ITC560 Exam 3

Devaki is a network engineer. She is diagnosing an issue with a small business customers wireless local area network. She knows the Institute of electrical and electronics engineers (IEEE) has created the standards involved in various networks technology while WLAN standards, cover a wide array of subsets, which general standard does she need to consult that addresses all WLANS?

802.11

Devaki is network engineer. She is diagnosing an issue with a small business customers wireless local area network. She knows the institute of electrical and electronics engineers has created the standards involved in various network technologies. While WLAN standards over a wide array of subnets, which general standard does she need to consult that address all WLANs.

802.11

Hajar is responsible for keeping her banking institutions servers operating 24 seven her recovery strategy is to have fully redundant or duplicate operations and synchronize data and to operate the site continuously which strategy has she selected?

Alternate Processing Site, Mirrored Site

Under the Federal Information Security Management Act (FISMA) of 2002, which of the following broadens the scope of FISMA beyond a federal agency and is important because IT systems and functions are often outsourced?

An agency must protect the IT systems that support its operations even if another agency or contractor owns the IT systems.

Mary is designing a software component that will function at the presentation layer of the OSI model. What other two layers of the model will her component need to interact with?

Application Layer and Session Layer

Mary is designing a software component that will function at the Presentation Layer of the Open Systems Interconnection (OSI) Reference Model. What other two layers of the model will her component need to interact with?

Application and Session

Jiang is pursuing a career in information security. He wants to eventually achieve the ISC certified information systems, security professional certification, but does not have the required experience. If he passes the CISSP exam now, which credential will Jiang get?

Associate of (ISC)2

Joe is the chief executive officer of the company that handles medical billing for several Regional Hospital systems. How would Joe's company be classified under the health insurance portability and accountability act?

Business associate of a covered entity

Betty visits a local library with her young children. She notices that someone using a computer terminal in the library is visiting, pornographic websites. What law requires that the library filter offensive web content for minors?

CIPA

Betty visits a local library with her young children. She notices that someone using a computer terminal is visiting pornographic websites. What law requires that the library filter offensive web content for minors?

CIPA

Hajar has been an (ISC)? Certified Information Systems Security Professional (CISSP) for 10 years. She would like to earn an advanced certification that demonstrates her ability in systems security engineering. Which of the following CISS concentrations would meet Hajar's needs?

CISSP-ISSEP

Arturo is leading a project to commission a new information system that will be used by a U.S. federal government agency. The agency uses the risk management framework (RMF) approach for Federal Information Security Management Act (FISMA) compliance. He is working with his team to assess and document agency IT systems based on risk. What step of the risk management framework is Arturo completing?

Categorize Information Systems

Maria is an IT security professional for a large healthcare corporation. She has been working with the compliance team on a few projects and is expanding her skills to include risk management, as well as control and assurance activities. What ISACA certification would be the best fit?

Certified Information Security Manager

Richard would like to earn a certification that demonstrates his ability to manage enterprise security programs. What certification would be most appropriate for Richard?

Certified Information Security Manager

What certification focuses on information systems, audit, Control, and security professionals?

Certified Information Systems Auditor

Collin is a software developer. He would like to earn a credential that demonstrates to employers that he is well educated on software security issues. What certification would be most suitable for this purpose?

Certified Secure Software Lifecycle Professional

Colin is a software developer. He would like to earn a credential that demonstrates to employers that he is well educated on software security issues. what certification would be most suitable for this purpose?

Certified Secure Software Lifecycle Professional (CSSLP)

Maria is an IT security professional for a large healthcare corporation. She has been working with the compliance team on a few projects and is expanding her skills to include risk management as well as control and assurance activities what ISACA certification would be the best fit?

Certified in Risk and Information Systems Control (CRISC)

Which of the following should you avoid during a disaster and recover?

Combine services that were on different hardware platforms onto common servers to speed up recovery

During which step of the incident handling process is the goal to contain the incident?

Containment

Maya is creating a computer infrastructure compliant with the payment card industry, data security standard. What type of information is she most likely trying to protect?

Credit card information

Which of the following provides IT and communications support to the White House, secretary of defense, and all military sectors that contribute to the defense of the United States of America?

DISA

Which type of evidence helps explain other evidence and includes visual aids such as charts and graphs?

Demonstrative

Which type of evidence helps explain other evidence and includes visual aids, such as charts and graphs

Demonstrative evidence

Which type of evidence is stored in a computers, memory, as well as on storage devices, as in files, and must be accompanied by documentation that validates the evidence is authenticity?

Digital evidence

A(n) _______ is an event that prevents a critical business function (CBF) from operating for a period greater than the maximum tolerable downtime (MTD).

Disaster

Which document is the Internet engineering task force request for comments second stage, after participants have demonstrated that the standard has been deployed in working environments?

Draft Standard

which term describes a process that requires an organization to preserve and not alter evidence that may be used in court? This process can help ensure that normal data-handling procedures do not contaminate or even delete data that may be needed for a case.

E-discovery

Tonya is working with a team of subject matter experts to diagnose a problem with her system. The experts determined that the problem likely resides at the transport layer of the OSI model. Which functionality is the most likely suspect?

End-to-end communication maintenance

Which organization creates information security standards that specifically apply within the European Union?

European Telecommunications Standards Institute (ETSI) Cyber Security Technical Committee (TC CYBER)

True or False? A website designer seeking guidance on how to incorporate, Simple Object Access Protocol (SOAP) and Extensible Markup Language (XML) would most likely consult Internet Engineering Task Force (IETF) requests for comments (RFCS).

False

True or False? CompTIA Security+ is an expert-level security certification.

False

True or False? Symantec offers vendor-neutral certifications as well as certifications for its product lines.

False

True or False? The (ISC Certified Secure Software Lifecycle Professional (CSSLP) credential measures the knowledge and skills necessary for professionals involved in the process of authorizing and maintaining information systems.

False

True or False? The Gramm-Leach-Bliley Act (GLBA) applies to the financial activities of both consumers and privately held companies.

False

True or False? The Health Insurance Portability and Accountability Act (HIPAA) replaced the Health Information Technology for Economic and Clinical Health (HITECH) Act.

False

True or False? The ISACA Certified in Risk and Information Systems Control (CRISC) certification targets security professionals who ensure that their organization satisfies IT governance requirements.

False

True or False? The federal agencies that oversee Gramm-Leach-Bliley Act (GLBA) compliance may not act against the financial institutions that they regulate when those institutions violate GLBA.

False

True or false? All types of disaster recovery sites are available in the cloud.

False

True or false? Business continuity management includes business continuity planning, disaster recovery planning, crisis management, incident response management, and risk management.

False

True or false? CompTia security+ is an expert level security certification.

False

True or false? Cyber terrorism is the use of online media and assets to harass individuals.

False

True or false? During a simulation test of a contingency plan, you must shut down the original system at the primary site for the duration.

False

True or false? Security professionals seeking Cisco certification must begin at the entry level and may work their way through the associate, professional, specialist, and expert levels.

False

True or false? Symantec offers vendor neutral certifications as well as certifications for its product lines.

False

True or false? The health insurance portability and accountability act applies only to current mental and physical health information and payments.

False

True or false? The health insurance portability and accountability act(HIPAA) replace the health information technology for economic and clinical Health(HITECH) Act.

False

True or false? The international organization for standardization publishes the IEEE 802 local area network/metropolitan area network standards family.

False

True or false? Under the payment card industry data security standard, the rules with which an organization must comply depend on which types of payment cards they accept.

False

true or false the national Institute of standards and technology is a non-governmental organization, whose goal is to develop and publish international standards.

False

true or false? Testimonial evidence is often the most important evidence in court because it provides relevance for other types of evidence.

False

true or false? the Internet engineering task force (IETF) request for comments. Development process is conducted solely by scientist on the Internet architecture board.

False

true or false? the international electro technical commission (IEC) develop standards, which cover both wired and wireless communication technologies, that are commonly adopted by member countries in the European union

False

True or false? The process of collecting evidence is called evidence preservation.

False, Evidence acquisition

True or false? The macOS operating system uses the EXT3 or EXT4 for file systems

False, uses APFS

Devaki is a new compliance manager. She is reading about various regulations to determine which ones apply to her industry. What law applies specifically to consumer data that originates in Europe?

GDPR

Which certification program enables credential holders to earn a gold credential through the acceptance of a technical paper that covers an important area of information security?

GIAC

Juan is an experienced information security professional. He has spent a lot of time evaluating computers for evidence of criminal or malicious activity as well as recovering data. Which global information assurance certification credential focus area is most likely to have certifications that are a good fit for Juan's skills and knowledge?

GIAC Certified Forensic Examiner

Lin works for a large finance school institution. She has been asked to create a written information, security program, which must state how the institution collects and uses customer data, and must describe the controls, used to protect that data. She is also in charge of running the program, conducting a risk assessment to identify risks to customer information, and assessing current safeguards to make sure they are affective, among other tasks. Which of the following is she trying to comply with?

GLBA Safeguards Rule

Devaki is a new compliance manager. She is reading about various regulations to determine which ones apply to her industry. What law applies specifically to consumer data that originates in Europe?

General Data Protection Regulation (GDRP)

Which of the following is a unit of measure that represents frequency and is expressed as the number of cycles per second?

Hertz

What organization offers a variety of security certifications that are focused on the requirements of auditors?

ISACA

Juan comes across documentation from his organization related to several information security initiatives using different standards as their reference. Which International Organization for Standardization (ISO) standard provides current guidance on information security management?

ISO 27002

During which step of the incident-handling process does triage take place?

Identification

Oscar is a digital forensic specialist. He has been given a suspect hard disc that has been physically damaged. He wants to try to recover the data. What is the first step he should take?

Install it in a test system

Fran is interested in learning more about the popular Certified Ethical Hacker credential. What organization should she contact?

International Council of E-Commerce Consultants (EC-Council)

Maria is working on the definition and application of the terms, gauze, hertz, and Weber. Which standards source should she consult?

International Electrotechnical Commission (IEC)

Bill is conducting an analysis of a new IT service. He would like to assess it using the Open Systems Interconnection (OSI) Reference Model and would like to learn more about this framework. What organization should he turn to for the official definition of OSI?

International Organization for Standardization

bill is conducting an analysis of the new IT service. He would like to assess it using the open systems interconnection reference model and would like to learn more about this framework. What organization should he turn to for the official definition of OSI?

International Organization for Standardization (ISO)

Lin is a digital forensic specialist who works in a forensic lab. She is evaluating diagnostic forensic software to add to the lab's toolkit. She wants a tool that is open source that can also be used for penetration testing. Which tool should she choose?

Kali Linux

Lynn is a digital forensic specialist who works in a forensic lab. She is evaluating diagnostic forensic software to add to the labs tool kit. She wants a tool that is open source that can also be used for penetration testing. Which tool should she use?

Kali Linux

Alison retrieved data from a company database containing personal information on customers. When she looks at the Social Security number (SSN) field, she sees values that look like this: "XXX-XX-9142." What has happened to these records?

Masking

Allison retrieve data from a company database containing personal information on customers. When she looks at the Social Security number field, she sees values that look like this: "XX-XX-9142." What happened to these records?

Masking

Which of the following is not true of mobile devices and forensics?

Mobile devices do not need to follow ordinary chain of custody techniques

Which of the following is a U.S. federal agency within the Department of Commerce that provides standards for measurement and technology on which nearly all computing devices rely?

NIST

which of the following is a U.S. Federal agency within the Department of Commerce that provides standards for measurement and technology on which nearly all computing devices rely?

National Institute of Standards and Technology

What type of organizations are required to comply with the Sarbanes Oxley act?

Publicly traded companies

Which method of fault tolerance connects two or more computers to act like a s ingle computer in a highly coordinated manner?

RAID

Which of the following is not true of requests for comments (RFCs)?

RFCs may be modified

Which of the following is not true of request for comments?

RFCs may be modified.

Which type of evidence is any physical object that you can touch or otherwise directly observe, such as a hard drive?

Real evidence

Isabella is an IT security manager for a state agency. The agency can survive for nine hours without a functioning data center. The power goes out in her data center. It takes six hours to move data center operations to an alternate site. Which of the following describes the time it takes for the move?

Recovery Time Objective

During which step of the incident-handling process is the goal to contain the incident?

Response

Which of the following is NOT one of the rights afforded to students (or the parents of a minor student) under the Family Educational Rights and Privacy Act (FERPA)?

Right to delete unwanted information from records: The Family Educational Rights and Privacy Act

Which of the following does not need to comply with the family educational rights and privacy act?

Schools that do not receive federal funding

Helen has no security experience. She would like to earn a certification that demonstrates that she has the basic knowledge necessary to work in the information security field. What certification would be an appropriate first step for her?

Security+

Which of the following items would generally not be considered personally identifiable information?

Social media post

Carl has assembled a team of representatives from each department to test a new business continuity plan during the test, the representatives meet in a room and review many aspects of the plan, such as the goals, scope, assumptions, and the structure of the organization. They also conduct scenario based exercises as though they are executing the plan for a certain type of incident to find errors, such as gaps or overlaps. What type of plan is being conducted?

Structured walk-through

Joe is responsible for the security of the systems that control and monitor devices for a power plant. What type of system does Joe likely administer?

Supervisory Control and Data Acquisition (SCADA)

Ben is working toward a position as a senior security administrator. He would like to earn his first international information systems security certification consortium certification. which certification is most appropriate for his needs?

Systems Security Certified Practitioner

The Internet Engineering Task Force (IETF) works closely with the World Wide Web Consortium (W3C) and the International Organization for Standardization (ISO/International Electrotechnical Commission (IEC) focusing on which of the following?

TCP/IP

Which type of evidence is information collected from individuals that supports and helps to interpret other types of evidence?

Testimonial

What is the determination?

The evidence is either acceptable or unacceptable to a court of law?

How are the health insurance portability and accountability act and payment card industry data security standard alike?

They both have requirements that protect the confidentiality, integrity, and availability of data.

Which term describes a process that requires an organization to preserve and not alter evidence that may be used in court?

This process can help ensure that normal data handling procedures do not contaminate or even delete data that may be needed for a case Legal Hold/Litigation Hold

Under the health insurance portability and accountability act(HIPAA) privacy rule, covered entities may not use or disclose people's protected health information without their written consent, although there are exceptions. Which of the following is generally not an allowed exception under the privacy rule?

To discuss a patient's medical status at a conference

What is the purpose of a disaster recovery plan (DRP):

To minimize disruption to business and IT operations, by keeping downtime of systems to a minimum and preventing significant data loss.

The Internet Engineering Task Force (IETF) works closely with the World Wide Web Consortium (W3C) and the International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) focusing on which of the following?

Transmission Control Protocol/Internet Protocol

True or False? A Faraday bag stops any electromagnetic emanations from passing into or out of the bag, preventing a mobile device from communicating with the outside world.

True

True or False? A network engineer in the United States who needs guidance on information security systems could consult the National Institute of Standards and Technology (NIST) Special Publications 800 series.

True

True or False? A primary concern for collected evidence is the preservation of its collected state, which means assurance that evidence remains unchanged from its state when it was collected.

True

True or False? A successful business impact analysis (BIA) maps the context, the critical business functions (BFS), and the processes on which they rely.

True

True or False? An organization can maintain a cloud based disaster recovery site for a traction of the cost of a physical site.

True

True or False? Any component that, if it fails, could interrupt business processing is a single point of failure (SPOF).

True

True or False? Any component that, if it fails, could interrupt business processing is called a single point of failure (SPOF).

True

True or False? Certified Internet Web Professional (CIW) offers several credentials that focus on both general and web-related security.

True

True or False? Digital forensics is the process of using well-defined analytical and investigative techniques to guide the processes of collecting and examining evidence related to a computer security incident.

True

True or False? E-discovery is an iterative process of examining storage media, searching for items of interest, identifying likely items that may have value as evidence, and then recovering those items.

True

True or False? Even if a mobile device is deemed not to be a direct part of a crime or incident, its ability to record the environment of an attacker during the incident could be material?

True

True or False? Fault-tolerance options are not replacements for data backups.

True

True or False? ISO/IC 27002 provides organizations with best-practice recommendations on information security management.

True

True or False? In an incremental backup, you start with a full back up when network traffic is light. Then, each night, you back up only that day's changes.

True

True or False? Juniper Networks offers vendor-specific certifications for its networking product line.

True

True or False? Sarbanes-Oxley Act (SOX) Section 404 requires an organization's executive officers to establish, maintain, review, and report on the effectiveness of the company's internal controls over financial reporting (ICFR).

True

True or False? Schools and libraries that must comply with the Children's Internet Protection Act (CIPA) must also have some way to allow adults unfiltered Internet access.

True

True or False? The Institute of Electrical and Electronics Engineers (IEEE) develops and distributes standards that relate to electricity and electronics.

True

True or False? The emergency operations center (EOC) is the place where an organization's recovery team will meet and work during a disruption.

True

True or False? The process of collecting evidence is called evidence preservation.

True

True or False? The purpose of the Children's Online Privacy Protection Act of 1998 (COPPA) is to restrict the online collection of personal information of children under 13 years of age.

True

True or False? Time stamps correspond to computer log files to help coordinate a sequence of events and are accurate to at least the second.

True

True or False? When outsourcing operations to a cloud service provider, the client is responsible for determining the best fault tolerance implementations to meet the service level agreement availability requirements.

True

True or False? Whereas a vendor-neutral certification covers concepts and topics that are general in nature, a vendor-specific certification focuses on a specific product or product line.

True

True or False? While running business operations at an alternate site, you must continue to make backups of data and systems.

True

True or false World Wide Web Consortium (W3C) standards and specifications ensure that web applications, interact with web components from other vendors.

True

True or false? A certification is an official statement that validates that a person has satisfied specific job Requirements.

True

True or false? A faraday bag stops any electromagnetic imaginations from passing into or out of the bag, preventing a mobile device from communicating with the outside world

True

True or false? A network engineer in the United States who needs guidance on information security systems could consult the national Institute of standards and technology special publications, 800 series

True

True or false? All checkpoint certification exams involve some hands-on experience

True

True or false? All types of evidence are subject to the chain of custody procedures.

True

True or false? Certified Internet web professional offer several credentials that focus on both general and Webb related security

True

True or false? Examples of major disruptions include extreme weather, application, failure, and criminal activity.

True

True or false? Generally, once evidence becomes inadmissible, it cannot be fixed.

True

True or false? ISO/IEC27002 provides organizations with the best practice recommendations on information, security management

True

True or false? Juniper Networks offers vendor specific certifications for its networking product line.

True

True or false? Operating systems remove data when a file is deleted.

True

True or false? Patching computers and devices with the latest security fixes makes them more resistant to many types of attacks.

True

True or false? Regarding disaster recovery, an alternate processing center or mirrored site is always ready and under the organizations control.

True

True or false? The Graham-Leach Bliley act applies to the financial activities of both consumers and privately held companies.

True

True or false? The ISC healthcare certified information security and privacy practitioner. Credential recognizes the knowledge and skills necessary to perform and conduct security and privacy work for health care organizations.

True

True or false? The US Department of Defense cyber crime division (DC3) set standards for digital evidence processing, analysis, and diagnostics.

True

True or false? The federal information security modernization act of 2014 assigned the Department of Homeland security the responsibility for developing, implementing, and ensuring federal government wide compliance as per FISM information security policies procedures and security controls.

True

True or false? The international electro technical commission (IEC) is the preeminent organization for developing and publishing international standards for technologies related to electrical and electronic devices and processes.

True

True or false? The international electro technical commission is the preeminent organization for developing and publishing international standards for technologies related to electrical and electronic devices and processes

True

True or false? The national initiative for cybersecurity education training framework provides descriptions of work roles and specialty areas for information security professionals.

True

True or false? The term computer crime typically refers to crimes that target, computer resources, either data that computer store or the services they provide, or both

True

True or false? There are excellent security professionals who hold no certifications

True

True or false? There are excellent security professionals, who hold no certifications

True

True or false? Today's mobile devices almost all run with either iOS or android

True

True or false? Two common methods to protect evidence during imaging are to use forensics software that forces read only mode or connect to the evidence device using a hardware interface that blocks any right operations

True

True or false? Visa, MasterCard, and other payment card vendors helped to create the payment card industry data security standard.

True

True or false? Visa, MasterCard, and other payment card, vendors help to create the payment card, industry, data security, standard.

True

True or false? Whereas a vendor, neutral certification covers concepts, and topics that are general in nature, a vendor specific certification focuses on a specific product or product line

True

What certification focuses on information systems audit, control, and security professionals?

True

true or false? Even if a mobile device is deemed not to be a direct part of a crime or incident, it's ability to record the environment of an attacker during incident could be material.

True

true or false? One requirement of the GIAC security expert credential is that candidates must hold three GI AC credentials, with two of the credentials being gold.

True

true or false? Standards provide guidelines to ensure that products in today's computing environments work together.

True

true or false? The Internet engineering task force is a collection of working groups, and each working group addresses a specific topic

True

true or false? The system security certified practitioner credential covers 7 domains of best practices for information security.

True

The FAT32 and NTFS file systems are associated with which of the following?

Windows

Which type of evidence is information collected from individuals that supports and helps to interpret other types of evidence.

Witness Evidence

True or false? The Graham Leach Bliley act applies to the financial activities of both consumers and privately held company's.

false

Tim is implementing a set of controls design to ensure that financial reports, records, and data are accurately maintained. What information security goal is Tim attempting to achieve?

integrity

Which term describes a process that requires an organization to preserve and not alter evidence that may be used in court? This process can help ensure that normal data-handling procedures do not contaminate or even delete data that may be needed for a case.

legal hold

True or false? Forensic labs may use both open source and commercial software for digital analysis.

true

True or false? The federal information security modernization act of 2014 assigned the department of homeland, security, the responsibility for developing, implementing, and ensuring federal government wide compliance as per FISMA, information, security, policies, procedures, and security controls

true