chapter 8 cyber ops

. The security policy of an organization allows employees to connect to the office intranet from their homes. Which type of security policy is this?

Remote access

In threat intelligence communications, what set of specifications is for exchanging cyberthreat information between organizations?

Structured threat information expression (STIX)

With the evolution of borderless networks, which vegetable is now used to describe a defense-in-depth approach?

Artichoke *

Passwords, passphrases, and PINs are examples of which security term

Authentication *

Which component of AAA is used to determine which resources a user can access and which operations the user is allowed to perform?

Authorization

How does BYOD change the way in which businesses implement networks?

BYOD provides flexibility in where and how users can access network resources.

Which type of business policy establishes the rules of conduct and the responsibilities of employees and employers?

Company *

Which of the following offers a free service called Automated Indicator Sharing that enables the real-time exchange of cyberthreat indicators?

Department of Homeland Security

What device is usually the first line of defense in a layered defense-in-depth approach

Edge router

Which method is used to make data unreadable to unauthorized users?

Encrypt the data.

During the AAA process, when will authorization be implemented

Immediately after successful authentication against an AAA data source *

What is the purpose of mobile device management (MDM) software?

It is used to implement security policies, setting, and software configurations on mobile devices

What is a characteristic of a layered defense-in-depth security approach?

One safeguard failure does not affect the effectiveness of other safeguards. *

Which statement describes a difference between RADIUS and TACACS+?

RADIUS encrypts only the password whereas TACACS+ encrypts all communication

What component of a security policy explicitly defines the type of traffic allowed on a network and what users are allowed and not allowed to do?

Acceptable use policies

Which component of AAA allows an administrator to track individuals who access network resources and any changes that are made to those resources?

Accounting *

What are two characteristics of the RADIUS protocol?

The use of UDP ports for authentication and accounting * Encryption of the password only

What is the principle of least privilege access control model?

Users are granted rights on an as-needed approach.

What is privilege escalation

Vulnerabilities in systems are exploited to grant higher levels of privilege than someone or some process should have

What component of a security policy explicitly defines the type of traffic allowed on a network and what users are allowed and not allowed to do?

acceptable use policies

In a defense-in-depth approach, which three options must be identified to effectively defend a network against attacks?

assets that need protection

Which AAA component can be established using token cards

authentication

Which technology provides the framework to enable scalable access security?

authentication, authorization, and accounting

A company has a file server that shares a folder named Public. The network security policy specifies that the Public folder is assigned Read-Only rights to anyone who can log into the server while the Edit rights are assigned only to the network admin group. Which component is addressed in the AAA network service framework?

authorization

What service determines which resources a user can access along with the operations that a user can perform?

authorization

Which three services are provided by the AAA framework?

authorization authentication accounting

A company is experiencing overwhelming visits to a main web server. The IT department is developing a plan to add a couple more web servers for load balancing and redundancy. Which requirement of information security is addressed by implementing the plan?

availability

A web server administrator is configuring access settings to require users to authenticate first before accessing certain web pages. Which requirement of information security is addressed through the configuration?

confidentiality

Which device is usually the first line of defense in a layered defense-in-depth approach?

edge router

Which two areas must an IT security person understand in order to identify vulnerabilities on a network?

hardware used by applications important applications used

. Which section of a security policy is used to specify that only authorized individuals should have access to enterprise data?

identification and authentication policy

emplyee

identifies salries and pay schedules

What three items are components of the CIA triad? (Choose three.)

integrity availability confidentiality

Which type of access control applies the strictest access control and is commonly used in military or mission critical applications?

mandatory access control (MAC)

company

protects the rights of the workers