SPM1

The art of manipulating people into performing actions or divulging confidential information, is known as: A. Malware B. Industrial espionage C. Social engineering D. Spam E. Phishing

Social engineering

What is the abuse of electronic messaging systems to indiscriminately send unsolicitedbulk messages, many of which contain hoaxes or other undesirable contents such aslinks to phishing sites? A. Spamming B. Phishing C. Hoaxes D. Distributed denial-of-service E. All of the Above

Spamming

What perform the same operations as packet filters, but also maintain state about the packets that have arrived? A. Stateful firewalls B. Virus C. Worm D. Backdoor E. User-level Rootkit

Stateful firewalls

What is a self-replicating code that propagates over a network, usually without humaninteraction? A. Backdoor B. Virus C. Worm D. Trojan Horse E. User-level Rootkit

Worm

The purpose of SETA is to enhance security in all but which of the following ways? a. by building in-depth knowledge b. by adding barriers c. by developing skills d. by improving awareness

by adding barriers

Which of the following is a disadvantage of the individual policy approach to creating and managing ISSPs? a. can suffer from poor policy dissemintation, enforcement, and review b. may skip vulnerabilities otherwise reported c. may be more expensive than necessary d. implementation can be less difficult to manage

can suffer from poor policy dissemintation, enforcement, and review

Which of the following is NOT among the functions typically performed within the InfoSec department as a compliance enforcement obligation? a. policy b. centralized authentication c. compliance audit d. risk management

centralized authentication

Which of the following are instructional codes that guide the execution of the system when information is passing through it? a. access control lists b. user profiles c. configuration rules d. capability tables

configuration rules

What can filter traffic at the network, transport, and application layer? A. Application layer firewalls B. Virus C. Worm D. Backdoor E. User-level Rootkit

Application layer firewalls

Two of the activities involved in risk management include identifying risks and assessing risks. Which of the following activities is part of the risk identification process? a. Determining the likelihood that vulnerable systems will be attacked by specific threats b. Calculating the severity of risks to which assets are exposed in their current setting c. Assigning a value to each information asset d. Documenting and reporting the findings of risk identification and assessment

Assigning a value to each information asset

What stage involves the actual compromise of the target? A. Worm Phase B. Virus Phase C. Backdoor Phase D. More popular Phase E. Attack Phase

Attack phase

What is the SETA program designed to do? a. reduce the occurrence of external attacks b. improve operations c. reduce the occurence of accidental security breaches d. increase the efficiency of InfoSec staff

reduce the occurence of accidental security breaches

Which of the following would be responsible for configuring firewalls and IDPSs, implementing security software, and diagnosing and troubleshooting problems? a. A security technician b. A security analyst c. A security consultant d. The security manager

A security technician

What is a program that by passes standard security controls to provide an attacker access, often in a stealthy way? A. Trojan Horse B. Virus C. Worm D. Backdoor E. User-level Rootkit

Backdoor

Which of the following is a policy implementation model that addresses issues by moving from the general to the specific and is a proven mechanism for prioritizing complex changes? a. On-target model b. Wood's model c. Bull's-eye model d. Bergeron and Berube model

Bull's-eye model

What analyzes the impact of outage on critical business function operations? A. Risk assessment B. Recovery strategy identification C. Recovery strategy selection D. Business impact analysis E. All of the above

Business impact analysis

Two of the activities involved in risk management include identifying risks and assessing risks. Which of the following activities is part of the risk assessment process? a. Creating an inventory of information assets b. Classifying and organizing information assets into meaningful groups c. Assigning a value to each information asset d. Calculating the severity of risks to which assets are exposed in their current setting

Calculating the severity of risks to which assets are exposed in their current setting

_____the contents of the system's memory? A. Turn off B. Document C. Create D. Capture E. All of the above

Capture

________________ in centralized identity infrastructures, can't solve the problem ofcross-organizational authentication and authorization? A. Centrally managed repositories B. Information system auditors C. IT personnel D. Systems Administrators E. All of the above

Centrally managed repositories

Classification categories must be mutually exclusive and which of the following? a. Repeatable b. Unique c. Comprehensive d. Selective

Comprehensive

What test is a systematic analysis of all security controls in place at the testedorganization? A. Trojan Horse B. Firewalls C. Worm D. Comprehensive penetration E. User-level Rootkit

Comprehensive penetration

What documents the processes, equipment, and facilities required to restore theIT assets? A. Contingency plan development B. User training C. Plan verification D. Plan maintenance E. Recovery strategy selection

Contingency plan development

Determining the cost of recovery from an attack is one calculation that must be made to identify risk, what is another? a. Cost of prevention b. Cost of litigation c. Cost of detection d. Cost of identification

Cost of prevention

_____a forensic image of the system's hard drive? A. Create B. Turn off C. Capture D. Document E. All of the above

Create

. Which of the following is an advantage of the one-on-one method of training? a. Trainees can learn from each other b. Very cost-effective c. Customized d. Maximizes use of company resources

Customized

What describes activities such as theft of trade secrets, bribery, blackmail, andtechnological surveillance as well as spying on commercial organizations andsometimes governments? A. Spam B. Phishing C. Hoaxes D. Industrial espionage E. Denial-of-service

Denial-of-service

_______ what is on the screen by photographing it? A. Capture B. Turn off C. Document D. Create E. All of the above

Document

What can also be categorized based on where they are implemented or what they areintended to protect—host or network? A. Trojan Horse B. Firewalls C. Worm D. Backdoor E. User-level Rootkit

Firewalls

Which of the following is a network device attribute that may be used in conjunction with DHCP, making asset-identification using this attribute difficult? a. Part number b. Serial number c. MAC address d. IP address

IP address

Who is responsible for building IT security controls into the design andimplementations of the systems? A. Information owners B. Information system auditors C. IT personnel D. Systems Administrator E. All of the above

IT personnel

Which of the following is the first step in the process of implementing training? a. Identify training staff b. Identify target audiences c. Identify program scope, goals, and objectives d. Motivate management and employees

Identify program scope, goals, and objectives

The main identity management system deployed currently in the world of the Internetis known as the? A. Federated identity management model B. Identity life cycle C. Aggregate identity D. Executive management model E. Silo model

Identity life cycle

Who are responsible for ensuring that the information security policies and procedureshave been adhered to? A. Information owners B. Information system auditors C. Security officers D. Executive management E. All of the above

Information system auditors

Which of the following is an advantage of the formal class method of training? a. Personal b. Self-paced, can go as fast or as slow as the trainee needs c. Can be scheduled to fit the needs of the trainee d. Interaction with trainer is possible

Interaction with trainer is possible

Each manager in the organization should focus on reducing risk. This is often done within the context of one of the three communities of interest, which includes all but which of the following? a. General management must structure the IT and InfoSec functions b. IT management must serve the IT needs of the broader organization c. Legal management must develop corporate-wide standards d. InfoSec management must lead the way with skill, professionalism, and flexibility

Legal management must develop corporate-wide standards

What is the final step in the risk identification process? a. Assessing values for information assets b. Classifying and categorizing assets c. Identifying and inventorying assets d. Listing assets in order of importance

Listing assets in order of importance

Which of the following is an attribute of a network device is physically tied to the network interface? a. Serial number b. MAC address c. IP address d. Model number

MAC address

Which of the following distinctly identifies an asset and can be vital in later analysis of threats directed to specific models of certain devices or software components? a. Name b. MAC address c. Serial number d. Manufacturer's model or part number

Manufacturer's model or part number

What is simply a way to ensure that a particular activity is conducted in a standardmanner, with documented and repeatable results? A. Stateful firewalls B. Virus C. Methodology D. Backdoor E. User-level Rootkit

Methodology

Which of the following variables is the most influential in determining how to structure an information security program? a. Security capital budget b. Organizational size c. Security personnel budget d. Organizational culture

Organizational culture

Which of the following is an example of a technological obsolescence threat? a. Hardware equipment failure b. Unauthorized access c. Outdated servers d. Malware

Outdated servers

What is the most basic type of a firewall since it only filters at the network andtransport layers (layers two and three)? A. Backdoor B. Virus C. Worm D. Packet filter E. User-level Rootkit

Packet filter

What is the criminally fraudulent process of attempting to acquire sensitive informationsuch as usernames, passwords, and credit-card details by masquerading as atrustworthy entity in an electronic communication? A. Splicing B. Phishing C. Bending D. FSO E. Cabling

Phising

What is unique to the penetration test team? A. Backdoor Phase B. Virus Phase C. Post-Attack Phase D. Packet filter Phase E. User-level Rootkit Phase

Post-Attack Phase

What requires that an individual, program, or system process is not granted any moreaccess privileges than are necessary to perform the task? A. Administrative controls B. Principle of Least Privilege C. Technical controls D. Physical controls E. Risk analysis

Principle of Least Privilege

Which of the following attributes does NOT apply to software information assets? a. Serial number b. Controlling entity c. Manufacturer name d. Product dimensions

Product dimensions

What should you be armed with to adequately assess potential weaknesses in each information asset? a. Properly classified inventory b. Audited accounting spreadsheet c. Intellectual property assessment d. List of known threats

Properly classified inventory

What have been developed by particular entities offering network security services orcertifications? A. Application layer firewalls B. Proprietary methodologies C. Worms D. Backdoors E. User-level Rootkit

Proprietary methodologies

Once an information asset is identified, categorized, and classified, what must also be assigned to it? a. Asset tag b. Relative value c. Location ID d. Threat risk

Relative value

Which of the following is a disadvantage of the one-on-one training method? a. Inflexible b. May not be responsive to the needs of all the trainees c. Content may not be customized to the needs of the organization d. Resource intensive, to the point of being inefficient

Resource intensive, to the point of being inefficient

The identification and assessment of levels of risk in an organization describes which of the following? a. Risk analysis b. Risk identification c. Risk management d. Risk reduction

Risk analysis

Which of the following functions includes identifying the sources of risk and may include offering advice on controls that can reduce risk? a. Risk management b. Risk assessment c. Systems testing d. Vulnerability assessment

Risk assessment

The likelihood of the occurrence of a vulnerability multiplied by the value of the information asset minus the percentage of risk mitigated by current controls plus the uncertainty of current knowledge of the vulnerability are each examples of _____. a. Vulnerability mitigation controls b. Risk assessment estimate factors c. Exploit likelihood equation d. Attack analysis calculation

Risk assessment estimate factors

Data classification schemes should categorize information assets based on which of the following? a. Value and uniqueness b. Sensitivity and security needs c. Cost and replacement value d. Ease of reproduction and fragility

Sensitivity and security needs

A relatively simple ____________ model is to build a platform that centralizesidentities? A. Common user identity management B. Simple centralized identity management C. Unique identity management D. Meta directory E. Executive Management

Simple centralized identity management

What provides an abstraction boundary between application and the actualimplementation? A. Single point of administration B. Redundant directory information C. Single point of reference D. Business impact analysis E. All of the above

Single point of reference

Who is responsible for configuring the hardware and the operating system to ensure that the information systems and their contents are available for business as and when needed? A. Information System Auditor B. Information Owners C. Systems Administrator D. Security Officer E. Executive Management

Systems Administrator

Which of the following functions needed to implement the information security program evaluates patches used to close software vulnerabilities and acceptance testing of new systems to assure compliance with policy and effectiveness? a. Systems testing b. Risk assessment c. Incident response d. Systems security administration

Systems testing

What should the prioritized list of assets and their vulnerabilities and the prioritized list of threats facing the organization be combined to create? a. Risk exposure report b. Threats-vulnerabilities-assets worksheet c. Costs-risks-prevention database d. Threat assessment catalog

Threats-vulnerabilities-assets worksheet

What is a program that masquerades as a legitimate, useful program while also performing malicious functions in the background? A. Trojan Horse B. Virus C. Worm D. Backdoor E. User-level Rootkit

Trojan Horse

_____the computer? A. Capture B. Create C. Document D. Distribute E. Turn off

Turn off

Devices that can be used to copy proprietary company data off the internal network areknown as: A. Remote control software B. Email C. USB storage D. General Internet use E. Risk analysis

USB storage

An estimate made by the manager using good judgement and experience can account for which factor of risk assessment? a. Risk determination b. Assessing potential loss c. Likelihood and consequences d. Uncertainty

Uncertainty

Which of the following is NOT among the typical columns in the ranked vulnerability risk worksheet? a. Uncertainty percentage b. Asset impact c. Risk-rating factor d. Vulnerability likelihood

Uncertainty percentage

What is the Trojan/ backdoor code that modifies operating system software so theattacker can maintain privileged access on a machine but remain hidden? A. Trojan Horse B. Virus C. Worm D. Backdoor E. User-level Rootkit

User-level Rootkit

What refers to how often the rule is a match? A. Worm B. Virus C. Backdoor D. More popular E. User-level Rootkit

User-level Rootkit

Which of the following is an advantage of the user support group form of training? a. Usually conducted in an informal social setting b. Formal training plan c. Can be live, or can be archived and viewed at the trainee's convenience d. Can be customized to the needs of the trainee

Usually conducted in an informal social setting

What directories are not located in the same physical structure as the Web homedirectory, but look as if they were to Web clients? A. Single Sign-On B. Seamless C. Session D. Virtual E. Flexible

Virtual

What is a self-replicating code that attaches itself to another program? A. Worm B. Virus C. Backdoor D. Trojan Horse E. User-level Rootkit

Virus

What is defined as specific avenues that threat agents can exploit to attack an information asset? a. Liabilities b. Defenses c. Vulnerabilities d. Weaknesses

Vulnerabilities

_______ is a simple project management planning tool. a. RFP b. WBS c. ISO 17799 d. SDLC

WBS

What are the two general methods for implementing technical controls? a. profile lists and configuration filters b. firewall rules and access filters c. user profiles and filters d. access control lists and configuration rules

access control lists and configuration rules

A risk assessment is performed during which phase of the SecSDLC? a. implementation b. analysis c. design d. investigation

analysis

In which phase of the SecSDLC must the team create a plan to distribute and verify the distribution of the policies? a. design b. implementation c. investigation d. analysis

design

When an organization demonstrates that it is continuously attempting to meet the requirements of the market in which it operates, what is it ensuring? a. policy administration b. due diligence c. adequate security measures d. certification and accreditation

due diligence

Which of the following is NOT a step in the process of implementing training? a. administer the program b. hire expert consultants c. motivate management and employees d. identify target audiences

hire expert consultants

A detailed outline of the scope of the policy development project is created during which phase of the SecSDLC? a. design b. analysis c. implementation d. investigation

investigation

Which of the following is true about a company's InfoSec awareness Web site? a. it should contain large images to maintain interest b. appearance doesn't matter if the information is there c. it should be placed on the Internet for public use d. it should be tested with multiple browsers

it should be tested with multiple browsers

An information security professional with authorization to attempt to gain system access in an effort to identify and recommend resolutions for vulnerabilities in those systems is known as a(n) ____________. a. penetration tester b. gray-hat hacker c. script kiddie d. zebra team

penetration tester

GGG security is commonly used to describe which aspect of security? a. technical b. software c. physical d. theoretical

physical

Which function needed to implement the information security program includes researching, creating, maintaining, and promoting information security plans? a. compliance b. policy c. planning d. systems security administration

planning

According to NIST SP 800-18, Rev. 1, which individual is responsible for the creation, revision, distribution, and storage of the policy? a. policy developer b. policy reviewer c. policy enforcer d. policy administrator

policy administrator

A SETA program consists of three elements: security education, security training, and which of the following? a. security accountability b. security authentication c. security awareness d. security authorization

security awareness

Which of the following is the most cost-effective method for disseminating security information and news to employees? a. distance learning seminars b. security-themed Web site c. conference calls d. security newsletter

security newsletter

Which of the following are the two general groups into which SysSPs can be separated? a. technical specifications and managerial guidance b. business guidance and network guidance c. user specifications and managerial guidance d. technical specifications and business guidance

technical specifications and managerial guidance

Advanced technical training can be selected or developed based on which of the following? a. level of previous education b. level of previous training c. technology product d. number of employees

technology product

Which of the following is true about the security staffing, budget, and needs of a medium-sized organization? a. they have a larger security staff than a small organization b. they have a larger security budget (as percent of IT budget) than a small organization c. they have a smaller security budget (as percent of IT budget) than a large organization d. they have larger information security needs than a small organization

they have larger information security needs than a small organization

Which of the following is NOT an aspect of access regulated by ACLs? a. what authorized users can access b. where the system is located c. how authorized users can access the system d. when authorized users can access the system

where the system is located