Term Test 1 Flashcards
Which of the following contains the primary goals and objectives of security? A. A network's border perimeter B. The CIA Triad C. A stand-alone system D. The Internet
B. The CIA Triad
\_\_\_\_\_\_\_\_\_\_ refers to keeping information confidential that is personally identifiable or which might cause harm, embarrassment, or disgrace to someone if revealed. A. Seclusion B. Concealment C. Privacy D. Criticality
C. Privacy
Which of the following is NOT considered a violation of confidentiality? A. Stealing passwords B Eavesdropping C. Hardware destruction D. Social engineering
C. Hardware destruction
If a security mechanism offers availability, then it offers a high level of assurance that authorized subjects can \_\_\_\_\_\_\_\_\_\_\_ the data, objects, and resources. A. Control B. Audit C. Access D. Repudiate
C.. Access
What element of data categorization management can override all other forms of access control? A. Classification B. Physical access C. Custodian responsibilities D. Taking ownership
D. Taking ownership
What is the primary goal of change management? A. Maintaining documentation B. Keeping users informed of changes C. Allowing rollback of failed changes D. Preventing security compromises
D. Preventing security compromises
What are the two common data classification schemes?
A. Military and private sector
B. Personal and government
C. Private sector and unrestricted sector
D. Classified and unclassified
A. Military and private sector
data classifications are used to focus security controls overall but which of the following? A. Storage B. Processing C. Layering D. Transfer
C. Layering
Which of the following is not considered an example of data hiding?
A. Preventing an authorized reader of an object from deleting that object
B. Keeping a database from being accessed by unauthorized visitors
C. Restricting a subject at a lower classification level from accessing data at a higher classification level
D. Preventing an application from accessing hardware directly
A. Preventing an authorized reader of an object from deleting that object
Which of the following is the weakest element in any security solution? A.Software products B. Internet connections C. Security policies D. Humans
D. Humans
What is the first step that individuals responsible for the development of a business continuity plan should perform? A. BCP team selection B. Business organization analysis C. Resource requirements analysis D. Legal and regulatory assessment
B. Business organization analysis
Which one of the following BIA terms identifies the amount of money a business expects to lose to a given risk each year? A. ARO B. SLE C. ALE D. EF
C. ALE
You are concerned about the risk that an avalanche poses to your $3 million shipping facility. Based on expert opinion, you determine that there is a 5 percent chance that an avalanche will occur each year. Experts advise you that an avalanche would completely destroy your building and require you to rebuild on the same land. Ninety percent of the $3 million value of the facility is attributed to the building and 10 percent is attributed to the land itself. What is the single loss expectancy of your shipping facility to avalanches?
A. $3,000,000
B. $2,700,000
C. $270,000
D. $135,000
B. $2,700,000
You are concerned about the risk that a hurricane poses to your corporate headquarters in South Florida. The building itself is valued at $15 million. After consulting with the National Weather Service, you determine that there is a 10 percent likelihood that a hurricane will strike over the course of a year. You hired a team of architects and engineers who determined that the average hurricane would destroy approximately 50 percent of the building. What is the annualized loss expectancy (ALE)?
A. $750,000
B. $1.5 million
C. $7.5 million
D. $15 million
A. $750,000
Which task of BCP bridges the gap between the business impact assessment and the continuity planning phases?
A. Resource prioritization
B. Likelihood assessment
C. Strategy development
D. Provisions and processes
C. Strategy development
The strategy development task bridges the gap between business impact assessment and continuity planning by analyzing the prioritized list of risks developed during the BIA and determining which risks will be addressed by the BCP.
Which resource should you protect first when designing continuity plan provisions and processes?
A. Physical plant
B. Infrastructure
C. Financial
D. People
D. People
Lighter Than Air Industries expects that it would lose $10 million if a tornado struck its aircraft operations facility. It expects that a tornado might strike the facility once every 100 years. What is the single loss expectancy for this scenario?
A. 0.01
B. $10,000,000
C. $100,000
D. 0.10
B. $10,000,000
In which business continuity planning task would you actually design procedures and mechanisms to mitigate risks deemed unacceptable by the BCP team?
A. Strategy development
B. Business impact assessment
C. Provisions and processes
D. Resource prioritization
C. Provisions and processes
In the provisions and processes phase, the BCP team actually designs the procedures and mechanisms to mitigate risks that were deemed unacceptable during the strategy development phase.
What type of plan outlines the procedures to follow when a disaster interrupts the normal operations of a business?
A. Business continuity plan
B. Business impact assessment
C. Disaster recovery plan
D. Vulnerability assessment
C. Disaster recovery plan
Of the individuals listed, who would provide the best endorsement for a business continuity plan’s statement of importance?
A. Vice president of business operations
B. Chief information officer
C. Chief executive officer
D. Business continuity manager
C. Chief executive officer
When an employee is to be terminated, which of the following should be done?
A. Inform the employee a few hours before they are officially terminated.
B. Disable the employee’s network access just as they are informed of the termination.
C. Send out a broadcast email informing everyone that a specific employee is to be terminated.
D. Wait until you and the employee are the only people remaining in the building before announcing the termination.
B. Disable the employee’s network access just as they are informed of the termination.
Which of the following is not an element of the risk analysis process?
A. Analyzing an environment for risks
B. Creating a cost/benefit report for safeguards to present to upper management
C. Selecting appropriate safeguards and implementing them
D. Evaluating each threat event as to its likelihood of occurring and cost of the resulting damage
C. Selecting appropriate safeguards and implementing them
Which of the following would generally not be considered an asset in a risk analysis?
A. A development process
B. An IT infrastructure
C. A proprietary system resource
D. Users’ personal files
D. Users’ personal files
Which of the following is a principle of the CIA Triad that means authorized subjects are granted timely and uninterrupted access to objects?
A. Identification
B. Availability
C. Encryption
D. Layering
B. Availability
Which of the following is not a valid definition for risk?
A. An assessment of probability, possibility, or chance
B. Anything that removes a vulnerability or protects against one or more specific threats
C. Risk = threat * vulnerability
D. Every instance of exposure
B. Anything that removes a vulnerability or protects against one or more specific threats
How is single loss expectancy (SLE) calculated?
A. Threat + vulnerability
B. Asset value ($) * exposure factor
C. Annualized rate of occurrence * vulnerability
D. Annualized rate of occurrence * asset value * exposure factor
B. Asset value ($) * exposure factor
How is the value of a safeguard to a company calculated?
A. ALE before safeguard - ALE after implementing the safeguard - annual cost of safeguard
B. ALE before safeguard * ARO of safeguard
C. ALE after implementing safeguard + annual cost of safeguard - controls gap
D. Total risk - controls gap
A. ALE before safeguard - ALE after implementing the safeguard - annual cost of safeguard
What security control is directly focused on preventing collusion?
A. Principle of least privilege
B. Job descriptions
C. Separation of duties
D. Qualitative risk analysis
C. Separation of duties
While performing a risk analysis, you identify a threat of fire and a vulnerability because there are no fire extinguishers. Based on this information, which of the following is a possible risk?
A. Virus infection
B. Damage to equipment
C. System malfunction
D. Unauthorized access to confidential information
B. Damage to equipment
You’ve performed a basic quantitative risk analysis on a specific threat/vulnerability/risk relation. You select a possible countermeasure. When performing the calculations again, which of the following factors will change?
A. Exposure factor
B. Single loss expectancy
C. Asset value
D. Annualized rate of occurrence
D. Annualized rate of occurrence
Which criminal law was the first to implement penalties for the creators of viruses, worms, and other types of malicious code that cause harm to computer system(s)?
A. Computer Security Act
B. National Infrastructure Protection Act
C. Computer Fraud and Abuse Act
D. Electronic Communications Privacy Act
C. Computer Fraud and Abuse Act
Which law first required operators of federal interest computer systems to undergo periodic training in computer security issues?
A. Computer Security Act
B. National Infrastructure Protection Act
C. Computer Fraud and Abuse Act
D. Electronic Communications Privacy Act
A. Computer Security Act
What is the broadest category of computer systems protected by the Computer Fraud and Abuse Act, as amended?
A. Government-owned systems
B. Federal interest systems
C. Systems used in interstate commerce
D. Systems located in the United States
C. Systems used in interstate commerce
What law prevents government agencies from disclosing personal information that an individual supplies to the government under protected circumstances?
A. Privacy Act
B. Electronic Communications Privacy Act
C. Health Insurance Portability and Accountability Act
D. Gramm-Leach-Bliley Act
A. Privacy Act
What law formalizes many licensing arrangements used by the software industry and attempts to standardize their use from state to state?
A. Computer Security Act
B. Uniform Computer Information Transactions Act
C. Digital Millennium Copyright Act
D. Gramm-Leach-Bliley Act
B. Uniform Computer Information Transactions Act
Which one of the following is not a requirement that Internet service providers must satisfy in order to gain protection under the “transitory activities” clause of the Digital Millennium Copyright Act?
A. The service provider and the originator of the message must be located in different states.
B. The transmission, routing, provision of connections, or copying must be carried out by an automated technical process without selection of material by the service provider.
C. Any intermediate copies must not ordinarily be accessible to anyone other than anticipated recipients and must not be retained for longer than reasonably necessary.
D. The transmission must be originated by a person other than the provider.
A. The service provider and the originator of the message must be located in different states.
What industry is most directly impacted by the provisions of the Gramm-Leach-Bliley Act?
A. Health care
B. Banking
C. Law enforcement
D. Defense contractors
B. Banking
Matthew recently authored an innovative algorithm for solving a mathematical problem, and he wants to share it with the world. However, prior to publishing the software code in a technical journal, he wants to obtain some sort of intellectual property protection. Which type of protection is best suited to his needs?
A. Copyright
B. Trademark
C. Patent
D. Trade secret
A. Copyright
What is the standard duration of patent protection in the United States?
A. 14 years from the application date
B. 14 years from the date the patent is granted
C. 20 years from the application date
D. 20 years from the date the patent is granted
D. 20 years from the date the patent is granted
What compliance obligation relates to the processing of credit card information?
A. SOX
B. HIPAA
C. PCI DSS
D. FERPA
C. PCI DSS (Payment Card Industry Data Security Standard)
Which one of the following identifies the primary a purpose of information classification processes?
A. Define the requirements for protecting sensitive data.
B. Define the requirements for backing up data.
C. Define the requirements for storing data.
D. Define the requirements for transmitting data.
A. Define the requirements for protecting sensitive data.
Which of the following statements correctly identifies a problem with sanitization methods?
A. Methods are not available to remove data ensuring that unauthorized personnel cannot retrieve data.
B. Even fully incinerated media can offer extractable data.
C. Personnel can perform sanitization steps improperly.
D. Stored data is physically etched into the media.
C. Personnel can perform sanitization steps improperly.
Which of the following choices is the most reliable method of destroying data on a solid state drive?
A. Erasing
B. Degaussing
C. Deleting
D. Purging
D. Purging
Which of the following does not erase data?
A. Clearing
B. Purging
C. Overwriting
D. Remanence
D. Remanence
Which one of the following would administrators use to connect to a remote server securely for administration?
A. Telnet
B. Secure File Transfer Protocol (SFTP)
C. Secure Copy (SCP)
D. Secure Shell (SSH)
D. Secure Shell (SSH)
Which one of the following data roles is most likely to assign permissions to grant users access to data?
A. Administrator
B. Custodian
C. Owner
D. User
A. Administrator
Which would an administrator do to classified media before reusing it in a less secure environment?
A. Erasing
B. Clearing
C. Purging
D. Overwriting
C. Purging
Which of the following best defines “rules of behavior” established by a data owner?
A. Ensuring users are granted access to only what they need
B. Determining who has access to a system
C. Identifying appropriate use and protection of data
D. Applying security controls to a system
C. Identifying appropriate use and protection of data
Within the context of the European Union (EU) Data Protection law, what is a data processor?
A. The entity that processes personal data on behalf of the data controller
B. The entity that controls processing of data
C. The computing system that processes data
D. The network that processes data
A. The entity that processes personal data on behalf of the data controller
What do the principles of notice, choice, onward transfer, and access closely apply to?
A. Privacy
B. Identification
C. Retention
D. Classification
A. Privacy
How many keys are required to fully implement a symmetric algorithm with 10 participants?
A. 10
B. 20
C. 45
D. 100
A. 10
How many possible keys exist in a 5-bit key space?
A. 4
B. 8
C. 16
D. 32
D. 32
John recently received an email message from Bill. What cryptographic goal would need to be met to convince John that Bill was actually the sender of the message?
A. Nonrepudiation
B. Confidentiality
C. Availability
D. Integrity
A. Nonrepudiation
What is the length of the cryptographic key used in the Data Encryption Standard (DES) cryptosystem?
A. 56 bits
B. 128 bits
C. 192 bits
D. 256 bits
A. 56 bits
Which one of the following cipher types operates on large pieces of a message rather than individual characters or bits of a message?
A. Stream cipher
B. Caesar cipher
C. Block cipher
D. ROT3 cipher
C. Block cipher
What type of cipher relies on changing the location of characters within a message to achieve confidentiality?
A. Stream cipher
B. Transposition cipher
C. Block cipher
D. Substitution cipher
B. Transposition cipher
Which one of the following cannot be achieved by a secret key cryptosystem?
A. Nonrepudiation
B. Confidentiality
C. Availability
D. Key distribution
A. Nonrepudiation
When correctly implemented, what is the only cryptosystem known to be unbreakable?
A. Transposition cipher
B. Substitution cipher
C. Advanced Encryption Standard
D. One-time pad
D. One-time pad
What is the minimum number of cryptographic keys required for secure two-way communications in symmetric key cryptography?
A. One
B. Two
C. Three
D. Four
A. One
Which one of the following Data Encryption Standard (DES) operating modes can be used for large messages with the assurance that an error early in the encryption/decryption process won’t spoil results throughout the communication?
A. Cipher Block Chaining (CBC)
B. Electronic Codebook (ECB)
C. Cipher Feedback (CFB)
D. Output Feedback (OFB)
D. Output Feedback (OFB)
Many cryptographic algorithms rely on the difficulty of factoring the product of large prime numbers. What characteristic of this problem are they relying on?
A. It contains diffusion.
B. It contains confusion.
C. It is a one-way function.
D. It complies with Kerchoff’s principle.
C. It is a one-way function.
Dave is developing a key escrow system that requires multiple people to retrieve a key but does not depend on every participant being present. What type of technique is he using?
A. Split knowledge
B. M of N Control
C. Work function
D. Zero-knowledge proof
B. M of N Control
How many encryption keys are required to fully implement an asymmetric algorithm with 10 participants?
A. 10
B. 20
C. 45
D. 100
C. 45
What kind of attack makes the Caesar cipher virtually unusable?
A. Meet-in-the-middle attack
B. Escrow attack
C. Frequency analysis attack
D. Transposition attack
C. Frequency analysis attack
What type of cryptosystem commonly makes use of a passage from a well-known book for the encryption key?
A. Vernam cipher
B. Running key cipher
C. Skipjack cipher
D. Twofish cipher
B. Running key cipher
Toby is attempting to log in to a secure system. He provides his username at the prompt and then is asked to provide a password. What stage of the access control process is taking place at that moment?
A. Identification
B. Authentication
C. Indemnification
D. Authorization
B. Authentication
Which of the following storage media would not be affected by a degausser? A. HDD B. SSD C. Floppy Drive D. Tape
B. SSD
What technique is most effective for removing data stored on an SSD device?
A. Erasing
B. Degaussing
C. Reformatting
D. Destruction
D. Destruction
Mary recently read about a new hacking group that is using advanced tools to break into the database servers of organizations running public websites. In risk management language, how would she describe this group of hackers?
A. Risk
B. Vulnerability
C. Threat
D. Standard
C. Threat
You are selecting an encryption algorithm for use in exchanging sensitive information over the Internet. Which one of the following algorithms would NOT be acceptable for use?
A. DES
B. RSA
C. AES
D. Blowfish
A. DES
What is the output value of the mathematical function 18 mod 3?
A. 0
B. 1
C. 3
D. 5
A. 0
Which of the following is the most secure method of deleting data on a DVD?
A. Formatting
B. Deleting
C. Destruction
D. Degaussing
C. Destruction
Mary is the cofounder of Acme Widgets, a manufacturing firm. Together with her partner, Joe she has developed a special oil that will dramatically improve the widget manufacturing process. To keep the formula secret, Mary and Joe plan to make a large quantities of the oil by themselves in the plant after the other workers have left. They want to protect this formula for as long as possible. What type of intellectual property protection best suits their needs?
A. Copyright
B. Trademark
C. Patent
D. Trade secret
D. Trade secret
What will be the major resource consumed by the BCP process during the BCP phase?
A. Hardware
B. Software
C. Processing time
D. Personnel
D. Personnel
What is the formula used to compute the single loss expectancy for a risk scenario?
A. SLE =AV x EF
B. SLE = RO x EF
C. SLE = AV x ARO
D. SLE = EF x ARO
A. SLE =AV x EF
How can a group reach an anonymous consensus while all members of that group are in the same room?
A. Delphi technique
B. Brainstorming
C. Storyboarding
D. Surveys
A. Delphi technique
What is the term for the percentage of loss an asset’s value would experience in the event that a threat becomes realized?
A. Annualized loss expectancy
B. Annualized rate of occurrence
C. Single loss expectancy
D. Exposure factor
D. Exposure factor
What BIA metric can be used to express the longest time a business function can be unavailable without causing irreparable harm to the organization?
A. SLE
B. EF
C. MTD
D. ARO
C. MTD
When seeking to hire new emplloyees, what is the first step?
A. Create a job description
B. Set position classification
C. Screen candidates
D. Request resumes
A. Create a job description
What ensures that subject of an activity or event cannot deny that the event occurred? A. CIA Triad B. Abstraction C. Nonrepudiation D. Hash totals
C. Nonrepudiation
