CTC 362
________ is a suite of protocols designed to connect sites securely using IP networks. Answers: Dynamic Host Configuration Protocol (DHCP) Network access control (NAC) Point-to-Point Tunneling Protocol (PPTP) Internet Protocol Security (IPSec)
Internet Protocol Security (IPSec)
Which OSI Reference Model layer must translate the binary ones and zeros of computer language into the language of the transport medium? Answers: Data Link Layer Transport Layer Session Layer Physical Layer
Physical Layer
Which OSI Reference Model layer is responsible for the coding of data? Answers: Presentation Layer Session Layer Data Link Layer Transport Layer
Presentation Layer
Which of the following is the definition of white-box testing? Answers: An act carried out in secrecy. Software and devices that assist in collecting, storing, and analyzing the contents of log files. Security testing that is based on knowledge of the application's design and source code. Analysis of activity as it is happening.
Security testing that is based on knowledge of the application's design and source code.
_____________is the process of dividing a task into a series of unique activities performed by different people, each of whom is allowed to execute only one part of the overall task. Answers: Accountability Decentralized access control User Datagram Protocol (UDP) Separation of duties
Separation of duties
The ___________ framework defines the scope and contents of three levels of audit reports. Answers: Service Organization Control (SOC) permission-level real-time monitoring zone transfer
Service Organization Control (SOC)
________ is the basis for unified communications and is the protocol used by real-time applications, such as IM chat, conferencing, and collaboration. Answers: Dense wavelength division multiplexing (DWDM) Direct inward system access (DISA) Multimodal communications Session Initiation Protocol (SIP)
Session Initiation Protocol (SIP)
What is a Security Information and Event Management (SIEM) system? Answers: An intrusion detection system that uses pattern matching and stateful matching to compare current traffic with activity patterns (signatures) of known network intruders. An intrusion detection system that compares current activity with stored profiles of normal (expected) activity. Security testing that is based on knowledge of the application's design and source code. Software and devices that assist in collecting, storing, and analyzing the contents of log files.
Software and devices that assist in collecting, storing, and analyzing the contents of log files.
Which of the following is the definition of network address translation (NAT)? Answers: A management protocol for IP networks. A protocol to implement a VPN connection between two computers. A method to restrict access to a network based on identity or other rules. A method of IP address assignment that uses an alternate, public IP address to hide a system's real IP address.
A method of IP address assignment that uses an alternate, public IP address to hide a system's real IP address.
Which of the following is the definition of guideline? Answers: A method of developing software that is based on small project iterations, or sprints, instead of long project schedules. Recorded information from system events that describes security-related activity. A recommendation to purchase or how to use a product or system. A senior manager who reviews a certification report and makes the decision to approve the system for implementation.
A recommendation to purchase or how to use a product or system.
_______________ is another symmetric algorithm that organizations currently use. It is a 64-bit block cipher that has a variable key length from 32 to 448 bits. It is much faster than DES or IDEA and is a strong algorithm that has been included in more than 150 products, as well as v2.5.47 of the Linux kernel. Its author, Bruce Schneier, placed it in the public domain. Answers: RC4 RC2 CAST Blowfish
Blowfish
Which of the following identifies what assets are required for the business to recover from an event and continue doing business? Disaster recovery plan Risk assessment Business continuity plan Business impact analysis
Business impact analysis
There are four basic forms of a cryptographic attack. In a ________, the cryptanalyst has access only to a segment of encrypted data, and has no choice as to what that data might be. Answers: Chosen-ciphertext attack Chosen-plaintext attack Known-plaintext attack (KPA) Ciphertext-only attack (COA)
Ciphertext-only attack (COA)
Which part of the C-I-A triad refers to preventing the disclosure of secure information to unauthorized individuals or systems? Answers: Confidentiality Integrity Accessibility Availability
Confidentiality
____________ is exercised by frequently evaluating whether countermeasures are performing as expected. Answers: Corrective control Due diligence Detective control Preventive control
Due diligence
Another name for a border firewall is a DMZ firewall. Answers: True False
False
Quantitative analysis defines risk using a scenario that describes it. Answers: True False
False
________ is a type of attack in which the attacker takes control of a session between two machines and masquerades as one of them. Answers: Hijacking Malware Packet sniffer Spoofing
Hijacking
Which of the following is the definition of false negative? Answers: The process of gathering the wrong information. Incorrectly identifying abnormal activity as normal. Analysis of activity as it is happening. A method of security testing that isn't based directly on knowledge of a program's architecture.
Incorrectly identifying abnormal activity as normal.
In a ________, the cryptanalyst possesses certain pieces of information before and after encryption. Answers: Known-plaintext attack (KPA) Ciphertext-only attack (COA) Chosen-ciphertext attack Chosen-plaintext attack
Known-plaintext attack (KPA)
Which of the following allows analysts to view and analyze network packet traces? Answers: NetWitness Investigator OpenVAS Filezilla Promiscuous mode
NetWitness Investigator
During the vulnerability assessment, any known vulnerabilities or bugs will be flagged and identified by: Answers: footprinting. enumeration. a Ping scan. OpenVAS.
OpenVAS.
________ is an authentication credential that is generally longer and more complex than a password. Answers: Authorization Continuous authentication Passphrase Two-factor authentication (TFA)
Passphrase
What name is given to a protocol to implement a VPN connection between two computers? Answers: Dynamic Host Configuration Protocol (DHCP) Internet Control Message Protocol (ICMP) screened subnet Point-to-Point Tunneling Protocol (PPTP)
Point-to-Point Tunneling Protocol (PPTP)
________ uses various controls to reduce identified risks. These controls might be administrative, technical, or physical. Answers: Risk mitigation Risk assignment Risk acceptance Risk acceptance
Risk mitigation
________ is the difference between the security controls you have in place and the controls you need to have in place in order to address all vulnerabilities. Answers: Gap analysis Negative risk Quantitative risk analysis Security gap
Security gap
Which of the following is the definition of business drivers? Answers: A comparison of security controls in place and the controls that are needed to address all identified threats. The collection of components, including people, information, and conditions, that support business objectives. The process of identifying, assessing, prioritizing, and addressing risks. The estimated loss due to a specific realized threat.
The collection of components, including people, information, and conditions, that support business objectives.
Mandatory access control (MAC) is a means of restricting access to an object based on the object's classification and the user's security clearance. Answers: True False
True
Residual risk is the risk that remains after you have installed countermeasures and controls. Answers: True False
True
Sprint means one of the small project iterations used in the "agile" method of developing software, in contrast with the usual long project schedules of other ways of developing software. Answers: True False
True
Which of the following combines something you know (e.g. password) with something you are (e.g. fingerprint) or something you possess (e.g. USB stick) and can also employ a certificate system that adds a distinct third layer to the authentication process? Answers: Single-factor authentication Two-factor authentication Three-factor authentication Multi-factor authentication
Two-factor authentication
hat term is used to describe the current encryption standard for wireless networks? Answers: wireless access point (WAP) Wi-Fi Protected Access (WPA) screened subnet Wired Equivalent Privacy (WEP)
Wi-Fi Protected Access (WPA)
Which of the following is a protocol analyzer tool (sometimes called a "packet sniffer") that is used to capture IP traffic from a variety of sources? Answers: OpenVAS Zenmap NetWitness Investigator Wireshark
Wireshark
Which of the following is a graphical interface for Nmap that is typically used during the scanning phase of the ethical hacking process? Answers: Zenmap Greenbone Security Assistant SYN scan OpenVAS
Zenmap
Which of the following is a port scanning tool that can quickly identify hosts and detect what operating system and services are running on them? OpenVAS Ping scan Zenmap Greenbone Security Assistant
Zenmap
Which of the following is used to perform a scan of the network and create a network topology chart? Answers: Wireshark Zenmap OpenVAS NetWitness Investigator
Zenmap
Malicious software can be hidden in a ________. Answers: URL link PDF file ZIP file all of the above
all of the above
Prior to VoIP, attackers would use wardialers to ________. Answers: identify analog modem signals to gain access gain access to PBX phone systems to commit toll fraud identify the operating system running on a computer all of the above
all of the above
How often should an organization perform a risk management plan? Answers: every couple of years biannually annually when a risk is identified
annually
How your organization responds to risk reflects the value it puts on its ___________. Answers: environment assets technology vulnerability
assets
An attempt to exploit a vulnerability of a computer or network component is the definition of ________. Answers: phreaking attack spyware protocol analyzer
attack
Zenmap's Topology tab displays a __________ that shows the relative size and connection type of all discovered IP hosts. Answers: searchable database bar chart line graph bubble chart
bubble chart
The ________ is a simple review of a plan by managers and the business continuity team to make sure that contact numbers are current and that the plan reflects the company's priorities and structure. Answers: structured walk-through test checklist test parallel test review test
checklist test
Information security activities directly support several common business drivers, including ________ and efforts to protect intellectual property. Answers: confidentiality quantitative risk analysis regulations compliance
compliance
Cryptography accomplishes four security goals: nonrepudiation, integrity, authentication, and ________________. Answers: security confidentiality privacy reliability
confidentiality
Security audits help ensure that your rules and __________ are up to date, documented, and subject to change control procedures. Answers: applications mitigation activities configurations recommendations
configurations
Notification, response, recovery and follow-up, and documentation are all components of what process? Answers: control countermeasure business impact analysis Correct incident handling
control
Forensics and incident response are examples of ___________ controls. Answers: preventive technical corrective detective
corrective
What name is given to an attack that uses ping or ICMP echo-request, echo-reply messages to bring down the availability of a server or system? Answers: denial of service (DoS) quality of service (QoS) toll calls Regional Bell Operating Company (RBOC)
denial of service (DoS)
An intrusion detection system (IDS) is an example of ___________ controls. Answers: preventive corrective administrative detective
detective
Based on your interpretation of the Zenmap Intense Scan, the purpose/results of the ARP Ping Scan was to: Answers: discover how many hosts are alive. discover the IP path to the remote system. look for fingerprints of known services by testing responses to certain types of packets. identify open TCP ports.
discover how many hosts are alive.
A(n) ________ is a measurable occurrence that has an impact on the business. Answers: corrective control event cost critical business function
event
A ___________ controls the flow of traffic by preventing unauthorized network traffic from entering or leaving a particular portion of the network. Answers: hub firewall router switch
firewall
Cryptography accomplishes four security goals: confidentiality, integrity, authentication, and ________________. Answers: security privacy nonrepudiation reliability
nonrepudiation
If knowing about an audit changes user behavior, an audit will ____________. Answers: not be accurate be more accurate skew results not be required
not be accurate
A firewall that examines each packet it receives and compares the packet to a list of rules configured by the network administrator is the definition of ________. Answers: stateful inspection firewall packet-filtering firewall application proxy firewall Point-to-Point Tunneling Protocol (PPTP)
packet-filtering firewall
What name is given to a risk-analysis method that uses relative ranking to provide further definition of the identified risks in order to determine responses to them? Answers: quantitative risk analysis qualitative risk analysis annual loss expectancy (ALE) gap analysis
qualitative risk analysis
The goal of ____________ is to quantify possible outcomes of risks, determine probabilities of outcomes, identify high-impact risks, and develop plans based on risks. Answers: qualitative risk analysis annual rate of occurrence (ARO) quantitative risk analysis risk register
quantitative risk analysis
Network ________ is gathering information about a network for use in a future attack. Answers: reconnaissance eavesdropping denial of service surveying
reconnaissance
What name is given to any risk that exists but has a defined response? Answers: qualitative risk analysis residual risk risk management risk register
residual risk
An organization knows that a risk exists and has decided that the cost of reducing it is higher than the loss would be. This can include self-insuring or using a deductible. This is categorized as ________. Answers: risk mitigation risk assignment risk acceptance risk acceptance
risk acceptance
The process of managing risks starts by identifying __________. A. risks B. business drivers C. exposure factor (EF) D. standards
risks
What term is used to describe something built in or used in a system to address gaps or weaknesses in the controls that could otherwise lead to an exploit? Answers: safeguard countermeasure technical control detective control
safeguard
An encrypted channel used for remote access to a server or system, commonly used in Linux and UNIX servers and applications, is the definition of __________. Answers: private branch exchange (PBX) phone system divestiture network infrastructure security secure shell (SSH)
secure shell (SSH)
One of the best ways to avoid wasting your organization's resources is to ensure that you follow the ________ review cycle. Answers: audit security benchmark monitoring
security
The primary task of an organization's __________ team is to control access to systems or resources. Answers: compliance liaison management software development security administration
security administration
Your organization's __________ sets the tone for how you approach related activities. Answers: assets security policy configuration guidelines
security policy
One of the most popular types of attacks on computer systems involves ___________. These attacks deceive or use people to get around security controls. The best way to avoid this risk is to ensure that employees know how to handle such attacks. Answers: cloud computing the World Wide Web social engineering worms
social engineering
Audits also often look at the current configuration of a system as a snapshot in time to verify that it complies with ________. Answers: controls management standards plan
standards
An attacker or event that might exploit a vulnerability is a(n) ____________. Answers: incident threat source cost hacker
threat source
RTO identifies the maximum allowable ________ to recover the function. Answers: risk support data loss time
time
Which of these biometric authentication methods is not as accurate as the rest? Answers: iris scans voice pattern retina scan facial recognition
voice pattern
A _____________ is a flaw or weakness in a system's security procedures, design, implementation, or internal controls. Answers: threat impact risk vulnerability
vulnerability
A method of restricting resource access to specific periods of time is called ________. Answers: temporal isolation classification multi-tenancy separation of duties
temporal isolation
A(n) ________ is an intent and method to exploit a vulnerability. Answers: impact incident threat source safeguard
threat source
Which of the following best describes quantitative risk analysis? Answers: The process of identifying, assessing, prioritizing, and addressing risks. A risk-analysis method that uses relative ranking to provide further definition of the identified risks in order to determine responses to them. A comparison of security controls in place and the controls that are needed to address all identified threats. A risk-analysis method that uses mathematical formulas and numbers to assist in ranking risk severity.
A risk-analysis method that uses mathematical formulas and numbers to assist in ranking risk severity.
Which of the following is known as stateful matching? Answers: Security testing that is based on limited knowledge of an application's design. A method of security testing that isn't based directly on knowledge of a program's architecture. A technique of matching network traffic with rules or signatures based on the appearance of the traffic and its relationship to other packets. Using tools to determine the layout and services running on an organization's systems and networks.
A technique of matching network traffic with rules or signatures based on the appearance of the traffic and its relationship to other packets.
What is meant by rootkit? Answers: An attack in which one user or computer pretends to be another user or computer. A type of malware that modifies or replaces one or more existing programs to hide the fact that a computer has been compromised. An attack in which the attacker gets between two parties and intercepts messages before transferring them on to their intended destination. Unwanted e-mail or instant messages.
A type of malware that modifies or replaces one or more existing programs to hide the fact that a computer has been compromised.
What is the difference between a BCP and a DRP? Answers: A BCP does not specify how to recover from disasters, just interruptions. A DRP directs the actions necessary to recover resources after a disaster. A DRP is a part of a BCP. All of the above.
All of the above.
What is meant by pharming? Answers: The unique knowledge a business possesses that gives it a competitive advantage over similar companies in similar industries. An attack that seeks to obtain personal or private financial information through domain spoofing. A type of window that appears on top of the browser window. These generally contain ads, and although they are not strictly adware, many adware programs use them to interact with users. An application that captures traffic as it travels across a network.
An attack that seeks to obtain personal or private financial information through domain spoofing.
Which of the following is the definition of anomaly-based IDS? Answers: An intrusion detection system that compares current activity with stored profiles of normal (expected) activity. The state of a computer or device in which you have turned off or disabled unnecessary services and protected the ones that are still running. An intrusion detection system that uses pattern matching and stateful matching to compare current traffic with activity patterns (signatures) of known network intruders. Using tools to determine the layout and services running on an organization's systems and networks.
An intrusion detection system that compares current activity with stored profiles of normal (expected) activity.
Which of the following is the definition of pattern-based IDS? Answers: The state of a computer or device in which you have turned off or disabled unnecessary services and protected the ones that are still running. An intrusion detection system that uses pattern matching and stateful matching to compare current traffic with activity patterns (signatures) of known network intruders. Software and devices that assist in collecting, storing, and analyzing the contents of log files. A technique of matching network traffic with rules or signatures based on the appearance of the traffic and its relationship to other packets.
An intrusion detection system that uses pattern matching and stateful matching to compare current traffic with activity patterns (signatures) of known network intruders.
________ is an authorization method in which access to resources is decided by the user's formal status. Answers: Authority-level policy Knowledge Physically constrained user interface Decentralized access control
Authority-level policy
Which part of the C-I-A triad refers to making sure information is obtainable when needed? Answers: Confidentiality Integrity Accessibility Availability
Availability
Organizations currently use several symmetric algorithms, including ________, which is a substitution-permutation algorithm similar to DES. Unlike DES, its authors made its design criteria public. This 64-bit symmetric block cipher can use keys from 40 to 256 bits. Although it is patented (U.S. patent 5,511,123), its inventors, C.M. Adams and S.E. Tavares, made it available for free use. Answers: Blowfish CAST RC2 International Data Encryption Algorithm (IDEA)
CAST
________is a one-way calculation of information that yields a result usually much smaller than the original message. Answers: Caesar cipher Checksum Hash Symmetric key
Checksum
In a ________, cryptanalysts submit data coded with the same cipher and key they are trying to break to the decryption device to see either the plaintext output or the effect the decrypted message has on some system. Answers: Known-plaintext attack (KPA) Ciphertext-only attack (COA) Chosen-ciphertext attack Chosen-plaintext attack
Chosen-ciphertext attack
Which OSI Reference Model layer is responsible for transmitting information on computers connected to the same local area network (LAN)? Answers: Presentation Layer Session Layer Data Link Layer Transport Layer
Data Link Layer
Which OSI Reference Model layer uses Media Access Control (MAC) addresses? Device manufacturers assign each hardware device a unique MAC address. Answers: Data Link Layer Presentation Layer Transport Layer Session Layer
Data Link Layer
Which of the following allows Wireshark to capture packets destined to any host on the same subnet or virtual LAN (VLAN)? Answers: NetWitness Investigator OpenVAS Filezilla Promiscuous mode
Promiscuous mode
What is meant by application convergence? Answers: A basic digital signaling rate that corresponds to one voice-frequency-equivalent channel. Although the true data rate for DS0 is 64 kbit/s, the effective data rate for a single voice channel when using DS0 is 56 kbit/s. The integration of applications to enhance productivity. Unified communications is an example of application convergence. Unified communications integrates recorded voice messages into e-mail so that voice messages are retrievable via e-mail. An attack that uses ping or ICMP echo-request, echo-reply messages to bring down the availability of a server or system. DDoS attacks initiate from more than one host device. A term used to describe streamlining processes with automation or simplified steps.
The integration of applications to enhance productivity. Unified communications is an example of application convergence. Unified communications integrates recorded voice messages into e-mail so that voice messages are retrievable via e-mail.
What is meant by promiscuous mode? Answers: The mode in which sniffers operate; it is nonintrusive and does not generate network traffic. This means that every data packet is captured and can be seen by the sniffer. An event that results in a violation of any of the C-I-A security tenets. A software program that enables a computer to monitor and capture network traffic, including passwords and data. An attack method that takes all the words from a dictionary file and attempts to log on by entering each dictionary entry as a password.
The mode in which sniffers operate; it is nonintrusive and does not generate network traffic. This means that every data packet is captured and can be seen by the sniffer.
Which of the following is an accurate description of cloud computing? Answers: The process of providing credentials to claim to be a specific person or entity. The process of dividing a task into a series of unique activities performed by different people, each of whom is allowed to execute only one part of the overall task. The practice of using computing services that are delivered over a network. A database feature that allows different groups of users to access the database without being able to access each other's data.
The practice of using computing services that are delivered over a network.
Which of the following is not a type of authentication? Answers: knowledge ownership characteristics identification
identification
A ________ is an encryption key used to encrypt other keys before transmitting them. Answers: key directory key distribution key-encrypting key private (symmetric) key
key-encrypting key
The number of possible keys to a cipher is a ___________. Answers: checksum cryptosystem keyspace key directory
keyspace
The CVE listing is a database of: Answers: approved methods that can be used to identify hosts and detect what operating system and services are running on them. known software vulnerabilities and exposures as well as how to mitigate them with software patches and updates. graphical interfaces for Nmap that are typically used during the scanning and vulnerability phase of the ethical hacking process. license agreements that must be acknowledged in order to access the OpenVAS report that includes the details for each host.
known software vulnerabilities and exposures as well as how to mitigate them with software patches and updates.
What term is used to describe the probability that a potential vulnerability might be exercised within the construct of an associated threat environment? Answers: likelihood event detective control incident
likelihood
Loss of financial assets due to ________ is a worst-case scenario for all organizations. Answers: hijacking masquerade attacks phishing malicious attacks
malicious attacks
What term is used to describe a method of IP address assignment that uses an alternate, public IP address to hide a system's real IP address? Answers: application proxy firewall network address translation (NAT) Internet Control Message Protocol (ICMP) network access control (NAC)
network address translation (NAT)
