EXAM 2 FULL STUDY GUIDE

Réussis tes devoirs et examens dès maintenant avec Quizwiz!

Donna is building a security awareness program designed to meet the requirements of the Payment Card Industry Data Security Standard (PCI DSS) 3.2. How often must she conduct training for all current employees? :Monthly Semi-annually Annually Biannually

Annually

Mary is designing a software component that will function at the Presentation Layer of the Open Systems Interconnection (OSI) model. What other two layers of the model will her component need to interact with? Network and Session Session and Transport Application and Session Application and Transport

Application and Session

Taylor is a security professional working for a retail organization. She is hiring a firm to conduct the Payment Card Industry Data Security Standard (PCI DSS) required quarterly vulnerability scans. What credential should she seek in a vendor? Qualified security assessor (QSA) Self-assessment vendor (SAV) Approved scanning vendor (ASV) Independent Scanning Assessor (ISA)

Approved scanning vendor (ASV)

What level of academic degree requires the shortest period of time to earn and does NOT require any other postsecondary degree as a prerequisite? Bachelor's degree Master's degree Doctoral degree Associate's degree

Associate's degree

Which of the following is NOT a role described in DoD Directive 8140, which covers cyber security training? Attack Protect and defend Operate and maintain Investigate

Attack

Howard is leading a project to commission a new information system that will be used by a federal government agency. He is working with senior officials to document and accept the risk of operation prior to allowing use. What step of the risk management framework is Howard completing? Implement security controls in IT systems. Assess security controls for effectiveness. Authorize the IT system for processing. Continuously monitor security controls.

Authorize the IT system for processing.

Alice would like to send a message to Bob securely and wishes to encrypt the contents of the message. What key does she use to encrypt this message? Answers: Alice's public key Alice's private key Bob's public key Bob's private key

Bob's public key

Joe is the CEO of a company that handles medical billing for several regional hospital systems. How would Joe's company be classified under the Health Insurance Portability and Accountability Act (HIPAA)? Covered entity as a health plan Covered entity as a healthcare clearinghouse Covered entity as a provider Business associate of a covered entity

Business associate of a covered entity

Jim is an experienced security professional who recently accepted a position in an organization that uses Check Point firewalls. What certification can Jim earn to demonstrate his ability to administer these devices? CISSP CCIE Security+ CCSA

CCSA

Rod has been a Certified Information Systems Security Professional (CISSP) for 10 years. He would like to earn an advanced certification that demonstrates his ability in information security architecture. Which of the following CISSP concentrations would meet Rod's needs? CISSP-ISASP CISSP-ISSEP CISSP-ISSMP CISSP-ISSAP

CISSP-ISSAP

Karen would like to use a wireless authentication technology similar to that found in hotels where users are redirected to a webpage when they connect to the network. What technology should she deploy? Answers: Remote Authentication Dial-In User Service (RADIUS) Lightweight Extensible Authentication Protocol (LEAP) Captive portal Protected Extensible Authentication Protocol (PEAP)

Captive portal

Which information security objective allows trusted entities to endorse information? Answers: Validation Authorization Certification Witnessing

Certification

Richard would like to earn a certification that demonstrates his ability to manage the information security function. What certification would be most appropriate for Richard? Certified Information Security Manager (CISM) Certified Information Systems Auditor (CISA) Certified in the Governance of Enterprise IT (CGEIT) Certified in Risk and Information Systems Control (CRISC)

Certified Information Security Manager (CISM)

Which of the following certifications cannot be used to satisfy the security credential requirements for the advanced Certified Internet Webmaster (CIW) certifications? Security+ GIAC Certified Firewall Analyst (GCFW) Certified Information Security Manager (CISM) Certified Information Systems Security Professional (CISSP)

Certified Information Security Manager (CISM)

What certification focuses on information systems audit, control, and security professionals? Certified Information Security Manager (CISM) Certified Information Systems Auditor (CISA) Certified in the Governance of Enterprise IT (CGEIT) Certified in Risk and Information Systems Control (CRISC)

Certified Information Systems Auditor (CISA)

Which of the following certifications is considered the flagship Information Systems Security Certification Consortium, Inc. (ISC) 2 certification and the gold standard for information security professionals? Certified Authorization Professional (CAP) Certified Cloud Security Professional (CCSP) Certified Information Systems Security Professional (CISSP) Systems Security Certified Practitioner (SSCP)

Certified Information Systems Security Professional (CISSP)

Colin is a software developer. He would like to earn a credential that demonstrates to employers that he is well educated on software security issues. What certification would be most suitable for this purpose? Certified Information Systems Security Professional (CISSP) Certified Secure Software Lifecycle Professional (CSSLP) Certified Cyber Forensics Professional (CCFP) HealthCare Certified Information Security Privacy Practitioner (HCISPP)

Certified Secure Software Lifecycle Professional (CSSLP)

Which of the following circumstances would NOT trigger mandatory security training for a federal agency under Office of Personnel Management (OPM) guidelines? Change of senior leadership Change in security environment Change in security procedures Change in employee responsibilities

Change of senior leadership

Federal agencies are required to name a senior official in charge of information security. What title is normally given to these individuals? Chief information officer (CIO) Chief technology officer (CTO) Chief information security officer (CISO) Chief financial officer (CFO)

Chief information security officer (CISO)

Betty visits a local library with her young children. She notices that someone using a computer terminal in the library is visiting pornographic websites. What law requires that the library filter offensive web content for minors? Children's Online Privacy Protection Act (COPPA) Sarbanes-Oxley Act (SOX) Family Educational Rights and Privacy Act (FERPA) Children's Internet Protection Act (CIPA)

Children's Internet Protection Act (CIPA)

Which of the following Cisco certifications demonstrates the most advanced level of security knowledge? Cisco Certified Technician (CCT) Security Cisco Certified Network Associate (CCNA) Security Cisco Certified Network Professional (CCNP) Security Cisco Certified Internetwork Expert (CCIE) Security

Cisco Certified Internetwork Expert (CCIE) Security

Alison discovers that a system under her control has been infected with malware, which is using a key logger to report user keystrokes to a third party. What information security property is this malware attacking? Integrity Availability Accounting Confidentiality

Confidentiality

Alan withdraws cash from an ATM belonging to Bank X that is coming from his account with Bank Y. What is Alan's relationship with Bank X? Owner Covered entity Business associate Consumer

Consumer

Maya is creating a computing infrastructure compliant with the Payment Card Industry Data Security Standard (PCI DSS). What type of information is she most likely trying to protect? Health records Credit card information Educational records Trade secrets

Credit card information

Larry recently viewed an auction listing on a website. As a result, his computer executed code that popped up a window that asked for his password. What type of attack has Larry likely encountered? SQL injection Command injection XML injection Cross-site scripting (XSS)

Cross-site scripting (XSS)

What program, released in 2013, is an example of ransomware? BitLocker Crypt0L0cker FileVault CryptoVault

Crypt0L0cker

Which element is NOT a core component of the ISO 27002 standard? Risk assessment Cryptography Asset management Access control

Cryptography

Alan withdraws cash from an ATM belonging to Bank X that is coming from his account with Bank Y. What is Alan's relationship with Bank Y? Customer Covered entity Business associate Consumer

Customer

What is NOT one of the four main purposes of an attack? Denial of availability Data import Data modification Launch point

Data import

Betty receives a cipher text message from her colleague Tim. What type of function does Betty need to use to read the plaintext message? Answers: Encryption Hashing Decryption Validation

Decryption

What is the highest level of academic degree that may be earned in the field of information security? Bachelor of science (BS) Master of business administration (MBA) Doctor of philosophy (PhD) Master of science (MS)

Doctor of philosophy (PhD)

What type of security communication effort focuses on a common body of knowledge? Emails Acceptable use policy (AUP) Education Professional development

Education

What type of security communication effort focuses on a common body of knowledge? Emails Acceptable use policy (AUP) Education Professional development

Education

Tonya is working with a team of subject matter experts to diagnose a problem with her system. The experts determine that the problem likely resides at the Presentation Layer of the Open Systems Interconnection (OSI) model. Which technology is the most likely suspect? User interface Encryption Routing Signaling

Encryption

Which technology category would NOT likely be the subject of a standard published by the International Electrotechnical Commission (IEC)? Semiconductors Solar energy Encryption Consumer appliances

Encryption

Which organization creates information security standards that specifically apply within the European Union? International Telecommunication Union (ITU) American National Standards Institute (ANSI) European Telecommunications Standards Institute (ETSI) Cyber Security Technical Committee (TC CYBER) Institute of Electrical and Electronics Engineers (IEEE)

European Telecommunications Standards Institute (ETSI) Cyber Security Technical Committee (TC CYBER)

What mathematical problem forms the basis of most modern cryptographic algorithms? answers: Factoring large primes Traveling salesman problem Quantum mechanics Birthday problem

Factoring large primes

A professional certification is typically offered as part of an evening curriculum that leads to a certificate of completion. True False

False

A professional certification is typically offered as part of an evening curriculum thatleads to a certificate of completion. True False

False

A worm is a self-contained program that has to trick users into running it. True False

False

Advantages of self-study programs include self-motivation, low-cost, and interaction with other students or an instructor. True False

False

All request for comments (RFC) originate from the Internet Engineering Task Force (IETF). True False

False

Cisco offers certifications only at the Associate, Professional, and Expert levels. True False

False

In general, security training programs are identical to security education programs with respect to their focus on skills and in their duration. True False

False

Information Systems Security Certification Consortium, Inc. (ISC)2 is the baseline for federal and DoD work-role definitions. True False

False

Most prospective employers value unaccredited programs as much as accredited programs. True False

False

Privacy is the process used to keep data private. True Fals

False

Privacy is the process used to keep data private. True False

False

Retro viruses counter the ability of antivirus programs to detect changes in infected files. True False

False

Sarbanes-Oxley Act (SOX) Section 404 compliance requirements are highly specific. True False

False

Special Publications (SPs) are standards created by the National Institute of Standards and Technology (NIST). True False

False

Spyware does NOT use cookies. True False

False

System infectors are viruses that attack document files containing embedded macro programming capabilities. True False

False

The CISSP-ISSEP concentration requires that a candidate demonstrate two years of professional experience in the area of architecture. True False

False

The Centers for Medicare & Medicaid Services (CMS) investigates and responds to complaints from people who claim that a covered entity has violated the Health Insurance Portability and Accountability Act (HIPAA). True False

False

The Certified Secure Software Lifecycle Professional (CSSLP) credential measures the knowledge and skills necessary for professionals involved in the process of authorizing and maintaining information systems. True False

False

The Family Educational Rights and Privacy Act (FERPA) requires that specific information security controls be implemented to protect student records. True False

False

The Gramm-Leach-Bliley Act (GLBA) applies to the financial activities of both consumers and privately held companies. True False

False

The ISACA Certified in Risk and Information Systems Control (CRISC) certification targets security professionals who ensure that their organization satisfies IT governance requirements. True False

False

The International Standard Book Number (ISBN) is an IEEE standard. True False

False

The National Institute of Standards and Technology (NIST) is a nongovernmental organization whose goal is to develop and publish international standards. True False

False

The National Institute of Standards and Technology (NIST) is the main United Nations agency responsible for managing and promoting information and technology issues. True False

False

The National Institute of Standards and Technology (NIST) publishes the IEEE 802 LAN/MAN standard family. True False

False

The Payment Card Industry (PCI) Council has only one priority: to assist merchants and financial institutions in understanding and implementing standards for security policies, technologies, and ongoing processes that protect their payment systems from breaches and theft of cardholder data. True False

False

The four main areas in NIST SP 800-50 are awareness, training, certification, and professional development. True False

False

The four primary types of malicious code attacks are unplanned attacks, planned attacks, direct attacks, and indirect attacks. True False

False

The main goal of the Gramm-Leach-Bliley Act (GLBA) is to protect investors from financial fraud. True False

False

The skills necessary to manage a technical environment are the same as the skills necessary to perform technical work. True False

False

The standard bachelor's designation is a two-year degree program. True False

False

The standard bachelor's designation is a two-year degree program. True False

False

Trojans are self-contained programs designed to propagate from one host machine to another using the host's own network communications protocols. True False

False

Under the Gramm-Leach-Bliley Act (GLBA), a customer is any person who gets a consumer financial product or service from a financial institution. True False

False

Under the Health Insurance Portability and Accountability Act (HIPAA), a security incident is any impermissible use or disclosure of unsecured PHI that harms its security or privacy. True False

False

What entity is responsible for overseeing compliance with Family Educational Rights and Privacy Act (FERPA)? Family Policy Compliance Office (FPCO) Department of Defense (DOD) Federal Communications Commission (FCC) Federal Trade Commission (FTC)

Family Policy Compliance Office (FPCO)

What is NOT a common motivation for attackers? Answers: Money Fame Revenge Fear

Fear

Which of the following agencies is NOT involved in the Gramm-Leach-Bliley Act (GLBA) oversight process? Securities and Exchange Commission (SEC) Federal Trade Commission (FTC) Federal Deposit Insurance Corporation (FDIC) Federal Communications Commission (FCC)

Federal Communications Commission (FCC)

Donna is building a security awareness program designed to meet the requirements of the Payment Card Industry Data Security Standard (PCI DSS) 3.2. How often must she conduct training for all current employees? Monthly Semi-annually Annually Biannually

Annually

Erin is a system administrator for a federal government agency. What law contains guidance on how she may operate a federal information system? Family Educational Rights and Privacy Act (FERPA) Federal Information Security Management Act (FISMA) Gramm-Leach-Bliley Act (GLBA) Sarbanes-Oxley (SOX) Act

Federal Information Security Management Act (FISMA)

David would like to connect a fibre channel storage device to systems over a standard data network. What protocol can he use? Answers: Internet Small Computer System Interface (iSCSI) Fibre Channel (FC) Fibre Channel over Ethernet (FCoE) Secure Shell (SSH)

Fibre Channel over Ethernet (FCoE)

Norm recently joined a new organization. He noticed that the firewall technology used by his new firm opens separate connections between the devices on both sides of the firewall. What type of technology is being used? Answers: Packet filtering Application proxying Stateful inspection Network address translation

Application proxying

Which of the following is NOT an advantage to undertaking self-study of information security topics? Self-motivation Flexible materials Fixed pace Low cost

Fixed pace

What type of firewall security feature limits the volume of traffic from individual hosts? Answers: Loop protection Network separation Stateful inspection Flood guard

Flood guard

Jonas is an experienced information security professional with a specialized focus on evaluating computers for evidence of criminal or malicious activity and recovering data. Which GIAC certification would be most appropriate for Jonas to demonstrate his abilities? GIAC Systems and Network Auditor (GSNA) GIAC Certified Forensic Examiner (GCFE) GIAC Certified Firewall Analyst (GCFW) GIAC Certified Penetration Tester (GPEN)

GIAC Certified Forensic Examiner (GCFE)

Vincent recently went to work for a hospital system. He is reading about various regulations that apply to his new industry. What law applies specifically to health records? Health Insurance Portability and Accountability Act (HIPAA) Sarbanes-Oxley (SOX) Act Payment Card Industry Data Security Standard (PCI DSS) Gramm-Leach-Bliley Act (GLBA)

Health Insurance Portability and Accountability Act (HIPAA)

What type of system is intentionally exposed to attackers in an attempt to lure them out? Honeypot Bastion host Web server Database server

Honeypot

Gary is troubleshooting a security issue on an Ethernet network and would like to look at the Ethernet standard. What publication should he seek out? NIST 800-53 IEEE 802.3 ANSI x.1199 ISO 17799

IEEE 802.3

What organization offers a variety of security certifications that are focused on the requirements of auditors? International Information Systems Security Certification Consortium, Inc. (ISC)2 CompTIA Global Information Assurance Certification (GIAC) ISACA

ISACA

Juan comes across documentation from his organization related to several information security initiatives using different standards as their reference. Which International Organization for Standardization (ISO) standard provides current guidance on information security management? ISO 17799 ISO 9000 ISO 27002 ISO 14001

ISO 27002

Gary is sending a message to Patricia. He wants to ensure that nobody tampers with the message while it is in transit. What goal of cryptography is Gary attempting to achieve? answers: Confidentiality Integrity Authentication Nonrepudiation

Integrity

Tim is implementing a set of controls designed to ensure that financial reports, records, and data are accurately maintained. What information security goal is Tim attempting to achieve? Integrity Accountability Availability Confidentiality

Integrity

Fran is interested in learning more about the popular Certified Ethical Hacker (CEH) credential. What organization should she contact? High Tech Crime Network International Council of E-Commerce Consultants (EC-Council) Software Engineering Institute - Carnegie Mellon University The International Society of Forensic Computer Examiners

International Council of E-Commerce Consultants (EC-Council)

Which cryptographic attack offers cryptanalysts the most information about how an encryption algorithm works? Answers: Chosen plaintext Ciphertext only Known plaintext Chosen ciphertext

Chosen plaintext

DoD Directive 8570.01 is a voluntary certification requirement. True False

False

What certification organization began as an offshoot of the SANS Institute training programs? International Information Systems Security Certification Consortium, Inc. (ISC)2 CompTIA Certified Internet Webmaster (CIW) Global Information Assurance Certification (GIAC)

Global Information Assurance Certification (GIAC)

Terry is troubleshooting a network that is experiencing high traffic congestion issues. Which device, if present on the network, should be replaced to alleviate these issues? Answers: Firewall Hub Switch Router

Hub

What federal government agency is charged with the responsibility of creating information security standards and guidelines for use within the federal government and more broadly across industries? National Security Administration (NSA) National Institute of Standards and Technology (NIST) Department of Defense (DoD) Federal Communications Commission (FCC)

National Institute of Standards and Technology (NIST)

Adam discovers a virus on his system that is using encryption to modify itself. The virus escapes detection by signature-based antivirus software. What type of virus has he discovered? Answers: Polymorphic virus Stealth virus Cross-platform virus Multipartite virus

Polymorphic virus

Hilda is troubleshooting a problem with the encryption of data. At which layer of the OSI Reference Model is she working? Answers: Application Presentation Session Data Link

Presentation

Which of the following programs requires passing a standardized examination that is based upon a job-task analysis? Certificate of completion Professional certification Bachelor's degree Doctoral degree

Professional certification

Bob is developing a web application that depends upon a database backend. What type of attack could a malicious individual use to send commands through his web application to the database? Cross-site scripting (XSS) XML injection SQL injection LDAP injection

SQL injection

What firewall approach is shown in the figure? Answers: Border firewall Bastion host Screened subnet Multilayered firewall

Screened subnet

A GIAC credential holder may submit a technical paper that covers an important area of information security. If the paper is accepted, it adds the Gold credential to the base GIAC credential. True False

True

A successful denial of service (DoS) attack may create so much network congestion that authorized users cannot access network resources. True False

True

Distance learning is another term for online study. True False

True

You must always use the same algorithm to encrypt information and decrypt the same information. Answers: true or false

false

A keyword mixed alphabet cipher uses a cipher alphabet that consists of a keyword, minus duplicates, followed by the remaining letters of the alphabet true or false

true

Digital signatures require asymmetric key cryptography. true or false

true

What file type is least likely to be impacted by a file infector virus? .exe .docx .com .dll

.docx

Bill is conducting an analysis of a new IT service. He would like to assess it using the Open Systems Interconnection (OSI) model and would like to learn more about this framework. What organization should he turn to for the official definition of OSI? Ocean Surveillance Information System (OSIS) International Organization for Standardization (ISO) National Institute of Standards and Technology (NIST) Information Systems Audit and Control Association (ISACA)

International Organization for Standardization (ISO)

Which organization promotes technology issues as an agency of the United Nations? International Telecommunication Union (ITU) Institute of Electrical and Electronics Engineers (IEEE) American National Standards Institute (ANSI) Internet Assigned Numbers Authority (IANA)

International Telecommunication Union (ITU)

Yolanda would like to prevent attackers from using her network as a relay point for a smurf attack. What protocol should she block? Hypertext Transfer Protocol (HTTP) Transmission Control Protocol (TCP) Internet Control Message Protocol (ICMP) User Datagram Protocol (UDP)

Internet Control Message Protocol (ICMP)

Which of the following graduate degree programs focuses on managing the process of securing information systems, rather than the technical aspects of information security? MBA MS MSc MScIT

MBA

Alison retrieved data from a company database containing personal information on customers. When she looks at the SSN field, she sees values that look like this: "XXX-XX-9142." What has happened to these records? Encryption Truncation Hashing Masking

Masking

Helen is an experienced information security professional who earned a four-year degree while a full-time student. She would like to continue her studies on a part-time basis. What is the next logical degree for Helen to earn? Bachelor's degree Master's degree Doctoral degree Associate's degree

Master's degree

What federal agency is charged with the mission of promoting "U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life?" National Institute of Standards and Technology (NIST) Federal Communications Commission (FCC) Federal Trade Commission (FTC) National Aeronautics and Space Administration (NASA)

National Institute of Standards and Technology (NIST)

What government agency sponsors the National Centers of Academic Excellence (CAE) for the Cyber Operations Program? National Security Agency (NSA) Central Intelligence Agency (CIA) Federal Bureau of Investigation (FBI) National Institute of Standards and Technology (NIST)

National Security Agency (NSA)

Which term accurately describes Layer 3 of the Open Systems Interconnection (OSI) model? Network Application Physical Session

Network

Brian would like to conduct a port scan against his systems to determine how they look from an attacker's viewpoint. What tool can he use for this purpose? Ping Simple Network Management Protocol (SNMP) agent Nmap Remote Access Tool (RAT)

Nmap

When Patricia receives a message from Gary, she wants to be able to demonstrate to Sue that the message actually came from Gary. What goal of cryptography is Patricia attempting to achieve? Answers: Confidentiality Integrity Authentication Nonrepudiation

Nonrepudiation

Which of the following allows a certificate authority (CA) to revoke a compromised digital certificate in real time? Answers: Certificate revocation list (CRL)International Data Encryption Algorithm (IDEA) Transport Layer Security (TLS) Online Certificate Status Protocol (OCSP)

Online Certificate Status Protocol (OCSP)

Brian is the information security training officer for a health care provider. He wants to develop a training program that complies with the provisions of Health Insurance Portability and Accountability Act (HIPAA). Which of the following topics must be included? Password management Medical records formats Prescribing procedures Patient safety

Password management

A security awareness program that focuses on an organization's Bring Your Own Device (BYOD) policy is designed to cover the use of what type of equipment? Servers Workstations Printers Personally owned device

Personally owned devices

Which document is the initial stage of a standard under the Internet Engineering Task Force (IETF) process? Proposed Standard (PS) Draft Standard (DS) Standard (STD) Best Current Practice (BCP)

Proposed Standard (PS)

What type of organizations are required to comply with the Sarbanes-Oxley (SOX) Act? Non-profit organizations Publicly traded companies Government agencies Privately held companies

Publicly traded companies

Which approach to cryptography provides the strongest theoretical protection? Answers: Quantum cryptography Asymmetric cryptography Elliptic curve cryptography Classic cryptography

Quantum cryptography

What type of malicious software allows an attacker to remotely control a compromised computer? Worm Polymorphic virus Remote Access Tool (RAT) Armored virus

Remote Access Tool (RAT)

What type of publication is the primary working product of the Internet Engineering Task Force (IETF)? Special Publication (SP) Request for comment (RFC) ISO standard Public service announcement (PSA)

Request for comment (RFC)

Under the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, what type of safeguards must be implemented by all covered entities, regardless of the circumstances? Addressable Standard Security Required

Required

What type of security role is covered by the Committee on National Security Systems (CNSS) Training Standard CNSS-4016? Senior System Managers System Administrators Information Assurance Officers Risk Analysts

Risk Analysts

What is NOT a symmetric encryption algorithm? Rivest-Shamir-Adelman (RSA) Data Encryption Standard (DES) International Data Encryption Algorithm (IDEA) Carlisle Adams Stafford Tavares (CAST)

Rivest-Shamir-Adelman (RSA)

Taylor is preparing to submit her company's Payment Card Industry Data Security Standard (PCI DSS)self-assessment questionnaire. The company uses a payment application that is connected to the Internet but does not conduct e-commerce. What self-assessment questionnaire (SAQ) should she use? SAQ A SAQ B SAQ C SAQ D

SAQ C

Helen has no experience in security. She would like to earn a certification that demonstrates that she has the basic knowledge necessary to work in the information security field. What certification would be an appropriate first step for her? Certified Information Systems Security Professional (CISSP) GIAC Security Expert (GSE) Security+ CompTIA Advanced Security Practitioner (CASP)

Security+

What type of security role is covered by the Committee on National Security Systems (CNSS) Training Standard CNSS-4012? Senior System Managers System Administrators Information Assurance Officers Risk Analysts

Senior System Manager

Gwen is investigating an attack. An intruder managed to take over the identity of a user who was legitimately logged into Gwen's company's website by manipulating Hypertext Transfer Protocol (HTTP) headers. Which type of attack likely took place? Session hijacking XML injection Cross-site scripting SQL injection

Session hijacking

Barbara is investigating an attack against her network. She notices that the Internet Control Message Protocol (ICMP) echo replies coming into her network far exceed the ICMP echo requests leaving her network. What type of attack is likely taking place? Answers: Teardrop Land Smurf Cross-site scripting (XSS)

Smurf

The CEO of Kelly's company recently fell victim to an attack. The attackers sent the CEO an email informing him that his company was being sued and he needed to view a subpoena at a court website. When visiting the website, malicious code was downloaded onto the CEO's computer. What type of attack took place? Spear phishing Pharming Adware Command injection

Spear phishing

What is NOT an area where the Internet Architecture Board (IAB) provides oversight on behalf of the Internet Engineering Task Force (IETF)? Architecture for Internet protocols and procedures Editorial and publication procedures for requests for comments (RFCs) Confirmation of IETF chairs Subject matter expertise on routing and switching

Subject matter expertise on routing and switching

What type of network device normally connects directly to endpoints and uses MAC-based filtering to limit traffic flows? Answers: Router Hub Access point Switch

Switch

Which set of characteristics describes the Caesar cipher accurately? answers: Asymmetric, block, substitution Asymmetric, stream, transposition Symmetric, stream, substitution Symmetric, block, transposition

Symmetric, stream, substitution

Which type of virus targets computer hardware and software startup functions? Hardware infector System infector File infector Data infector

System infector

Ben is working toward a position as a senior security administrator and would like to earn his first International Information Systems Security Certification Consortium, Inc. (ISC) 2 certification. Which certification is most appropriate for his needs? Systems Security Certified Practitioner (SSCP) Certified Information Systems Security Professional (CISSP) Certified Secure Software Lifecycle Professional (CSSLP) Certified Cloud Security Professional (CCSP)

Systems Security Certified Practitioner (SSCP)

Bobbi recently discovered that an email program used within her healthcare practice was sending sensitive medical information to patients without using encryption. She immediately corrected the problem because it violated the company's security policy and standard rules. What level of the Health Insurance Portability and Accountability Act (HIPAA) violation likely took place? Tier A Tier B Tier C Tier D

Tier A

Which of the following items would generally NOT be considered personally identifiable information (PII)? Name Driver's license number Trade secret Social Security number

Trade secret

Breanne's system was infected by malicious code after she installed an innocent-looking solitaire game that she downloaded from the Internet. What type of malware did she likely encounter? Virus Worm Trojan horse Logic bomb

Trojan horse

A certificate of completion is a document that is given to a student upon completion of a continuing education program and is signed by the instructor. True False

True

A certification is an official statement that validates that a person has satisfied specific job requirements. True False

True

A common method for identifying what skills a security professional possesses is his or her level of certification. True False

True

A computer virus is an executable program that attaches to, or infects, other executable programs. True False

True

ANSI produces standards that affect nearly all aspects of IT. True False

True

American National Standards Institute (ANSI) was formed in 1918 through the merger of five engineering societies and three government agencies. True False

True

An electronic mail bomb is a form of malicious macro attack that typically involves an email attachment that contains macros designed to inflict maximum damage. True False

True

Attacks against confidentiality and privacy, data integrity, and availability of services are all ways malicious code can threaten businesses. True False

True

Backdoor programs are typically more dangerous than computer viruses. True False

True

Because people inside an organization generally have more detailed knowledge of the IT infrastructure than outsiders do, they can place logic bombs more easily. True False

True

CompTIA Security+ is an entry-level security certification. True False

True

Compliance not only includes the actual state of being compliant, but it also includes the steps and processes taken to become compliant. True False

True

Defense Information Systems Agency (DISA) is the agency arm of the U.S. Department of Defense that provides information technology and communications support to the White House, Secretary of Defense, and all military sectors that contribute to the defense of the United States of America. True False

True

Defense in depth is the practice of layering defenses to increase overall security and provide more reaction time to respond to incidents. True False

True

DoD and NSA have adopted several training standards to serve as a pathway to satisfy Directive 8140. Although they are called standards, they are really training requirements for specific job responsibilities. True False

True

ISO/IEC 27002 provides organizations with best-practice recommendations on information security management. True False

True

Information systems security is about ensuring the confidentiality, integrity, and availability of IT infrastructures and the systems they comprise. True False

True

It is common for rootkits to modify parts of the operating system to conceal traces of their presence. True False

True

Juniper Networks offers vendor-specific certifications. True False

True

Many security training courses specifically prepare students for certification exams. True False

True

Master of science (MS) degree programs prepare a student to enter the field of information security and perform the work of securing systems. True False

True

Master's programs are generally broad and don't focus on a particular field of study. True False

True

Most professional certifications require certification holders to pursue additional education each year to keep their certifications current. True False

True

Nearly any college or university can offer an information systems security or cybersecurity-related degree program once it obtains accreditation for the curriculum from that state's board of education. True False

True

One requirement of the GIAC Security Expert (GSE) credential is that candidates must hold three GIAC credentials, with two of the credentials being Gold. True False

True

Payment Card Industry Data Security Standard (PCI DSS) version 3.2 defines 12 requirements for compliance, organized into six groups, called control objectives. True False

True

RSA is a global provider of security, risk, and compliance solutions for enterprise environments. True False

True

Sarbanes-Oxley Act (SOX) Section 404 requires an organization's executive officers to establish, maintain, review, and report on the effectiveness of the company's internal controls over financial reporting (ICFR). True False

True

Security awareness training should remind employees to ensure confidentiality by not leaving any sensitive information or documents on their desks. True False

True

Standards provide guidelines to ensure that products in today's computing environments work together. True False

True

The (ISC) 2 Systems Security Certified Practitioner (SSCP) credential covers the seven domains of best practices for information security. True False

True

The Certified Cloud Security Professional (CCSP) certification was created by both (ISC) 2 and the Cloud Security Alliance (CSA). True False

True

The Federal Information Security Management Act (FISMA) of 2014 defines the roles, responsibilities, accountabilities, requirements, and practices that are needed to fully implement FISMA security controls and requirements. True False

True

The HealthCare Certified Information Security and Privacy Practitioner (HCISPP) credential recognizes the knowledge and skills necessary to perform and conduct security and privacy work for health care organizations. True False

True

The Institute of Electrical and Electronics Engineers (IEEE) publishes or sponsors more than 13,000 standards and projects. True False

True

Henry is creating a firewall rule that will allow inbound mail to the organization. What TCP port must he allow through the firewall? 22 25 53 80

25

What is the maximum value for any octet in an IPv4 IP address? 65 129 255 513

255

What ISO security standard can help guide the creation of an organization's security policy? 12333 17259 27002 42053

27002

Henry's last firewall rule must allow inbound access to a Windows Terminal Server. What port must he allow? Answers: 143 443 989 3389

3389

Henry would like to create a different firewall rule that allows encrypted web traffic to reach a web server. What port is used for that communication? Answers: 80 143 443 3389

443

Continuing professional education (CPE) credits typically represent ________ minutes of classroom time per CPE unit. 30 50 60 120

50

How many domains of knowledge are covered by the Certified Information Systems Security Professional (CISSP) exam? 7 8 9 10

8

What series of Special Publications does the National Institute of Standards and Technology (NIST) produce that covers information systems security activities? 600 700 800 900

800

Which Institute of Electrical and Electronics Engineers (IEEE) standard covers wireless LANs? 802.3 802.11 802.16 802.18

802.11

What DoD directive requires that information security professionals in the government earn professional certifications? 8088 8140 8270 8540

8140

The International Electrotechnical Commission (IEC) is the predominant organization for developing and publishing international standards for technologies related to electrical and electronic devices and processes. True False

True

The International Electrotechnical Commission (IEC) was instrumental in the development of standards for electrical measurements, including gauss, hertz, and weber. True False

True

The International Organization for Standardization (ISO) organizes its standards by both the International Classification for Standards (ICS) and the Technical Committee (TC) to which it assigns each standard. True False

True

The International Telecommunication Union (ITU) was formed in 1865 as the International Telegraph Union to develop international standards for the emerging telegraph communications industry. True False

True

The Internet Architecture Board (IAB) is a subcommittee of the IETF. True False

True

The Internet Architecture Board (IAB) serves as an advisory body to the Internet Society (ISOC). True False

True

The National Institute of Standards and Technology (NIST) 800 Series publications cover all NIST-recommended procedures for managing information security. True False

True

The Office of Personnel Management (OPM) requires that federal agencies provide the training suggested by the National Institute of Standards and Technology (NIST) guidelines. True False

True

The function of homepage hijacking is to change a browser's homepage to point to the attacker's site. True False

True

The main purpose of security training courses is to rapidly train students in one or more skills, or to cover essential knowledge in one or more specific areas. True False

True

The purpose of continuing education is to provide formal training courses that lead to a certificate or professional certification and NOT a degree. True False

True

The term "web defacement" refers to someone gaining unauthorized access to a web server and altering the index page of a site on the server. True False

True

Unlike viruses, worms do NOT require a host program in order to survive and replicate. True False

True

Visa, MasterCard, and other payment card vendors helped to create the Payment Card Industry Data Security Standard (PCI DSS). True False

True

How many years of specialized experience are required to earn one of the Certified Information Systems Security Professional (CISSP) concentrations? Two Three Four Five

Two

What is NOT an effective key distribution method for plaintext encryption keys? Answers: Paper Unencrypted email CD Smart card

Unencrypted email

What is NOT a typical sign of virus activity on a system? Unexplained decrease in available disk space Unexpected error messages Unexpected power failures Sudden sluggishness of applications

Unexpected power failures

Bob has a high-volume virtual private network (VPN). He would like to use a device that would best handle the required processing power. What type of device should he use? Answers: Firewall Unified threat management (UTM) Router VPN concentrator

VPN concentrator

Val would like to isolate several systems belonging to the product development group from other systems on the network, without adding new hardware. What technology can she use? Answers: Firewall Virtual LAN (VLAN) Virtual private network (VPN) Transport Layer Security (TLS)

Virtual LAN (VLAN)

Val would like to limit the websites that her users visit to those on an approved list of pre-cleared sites. What type of approach is Val advocating? Blacklisting Context-based screening Packet filtering Whitelisting

Whitelisting

What tool might be used by an attacker during the reconnaissance phase of an attack to glean information about domain registrations? Whois Simple Network Management Protocol (SNMP) Ping Domain Name System (DN

Whois

What type of network connects systems over the largest geographic area? Answers: Wide area network (WAN) Metropolitan area network (MAN) Local area network (LAN) Storage area network (SAN)

Wide area network (WAN)

What standard is NOT secure and should never be used on modern wireless networks? Answers: Wired Equivalent Privacy (WEP) Wi-Fi Protected Access (WPA) Wi-Fi Protected Access version 2 (WPA2) 802.11ac

Wired Equivalent Privacy (WEP)

What is NOT a service commonly offered by unified threat management (UTM) devices? Answers: URL filtering Wireless network access Malware inspection Content inspection

Wireless network access

Allie is working on the development of a web browser and wants to make sure that the browser correctly implements the Hypertext Markup Language (HTML) standard. What organization's documentation should she turn to for the authoritative source of information? International Electrotechnical Commission (IEC) National Institute of Standards and Technology (NIST) World Wide Web Consortium (W3C) Internet Engineering Task Force (IETF)

World Wide Web Consortium (W3C)

A border router can provide enhanced features to internal networks and help keep subnet traffic separate. Answers: true or false

false

A digitized signature is a combination of a strong hash of a message and a secret key. Answers: true or false

false

A packet-filtering firewall remembers information about the status of a network communication. Answers: true or false

false

A private key cipher is also called an asymmetric key cipher. true or false

false

A subnet mask is a partition of a network based on IP addresses. Answers: true or false

false

Another name for a border firewall is a DMZ firewall. Answers: true or false

false

Cryptographic key distribution is typically done by phone. Answers: true or false

false

IP addresses are eight-byte addresses that uniquely identify every device on the network. Answers: true or false

false

Implicit deny is when firewalls look at message addresses to determine whether a message is being sent around an unending loop. Answers: true or false

false

Internet Control Message Protocol (ICMP) is a method of IP address assignment that uses an alternate, public IP address to hide a system's real IP address. Answers: true or false

false

Product cipher is an encryption algorithm that has no corresponding decryption algorithm. Answers: true or false

false

The Transport Layer of the OSI Reference Model creates, maintains, and disconnects communications that take place between processes over the network. Answers: true or false

false

The term certificate authority (CA) refers to a trusted repository of all public keys. Answers: true or false

false

A firewall is a basic network security defense tool. Answers: true or false

true

A network attacker wants to know IP addresses used on a network, remote access procedures, and weaknesses in network systems. Answers: true or false

true

A network protocol governs how networking equipment interacts to deliver data across the network. Answers: true or false

true

A person demonstrates anonymity when posting information to a web discussion site without authorities knowing who he or she is. Answers: true or false

true

A salt value is a set of random characters you can combine with an actual input key to create the encryption key. Answers: true or false

true

A wireless access point (WAP) is the connection between a wired and wireless network. Answers: true or false

true

Digital signatures require asymmetric key cryptography. Answers: true or false

true

In a chosen-ciphertext attack, cryptanalysts submit data coded with the same cipher and key they are trying to break to the decryption device to see either the plaintext output or the effect the decrypted message has on some system. true or false?

true

Internet Small Computer System Interface (iSCSI) is a storage networking standard used to link data storage devices to networks using IP for its transport layer. Answers: true or false

true

Message authentication confirms the identity of the person who started a correspondence. Answers: true or false

true

Network access control (NAC) works on wired and wireless networks Answers: true or false

true

Network access control (NAC) works on wired and wireless networks. Answers: true or false

true

TCP/IP is a suite of protocols that operates at both the Network and Transport layers of the OSI Reference Model. Answers: true or false

true

The Data Link Layer of the OSI Reference Model is responsible for transmitting information on computers connected to the same local area network (LAN) Answers: true or false

true

The Data Link Layer of the OSI Reference Model is responsible for transmitting information on computers connected to the same local area network (LAN). Answers: true or false

true

The Diffie-Hellman (DHE) algorithm is the basis for several common key exchange protocols, including Diffie-Hellman in Ephemeral mode (DHE) and Elliptic Curve DHE (ECDHE). Answers: true or false

true

The OSI Reference Model is a theoretical model of networking with interchangeable layers. Answers: true or false

true

The Physical Layer of the OSI Reference Model must translate the binary ones and zeros of computer language into the language of the transport medium. Answers: true or false

true

The financial industry created the ANSI X9.17 standard to define key management procedures. true or false

true

The hash message authentication code (HMAC) is a hash function that uses a key to create a hash, or message digest. true or false

true

The term "router" describes a device that connects two or more networks and selectively interchanges packets of data between them. Answers: true or false

true

The three main categories of network security risk are reconnaissance, eavesdropping, and denial of service. Answers: true or false

true

________ refers to a program of study approved by the State Department of Education in the state that a school operates. Continuing education Accredited Continuing professional education (CPE) Certificate of completion

Accredited

Bob received a message from Alice that contains a digital signature. What cryptographic key does Bob use to verify the digital signature? Answers: Alice's public key Alice's private key Bob's public key Bob's private key

Alice's public key

Which organization created a standard version of the widely used C programming language in 1989? Institute of Electrical and Electronics Engineers (IEEE) International Organization for Standardization (ISO) American National Standards Institute (ANSI) European Telecommunications Standards Institute (ETSI)

American National Standards Institute (ANSI)


Ensembles d'études connexes

What makes a good friend- French module 1

View Set

Great Gatsby Quotes and Questions

View Set

Basic Electrical Theory: Unit 15 - Protection Devices

View Set