itm 350 final

Threat

Aditya is attempting to classify information regarding a new project that his organization will undertake in secret. Which characteristic is not normally used to make these types of classification decisions?

Diffie-Hellman

Alice and Bob would like to communicate with each other using a session key, but they do not already have a shared secret key. Which algorithm can they use to exchange a secret key?

Bob's public key

Alice would like to send a message to Bob securely and wishes to use asymmetric encryption to encrypt the contents of the message. What key does she use to encrypt this message?

Alice's private key

Alice would like to send a message to Bob using a digital signature. What cryptographic key does Alice use to create the digital signature?

Functional policies in support of organization policy

Antivirus, firewall, and email use policies belong to what part of a security policy hierarchy?

Slow virus

Arturo discovers a virus on his system that resides only in the computer's memory and not in a file. What type of virus has he discovered?

Event logs

Biyu is a network administrator. She is developing the compliance aspect of her company's security policy. Currently, she is focused on the records of actions that the organization's operating system or application software creates. What aspect of compliance is Biyu focusing on?

Structured Query Language (SQL) injection

Bob is developing a web application that depends on a backend database. What type of attack could a malicious individual use to send commands through his web application to the database?

Formatting

Bob is preparing to dispose of magnetic media and wishes to destroy the data stored on it. Which method is not a good approach for destroying data?

Session Hijacking

Devaki is investigating an attack. An intruder managed to take over the identity of a user who was legitimately logged in to Devaki's company's website by manipulating Hypertext Transfer Protocol (HTTP) headers. Which type of attack likely took place?

Copies of all software configurations for routers and switches

Donnelly is an IT specialist. He is in charge of the server and network appliances inventory. The infrastructure roadmap calls for a network systems reconfiguration in the next six months. Adina, the security expert, asks Donnelly to prepare a standardized list of all current and proposed equipment and then to present it to her in a hardware configuration chart. What does Adina tell Donnelly that the chart should include?

botnets

Hacking groups create _______ to launch attacks whereby they infect vulnerable machines with agents that perform various functions at the command of the controller.

Need to know

Hajar is a network engineer. She is creating a system of access involving clearance and classification based on users and the objects they need in a secure network. She is restricting access to secure objects by users based on least privilege and which of the following?

Ownership

Janette is the director of her company's network infrastructure group. She is explaining to the business owners the advantages and disadvantages of outsourcing network security. One consideration she presents is the question of who would be responsible for the data, media, and infrastructure. What consideration is she describing?

Wi-Fi Protected Access version 3 (WPA3)

Juan is a wireless security professional. He is selecting a standard for wireless encryption protocols for access points and devices for his agency. For the highest security, which protocol should Juan choose?

Remote Access Tool (RAT)

Karen is a hacker. She wants to access a server and control it remotely. The tool she plans to use is a type of Trojan. What tool will Karen use for this purpose?

Cross-site scripting (XSS)

Larry recently viewed an auction listing on a website. As a result, his computer executed code that popped up a window that asked for his password. What type of attack has Larry likely encountered?

Trojan horse

Lin installed a time-management utility that she downloaded from the Internet. Now several applications are not responding to normal commands. What type of malware did she likely encounter?

Project initiation and planning

Marguerite is creating a budget for a software development project. What phase of the system life cycle is she undertaking?

Decryption

Maria receives a ciphertext message from her colleague Wen. What type of function does Maria need to use to read the plaintext message?

Access to a higher level of expertise

Mark is considering outsourcing security functions to a third-party service provider. What benefit is he most likely to achieve?

Separation of duties

Mia is her company's network security professional. She is developing access policies based on personnel security principles. As part of this effort, she is devising a method of taking high-security tasks and splitting them among several different employees so that no one person is responsible for knowing and performing the entire task. What practice is she developing?

Intimidation

Rodrigo has just received an email at work from an unknown person. The sender claims to have incriminating evidence against Rodrigo and threatens to release it to his employer and his family unless he discloses certain confidential information about his employer's company. Rodrigo does not know that several other people in the organization received the same email. What form of social engineering has occurred?

Blacklisting

Tonya would like to protect her users and the network when users browse to known dangerous sites. She plans to maintain a list of those sites and drop messages from those websites. What type of approach is Tonya advocating?

False

True or False? Mandatory vacations minimize risk by rotating employees among various systems or duties.

True

True or False? Revocation is a security measure that stops authorization for access to data.

True

True or False? Symmetric key ciphers require that both parties first exchange keys to be able to securely communicate.

False

True or False? The U.S. government currently has no standard for creating cryptographic keys for classified applications.

False

True or False? The term certificate authority (CA) refers to a trusted repository of all public keys.

Field theory

ome ciphers, regardless of type, rely on the difficulty of solving certain mathematical problems, which is the basis for asymmetric key cryptography. Which of the following is a branch of mathematics that involves multiplicative inverses that these ciphers use?

False

rue or False? In a known-plaintext attack (KPA), the cryptanalyst has access only to a segment of encrypted data and has no choice as to what that data might be.

Macro virus

Alison is a security professional. A user reports that, after opening an email attachment, every document he saves is in a template format and other Microsoft Word documents will not open. After investigating the issue, Alison determines that the user's Microsoft Office normal.dot template has been damaged, as well as many Word files. What type of virus is the most likely cause?

Cross-site request forgery (XSRF)

Applications represent the most common avenue for users, customers, and attackers to access data, which means you must build the software to enforce the security policy and to ensure compliance with regulations, including the privacy and integrity of both data and system processes. Regardless of the development model, the application must validate all input. Certain attacks can take advantage of weak validation. One such attack provides script code that causes a trusted user who views the input script to send malicious commands to a web server. What is this called?

Confidentiality

Bob is sending a message to Alice. He wants to ensure that nobody can read the content of the message while it is in transit. What goal of cryptography is Bob attempting to achieve?

Integrity

Bob is sending a message to Alice. He wants to ensure that nobody tampers with the message while it is in transit. What goal of cryptography is Bob attempting to achieve?

Alice's public key

Bob received a message from Alice that contains a digital signature. What cryptographic key does Bob use to verify the digital signature?

Authorizing official (AO)

In an accreditation process, who has the authority to approve a system for implementation?

Baseline

Lin is creating a template for the configuration of Windows servers in her organization. The configuration includes the basic security settings that should apply to all systems. What type of document should she create?

Encouraging the adoption of ethical guidelines and standards

Omar is an infrastructure security professional. After reviewing a set of professional ethics issued by his company, he is learning and adopting ethical boundaries in an attempt to demonstrate them to others. What is this called?

Compartmentalized

Rylie is a newly hired cybersecurity expert for a government agency. Rylie used to work in the private sector. She has discovered that, whereas private sector companies often had confusing hierarchies for data classification, the government's classifications are well known and standardized. As part of her training, she is researching data that requires special authorization beyond normal classification. What is this type of data called?

Digital signature

Security objectives add value to relationships between businesses or between businesses and their customers. Which objective binds a message or data to a specific entity?

This scenario is a classic example of a spear phishing attack, highly targeted at an individual and including information about the company.

The chief executive officer (CEO) of a company recently fell victim to an attack. The attackers sent the CEO an email that appeared to come from the company's attorney. The email informed the CEO that his company was being sued and he needed to view a subpoena at a court website. When visiting the website, malicious code was downloaded onto the CEO's computer. What type of attack took place?

True

True or False? A blanket purchase agreement (BPA) creates preapproved accounts with qualified suppliers to fulfill recurring orders for products or services.

False

True or False? A block cipher encrypts one byte (or bit) at a time, whereas a stream cipher encrypts an entire block of data at a time.

False

True or False? A digitized signature is a combination of a strong hash of a message and a secret key.

True

True or False? A functional policy declares an organization's management direction for security in such specific functional areas as email use, remote access, and Internet interaction (including social media).

True

True or False? A keyword mixed alphabet cipher uses a cipher alphabet that consists of a keyword, minus duplicates, followed by the remaining letters of the alphabet.

False

True or False? A private key cipher is also called an asymmetric key cipher.

False

True or False? A product cipher is an encryption algorithm that has no corresponding decryption algorithm.

True

True or False? A salt value is a set of random characters you can combine with an input key to create an encryption key.

True

True or False? A security awareness program should address the requirements and expectations of an organization's security policy.

True

True or False? An algorithm is a repeatable process that produces the same result when it receives the same input.

True

True or False? Change control is the management of changes to the configuration of a system.

False

True or False? Change does not create risk for a business.

True

True or False? Classification scope determines what data to classify; classification process determines how to handle classified data.

True

True or False? Company-related classifications are not standard; therefore, there may be some differences of meaning between the terms "private" and "confidential" in different companies.

False

True or False? Configuration changes can be made at any time during a system life cycle, and no process is required.

True

True or False? Digital signatures require asymmetric key cryptography.

True

True or False? Elliptic curve cryptography (ECC) relies on algebraic structures of elliptic curves over finite fields.

True

True or False? In cryptography, a keyspace is the number of possible keys to a cipher.