IS-577 Chapter 11

For as long as it appears on the device

A TOTP token code is generally valid for what period of time? Only while the user presses SEND Until an event occurs For as long as it appears on the device For up to 24 hours

Jailbreaking

A friend of Ukrit told him that he has just downloaded and installed an app that allows him to circumvent the built-in limitations on his Apple iOS smartphone. What is this called? Ducking Rooting Sideloading Jailbreaking

Infrared

Agape was asked to make a recommendation regarding short-range wireless technologies to be supported in a new conference room that was being renovated. Which of the following would she NOT consider due to its slow speed and its low deployment levels today? Infrared NFC Bluetooth ANT

Type D

Calista is designing the specifications for new laptop computers to be purchased by her company. She is comparing the different types and sizes of USB connections found on the devices. Which type USB connection would she NOT find on a laptop? Type D Standard Micro Mini

geolocation

Creating a pattern of where a user accesses a remote web account is an example of which of the following? Cognitive biometrics Time-Location Resource Monitoring (TLRM) Keystroke dynamics Geolocation

Privileged accounts

Each of the following accounts should be prohibited EXCEPT: Shared accounts Generic accounts Privileged accounts Guest accounts

reset to factory settings

Gaetan has attempted to enter the passcode for his mobile device but keeps entering the wrong code. Now he is asked to enter a special phrase to continue. Which configuration setting is enabled on Gaetan's mobile device? extend lockout period lock device enable high security reset to factory settings

It takes more time to generate candidate password digests.

How is key stretching effective in resisting password attacks? It does not require the use of salts. It requires the use of GPUs. It takes more time to generate candidate password digests. The license fees are very expensive to purchase and use it.

OAuth

Ilya has been asked to recommend a federation system technology that is an open source federation framework that can support the development of authorization protocols. Which of these technologies would he recommend? NTLM Shibboleth Open ID Connect OAuth

CYOD

In her job interview, Xiu asks about the company policy regarding smartphones. She is told that employees may choose from a limited list of approved devices but that she must pay for the device herself; however, the company will provide her with a monthly stipend. Which type of enterprise deployment model does this company support? COPE CYOD Corporate-owned BYOD

push notification services

Jabez needs to alert through an SMS text message those corporate users who have a specific brand and type of mobile device regarding a serious malware incident. What technology will she use?

Connecting a mobile device as a peripheral to an infected computer could allow malware to be sent to that device.

Paavo was reviewing a request by an executive for a new subnotebook computer. The executive said that he wanted USB OTG support and asked Paavo's opinion regarding its security. What would Paavo tell him about USB OTG security? a. Subnotebooks do not support USB OTG. b. Connecting a mobile device as a peripheral to an infected computer could allow malware to be sent to that device. c. USB OTG uses strong security and the executive should have no concerns. d. An unsecured mobile device could infect other tethered mobile devices or the corporate network.

Wireless carriers are reluctant to provide firmware OTA updates because of the bandwidth it consumes on their wireless networks.

Pakpao has been asked to provide research regarding a new company initiative to add Android smartphones to a list of approved devices. One of the considerations is how frequently the smartphones receive firmware OTA updates. Which of the following reasons would Pakpao NOT list in his report as a factor in the frequency of Android firmware OTA updates? A. Wireless carriers are reluctant to provide firmware OTA updates because of the bandwidth it consumes on their wireless networks. B. Both OEMs and wireless carriers are hesitant to distribute Google updates because it limits their ability to differentiate themselves from competitors if all versions of Android start to look the same through updates. C. Because many of the OEMs had modified Android, they are reluctant to distribute updates that could potentially conflict with their changes. D. Because OEMs and wireless carriers want to sell as many devices as possible, they have no financial incentive to update mobile devices that users would then continue to use indefinitely.

Brute force attack

Timur was making a presentation regarding how attackers break passwords. His presentation demonstrated the attack technique that is the slowest yet most thorough attack that is used against passwords. Which of these password attacks did he demonstrate? Hybrid attack Custom attack Dictionary attack Brute force attack

single sign-on

Using one authentication credential to access multiple accounts or applications is known as _____. identification authentication single sign-on credentialization federal login

mobile device management (MDM)

What allows a device to be managed remotely? a. mobile device management (MDM) b. mobile application management (MAM) c. mobile resource management (MRM) d. mobile wrapper management (MWM)

It separates personal data from corporate data

What does containerization do? a. It splits operating system functions only on specific brands of mobile devices. b. It separates personal data from corporate data. c. It places all keys in a special vault. d. It slows down a mobile device to half speed.

geofencing

What enforces the location in which an app can function by tracking the location of the mobile device? Graphical Management Tracking (GMT) GPS tagging location resource management geofencing

Cost

What is a disadvantage of biometric readers? Speed Weight Standards Cost

An attack that combines a dictionary attack with a mask attack

What is a hybrid attack? A brute force attack that uses special tables An attack that combines a dictionary attack with a mask attack An attack that slightly alters dictionary words An attack that uses both automated and user input

Multifactor authentication system

What is a token system that requires the user to enter the code along with a PIN called? Multifactor authentication system Dual-prong verification system Token-passing authentication system Single-factor authentication system

geolocation

What is the process of identifying the geographical location of a mobile device?

screen lock

What prevents a mobile device from being used until the user enters the correct passcode? swipe identifier (SW-ID) touch swipe screen timeout screen lock

What you do

Which authentication factor is based on a unique talent that a user possesses? What you know What you do What you have What you are

Height

Which human characteristic is NOT used for biometric identification? Height Iris Retina Fingerprint

Plaintext password

Which of the following should NOT be stored in a secure password database? Plaintext password Password digest Salt Iterations

MMS

Which of the following technologies provides for pictures, video, or audio to be included in text messages? ANT SMS MMS QR

A long password

Which of these is NOT a characteristic of a weak password? Using a predictable sequence of characters Using personal information A common dictionary word A long password

Most sites force users to create weak passwords even though they do not want to.

Which of these is NOT a reason why users create weak passwords? A security policy requires a password to be changed regularly. A lengthy and complex password can be difficult to memorize. Most sites force users to create weak passwords even though they do not want to. Having multiple passwords makes it hard to remember all of them.

Public networks are faster than local networks and can spread malware more quickly to mobile devices.

Which of these is NOT a risk of connecting a mobile device to a public network? a. Public networks are faster than local networks and can spread malware more quickly to mobile devices. b. Public networks are beyond the control of the employee's organization. c. Replay attacks can occur on public networks. d. Public networks may be susceptible to man-in-the-middle attacks.

last known good configuration

Which of these is NOT a security feature for locating a lost or stolen mobile device? remote lockout thief picture alarm last known good configuration

Common Access Card (CAC)

Which of these is a U.S. Department of Defense (DoD) smart card that is used for identification of active-duty and reserve military personnel? Personal Identity Verification (PIV) card Secure ID Card (SIDC) Government Smart Card (GSC) Common Access Card (CAC)

password

Which of these is considered the strongest type of passcode to use on a mobile device? fingerprint swipe password PIN draw connecting dots pattern

HOTP

Which one-time password is event-driven? POTP TOTP HOTP ROTP

physical keyboard

Which technology is NOT a core feature of a mobile device? data synchronization capabilities physical keyboard local non-removable data storage small form factor

MAM

Which tool manages the distribution and control of apps? MAM MCM MDM MFM

RTOS

Which type of OS is typically found on an embedded system? RTOS OTG COPE SoC

Mask attack

Which type of password attack is a more targeted brute force attack that uses placeholders for characters in certain positions of the password? Rule attack Pass the hash attack Mask attack Rainbow attack

It could decrease calls to the help desk.

Why should the account lockout threshold not be set too low? It could decrease calls to the help desk. The network administrator would have to reset the account manually. The user would not have to wait too long to have her password reset. It could result in denial of service (DoS) attacks.

Cognitive

_____ biometrics is related to the perception, thought processes, and understanding of the user. Behavioral Cognitive Intelligent Standard