160 final
Computer assets are the focus of information security and are the information that has value to the organization, as well as the systems that store, process, and transmit the information. ____________
FALSE
Encryption methodologies that require the same secret key to encipher and decipher the message are using what is called public-key encryption. _________________________
FALSE
Every member of the organization's InfoSec department must have a formal degree or certification in information security.
FALSE
Fingerprinting is the organized research of the Internet addresses owned or controlled by a target organization. _________________________
FALSE
In the early stages of planning, the project planner should attempt to specify completion dates only for major employees within the project. _________________________
FALSE
Knowing yourself means identifying, examining, and understanding the threats facing the organization.
FALSE
Planning for the implementation phase requires the creation of a detailed request for proposal, which is often assigned either to a project manager or the project champion. _________________________
FALSE
Criminal laws address activities and conduct harmful to society and is categorized as private or public.
TRUE
Each organization has to determine its own project management methodology for IT and information security projects.
TRUE
A best practice proposed for a small to medium-sized business will be similar to one used to help design control strategies for a large multinational company.
FALSE
A cold site provides many of the same services and options of a hot site, but at a lower cost.
FALSE
A routing table tracks the state and context of each packet in the conversation by recording which station sent what packet and when. _________________________
FALSE
A(n) NIDPS functions on the host system, where encrypted traffic will have been decrypted and is available for processing. _________________________
FALSE
ACLs are more specific to the operation of a system than rule-based policies and they may or may not deal with users directly.
FALSE
Accountability is the matching of an authenticated entity to a list of information assets and corresponding access levels.
FALSE
Alarm filtering may be based on combinations of frequency, similarity in attack signature, similarity in attack target, or other criteria that are defined by the system administrators. _________________________
FALSE
All IDPS vendors target users with the same levels of technical and security expertise.
FALSE
CERT stands for "computer emergency recovery team." _________________________
FALSE
Common implementations of a registration authority (RA) include functions to issue digital certificates to users and servers.
FALSE
CompTIA offers a vendor-specific certification program called the Security+ certification.
FALSE
Port Address Translation assigns non-routing local addresses to computer systems in the local area network and uses ISP-assigned addresses to communicate with the Internet on a one-to-one basis. _________________________
FALSE
Process-based measures are comparisons based on observed numerical data, such as numbers of successful attacks. _________________________
FALSE
Risk acceptance defines the quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility. _________________________
FALSE
Task-based controls are associated with the assigned role a user performs in an organization, such as a position or temporary assignment like project manager.
FALSE
The Analysis phase of the SDLC examines the event or plan that initiates the process and specifies the objectives, constraints, and scope of the project. _________________________
FALSE
The Federal Privacy Act of 1974 regulates government agencies and holds them accountable if they release information about national security without permission. _________________________
FALSE
The Graham-Leach-Bliley Act is a critical piece of legislation that affects the executive management of publicly traded corporations and public accounting firms. _________________________
FALSE
The SSCP examination is much more rigorous than the CISSP examination.
FALSE
The ability of a router to restrict traffic to a specific service is an advanced capability and not considered a standard feature for most routers.
FALSE
The computed value of the ALE compares the costs and benefits of a particular control alternative to determine whether the control is worth its cost. _________________________
FALSE
The defense control strategy is the risk control strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards, but it is not the preferred approach to controlling risk.
FALSE
The key difference between laws and ethics is that ethics carry the authority of a governing body and laws do not.
FALSE
The parallel operations strategy works well when an isolated group can serve as a test area, which prevents any problems with the new system dramatically interfering with the performance of the organization as a whole. _________________________
FALSE
The physical design is the blueprint for the desired solution.
FALSE
To use a packet sniffer legally, an administrator only needs permission of the organization's top computing executive.
FALSE
Usually, as the length of a cryptovariable increases, the number of random guesses that have to be made in order to break the code is reduced.
FALSE
Videoconferencing is off-site computing that uses Internet connections, dial-up connections, connections over leased point-to-point links between offices, and other mechanisms. _________________________
FALSE
Within security perimeters the organization can establish security redundancies, each with differing levels of security, between which traffic must be screened. _________________________
FALSE
A content filter, also known as a reverse firewall, is a network device that allows administrators to restrict access to external content from within a network.
TRUE
A service bureau is an agency that provides a service for a fee. _________________________
TRUE
A task or subtask becomes a(n) action step when it can be completed by one individual or skill set and when it includes a single deliverable. _________________________
TRUE
A(n) known vulnerability is a published weakness or fault in an information asset or its protective systems that may be exploited and result in loss. _________________________
TRUE
A(n) polymorphic threat is one that over time changes the way it appears to antivirus software programs, making it undetectable by techniques that look for preconfigured signatures. _________________________
TRUE
An HIDPS can detect local events on host systems and detect attacks that may elude a network-based IDPS.
TRUE
An organization should integrate security awareness education into a new hire's ongoing job orientation and make it a part of every employee's on-the-job security training.
TRUE
If an organization deals successfully with change and has created procedures and systems that can be adjusted to the environment, the existing security improvement program will probably continue to work well.
TRUE
In digital forensic investigations for information security, most operations focus on policies-documents that provide managerial guidance for ongoing implementation and operations. ____________
TRUE
In many organizations, information security teams lack established roles and responsibilities.
TRUE
In most cases, organizations look for a technically qualified information security generalist who has a solid understanding of how an organization operates.
TRUE
NIST Special Publication 800-18 Rev. 1, The Guide for Developing Security Plans for Federal Information Systems, includes templates for major application security plans, and provides detailed methods for assessing, designing, and implementing controls and plans for applications of varying size.
TRUE
Over time, external monitoring processes should capture information about the external environment in a format that can be referenced across the organization as threats emerge and for historical use.
TRUE
Over time, policies and procedures may become inadequate due to changes in the organization's mission and operational requirements, threats, or the environment.
TRUE
Remediation of vulnerabilities can be accomplished by accepting or transferring the risk, removing the threat, or repairing the vulnerability.
TRUE
Security efforts that seek to provide a superior level of performance in the protection of information are referred to as best business practices. _________________________
TRUE
Security managers are accountable for the day-to-day operation of the information security program.
TRUE
Security tools that go beyond routine intrusion detection include honeypots, honeynets, and padded cell systems.
TRUE
Sometimes a risk assessment report is prepared for a specific IT project at the request of the project manager, either because it is required by organizational policy or because it is good project management practice. _________________________
TRUE
Studies on ethics and computer use reveal that people of different nationalities have different perspectives; difficulties arise when one nationality's ethical behavior violates the ethics of another national group.
TRUE
The ISO/IEC 27000 series is derived from an earlier standard, BS7799.
TRUE
The Metasploit Framework is a collection of exploits coupled with an interface that allows the penetration tester to automate the custom exploitation of vulnerable systems.
TRUE
The Simple Network Management Protocol contains trap functions, which allow a device to send a message to the SNMP management console indicating that a certain threshold has been crossed, either positively or negatively.
TRUE
The best method of remediation in most cases is to repair a vulnerability. _________________________
TRUE
The false reject rate describes the number of legitimate users who are denied access because of a failure in the biometric device. _________________________
TRUE
The investigation phase of the SDLC involves specification of the objectives, constraints, and scope of the project.
TRUE
The stated purpose of ISO/IEC 27002 is to offer guidelines and voluntary directions for information security management. _________________________
TRUE
