Security Awareness - Ch1 Unit 1 Quiz

Which tool is most commonly associated with nation state threat actors? Closed-Source Resistant and Recurrent Malware (CSRRM) Unlimited Harvest and Secure Attack (UHSA) Advanced Persistent Threat (APT) Network Spider and Worm Threat (NSAWT)

Advanced Persistent Threat (APT)

What is the category of threat actors that sell their knowledge of vulnerabilities to other attackers or governments? Cyberterrorists Brokers Competitors Resource managers

Brokers

Which of the following ensures that only authorized parties can view protected information? Availability Authorization Confidentiality Integrity

Confidentiality

An organization that practices purchasing products from different vendors is demonstrating which security principle? Diversity Layering Obscurity Limiting

Diversity

Gunnar is creating a document that explains risk response techniques. Which of the following would he NOT list and explain in his document? Avoid risk Transfer risk Extinguish risk Mitigate risk

Extinguish risk

Which act requires banks and financial institutions to alert their customers of their policies in disclosing customer information? Financial and Personal Services Disclosure Act Health Insurance Portability and Accountability Act (HIPAA) Gramm-Leach-Bliley Act (GLBA) Sarbanes-Oxley Act (Sarbox)

Gramm-Leach-Bliley Act (GLBA)

Which the following is NOT a reason why it is difficult to defend against today's attackers? Simplicity of attack tools Greater sophistication of defense tools Increased speed of attacks Delays in security updating

Greater sophistication of defense tools

Which of the following is an enterprise critical asset? System software Outsourced computing services Servers, routers, and power supplies Information

Information

Alyona has been asked by her supervisor to give a presentation regarding reasons why security attacks continue to be successful. She has decided to focus on the issue of widespread vulnerabilities. Which of the following would Alyona NOT include in her presentation? Misconfigurations End-of-life systems Lack of vendor support Large number of vulnerabilities

Misconfigurations

Why do cyberterrorists target power plants, air traffic control centers, and water systems? These targets have notoriously weak security and are easy to penetrate. They can cause significant disruption by destroying only a few targets. These targets are government-regulated and any successful attack would be considered a major victory. The targets are privately owned and cannot afford high levels of security.

They can cause significant disruption by destroying only a few targets.

What is an objective of state-sponsored attackers? To right a perceived wrong To sell vulnerabilities to the highest bidder To spy on citizens To amass fortune over of fame

To spy on citizens

Tatyana is discussing with her supervisor potential reasons why a recent attack was successful against one of their systems. Which of the following configuration issues would NOT be covered? Weak configurations Vulnerable business processes Misconfigurations Default configurations

Vulnerable business processes

What is a race condition? When an attack finishes its operation before antivirus can complete its work. When a software update is distributed prior to a vulnerability being discovered. When a vulnerability is discovered and there is a race to see if it can be patched before it is exploited by attackers. When two concurrent threads of execution access a shared resource simultaneously, resulting in unintended consequences.

When two concurrent threads of execution access a shared resource simultaneously, resulting in unintended consequences.

Complete this definition of information security: That which protects the integrity, confidentiality, and availability of information _____. through a long-term process that results in ultimate security through products, people, and procedures on the devices that store, manipulate, and transmit the information using both open-sourced as well as supplier-sourced hardware and software that interacts appropriately with limited resources on electronic digital devices and limited analog devices that can connect via the Internet or through a local area network

through products, people, and procedures on the devices that store, manipulate, and transmit the information

Signe wants to improve the security of the small business where she serves as a security manager. She determines that the business needs to do a better job of not revealing the type of computer, operating system, software, and network connections they use. What security principle does Signe want to use? Limiting Diversity Layering Obscurity

Obscurity

Which of the following is NOT a successive layer in which information security is achieved? Purposes People Procedures Products

Purposes

What are industry-standard frameworks and reference architectures that are required by external agencies known as? Regulatory Mandatory Required Compulsory

Regulatory

Ian recently earned his security certification and has been offered a promotion to a position that requires him to analyze and design security solutions as well as identifying users' needs. Which of these generally recognized security positions has Ian been offered? Security technician Security officer Security manager Security administrator

Security administrator

Adone is attempting to explain to his friend the relationship between security and convenience. Which of the following statements would he use? Security and convenience are not related. Convenience always outweighs security. Whenever security and convenience intersect, security always wins. Security and convenience are inversely proportional.

Security and convenience are inversely proportional.

Which of the following is NOT true regarding security? Security is a war that must be won at all costs. Security is a goal. Security includes the necessary steps to protect from harm. Security is a process.

Security is a war that must be won at all costs