Cyber Security II

What best describes vulnerabilities? Select one: a. The amount of risk that remains after steps have been taken to mitigate risk b. Any type of activity or event that can result in a loss of C.I.A. c. A flaw or weakness in system security procedures, design, implementation, or internal controls d. Net negative impact of the exercise of a vulnerability

A flaw or weakness in system security procedures, design, implementation, or internal controls

Which choice describes the main difference between risk management and risk assessments? Select one: a. Risk management is a point-in-time event, while a risk assessment is a continuing process. b. A risk assessment is a point-in-time event, while risk management is an continuing process. c. Risk assessments are comprehensive in scope, while risk management is concentrated on a specific system. d. Risk assessment is one part of an overall risk management strategy for an organization.

A risk assessment is a point-in-time event, while risk management is an continuing process.

What is Kerberos? Select one: a. A security model by MAC. b. A three-headed dog of Hades. c. A remote authentication protocol for dial in to server. d. A trusted third-party authentication protocol.

A trusted third-party authentication protocol.

Which process is needed to operate the system in the company? Select one: a. Certification process b. Accreditation process c. Quality control process d. Configuration process

Accreditation process

Which best describes IPS compared to IDS? Select one: a. An inline monitoring system that can modify the environment to block an attack b. A system used to analyze vulnerabilities aganist a host machine c. An active device that detects and alertsd administrators d. A passive device that detects and alertsd administrators

An active device that detects and alertsd administrators

What best describes threats? Select one: a. A flaw or weakness in system security procedures, design, implementation, or internal controls b. Any type of activity or event that can result in a loss of C.I.A. c. The amount of risk that remains after steps have been taken to mitigate risk d. Net negative impact of the exercise of a vulnerability

Any type of activity or event that can result in a loss of C.I.A.

If an organization wants to implement a policy to define how long long archives and other data are kept Select one: a. Data loss prevention b. Storage media c. Transmission d. Archiving and Retention Requirements

Archiving and Retention Requirements

Of the following, which management is needed to manage the hardware and software items in your company? Select one: a. Risk management b. Asset management c. Software management d. Project management

Asset management

________created by one or more logs that track events occurring on a system or network Select one: a. Clipping levels b. Audit Trails c. Auditing with Logs d. Accountability e. security audit

Audit Trails

________ used to record details such as who, what, when, and where for any events of interest Select one: a. Clipping levels b. security audit c. Audit Trails d. Accountability e. Auditing with Logs

Auditing with Logs

When a company decide to block access to FaceBook completely. What risk management strategy are they using? Select one: a. Transfer b. Avoid c. Mitigate d. Accept

Avoid

Investigator uses which method to create an image of a drive for forensics investigation? Select one: a. Hashing b. Bit copy tool c. Diskcopy command d. Xcopy

Bit copy tool

______ used to generate alerts when the threshold is exceeded Select one: a. security audit b. Auditing with Logs c. Accountability d. Audit Trails e. Clipping levels

Clipping levels

Of the following, which is the first phase of forensics investigation process? Select one: a. Reporting b. Examination c. Analysis d. Collection

Collection

An individual is dishonest or unethical and using a computer in an unauthorized manner is considered as? a. Cyber Stalking b. Net Crime c. Computer abuse d. Cyber Terrorism e. Computer crime

Computer abuse

Which of the following data needs to be most protected? Select one: a. Public b. Sensitive c. Private d. Confidential

Confidential

_______ is the practice of ensuring that systems are configured with security in mind Select one: a. Change management b. Project management c. Configuration management d. Group policy

Configuration management

Common among adults is to use of the Internet to harass another person is called? Select one: a. Cyber Stalking b. Net Crime c. Cyber bullying d. Cyber Terrorism e. Cyber Warfare

Cyber Stalking

He uses the Internet to attack a victim through harassment, coercion, or intimidation is an example of? Select one: a. Cyber bullying b. Cyber Terrorism c. Cyber Warfare d. Net Crime e. Cyber Stalking

Cyber bullying

According to discretionary access control model, which entity is authorized to grant access to other users? Select one: a. Group Lead b. Data Owner c. Security Supervisor d. Boss

Data Owner

The procedure to secure data moving in a media is called? Select one: a. Data at process b. Data at rest c. Data at execution d. Data at motion

Data at motion

The ability of hackers to gain knowledge by piecing together unclassified data to determine classified or secret information is called? Select one: a. Data acquisition b. Data inference c. Data collection d. Data analysis

Data inference

If a company wants to ensure that a file is only stored once on a system. Which policy you would recommend? Select one: a. Data loss prevention b. Archiving and Retention Requirements c. Storage media d. Transmission e. Deduplication

Deduplication

What is the purpose of tunneling protocol? Select one: a. Encapsulate data b. Allow dial-in c. None of the above d. Speed up data transfer

Encapsulate data

_____________are controls implemented to protect against risks from USB devices, mobile phones, thin clients, and virtualization Select one: a. Firewall b. AV c. Endpoint devices d. IDS

Endpoint devices

A fault tolerance for one or more servers is called Select one: a. Failover cluster b. RAID 10 c. Load balance d. Dual CPUs

Failover cluster

Which application can be used to detect intrusion on the host machine? Select one: a. AV software b. HIDS c. HIPS d. NIDS

HIDS

Which Protocol is used to protect data in motion? Select one: a. IPsec b. SMTP c. SFTP d. L2T

IPsec

Which protocol can be used by itself as a tunneling? Select one: a. IPsec b. SSH c. L2TP d. MPPE

IPsec

The process of submitting a user name is called? Select one: a. Accounting b. Accountability c. Identification d. Authentication

Identification

The purpose of system hardening is to Select one: a. Implement configuration management b. Increase the security of the operating system c. Document changes to operating system d. Increase policy awareness

Increase the security of the operating system

What is the main concern with using the single sign-on? Select one: a. Increases the unauthorized access if a password is revealed b. The security administrator's assignment would increase c. Makes it hard to remember passwords d. Access rights of users would be decreased

Increases the unauthorized access if a password is revealed

Which protocol doesn't encrypt the traffic itself? Select one: a. MPPE b. L2TP c. IPsec d. SSH

L2TP

How can you control call forwarding in your phone system? Select one: a. Setup a password on the phone system b. Limit which phone numbers can use this feature c. Stop all long distance calls d. Restrict long distance calls

Limit which phone numbers can use this feature

The company decided to install several technical controls in their system. What risk management strategy are they using? Select one: a. Transfer b. Accept c. Avoid d. Mitigate

Mitigate

SEMs are designed to do: Select one: a. Update the vulnerabilities database b. Identifies lists of applications installed on the system c. To give administratorts an opportunity to perform vulnerability tests d. Monitoring an enterprise for security events

Monitoring an enterprise for security events

What makes MS-CHAP v2 better than MS-CHAP? Select one: a. Use of a nonce b. Mutual authentication c. Support for biometrics d. Use of certificates

Mutual authentication

____________ is used to control which clients are granted access to a network based on the health status. Select one: a. Firewall b. NAC c. Radius d. IDS

NAC

Which application can be used to detect intrusion on the network? Select one: a. NIDS b. AV software c. HIDS d. HIPS

NIDS

If the cost of the control is significantly lower than the losses without the control, then the cost of control is? Select one: a. Justified b. Requires further investigation c. Maybe justified d. Not justified

Not justified

Health is defined by criteria such as (Choose more than one answer) Select one or more: a. OS is up-to-date b. User can login c. firewall enabled d. Quarantine is enabled e. up-to-date antivirus

OS is up-to-date firewall enabled up-to-date antivirus

As a security professional, you were asked to perform a vulnerability assessment, what is your first step before starting the process? Select one: a. Collect all documentations b. List all discovered vulnerabilities c. Obtain permission from the business owner d. Perform discovery on the network

Obtain permission from the business owner

The purpose of order of volatility is to Select one: a. Examining volatile data first b. Obtaining volatile data first c. Examining non-volatile data first d. Obtaining non-volatile data first

Obtaining volatile data first

Which control can be used to prevent password sniffing attacks from occuring? Select one: a. Static and repeated passwords b. Encryption and frequent passwords c. Static and one-time password d. One-time passwords and encryption

One-time passwords and encryption

A good example of nontechnical control is? Select one: a. Policy b. Firewall c. IDS d. IPS

Policy

Chain of custody is used to: Select one: a. Get permission from my boss b. Proof that evidence has been protected c. The amount of effort required to acquire different data sources d. Data collection method

Proof that evidence has been protected

Of the following choices, what deserves the lowest level of protection based commercial companies' standards? Select one: a. Sensitive b. Private c. Public d. Confidential

Public

A company using a numerical-based risk analysis to locate risks. What type of risk analysis is this? Select one: a. Qualitative analysis b. Total cost of ownership c. Return on investment d. Quantitative analysis

Quantitative analysis

uses two or more drives in an array and uses striping without parity Select one: a. RAID 1 b. RAID 0 c. RAID 10 d. RAID 5

RAID 0

__________ uses two disks only to provide data protection Select one: a. RAID 10 b. RAID 0 c. RAID 5 d. RAID 1

RAID 1

_________uses three or more drives in an array and uses striping with parity Select one: a. RAID 5 b. RAID 0 c. RAID 1 d. RAID 10

RAID 5

When the costs and savings are about the same, then we need to implement________________ to determine whether the cost is justified Select one: a. ROI b. NDB c. SLA d. RFI

ROI

The last step in vulnerability assessment is? Select one: a. Document vulnerabilities b. Analyze results c. Remediate d. Discovery

Remediate

What is the acronym for RADUIS? Select one: a. Remote Authentication Dialing User System b. Remote Authentication Dial-in User Service c. Remote Access Dial-in User System d. Roaming Access Dial-in User Service

Remote Authentication Dial-in User Service

Kerberos can prevent which one of the following attacks? Select one: a. Tunneling attack b. Replay attack c. Procedure attack d. Negative attack

Replay attack

Of the following, which is the last phase of forensics investigation? Select one: a. Collection b. Analysis c. Examination d. Reporting

Reporting

Which regulatory requirements mandate specific protections for data related to publicly held companies? Select one: a. SOX b. PII c. HIPPA d. SCACS

SOX

Which protocol is needed to provide a secure VoIP communication? Select one: a. NAC b. TACACS c. SRTP d. PSTN

SRTP

Which one of the following represents an ALE calculation? Select one: a. Single loss expectancy x annualized rate of occurrence. b. Asset value x loss expectancy. c. Gross loss expectancy x loss frequency. d. actual spare cost

Single loss expectancy x annualized rate of occurrence.

___________ refer to mandatory activities, actions, or rules Select one: a. Procedures b. Policy c. Standards d. Guidelines

Standards

What best describes residual risk? Select one: a. The amount of risk that remains after steps have been taken to mitigate risk. b. Any type of activity or event that can result in a loss of C.I.A. c. A flaw or weakness in system security procedures, design, implementation, or internal controls d. Net negative impact of the exercise of a vulnerability

The amount of risk that remains after steps have been taken to mitigate risk.

How do you describe the purpose of examination in forensics investigation? Select one: a. The analyst develops a plan that prioritizes the sources, establishing the order in which the data should be acquired b. The investigator starts assessing and extracting the relevant pieces of information from the composed data while protecting its integrity c. The investigator collects data related to the event identified following by labeling, recording and integrity preservation d. The investigator searches for the evidence and begins investigation immediately

The investigator collects data related to the event identified following by labeling, recording and integrity preservation

How do you describe the purpose of assembly of data in forensics investigation? Select one: a. The analyst should create a plan that prioritizes the sources, establishing the order in which the data should be acquired b. The investigator collects data related to the event identified following by labeling, recording and integrity preservation c. The investigators collect the evidence and begin investigation immediately d. The investigator should start assessing and extracting the relevant pieces of information from the composed data while protecting its integrity

The investigator should start assessing and extracting the relevant pieces of information from the composed data while protecting its integrity

When a company decides to buy insurance to deal with any losses, which one of the following is being applied? Select one: a. Mitigate b. Accept c. Avoid d. Transfer

Transfer

Which mode encrypts and encapsulates the entire packet? Select one: a. Encryption mode b. Hidden mode c. Transport mode d. Tunnel mode

Tunnel mode

Discretionary Access Controls (DAC) are: Select one: a. Less flexible than mandatory access controls. b. Concerned with information flow. c. Based upon security labels. d. Widely used in commercial environments.

Widely used in commercial environments.

Which of the following is not part of logical access security? Select one: a. username b. cipher locks c. passwords. d. access profiles

cipher locks

Mandatory Access control requires attaching labels to all objects. Which is considered as objects? Select one: a. devices, processes and I/O pipe b. files, directories, sockets and processes c. files, directories, and print queue d. users, programs and windows

files, directories, and print queue

Preventive controls are used to Select one: a. takes action to reverse the effects of an event b. identify the event either as it is occurring or after it has occurred c. focused on stopping losses due to risks d. focused on reducing losses due to risks to an acceptable level

focused on stopping losses due to risks

The purpose of DRP is to Select one: a. help an organization prepare for emergencies that can interrupt the mission of the business b. Document changes to operating system c. identifies steps to recover critical systems d. Increase policy awareness

identifies steps to recover critical systems

Detective controls are used to Select one: a. focused on reducing losses due to risks to an acceptable level b. focused on stopping losses due to risks c. identify the event either as it is occurring or after it has occurred d. takes action to reverse the effects of an event

identify the event either as it is occurring or after it has occurred

What is the definition of control? Select one: a. A preventive method used to implement firewall to stop attackers b. A corrective method used to correct security violations c. means, methods, actions, techniques, processes, procedures, or devices that reduce the vulnerability of a system d. means, methods, actions, techniques, processes, procedures, or devices to stop attackers for starting an attack against the system

means, methods, actions, techniques, processes, procedures, or devices that reduce the vulnerability of a system

__________examines an organization's practices and operations to determine whether they conform to the organization's policies or applicable laws Select one: a. Accountability b. security audit c. Audit Trails d. Auditing with Logs e. Clipping levels

security audit

Corrective controls are used to Select one: a. focused on stopping losses due to risks b. takes action to reverse the effects of an event c. focused on reducing losses due to risks to an acceptable level d. identify the event either as it is occurring or after it has occurred

takes action to reverse the effects of an event

There are three ways to authenticate to the computer security software are by something you know, something you are, and something: Select one: a. your essential b. you have c. you can become d. Non-trivial

you have