Intro to Information Security

During what phase of a remote access connection does the end user prove his or her claim of identity?

Authentication

Continuity of critical business functions and operations is the first priority in a well-balanced business continuity plan (BCP).

False

David would like to connect a fibre channel storage device to systems over a standard data network. What protocol can he use?

Fibre Channel over Ethernet (FCoE)

Data loss prevention (DLP) uses business rules to classify sensitive information to prevent unauthorized end users from sharing it.

True

Standards are used when an organization has selected a solution to fulfill a policy goal.

True

The Federal Financial Institutions Examination Council (FFIEC) developed the Cybersecurity Assessment Tool, which can be used as a self-assessment tool for identifying a bank or financial institution's cyber security maturity.

True

The Gramm-Leach-Bliley Act (GLBA) addresses information security concerns in the financial industry.

True

Written security policies document management's goals and objectives.

True

Allie is working on the development of a web browser and wants to make sure that the browser correctly implements the Hypertext Markup Language (HTML) standard. What organization's documentation should she turn to for the authoritative source of information?

World Wide Web Consortium (W3C)

Which one of the following is an example of two-factor authentication?

A token device and a PIN

Which activity manages the baseline settings for a system or device?

Configuration control

Which practice is NOT considered unethical under RFC 1087 issued by the Internet Architecture Board (IAB)?

Enforcing the integrity of computer-based information

Removable storage is a software application that allows an organization to monitor and control business data on a personally owned device.

False

You should use easy-to-remember personal information to create secure passwords.

False

Which one of the following is an example of a logical access control?

Password

Which tool can capture the packets transmitted between systems over a network?

Protocol analyzer

Bob is using a port scanner to identify open ports on a server in his environment. He is scanning a web server that uses Hypertext Transfer Protocol (HTTP). Which port should Bob expect to be open to support this service?

80

Ed wants to make sure that his system is designed in a manner that allows tracing actions to an individual. Which phase of access control is Ed concerned about?

Accountability

Which audit data collection method helps ensure that the information gathering process covers all relevant areas?

Checlist

A phishing attack "poisons" a domain name on a domain name server.

False

Which one of the following governs the use of Internet of Things (IoT) by healthcare providers, such as physicians and hospitals?

Health Insurance Portability and Accountability Act (HIPAA)

Which one of the following is NOT an advantage of biometric systems?

Physical characteristics may change.

What is the only unbreakable cipher when it is used properly?

Vernam

The Children's Online Privacy Protection Act (COPPA) restricts the collection of information online from children. What is the cutoff age for COPPA regulation?

13

Which action is the best step to protect Internet of Things (IoT) devices from becoming the entry point for security vulnerabilities into a network while still meeting business requirements?

Applying security updates promptly

Jody would like to find a solution that allows real-time document sharing and editing between teams. Which technology would best suit her needs?

Collaboration

Alan withdraws cash from an ATM belonging to Bank X that is coming from his account with Bank Y. What is Alan's relationship with Bank X?

Consumer

What is NOT a common endpoint for a virtual private network (VPN) connection used for remote network access?

Content Filter

Betty receives a cipher text message from her colleague Tim. What type of function does Betty need to use to read the plaintext message?

Decryption

Internet Control Message Protocol (ICMP) is a method of IP address assignment that uses an alternate, public IP address to hide a system's real IP address.

False

Which type of attack involves the creation of some deception in order to trick unsuspecting users?

Farbrication

Which compliance obligation includes security requirements that apply specifically to federal government agencies in the United States?

Federal Information Security Management Act (FISMA)

Which of the following allows a certificate authority (CA) to revoke a compromised digital certificate in real time?

Online Certificate Status Protocol (OCSP)

The CEO of Kelly's company recently fell victim to an attack. The attackers sent the CEO an email informing him that his company was being sued and he needed to view a subpoena at a court website. When visiting the website, malicious code was downloaded onto the CEO's computer. What type of attack took place?

Spear phishing

During an audit, an auditor compares the current setting of a computer or device with a benchmark to help identify differences.

True

Hypertext Transfer Protocol (HTTP) is the communications protocol between web browsers and websites with data in cleartext.

True

ISO/IEC 27002 provides organizations with best-practice recommendations on information security management.

True

In a chosen-ciphertext attack, cryptanalysts submit data coded with the same cipher and key they are trying to break to the decryption device to see either the plaintext output or the effect the decrypted message has on some system.

True

In security testing data collection, observation is the input used to differentiate between paper procedures and the way the job is really done.

True

What tool might be used by an attacker during the reconnaissance phase of an attack to glean information about domain registrations?

Whois

What is NOT a valid encryption key length for use with the Blowfish algorithm?

512 bits

What is the first step in a disaster recovery effort?

Ensure that everyone is safe.

The Institute of Electrical and Electronics Engineers (IEEE) publishes or sponsors more than 13,000 standards and projects.

False

Adam discovers a virus on his system that is using encryption to modify itself. The virus escapes detection by signature-based antivirus software. What type of virus has he discovered?

Polymorphic virus

Application service providers (ASPs) are software companies that build applications hosted in the cloud and on the Internet.

True

Integrity-checking tools use cryptographic methods to make sure nothing and no one has modified the software.

True

Log files are records that detail who logged on to a system, when they logged on, and what information or resources they used.

True

Policies that cover data management should cover transitions throughout the data life cycle.

True

The Internet Architecture Board (IAB) is a subcommittee of the IETF.

True

The idea that users should be granted only the levels of permissions they need in order to perform their duties is called the principle of least privilege.

True

Chris is writing a document that provides step-by-step instructions for end users seeking to update the security software on their computers. Performing these updates is mandatory. Which type of document is Chris writing?

Procedure

A firewall is a basic network security defense tool.

True

Dawn is selecting an alternative processing facility for her organization's primary data center. She would like to have a facility that balances cost and switchover time. What would be the best option in this situation?

Warm Site

Ann is creating a template for the configuration of Windows servers in her organization. It includes the basic security settings that should apply to all systems. What type of document should she create?

Baseline

The Diffie-Hellman (DHE) algorithm is the basis for several common key exchange protocols, including Diffie-Hellman in Ephemeral mode (DHE) and Elliptic Curve DHE (ECDHE).

True

The recovery point objective (RPO) is the maximum amount of data loss that is acceptable.

True

In what software development model does activity progress in a lock-step sequential process where no phase begins until the previous phase is complete?

Waterfall

Gwen's company is planning to accept credit cards over the Internet. Which one of the following governs this type of activity and includes provisions that Gwen should implement before accepting credit card transactions?

Payment Card Industry Data Security Standard (PCI DSS)

Yuri is a skilled computer security expert who attempts to break into the systems belonging to his clients. He has permission from the clients to perform this testing as part of a paid contract. What type of person is Yuri?

White-hat hacker

Which activity is an auditor least likely to conduct during the information gathering phase of an audit?

Report writing

Which of the following is NOT one of the rights afforded to students (or the parents of a minor student) under the Family Educational Rights and Privacy Act (FERPA)?

Right to delete unwanted information from records

Emily is the information security director for a large company that handles sensitive personal information. She is hiring an auditor to conduct an assessment demonstrating that her firm is satisfying requirements regarding customer private data. What type of assessment should she request?

SOC 3

Gina is preparing to monitor network activity using packet sniffing. Which technology is most likely to interfere with this effort if used on the network?

Secure Sockets Layer (SSL)

As a follow-up to her annual testing, Holly would like to conduct quarterly disaster recovery tests that introduce as much realism as possible but do not require the use of technology resources. What type of test should Holly conduct?

Simulation Test

What is NOT generally a section in an audit report?

System configurations

Which one of the following is an advantage that the Internet of Things (IoT) brings to economic development for countries?

Technical and industry development

Which one of the following is NOT an example of store-and-forward messaging?

Telephone call

Aditya is attempting to classify information regarding a new project that his organization will undertake in secret. Which characteristic is NOT normally used to make these type of classification decisions?

Threat

A degausser creates a magnetic field that erases data from magnetic storage media.

True

An algorithm is a repeatable process that produces the same result when it receives the same input.

True

An auditing benchmark is the standard by which a system is compared to determine whether it is securely configured.

True

An electronic mail bomb is a form of malicious macro attack that typically involves an email attachment that contains macros designed to inflict maximum damage.

True

Common methods used to identify a user to a system include username, smart card, and biometrics.

True

Denial of service (DoS) attacks are larger in scope than distributed denial of service (DDoS) attacks

False

Federal agencies fall under the legislative branch of the U.S. government.

False

Service-level agreements (SLAs) are optical backbone trunks for private optical backbone networks.

False

Spyware does NOT use cookies

False

The asset protection policy defines an organization's data classification standard.

False

Encrypting the data within databases and storage devices gives an added layer of security.

True

Vincent recently went to work for a hospital system. He is reading about various regulations that apply to his new industry. What law applies specifically to health records?

Health Insurance Portability and Accountability Act (HIPAA)

IoT technology has a significant impact on developing economies, given that it can transform countries into e-commerce-ready nations.

True

It is common for rootkits to modify parts of the operating system to conceal traces of their presence.

True

Spyware gathers information about a user through an Internet connection, without his or her knowledge.

True

Committee of Sponsoring Organizations (COSO) is a set of best practices for IT management.

False

A network protocol governs how networking equipment interacts to deliver data across the network.

True

Attacks against confidentiality and privacy, data integrity, and availability of services are all ways malicious code can threaten businesses.

True

What type of network connects systems over the largest geographic area?

Wide area network (WAN)

What is NOT a good practice for developing strong professional ethics?

Assume that information should be free

Which one of the following is an example of a direct cost that might result from a business disruption?

Facility repair

A border router can provide enhanced features to internal networks and help keep subnet traffic separate.

False

A physical courier delivering an asymmetric key is an example of in-band key exchange.

False

Cryptography is the process of transforming data from cleartext into ciphertext.

False

Passphrases are less secure than passwords.

False

System infectors are viruses that attack document files containing embedded macro programming capabilities.

False

Temporal isolation is commonly used in combination with rule-based access control.

False

The term risk methodology refers to a list of identified risks that results from the risk-identification process.

False

Trojans are self-contained programs designed to propagate from one host machine to another using the host's own network communications protocols.

False

Vishing is a type of wireless network attack.

False

What type of firewall security feature limits the volume of traffic from individual hosts?

Flood guard

Yolanda would like to prevent attackers from using her network as a relay point for a smurf attack. What protocol should she block?

Internet Control Message Protocol (ICMP)

Which term accurately describes Layer 3 of the Open Systems Interconnection (OSI) model?

Network

When Patricia receives a message from Gary, she wants to be able to demonstrate to Sue that the message actually came from Gary. What goal of cryptography is Patricia attempting to achieve?

Nonrepudiation

Which of the following is NOT one of the four fundamental principles outlined by the Internet Society that will drive the success of Internet of Things (IoT) innovation?

Secure

In which type of attack does the attacker attempt to take over an existing connection between two systems?

Session Hijacking

Barbara is investigating an attack against her network. She notices that the Internet Control Message Protocol (ICMP) echo replies coming into her network far exceed the ICMP echo requests leaving her network. What type of attack is likely taking place?

Smurf

Authorization is the process of granting rights to use an organization's IT assets, systems, applications, and data to a specific user.

True

For businesses and organizations under recent compliance laws, data classification standards typically include private, confidential, internal use only, and public domain categories.

True

The Transport Layer of the OSI Reference Model creates, maintains, and disconnects communications that take place between processes over the network.

True

What wireless security technology contains significant flaws and should never be used?

Wired Equivalent Privacy (WEP)

Which type of attack against a web application uses a newly discovered vulnerability that is not patchable?

Zero-day attack