. The Double DES (2DES) encryption algorithm was never used as a viable alternative to the original DES algorithm. What attack is 2DES vulnerable to that does not exist for the DES or 3DES approach? A. Chosen ciphertext B. Brute force C. Man in the middle D. Meet in the middle
D. The meet-in-the-middle attack uses a known plaintext message and uses both encryption of the plaintext and decryption of the ciphertext simultaneously in a brute-force manner to identify the encryption key in approximately double the time of a brute-force attack against the basic DES algorithm.
#這個術語指的是用於嘗試從兩端打破數學問題的數學分析。
這是一種同時處理函數的正向映射和第二函數的逆的技術。 攻擊的工作原理是從一端加密並從另一端解密，從而在中間進行會議。
中間會合攻擊使用已知的明文消息，並以強力方式同時使用明文加密和密文解密，以大約兩倍於暴力攻擊的時間識別加密密鑰。 基本的DES算法。
76. Warren is designing a physical intrusion detection system for his data center and wants to include technology that issues an alert if the communications lines for the alarm system are unexpectedly cut. What technology would meet this requirement? A. Heartbeat sensor B. Emanation security C. Motion detector D. Faraday cage
A. Heartbeat sensors send periodic status messages from the alarm system to the monitoring center. The monitoring center triggers an alarm if it does not receive a status message for a prolonged period of time, indicating that communications were disrupted.#都叫Heartbeat
- John and Gary are negotiating a business transaction, and John must demonstrate to Gary that he has access to a system. He engages in an electronic version of the “magic door” scenario shown here. What technique is John using?
A. Split-knowledge proof
B. Zero-knowledge proof
C. Logical proof
D. Mathematical proof
B. In a zero-knowledge proof, one individual demonstrates to another that they can achieve a result that requires sensitive information without actually disclosing the sensitive information. #在零知識證明中，一個人向另一個人證明他們可以在不實際披露敏感信息的情況下獲得需要敏感信息的結果。
78. Raj is selecting an encryption algorithm for use in his organization and would like to be able to vary the strength of the encryption with the sensitivity of the information. Which one of the following algorithms allows the use of different key strengths? A. Blowfish B. DES C. Skipjack D. IDEA
A. Blowfish allows the user to select any key length between 32 and 448 bits.
79. Referring to the fire triangle shown here, which one of the following suppression materials attacks a fire by removing the fuel source? A. Water B. Soda acid C. Carbon dioxide D. Halon
B. Soda acid and other dry powder extinguishers work to remove the fuel supply. Water suppresses temperature, while halon and carbon dioxide remove the oxygen supply from a fire. #蘇打酸和其他乾粉滅火器用於去除燃料供應。水可以抑制溫度，而哈龍和二氧化碳可以消除火災中的氧氣供應。#考英文&化學
82. The Bell-LaPadula and Biba models implement state machines in a fashion that uses what specific state machine model? A. Information flow B. Noninterference C. Cascading D. Feedback
A. The information flow model applies state machines to the flow of information. The Bell-LaPadula model applies the information flow model to confidentiality while the Biba model applies it to integrity.
83. The \_\_\_\_\_ of a process consist(s) of the limits set on the memory addresses and resources that the process may access. A. Perimeter B. Confinement limits C. Metes D. Bounds
D. Each process that runs on a system is assigned certain physical or logical bounds for resource access, such as memory.
84. What type of motion detector senses changes in the electromagnetic fields in monitored areas? A. Infrared B. Wave pattern C. Capacitance D. Photoelectric
C. Capacitance(電容) motion detectors monitor the electromagnetic field in a monitored area, sensing disturbances that correspond to motion.
88. Beth would like to include technology in a secure area of her data center to protect against unwanted electromagnetic emanations. What technology would assist her with this goal? A. Heartbeat sensor B. Faraday cage C. Piggybacking D. WPA2
B. A Faraday cage is a metal skin that prevents electromagnetic emanations from exiting. It is a rarely used technology because it is unwieldy and expensive, but it is quite effective at blocking unwanted radiation. #法拉第籠是一種金屬皮，可防止電磁輻射的流出。 它是一種很少使用的技術，因為它既笨重又昂貴，但在阻擋不需要的輻射方面非常有效。
91. A software company developed two systems that share information. System A provides information to the input of System B, which then reciprocates by providing information back to System A as input. What type of composition theory best describes this practice? A. Cascading B. Feedback C. Hookup D. Elementary
B. The feedback model of composition theory occurs when one system provides input for a second system and then the second system provides input for the first system. This is a specialized case of the cascading model, so the feedback model is the most appropriate answer.
92. Tommy is planning to implement a power conditioning UPS for a rack of servers in his data center. Which one of the following conditions will the UPS be unable to protect against if it persists for an extended period of time? A. Fault#指短暫的電力故障 B. Blackout#指較長期的斷電 C. Sag#下降 D. Noise
B. UPSs are designed to protect against short-term power losses, such as power faults. When they conduct power conditioning, they are also able to protect against sags and noise. UPSs have limited-life batteries and are not able to maintain continuous operating during a sustained(連續) blackout.
93. Which one of the following humidity values is within the acceptable range for a data center operation? A. 0% B. 10% C. 25% D. 40%
D. Data center humidity should be maintained between 40% and 60%. Values below this range increase the risk of static electricity, while values above this range may generate moisture that damages equipment.
95. What term is used to describe the formal declaration by a designated approving authority (DAA) that an information technology (IT) system is approved to operate in a specific environment? A. Certification B. Accreditation C. Evaluation D. Approval
B. Accreditation is the formal approval by a DAA that an IT system may operate in a described risk environment.
- Object-oriented programming languages use a black box approach to development, where users of an object do not necessarily need to know the object’s implementation details.
What term is used to describe this concept?
A. Layering
B. Abstraction
C. Data hiding
D. Process isolation
B. Abstraction uses a black box approach to hide the implementation details of an object from the users of that object.#你眼殘
97. Todd wants to add a certificate to a certificate revocation list. What element of the certificate goes on the list? A. Serial number B. Public key C. Digital signature D. Private key
A. The certificate revocation list contains the serial numbers of digital certificates issued by a certificate authority that have later been revoked.
- Which one of the following is an example of a covert timing channel when used to exfiltrate information from an organization?
A. Sending an electronic mail message
B. Posting a file on a peer-to-peer file sharing service
C. Typing with the rhythm of Morse code
D. Writing data to a shared memory space
C. Covert channels use surreptitious communications’ paths. Covert timing channels alter the use of a resource in a measurable fashion to exfiltrate information. If a user types using a specific rhythm of Morse code, this is an example of a covert timing channel. Someone watching or listening to the keystrokes could receive a secret message with no trace of the message left in logs.
100. Which one of the following would be a reasonable application for the use of self-signed digital certificates? A. E-commerce website B. Banking application C. Internal scheduling application D. Customer portal
C. Self-signed digital certificates should be used only for internal-facing applications, where the user base trusts the internally generated digital certificate. #自簽名數字證書應僅用於面向內部的應用程序，其中用戶群信任內部生成的數字證書。
104. Lauren implements ASLR to help prevent system compromises. What technique has she used to protect her system? A. Encryption B. Mandatory access control C. Memory address randomization D. Discretionary access control
C. Lauren has implemented “address space layout randomization”(ALSR), a memory protection methodology that randomizes memory locations, which prevents attackers from using known address spaces and contiguous memory regions to execute code via overflow or stack smashing attacks.
106. Joanna wants to review the status of the industrial control systems her organization uses for building control. What type of systems should she inquire(詢問) about access to? A. SCADA B. DSS C. BAS D. ICS-CSS
A. Supervisory Control and Data Acquisition systems, or SCADA systems, provide a graphical interface to monitor industrial control systems (ICS).
Joanna should ask about access to her organization’s SCADA systems.
- After scanning all of the systems on his wireless network, Mike notices that one system is identified as an iOS device running a massively out-of-date version of Apple’s mobile operating system. When he investigates further, he discovers that the device is an original iPad and that it cannot be updated to a current secure version of the operating system. What should Mike recommend?
A. Retire or replace the device
B. Isolate the device on a dedicated wireless network
C. Install a firewall on the tablet
D. Reinstall the OS
A. When operating system patches are no longer available for mobile devices, the best option is typically to retire or replace the device. Building isolated networks will not stop the device from being used for browsing or other purposes, which means it is likely to continue to be exposed to threats. Installing a firewall will not remediate the security flaws in the OS, although it may help somewhat. Finally, reinstalling the OS will not allow new updates or fix the root issue.
- During a third-party vulnerability scan and security test, Danielle’s employer recently discovered that the embedded systems that were installed to manage her company’s new buildings have a severe remote access vulnerability. The manufacturer has gone out of business, and there is no patch or update for the devices. What should Danielle recommend that her employer do about the hundreds of devices that are vulnerable?
A. Identify a replacement device model and replace every device
B. Turn off all of the devices
C. Move the devices to a secured network segment
D. Reverse engineer the devices and build an in-house patch
C. The most reasonable choice presented is to move the devices to a secure and isolated network segment. This will allow the devices to continue to serve their intended function while preventing them from being compromised. All of the other scenarios either create major new costs or deprive her organization of the functionality that the devices were purchased to provide.#就很…都給他講這樣= =
109. Alex’s employer creates most of their work output as PDF files. Alex is concerned about limiting the audience for the PDF files to those individuals who have paid for them. What technology can he use to most effectively control the access to and distribution of these files? A. EDM B. Encryption C. Digital signatures D. DRM
D. Alex can use digital rights management technology to limit use of the PDFs to paying customers. While DRM is rarely a perfect solution, in this case, it may fit his organization’s needs. EDM is electronic dance music, which his customers may appreciate but which won’t solve the problem. Encryption and digital signatures can help to keep the files secure and to prove who they came from but won’t solve the rights management issue Alex is tackling.
- Match the following numbered security models with the appropriate lettered security descriptions:
Security models - Clark-Wilson
- Graham-Denning
- Bell-LaPadula
- Sutherland
- Biba
Descriptions
A. This model blocks lower-classified objects from accessing higher-classified objects,
thus ensuring confidentiality.
B. The * property of this model can be summarized as “no write-up.”
C. This model uses security labels to grant access to objects via transformation procedures and a restricted interface model.
D. This model focuses on the secure creation and deletion of subjects and objects using
eight primary protection rules or actions.
E. This integrity model focuses on preventing interference in support of integrity.
CDAEB
- What important factor differentiates Frame Relay from X.25?
A. Frame Relay supports multiple PVCs over a single WAN carrier connection.
B. Frame Relay is a cell-switching technology instead of a packet-switching technology like X.25.
C. Frame Relay does not provide a committed information rate (CIR).
D. Frame Relay only requires a DTE on the provider side.
A. Frame Relay supports multiple private virtual circuits (PVCs), unlike X.25. It is a packet-switching technology that provides a Committed Information Rate (CIR), which is a minimum bandwidth guarantee provided by the service provider to customers. Finally, Frame Relay requires a DTE/DCE at each connection point, with the DTE providing access to the Frame Relay network, and a provider-supplied DCE, which transmits the data over the network.
- During a security assessment of a wireless network, Jim discovers that LEAP is in use on a network using WPA. What recommendation should Jim make?
A. Continue to use LEAP. It provides better security than TKIP for WPA networks.
B. Use an alternate protocol like PEAP or EAP-TLS and implement WPA2 if supported.
C. Continue to use LEAP to avoid authentication issues, but move to WPA2.
D. Use an alternate protocol like PEAP or EAP-TLS, and implement Wired Equivalent Privacy to avoid wireless security issues.
B. LEAP, the Lightweight Extensible Authentication Protocol, is a Cisco proprietary protocol designed to handle problems with TKIP. Unfortunately, LEAP has significant security issues as well and should not be used. Any modern hardware should support WPA2 and technologies like PEAP or EAP-TLS. Using WEP, the predecessor to WPA and WPA2, would be a major step back in security for any network.
6. Gary is deploying a wireless network and wants to deploy the fastest possible wireless technology. Due to technical constraints, he is limited to using a 2.4 GHz option. Which one of the following wireless networking standards should he use? A. 802.11a B. 802.11g C. 802.11n D. 802.11ac
C. He should choose 802.11n, which supports 200+ Mbps in the 2.4 GHz or the 5 GHz frequency range.
802.11a and 802.11ac are both 5 GHz only,
while 802.11g is only capable of 54 Mbps.
- 11a 5G
- 11g 2.4G 54Mbps
- 11n 2.4/5G 200+ Mbps
- 11ac 5G 1G Mbps
7. Match each of the numbered TCP ports listed with the associated lettered protocol provided: TCP ports 1. 23 2. 25 3. 143 4. 515 Protocols A. SMTP B. LPD C. IMAP D. Telnet
DACB. These common ports are important to know, although some of the protocols are becoming less common. SMTP is the Simple Mail Transfer Protocol, IMAP is the Internet Message Access Protocol, and LPD is the Line Printer Daemon protocol used to send print jobs to printers.
9. FHSS, DSSS, and OFDM all use what wireless communication method that occurs over multiple frequencies simultaneously? A. WiFi B. Spread Spectrum C. Multiplexing D. Orthogonal modulation
B. Frequency Hopping Spread Spectrum (FHSS), Direct Sequence Spread Spectrum (DSSS), and Orthogonal Frequency-Division Multiplexing (OFDM) all use spread spectrum techniques to transmit on more than one frequency at the same time. Neither FHSS nor DHSS uses orthogonal modulation, while multiplexing describes combining multiple signals over a shared medium of any sort. WiFi may receive interference from
FHSS systems but doesn’t use it.
10. Brian is selecting an authentication protocol for a PPP connection. He would like to select an option that encrypts both usernames and passwords and protects against replay using a challenge/response dialog. He would also like to re-authenticate remote systems periodically. Which protocol should he use? A. PAP B. CHAP C. EAP D. LEAP
B. The Challenge-Handshake Authentication Protocol, or CHAP, is used by PPP servers to authenticate remote clients. It encrypts both the username and password and performs periodic reauthentication while connected using techniques to prevent replay attacks. LEAP provides reauthentication but was designed for WEP, while PAP sends passwords unencrypted. EAP is extensible and was used for PPP connections, but it doesn’t directly address the listed items.
11. Which one of the following protocols is commonly used to provide backend authentication services for a VPN? A. HTTPS B. RADIUS C. ESP D. AH
B. The Remote Access Dial In User Service (RADIUS) protocol was originally designed to support dial-up modem connections but is still commonly used for VPN-based authentication. HTTPS is not an authentication protocol. ESP and AH are IPsec protocols but do not provide authentication services for other systems.
Chris is designing layered network security for his organization. Using the following diagram, answer questions 13 through 15.
13. What type of firewall design is shown in the diagram? A. A single-tier firewall B. A two-tier firewall C. A three-tier firewall D. A four-tier firewall
B. The firewall in the diagram has two protected zones behind it, making it a two-tier firewall design.
Chris is designing layered network security for his organization. Using the following diagram, answer questions 13 through 15.
- If the VPN grants remote users the same access to network and system resources as local workstations have, what security issue should Chris raise?
A. VPN users will not be able to access the web server.
B. There is no additional security issue; the VPN concentrator’s logical network location matches the logical network location of the workstations.
C. Web server traffic is not subjected to stateful inspection.
D. VPN users should only connect from managed PCs.
D. Remote PCs that connect to a protected network need to comply with security settings and standards that match those required for the internal network. The VPN concentrator logically places remote users in the protected zone behind the firewall, but that means that user workstations (and users) must be trusted in the same way that local workstations are.
Chris is designing layered network security for his organization. Using the following diagram, answer questions 13 through 15.
- Ben has configured his network to not broadcast an SSID. Why might Ben disable SSID broadcast, and how could his SSID be discovered?
A. Disabling SSID broadcast prevents attackers from discovering the encryption key. The SSID can be recovered from decrypted packets.
B. Disabling SSID broadcast hides networks from unauthorized personnel. The SSID can be discovered using a wireless sniffer.
C. Disabling SSID broadcast prevents issues with beacon frames. The SSID can be recovered by reconstructing the BSSID.
D. Disabling SSID broadcast helps avoid SSID conflicts. The SSID can be discovered by attempting to connect to the network.
B. Disabling SSID broadcast can help prevent unauthorized personnel from attempting to connect to the network. Since the SSID is still active, it can be discovered by using a wireless sniffer. Encryption keys are not related to SSID broadcast, beacon frames are used to broadcast the SSID, and it is possible to have multiple networks with the same SSID.
18. What network tool can be used to protect the identity of clients while providing Internet access by accepting client requests, altering the source addresses of the requests, mapping requests to clients, and sending the modified requests out to their destination? A. A gateway B. A proxy C. A router D. A firewall
B. A proxy is a form of gateway that provide clients with a filtering, caching, or other service that protects their information from remote systems. A router connects networks, while a firewall uses rules to limit traffic permitted through it. A gateway translates between protocols.
20. A remote access tool that copies what is displayed on a desktop PC to a remote computer is an example of what type of technology? A. Remote node operation B. Screen scraping C. Remote control D. RDP
B. Screen scrapers copy the actual screen displayed and display it at a remote location. RDP provides terminal sessions without doing screen scraping, remote node operation is the same as dial-up access, and remote control is a means of controlling a remote system (screen scraping is a specialized subset of remote control).
- Which email security solution provides two major usage modes:
(1) signed messages that provide integrity, sender authentication, and nonrepudiation; and
(2) an enveloped message mode that provides integrity, sender authentication, and confidentiality?
A. S/MIME
B. MOSS
C. PEM
D. DKIM
A. S/MIME supports both signed messages and a secure envelope method. While the functionality of S/MIME can be replicated with other tools, the secure envelope is an S/MIME-specific concept. MOSS, or MIME Object Security Services, and PEM can also both provide authentication, confidentiality, integrity, and nonrepudiation, while DKIM, or Domain Keys Identified Mail, is a domain validation tool.
- During a security assessment, Jim discovers that the organization he is working with uses a multilayer protocol to handle SCADA systems and recently connected the SCADA network to the rest of the organization’s production network. What concern should he raise about serial data transfers carried via TCP/IP?
A. SCADA devices that are now connected to the network can now be attacked over the network.
B. Serial data over TCP/IP cannot be encrypted.
C. Serial data cannot be carried in TCP packets.
D. TCP/IP’s throughput can allow for easy denial of service attacks against serial devices.
A. Multilayer protocols like DNP3 allow SCADA and other systems to use TCP/IP-based networks to communicate. Many SCADA devices were never designed to be exposed to a network, and adding them to a potentially insecure network can create significant risks. TLS or other encryption can be used on TCP packets, meaning that even serial data can be protected. Serial data can be carried via TCP packets because TCP packets don’t care about their content; it is simply another payload. Finally, TCP/IP does not have a specific
throughput as designed, so issues with throughput are device-level issues.
23. What type of key does WEP use to encrypt wireless communications? A. An asymmetric key B. Unique key sets for each host C. A predefined shared static key D. Unique asymmetric keys for each host
C. WEP has a very weak security model that relies on a single, predefined, shared static key. This means that modern attacks can break WEP encryption in less than a minute.
