Test King Flashcards
A country that fails to legally protect personal data in order to attract companies engaged in
collection of such data is referred to as a
A. data pirate
B. data haven
C. country of convenience
D. sanctional nation
Answer: B
Explanation:
Data Haven
A place where data that cannot legally be kept can be stashed for later use; an offshore web host. This is an interesting topic; companies often need information that they are not legally allowed to know. For example, some hospitals are not allowed to mark patients as HIV positive (because it stigmatizes patients); staff members create codes or other ways so they can take the necessary steps to protect themselves.
http://www.tech novelqy.com/ct/content.asp?Bnum=279
DATA HAVEN
This phrase has been around for at least 15 years, but only in a specialist way. One sense is that of a place of safety and security for electronic information, for example where encrypted copies of crucial data can be stored as a backup away from one?s place of business. But it can also mean a site in which data can be stored outside the jurisdiction of regulatory authorities. This sense has come to wider public notice recently as a result of Neal Stephenson?s book Cryptonomicon, in which the establishment of such a haven in South East Asia is part of the plot. In a classic case of life imitating art, there is now a proposal to set up a data haven on one of the old World War Two
forts off the east coast of Britain, which declared independence under the name of Sealand back in 1967 (it issues its own stamps and money, for example). The idea is to get round a proposed British law?the Regulation of Investigatory Powers Bill (RIP)?that would force firms to hand over decryption keys if a crime is suspected and make Internet providers install equipment to allow interception of e?mails by the security services. The Privacy Act doesn?t protect information from being transferred from New Zealand to data havenscountries that don?t have adequate privacy protection. [Computerworld, May 1999] The government last night poured cold water on a plan by a group of entrepreneurs to establish a ?data haven? on a rusting iron fortress in the North Sea in an attempt to circumvent new anti?cryptography laws. [Guardian, June 2000]
World Wide Words is copyright ? Michael Quinion, 1996?2004. All rights reserved. Contact the author for reproduction requests. Comments and feedback are always welcome.
Page created 17 June 2000; last updated 27 October2002.
http://www.worldwidewords.orq/turnsofphrase/tp?dat2.htm
Not C: The majority google searches for ?Country of Convenience? relate to those countries
supporting terrorism.
Not D: the meaning of sanctioned is listed below. This would mean that countries that DON?T
protect privacy are APPROVED
Main Entry: 2sanction
Function: transitive verb
Inflected Form(s): sanctioned; sanction*ing
Date: 1778
I to make valid or binding usually by a formal procedure (as ratification)
2 to give effective or authoritative approval or consent
After law enforcement is informed of a computer crime, the organizations investigators constraints are A. removed. B. reduced. C. increased. D. unchanged.
Answer: C
Explanation:
?On the other hand, there are also two major factors that may cause a company to shy away from calling in the authorities. First, the investigation will more than likely become public and may embarrass the company. Second, law enforcement authorities are bound to conduct an investigation that complies with the Fourth Amendment and other legal requirements that may not apply to a private investigation.? Pg. 529 Tittel: CISSP Study Guide
All of the following are basic components of a security policy EXCEPT the
A. definition of the issue and statement of relevant terms.
B. statement of roles and responsibilities
C. statement of applicability and compliance requirements.
D. statement of performance of characteristics and requirements.
Answer: D
Explanation:
Policies are considered the first and highest level of documentation, from which the lower level elements of standards, procedures, and guidelines flow. This order, however, does not mean that policies are more important than the lower elements. These higher?level policies, which are the more general policies and statements, should be created first in the process for strategic reasons, and then the more tactical elements can follow. ?Ronald Krutz The CISSP PREP Guide (gold edition) pg 13
Audit trails based upon access and identification codes establish... A. intrustion detection thresholds B. individual accontabbility C. audit review critera D. individual authentication
Answer: B
Explanation:
Accountability is another facet of access control. Individuals on a system are responsible for their actions. This accountability property enables system activities to be traced to the proper individuals. Accountability is supported by audit trails that record events on the system and on the network. Audit trails can be used for intrusion detection and for the reconstruction of past events.
?Ronald Krutz The CISSP PREP Guide (gold edition) pg 65
Digital signature users register their public keys with a certification authority, which distributes a certificate containing the user?s public key and digital signature of the certification authority. In
create the certificate, the useis public key and the validity period are combined with what other information before computing the digital signature?
A. Certificate issuer and the Digital Signature Algorithm identifier
B. User?s private key and the identifier of the master key code
C. Name of secure channel and the identifier of the protocol type
D. Key authorization and identifier of key distribution center
Answer: A
Explanation:
The key word is ?In create the certificate..? Certificates Certificates that conform to X.509 contain the following data: Version of X.509 to which the certificate conforms; Serial number (from the certificate creator); Signature algorithm identifier (specifies the technique used by the certificate authority to digitally sign the contends of the certificate); Issuer name (identification of the certificate authority that issues the certificate) Validity perido (specifies the dates and times ? a starting date and time and an ending date and time ? during which the certificate is valued); Subject?s name (contains the distinguished name, or DN, of the entity that owns the public key contained in the certificate); Subject?s public key (the meat of the certificate ? the actual public key of the certificate owner used to setup secure communications) pg 343?344 CISSP Study Guide byTittel
Ensuring the integrity of business information is the PRIMARY concern of A. Encryption Security B. Procedural Security. C. Logical Security D. On?line Security
Answer: B
Explanation:
Procedures are looked at as the lowest level in the policy chain because they are closest to the computers and provide detailed steps for configuration and installation issues. They provide the steps to actually implement the statements in the policies, standards, and guidelines…Security procedures, standards, measures, practices, and policies cover a number of different subject areas. ? Shon Harris All?in?one CISSP Certification Guide pg 44?45
In addition to providing an audit trail required by auditors, logging can be used to
A. provide backout and recovery information
B. prevent security violations
C. provide system performance statistics
D. identify fields changed on master files.
Answer: B
Explanation:
Auditing tools are technical controls that track activity within a network on a network device or on a specific computer. Even though auditing is not an activity that will deny an entity access to a network or computer, it will track activities so a network administrator can understand the types of access that took place, identify a security breach, or warn the administrator of suspicious activity. This can be used to point out weakness of their technical controls and help administrators understand where changes need to be made to preserve the necessary security level within the environment. . ? Shon Harris All?in?one CISSP Certification Guide pg 179?180
In which one of the following documents is the assignment of individual roles and responsibilities MOST appropriately defined? A. Security policy B. Enforcement guidelines C. Acceptable use policy D. Program manual
Answer: C
Explanation:
An acceptable use policy is a document that the employee signs in which the expectations, roles and responsibilities are outlined.
Issue ?specific policies address specific security issues that management feels need more detailed explanation and attention to make sure a comprehensive structure is built and all employees understand how they are to comply to these security issues. ? Shon Harris AIIm? one CISSP Certification Guide pg 62
In which situation would TEMPEST risks and technologies be of MOST interest?
A. Where high availability is vital.
B. Where the consequences of disclose are very high.
C. Where countermeasures are easy to implement
D. Where data base integrity is crucial
Answer: B
Explanation:
Emanation eavesdropping. Receipt and display of information, which is resident on computers or terminals, through the interception of radio frequency (RF) signals generated by those computers or terminals. The U.S. government established a program called TEMPEST that addressed this problem by requiring a shielding and other emanation?reducing mechanisms to be employed on computers processing sensitive and classified government information. . ?Ronald Krutz The CISSP PREP Guide (gold edition) pg 416
In which state must a computer system operate to process input/output instructions? A. User mode B. Stateful inspection C. Interprocess communication D. Supervisor mode
Answer: D
Explanation:
A computer is in a supervisory state when it is executing these privileged instructions. (privileged instructions are executed by the system administrator or by an individual who is authorized to use those instructions.) . ?Ronald Krutz The CISSP PREP Guide (gold edition) pg 254?255
Management can expect penetration tests to provide all of the following EXCEPT
A. identification of security flaws
B. demonstration of the effects of the flaws
C. a method to correct the security flaws.
D. verification of the levels of existing infiltration resistance
Answer: B
Explanation:
Penetration testing is a set of procedures designed to test and possibly bypass security controls of a system. Its goal is to measure an organization?s resistance to an attack and to uncover any weaknesses within the environment…The result of a penetration test is a report given to management describing the list of vulnerabilities that were identified and the severity of those vulnerabilities. From here, it is up to management to determine how the vulnerabilities are dealt with and what countermeasures are implemented.
? Shon Harris All?in?one CISSP Certification Guide pg 837?839
Satellite communications are easily intercepted because_
A. transmissions are continuous 24 hours per day.
B. a satellite footprint is narrowly focused.
C. a satellite footprint is very large.
D. a satellite footprint does not change.
Answer: C
Explanation:
I think it may have to do with the footprint of the satellite.
Footprint ? The area of Earth with sufficient antenna gain to receive a signal from a satellite. ? http://www.aero.orcj/publications/crosslink/winter2002/backpacje. html
Not A: Granted Satellites transmit but they may not do it 24x7 as it could be only when traffic is sent.
The Common Criteria construct which allows prospective consumers or developers to create standardized sets of security requirements to meet there needs is
A. a Protection Profile (PP).
B. a Security Target (ST).
C. an evaluation Assurance Level (EAL).
D. a Security Functionality Component Catalog (SFCC).
Answer: A
Explanation:
Protection Profiles: The Common Criteria uses protection profiles to evaluate products. The protection profile contains the set of security requirements, their meaning and reasoning, and the corresponding EAL rating. The profile describes the environmental assumptions, the objectives, and functional and assurance level expectations. Each relevant threat is listed along with how it is to be controlled by specific objectives. It also justifies the assurance level and requirements for the strength of each protection mechanism. The protection profile provides a means for the consumer, or others, to identify specific security needs;p this is the security problem to be conquered.
EAL: An evaluation is carried out on a product and is assigned an evaluation assurance level (EAL) The thoroughness and stringent testing increases in detailed?oriented tasks as the levels increase. The Common Criteria has seven assurance levels. The ranges go from EAL1, where the functionality testing takes place, to EAL7, where thorough testing is performed and the system is verified. All?In?One CISSP Certification Exam Guide by Shon Harris pg. 262
Note:
?The Common Criteria defines a Protection Profile (PP), which is an implementation?independent specification of the security requirements and protections of a product that could be built. The Common Criteria terminology for the degree of examination of the product to be tested is the Evaluation Assurance Level (EAL). EAL5 range from EA1 (functional testing) to EA7 (detailed testing and formal design verification). The Common Criteria TOE [target of evaluation] refers to the product to be tested. A Security Target (ST) is a listing of the security claims for a particular IT security product.? ?Ronald Krutz The CISSP PREP Guide (gold edition) pg 266?267
The Trusted Computer Security Evaluation Criteria (TBSEC) provides
A. a basis for assessing the effectiveness of security controls built into automatic data?processing system products
B. a system analysis and penetration technique where specifications and document for the system are analyzed.
C. a formal static transition model of computer security policy that describes a set of access Control rules.
D. a means of restricting access to objects based on the identity of subjects and groups to which They belong.
Answer: A
Explanation:
TBSEC provides guidelines to be used with evaluating a security product. The TBSEC guidelines address basic security functionality and allow evaluators to measure and rate the functionality of a system and how trustworthy it is. Functionality and assurance are combined and not separated, as in criteria developed later. TCSEC guidelines can be used for evaluating vendor products or by vendors to design necessary functionality into new products. CISSP Study Guide by Tittel pg.
413.
Tracing violations, or attempted violations of system security to the user responsible is a function of A. authentication B. access management C. integrity checking D. accountability
Answer: D
Explanation:
Auditing capabilities ensure that users are accountable for their actions, verify that the security policies are enforced, worked as a deterrent to improper actions, and are used as investigation tools. ? Shon Harris AIIm? one CISSP Certification Guide pg 182
