Practice exam strengthening Flashcards
What is the range of well known ports?
0-1023
What was the first international treaty seeking to address computer crimes?
Council of Europe (CoE) Convention on Cybercrime
What outlines the general requirements of an ISMS?
Answers questions like: What is an ISMS? What does it do?
ISO/IEC 27001
NIST SP 800-53 was initially created to tells agencies what needs to be put into place in order to be compliant with what?
A. HIPAA
B. FISMA
C. GLBA
D. PCI DSS
B
What is the best definition of a socket?
A port number and an IP address
Computer-generated or electronic information is most often categorized as what type of evidence?
Hearsay
How often should fire extinguishers be inspected?
A. Every two years
B. Once a year
C. Quarterly
D. Monthly
quarterly
What is the other name for Thin Net?
A. 10BaseT
B. 100BaseT
C. Fast Ethernet
D. 10Base2
10Base2
What SDLC model does this describe?
“Discrete phases of development requiring formal reviews and documentation” ?
Waterfall model
Which are the most used backup facility type?
A. Warm site
B. Hot Site
C. Redundant Site
D. Cold site
Warm site
A form of attack on a computer which takes advantage of the fact that the operating system is in a vulnerable state after an interrupt has occurred.
(Fun Fact: Also not mentioned in the book.)
NAK attack
This component of PPP establishes, configures, and maintains the connection.
Link Control Protocol
LCP
This component of PPP provides user authentication capabilities through PAP, CHAP, and EAP
Network Control Protocol
NCP
This is a framing protocol that is used mainly for device-to-device communication, such as two routers communicating over a WAN link. It is an improvement over SDLC
HDLC
High Level Data Link Control
This is the simplest SOO technology, but it is not very secure.
A. Kerberos
B. Thin Clients
C. SESAME
D. scripting
D. scripting
This is a symmetric block cipher developed while studying DES, an ICMP tunneling attack, and the name of a god i norse mythology.
Loki
Which of the following is not considered a
detective control.
A. Incident Response
B. Mandatory Vacations
C. Separation of Duties
D. Job Rotation
Separation of Duties
Put these change management steps in order.
A Request a change B, Document a change C. Implement a change D. Test a change E. Approve a change F. Report to management
Request a change Approve a change Document a change Test a change Implement a change Report to management
American Institute of Certified Public Accountants (AICPA) first had SAS 70, which originally had a focus on financial issues. In 2011 the AICPA released a new framework of auditing standards on ________, which are defined in the __________ .
SOC (Service Organization Controls)
SSAE 16 American Statement on Standards for Attestation Engagements
What is the single point of failure within an SOO implementation?
authentication server
OSI Model —-> TCP/IP model
Application, Presention, Session = ____________
Transport = __________
Network = ____________
Data Link, Physical = _____________
Application
Host-to-Host
Internet
Network Access
In 802.11, OSA has no authentication and all transactions are in cleartext, so wide open to sniffing. When the AP is configured to use ______, the AP sends a random value to the wireless device, which encrypts it and sends it back. AP decrypts it and verifies the value.
SKA
Shared Key Authentication
This is the most authoritative level of time source.
A. Stratum 0
B. Stratum 1
C. Stratum 2
C. Stratum 3
A
Which component of the IPSec suite provides confidentiality, data-origin authentication, and data integrity?
A. ISAKMP
B. ESP
C. AH
D. IKE
ESP
Encapsulating Security Payload
Which component of the IPSec suite provides data integrity, data-origin authentication, and protection from replay attacks?
A. ISAKMP
B. ESP
C. AH
D. IKE
AH
Authentication Header
Which component of the IPSec suite provides a framework for security association?
A. ISAKMP
B. ESP
C. AH
D. IKE
ISAKMP
Internet Security Association and Key Management Protocol
Which component of the IPSec suite provides authentication keying material for use with ISAKMP?
A. ISAKMP
B. ESP
C. AH
D. IKE
IKE
Internet Key Exchange
Which tunneling protocol extends and protects PPP connections, works at the data link layer, transmits over multiple types of networks (not just IP), and combines with IPSec for security?
A. TLS
B. IPSec
C. PPTP
D. L2TP
L2TP
Which tunneling protocol extends and protects PPP connections, works at the data link layer, transmits over IP networks only?
A. TLS
B. IPSec
C. PPTP
D. L2TP
PPTP
Which tunneling protocol handles multiple VPN connections at the same time, provides secure authentication and encryption, and works at the network layer?
A. TLS
B. IPSec
C. PPTP
D. L2TP
IPSec
Which tunneling protocol protects mainly web and e-mail traffic, works at the session layer, and is easy to deploy since it is already embedded into web browsers?
A. TLS
B. IPSec
C. PPTP
D. L2TP
TLS
____________ software controls what users can access when using a web browser to interact with web-based enterprise assets. This type of access control is put into place to control external entities requesting access to internal resources.
WAM
Web-based Access Management
If a non-European organization wants to do business with a European entity, it will need to adhere to the __________________ requirements if certain types of data will be passed back and forth during business processes.
Safe Harbor
This is an international organization that helps different GOVERNMENTS come together and tackle the economic, social , and governance challenges of a globalized economy.
OECD
Organization for Economic Co-Operation and Development
Which does XACML not use?
A. Action Element - Types of Access
B. Subject Element - Requesting Entity
C. Resource Element - Requested Entity
D. Action Element - Access Control
D. Action Element - Access Control
________ is a tool used to conceptually understand the structure and behavior of a complex entity through different views. It provides different views of the system, based upon the needs of the stakeholders of that system.
An Architecture
What is the international standard for business continuity?
It provides guidelines for information and communications technology readiness for business continuity.
ISO/IEC 27031:2011
The ___________ framework is a model for the development of ENTERPRISE architectures. The _______ model is the moedel and methodology for hte development of information security enterprise architectures.
Zachman, SABSA
____________ is a methodology that is intended to be used in situations where people manage and direct the risk evaluation for information security within their company.
OCTAVE
Operationally Critical Threat, Asset, and Vulnerability Evaluation
