S+ Midterm

What is the maximum fine for those who wrongfully disclose individually identifiable health information with the intent to sell it?

$250,000

In information security, an example of a threat agent can be ____.

--a force of nature such as a tornado that could destroy computer equipment --virus that attacks a computer network

The expression ____ up one directory level.

../ traverses

For a Web server's Linux system, the default root directory is typically ____.

/var/www

A study by Foote Partners showed that security certifications earn employees ____ percent more pay than their uncertified counterparts.

10 to 14

Passive tags have ranges from about 1/3 inch to ____ feet.

19

IP addresses are ____-bit addresses.

32

There are almost ____ different Microsoft Windows file extensions that could contain a virus.

70

Approximately ____ percent of households in the United States use the Internet for managing their finances.

80

____ is the probability that a risk will occur in a particular year.

ARO

____ is a software program that delivers advertising content in a manner that is unexpected and unwanted by the user.

Adware

____ ensures that the individual is who they claim to be (the authentic or genuine person) and not an imposter.

Authentication

____ is a comparison of the present state of a system compared to its baseline.

Baseline reporting

The default root directory of the Microsoft Internet Information Services (IIS) Web server is ____.

C:\Inetpub\ wwwroot

Using video cameras to transmit a signal to a specific and limited set of receivers is called ____.

CCTV

____ are combination locks that use buttons which must be pushed in the proper sequence to open the door.

Cipher locks

____ ensures that only authorized parties can view information.

Confidentiality

____ is defined as a security analysis of the transaction within its approved context.

Content inspection

____ are a loose-knit network of attackers, identity thieves, and financial fraudsters.

Cyberterrorists

____ is a system of security tools that is used to recognize and identify data that is critical to the organization and ensure that it is protected.

DLP

Each host (desktop, wireless laptop, smartphone, gateway server) runs a local application called a ____, which is sent over the network to the devices and runs as an OS service.

DLP agent

In order to allow untrusted outside users access to resources such as Web servers, most networks employ a ____.

DMZ

When TCP/IP was developed, the host table concept was expanded to a hierarchical name system for matching computer names and numbers known as the ____.

DNS

The Chinese government uses _____ to prevent Internet content that it considers unfavorable from reaching its citizenry.

DNS poisoning

____ substitutes DNS addresses so that the computer is automatically redirected to another device.

DNS poisoning

____ is the proportion of an asset's value that is likely to be destroyed by a particular risk.

EF

A(n) ____ refers to an undocumented, yet benign, hidden feature, that launches by entering a set of special commands, key combinations, or mouse clicks.

Easter egg

____ attacks are responsible for half of all malware delivered by Web advertising.

Fake antivirus

____ is an image spam that is divided into multiple images.

GIF layering

____ uses "speckling" and different colors so that no two spam e-mails appear to be the same.

Geometric variance

The ____ Act requires banks and financial institutions to alert customers of their policies and practices in disclosing customer information.

Gramm-Leach-Bliley

Under the ____, health care enterprises must guard protected health information and implement policies and procedures to safeguard it, whether it be in paper or electronic format.

HIPAA

____ is designed to display data, with the primary focus on how the data looks.

HTML

The ____ is part of an HTTP packet that is composed of fields that contain the different characteristics of the data being transmitted.

HTTP header

____ ensures that information is correct and that no unauthorized person or malicious software has altered that data.

Integrity

____ is a technology that can help to evenly distribute work across a network.

Load balancing

____ can be prewired for electrical power as well as wired network connections.

Locking cabinets

The single most expensive malicious attack was the 2000 ____, which cost an estimated $8.7 billion.

Love Bug

The most popular attack toolkit, which has almost half of the attacker toolkit market is ____.

MPack

____ is a technique that allows private IP addresses to be used on the public Internet.

NAT

Layer 3 of the OSI model is the ____ layer.

Network

____ is a means by which an organization can transfer the risk to a third party who can demonstrate a higher capability at managing or reducing risks.

Outsourcing

____ is typically used on home routers that allow multiple users to share one IP address received from an Internet service provider (ISP).

PAT

____ IP addresses are IP addresses that are not assigned to any specific user or organization.

Private

ID badges that can be detected by a proximity reader are often fitted with tiny radio ____ tags.

RFID

____ provides remote users with the same access and functionality as local users through a VPN or dial-up connection.

Remote access

Released in 1995, one of the first tools that was widely used for penetration testing was ____.

SATAN

The ____ is the expected monetary loss every time a risk occurs.

SLE

____ is a language used to view and manipulate data that is stored in a relational database.

SQL

Layer 5 of the OSI model is the ____ layer.

Session

____ is an attack in which an attacker attempts to impersonate the user by using his session token.

Session hijacking

____ is when an attacker tricks users into giving out information or performing a compromising action.

Social engineering

____ keeps a record of the state of a connection between an internal computer and an external device and then makes decisions based on the connection as well as the conditions.

Stateful packet filtering

In a(n) ____ infection, a virus injects itself into the program's executable code instead of at the end of the file.

Swiss cheese

____ use multiple infrared beams that are aimed across a doorway and positioned so that as a person walks through the doorway some beams are activated.

Tailgate sensors

A ____ is a program advertised as performing one activity but actually does something else.

Trojan

A ____ allows scattered users to be logically grouped together even though they may be attached to different switches.

VLAN

A(n) ____ encrypts all data that is transmitted between the remote device and the network.

VPN

A(n) ____ can block malicious content in "real time" as it appears without first knowing the URL of a dangerous site.

Web security gateway

____ involves horizontally separating words, although it is still readable by the human eye.

Word splitting

____ switches are connected directly to the devices on a network.

Workgroup

____ is for the transport and storage of data, with the focus on what the data is.

XML

In information security, a loss can be ____.

a. theft of information b. a delay in transmitting information that results in a financial penalty c. the loss of good will or a reputation

The ____ for software is the code that can be executed by unauthorized users.

attack surface

Users who access a Web server are usually restricted to the ____ directory.

base

A ____ outlines the major security considerations for a system and becomes the starting point for solid security.

baseline

A ____ virus infects the Master Boot Record of a hard disk drive.

boot

A ____ can be inserted into the security slot of a portable device and rotated so that the cable lock is secured to the device, while a cable connected to the lock can then be secured to a desk or immobile object.

cable lock

A(n) ____ indicates that no process is listening at this port.

closed port

While the code for a program is being written, it is being analyzed by a ____.

code review

A(n) ____ virus adds a program to the operating system that is a malicious copycat version to a legitimate program.

companion

Targeted attacks against financial networks, unauthorized access to information, and the theft of personal information is sometimes known as ____.

cybercrime

Business ____ theft involves stealing proprietary business information such as research for a new drug or a list of customers that competitors are eager to acquire.

data

In a ____ attack, attackers can attackers use hundreds or thousands of computers in an attack against a single computer or network.

distributed

A client-side attack that results in a user's computer becoming compromised just by viewing a Web page and not even clicking any content is known as a ____.

drive-by-download

A(n) ____ is the end of the tunnel between VPN devices.

endpoint

Securing a restricted area by erecting a barrier is called ____.

fencing

A(n) ____ is hardware or software that is designed to prevent malicious packets from entering or leaving computers.

firewall

In ____, a virtualized environment is created that simulates the central processing unit (CPU) and memory of the computer.

heuristic detection

A ____ is a network set up with intentional vulnerabilities.

honeynet

A ____ is a computer typically located in an area with limited security and loaded with software and data files that appear to be authentic, yet they are actually imitations of real data files.

honeypot

A ____ is a standard network device for connecting multiple Ethernet devices together by using twisted-pair copper or fiber-optic cables in order to make them function as a single network segment.

hub

The term ____ is frequently used to describe the tasks of securing information that is in a digital format.

information security

A ____ is a computer program or a part of a program that lies dormant until it is triggered by a specific logical event.

logic bomb

A ____ is a series of instructions that can be grouped together as a single command and are often used to automate a complex set of tasks or a repeated series of tasks.

macro

An information security ____ position focuses on the administration and management of plans, policies, and people.

manager

A ____ is designed to separate a nonsecured area from a secured area.

mantrap

A(n) ____ means that the application or service assigned to that port is listening for any instructions.

open port

Instead of using a key or entering a code to open a door, a user can display a ____ to identify herself.

physical token

When performing a vulnerability assessment, many organizations use ____ software to search a system for any port vulnerabilities.

port scanner

A ____ virus infects program executable files.

program

A(n) ____ is hardware or software that captures packets to decode and analyze its contents.

protocol analyzer

The signal from an ID badge is detected as the owner moves near a ____, which receives the signal.

proximity reade

A ____ is a computer or an application program that intercepts a user request from the internal secure network and then processes that request on behalf of the user.

proxy server

A ____ attack is similar to a passive man-in-the-middle attack.

replay

Viruses and worms are said to be self-____.

replicating

A ____ virus is loaded into random access memory (RAM) each time the computer is turned on and infects files that are opened by the user or the operating system.

resident

A(n) ____ does not serve clients, but instead routes incoming requests to the correct server.

reverse proxy

A ____ is an independently rotating large cups affixed to the top of a fence prevent the hands of intruders from gripping the top of a fence to climb over it.

roller barrier

A ____ is a set of software tools used by an attacker to hide the actions or presence of other types of malicious software, such as Trojans, viruses, or worms.

rootkit

A ____ is a network device that can forward packets across computer networks.

router

The position of ____ is generally an entry-level position for a person who has the necessary technical skills.

security technician

In Microsoft Windows, a ____ is a collection of security configuration settings.

security template

Web application attacks are considered ____ attacks.

server-side

A ____ is software that is a cumulative package of all security updates plus additional features.

service pack

Examining network traffic, activity, transactions, or behavior and looking for well-known patterns is known as ____-based monitoring

signature

What is another name for unsolicited e-mail messages?

spam

An anti-climb collar is a ____ that extends horizontally for up to 3 feet (1 meter) from the pole to prevent anyone from climbing.

spiked collar

Each operation in a computing environment starts with a ____.

system call

HTML is a markup language that uses specific ____ embedded in brackets.

tags

The end product of a penetration test is the penetration ____.

test report

The goal of ____ is to better understand who the attackers are, why they attack, and what types of attacks might occur.

threat modeling

A computer ____ is malicious computer code that reproduces itself on the same computer.

virus

Unlike other malware, a ____ is heavily dependent upon the user for its survival.

virus

The two types of malware that have the primary objective of spreading are ____.

viruses and worms

A security weakness is known as a(n) ____.

vulnerability

A ____ in effect takes a snapshot of the current security of the organization.

vulnerability appraisal

A(n) ____ examines the current security in a passive method.

vulnerability scan

The SQL injection statement ____ discovers the name of a table.

whatever' AND 1=(SELECT COUNT(*) FROM tabname); --

The SQL injection statement ____ determines the names of different fields in a database.

whatever' AND email IS NULL; --

The SQL injection statement ____ finds specific users.

whatever' OR full_name LIKE '%Mia%'

The SQL injection statement ____ erases the database table.

whatever'; DROP TABLE members; -- Correct

A ____ tester has an in-depth knowledge of the network and systems being tested, including network diagrams, IP addresses, and even the source code of custom applications.

white box

When DNS servers exchange information among themselves it is known as a ____.

zone transfer