Quiz 2 Flashcards
Which of the following is not a denial-of-service attack?
Exploiting a flaw in a program to consume 100 percent of the CPU
Sending malformed packets to a system, causing it to freeze
Performing a brute-force attack against a known user account
Sending thousands of emails to a single address
Performing a brute-force attack against a known user account
Why is spam so difficult to stop?
filters are ineffective at blocking inbound messages.
The source address is usually spoofed.
It is an attack requiring little expertise.
Spam can cause denial-of-service attacks.
The source address is usually spoofed.
Which of the following is not a benefit of NAT?
Hiding the internal IP addressing scheme
Sharing a few public Internet addresses with a large number of
internal clients
Using the private IP addresses from RFC 1918 on an internal
network
filtering network traffic to prevent brute-force attacks
filtering network traffic to prevent brute-force attacks
Which of the following can prevent e-mail spoofing? Pretty good privacy Point-to-point protocol Microcom networking protocol Password authentication protocol
Pretty good privacy
Countermeasures against sniffers do not include which of the
following?
Using recent version of secure shell protocol.
Applying end-to-end encryption.
Using packet filters.
Implementing robust authentication techniques.
Using packet filters.
A virtual private network (VPN) cannot provide or improve which of the following security services? Availability Confidentiality Integrity Replay protection
Availability
In a distributed computing environment, system security takes on
an important role. Two types of network attacks exist: passive and
active. Which of the following is an example of a passive attack?
Attempting to log in to someone else’s account
Installing a wiretap on a network cable to generate false
messages
Denying services to legitimate users
Sniffng a system password when the user types it
Sniffng a system password when the user types it
Which of the following cannot protect non-IP protocols? IPsec PPTP L2TP L2F
IPsec
A major risk involving the use of packet-switching networking is that:
It is possible that some packets can arrive at their destinations
out of sequence.
It is not possible to vary the routing of packets depending on
network conditions.
Terminals attached to a public data network may not have
enough intelligence.
Terminals attached to a public data network may not have
enough storage capacity.
It is possible that some packets can arrive at their destinations
out of sequence.
Frame relay and X.25 networks are part of which of the following? Circuit-switched services Cell-switched services Packet-switched services Dedicated digital services
Packet-switched services
What is it called when email itself is used as an attack mechanism? Masquerading Spoofing Mail-bombing Smurf attack
Mail-bombing
What are the two common data classification schemes? Military and private sector Personal and government Private sector and unrestricted sector Classified and unclassified
Military and private sector
When seeking to hire new employees, what is the first step? Create a job description. Set position classification. Screen candidates. Request resumes
Create a job description.
Which of the following is a primary purpose of an exit interview?
To return the exiting employee’s personal belongings
To review the nondisclosure agreement
To evaluate the exiting employee’s performance
To cancel the exiting employee’s network access accounts
To review the nondisclosure agreement
Which of the following statements is not true?
IT security can provide protection only against logical or technical
attacks.
The process by which the goals of risk management are achieved is
known as risk analysis.
Risks to an IT infrastructure are all computer based.
An asset is anything used in a business process or task.
Risks to an IT infrastructure are all computer based.
When a safeguard or a countermeasure is not present or is not sufficient, what remains? Vulnerability Exposure Risk Penetration
Vulnerability
How is single loss expectancy (SLE) calculated?
Threat + vulnerability
Asset value ($) * exposure factor
Annualized rate of occurrence * vulnerability
Annualized rate of occurrence * asset value * exposure factor
Asset value ($) * exposure factor
How is the value of a safeguard to a company calculated?
- ALE before safeguard – ALE after implementing the safeguard –annual cost of safeguard
- ALE before safeguard * ARO of safeguard
- ALE after implementing safeguard – annual cost of safeguard – controls gap
- Total risk – controls gap
ALE before safeguard – ALE after implementing the safeguard – annual cost of safeguard
Which of the following methods for handling risk involves a third party? Accepting Risk Eliminating risk Reducing risk Transferring risk
Transferring risk
Which of the following assists in complying with others? Policy Procedure Standard Guideline
Procedure
Which of the following is not the major reason for conducting risk
assessment?
It is a good security practice.
It is required by law or regulation.
It is integrated into the system development life-cycle process.
It supports the business objectives.
It is required by law or regulation.
Which of the following is not a goal of the risk management
evaluation and assessment process in ensuring that the system
continues to operate in a safe and secure manner?
Implement a strong configuration management program.
Monitor the system security on a continuous basis.
Eliminate all potential threats, vulnerabilities, and risks to the
system.
Track findings from the security control assessment process.
Eliminate all potential threats, vulnerabilities, and risks to the
system.
Which of the following is not a goal of IT security? Confidentiality Availability Integrity Aggregation
Aggregation
Risk management is a major priority of the SPK Company. The
following data has been collected for one asset in the company: Natural
threats are realized once every five years. The total asset value is
$1,000,000. Every time a threat causes damage, it cost the company an
average of $100,000. The company has the choice of getting insurance
for $10,000 per year or moving to a new location that will be a onetime
cost of $35,000. The SPK priorities in the risk management strategy
are accuracy and long-term repeatability of process.
What can be done with the residual risk?
It can be either reduced or calculated.
It can be either identified or evaluated.
It can be either assigned or accepted.
It can be either exposed or assessed
It can be either assigned or accepted.
