Ch. 7 Quiz & Assessment

Regarding an intrusion detection system (IDS), stateful matching looks for specific sequences appearing across several packets in a traffic stream rather than just in individual packets.

True

An audit examines whether security controls are appropriate, installed correctly, and __________.

Addressing their purpose

A __________ is a standard used to measure how effective your system is as it relates to industry expectations.

Benchmark

Fran is conducting a security test of a new application. She does not have any access to the source code or other details of the application she is testing. What type of test is Fran conducting?

Black-box test

Host isolation is the isolation of internal networks and the establishment of a(n) __________.

DMZ

What information should an auditor share with the client during an exit interview?

Details on major issues

Curtis is conducting an audit of an identity management system. Which question is NOT likely to be in the scope of his audit?

Does the firewall properly block unsolicited network connection attempts?

A SOC 1 report primarily focuses on security.

False

A hardened configuration is a system that has had unnecessary services enabled.

False

During the secure phase of a security review, you review and measure all controls to capture actions and changes on the system.

False

The four main types of logs that you need to keep to support security auditing include event, access, user and security.

False

What is a set of concepts and policies for managing IT infrastructure, development and operations?

IT Infrastructure Library (ITIL)

Which security testing activity uses tools that scan for services running on systems?

Network mapping

__________ is used when it's not as critical to detect and respond to incidents immediately.

Non-real-time monitoring

Post-audit activities include which of the following?

Presenting findings, data analysis, exit interviews, reviewing of findings

Christopher is designing a security policy for his organization. He would like to use an approach that allows a reasonable list of activities but does not allow other activities. Which permission level is he planning to use?

Prudent

Which of the following is an example of a level of permissiveness?

Prudent, permissive, promiscuous, paranoid

The review of the system to learn as much as possible about the organization, its systems, and networks is known as __________.

Reconnaissance

Emily is the information security director for a large company that handles sensitive personal information. She is hiring an auditor to conduct an assessment demonstrating that her firm is satisfying requirements regarding customer private data. What type of assessment should she request?

SOC 3

Gina is preparing to monitor network activity using packet sniffing. Which technology is most likely to interfere with this effort if used on the network?

Secure Sockets Layer (SSL)

A common platform for capturing and analyzing log entries is __________.

Security Information and Event Management (SIEM)

Isaac is responsible for performing log reviews for his organization in an attempt to identify security issues. He has a massive amount of data to review. What type of tool would best assist him with this work?

Security information and event management (SIEM)

Which intrusion detection system strategy relies upon pattern matching?

Signature detection

In __________ methods, the IDS compares current traffic with activity patterns consistent with those of a known network intrusion via pattern matching and stateful matching.

Signature-based

Some of the tools and techniques used in security monitoring include baselines, alarms, closed-circuit TV, and honeypots.

True

When you use a control that costs more than the risk involved, you're making a poor management decision.

True

What type of security monitoring tool would be most likely to identify an unauthorized change to a computer system?

System integrity monitoring