CSS310 Final

What level of academic degree requires the shortest period of time to earn and does NOT require any other postsecondary degree as a prerequisite? Doctoral degree Master's degree Associate's degree Bachelor's degree

Associate's degree

Alison discovers that a system under her control has been infected with malware, which is using a key logger to report user keystrokes to a third party. What information security property is this malware attacking? Accounting Availability Confidentiality Integrity

Confidentiality

Maya is creating a computing infrastructure compliant with the Payment Card Industry Data Security Standard (PCI DSS). What type of information is she most likely trying to protect? Health records Trade secrets Credit card information Educational records

Credit card information

Larry recently viewed an auction listing on a website. As a result, his computer executed code that popped up a window that asked for his password. What type of attack has Larry likely encountered? XML injection Cross-site scripting (XSS) Command injection SQL injection

Cross-site scripting (XSS)

What is the highest level of academic degree that may be earned in the field of information security? Master of business administration (MBA) Bachelor of science (BS) Master of science (MS) Doctor of philosophy (PhD)

Doctor of philosophy (PhD)

A business impact analysis (BIA) details the steps to recover from a disruption and restore the infrastructure necessary for normal business operations.

False

Implicit deny is when firewalls look at message addresses to determine whether a message is being sent around an unending loop.

False

In a known-plaintext attack (KPA), the cryptanalyst has access only to a segment of encrypted data, and has no choice as to what that data might be.

False

Jake has been asked to help test the business continuity plan at an offsite location while the system at the main location is shut down. He is participating in a parallel test.

False

Retro viruses counter the ability of antivirus programs to detect changes in infected files.

False

The International Standard Book Number (ISBN) is an IEEE standard.

False

The National Institute of Standards and Technology (NIST) is a nongovernmental organization whose goal is to develop and publish international standards.

False

The National Institute of Standards and Technology (NIST) is the main United Nations agency responsible for managing and promoting information and technology issues.

False

The National Institute of Standards and Technology (NIST) publishes the IEEE 802 LAN/MAN standard family.

False

You must always use the same algorithm to encrypt information and decrypt the same information.

False

Terry is troubleshooting a network that is experiencing high traffic congestion issues. Which device, if present on the network, should be replaced to alleviate these issues? Hub Switch Firewall Router

Hub

A person demonstrates anonymity when posting information to a web discussion site without authorities knowing who he or she is.

True

A salt value is a set of random characters you can combine with an actual input key to create the encryption key.

True

Examples of major disruptions include extreme weather, application failure, and criminal activity.

True

Fencing and mantraps are examples of physical controls.

True

Master of science (MS) degree programs prepare a student to enter the field of information security and perform the work of securing systems.

True

Standards provide guidelines to ensure that products in today's computing environments work together.

True

The Diffie-Hellman (DHE) algorithm is the basis for several common key exchange protocols, including Diffie-Hellman in Ephemeral mode (DHE) and Elliptic Curve DHE (ECDHE).

True

The International Organization for Standardization (ISO) organizes its standards by both the International Classification for Standards (ICS) and the Technical Committee (TC) to which it assigns each standard.

True

The Office of Personnel Management (OPM) requires that federal agencies provide the training suggested by the National Institute of Standards and Technology (NIST) guidelines.

True

The financial industry created the ANSI X9.17 standard to define key management procedures.

True

What wireless security technology contains significant flaws and should never be used? Remote Authentication Dial-In User Service (RADIUS) WPA2 Wi-Fi Protected Access (WPA) Wired Equivalent Privacy (WEP)

Wired Equivalent Privacy (WEP)

What is NOT a service commonly offered by unified threat management (UTM) devices? Content inspection Wireless network access URL filtering Malware inspection

Wireless network access

What type of malicious software allows an attacker to remotely control a compromised computer? Armored virus Polymorphic virus Remote Access Tool (RAT) Worm

Remote Access Tool (RAT)

Which of the following study options provides little to no opportunity for feedback? Self-study programs Certificate programs Graduate programs Undergraduate programs

Self-study programs

Kim is the risk manager for a large organization. She is evaluating whether the organization should purchase a fire suppression system. She consulted a variety of subject matter experts and determined that there is a 1 percent chance that a fire will occur in a given year. If a fire occurred, it would likely cause $2 million in damage to the facility, which has a $10 million value. Given this scenario, what is the exposure factor? 1 percent 10 percent 50 percent 20 percent

20 percent

All request for comments (RFC) originate from the Internet Engineering Task Force (IETF).

False

Master's programs are generally broad and don't focus on a particular field of study.

False

Product cipher is an encryption algorithm that has no corresponding decryption algorithm.

False

The first step in the risk management process is to monitor and control deployed countermeasures.

False

Violet deploys an intrusion prevention system (IPS) on her network as a security control. What type of control has Violet deployed? Detective Deterrent Corrective Preventive

Preventive

Adam's company recently suffered an attack where hackers exploited an SQL injection issue on their web server and stole sensitive information from a database. What term describes this activity? Incursion Outage Incident Event

Incident

A computer virus is an executable program that attaches to, or infects, other executable programs.

True

A keyword mixed alphabet cipher uses a cipher alphabet that consists of a keyword, minus duplicates, followed by the remaining letters of the alphabet.

True

ActiveX is used by developers to create active content.

True

Integrity-checking tools use cryptographic methods to make sure nothing and no one has modified the software.

True

It is common for rootkits to modify parts of the operating system to conceal traces of their presence.

True

Many security training courses specifically prepare students for certification exams.

True

The hash message authentication code (HMAC) is a hash function that uses a key to create a hash, or message digest.

True

Which element is NOT a core component of the ISO 27002 standard? Risk assessment Access control Cryptography Asset management

True

Gary is configuring a Smartphone and is selecting a wireless connectivity method. Which approach will provide him with the highest speed wireless connectivity? 3G Digital subscriber line (DSL) 4G Wi-Fi

Wi-Fi

Bob received a message from Alice that contains a digital signature. What cryptographic key does Bob use to verify the digital signature? Alice's private key Bob's public key Bob's private key Alice's public key

Alice's public key

__________ is a continuous process designed to keep all personnel vigilant.

Awareness

Alice would like to send a message to Bob securely and wishes to encrypt the contents of the message. What key does she use to encrypt this message? Bob's private key Alice's public key Alice's private key Bob's public key

Bob's public key

Which of the following circumstances would NOT trigger mandatory security training for a federal agency under Office of Personnel Management (OPM) guidelines? Change in security environment Change in employee responsibilities Change of senior leadership Change in security procedures

Change of senior leadership

Kim is the risk manager for a large organization. She is evaluating whether the organization should purchase a fire suppression system. She consulted a variety of subject matter experts and determined that there is a 1 percent chance that a fire will occur in a given year. If a fire occurred, it would likely cause $2 million in damage to the facility, which has a $10 million value. Given this scenario, what is the annualized loss expectancy (ALE)?

$20,000

Henry is creating a firewall rule that will allow inbound mail to the organization. What TCP port must he allow through the firewall? 80 53 22 25

25

Which organization created a standard version of the widely used C programming language in 1989? International Organization for Standardization (ISO) Institute of Electrical and Electronics Engineers (IEEE) European Telecommunications Standards Institute (ETSI) American National Standards Institute (ANSI)

American National Standards Institute (ANSI)

Karen would like to use a wireless authentication technology similar to that found in hotels where users are redirected to a webpage when they connect to the network. What technology should she deploy? Captive portal Remote Authentication Dial-In User Service (RADIUS) Lightweight Extensible Authentication Protocol (LEAP) Protected Extensible Authentication Protocol (PEAP)

Captive portal

Alice and Bob would like to communicate with each other using a session key but they do not already have a shared secret key. Which algorithm can they use to exchange a secret key? Rivest, Shamir, Adelman (RSA) Blowfish Diffie-Hellman Message digest algorithm (MD5)

Diffie-Hellman

Which technology category would NOT likely be the subject of a standard published by the International Electrotechnical Commission (IEC)? Encryption Semiconductors Solar energy Consumer appliances

Encryption

Which organization promotes technology issues as an agency of the United Nations? Internet Assigned Numbers Authority (IANA) International Telecommunication Union (ITU) Institute of Electrical and Electronics Engineers (IEEE) American National Standards Institute (ANSI)

International Telecommunication Union (ITU)

Yolanda would like to prevent attackers from using her network as a relay point for a smurf attack. What protocol should she block? Internet Control Message Protocol (ICMP) Hypertext Transfer Protocol (HTTP) User Datagram Protocol (UDP) Transmission Control Protocol (TCP)

Internet Control Message Protocol (ICMP)

What federal agency is charged with the mission of promoting "U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life?" National Aeronautics and Space Administration (NASA) National Institute of Standards and Technology (NIST) Federal Trade Commission (FTC) Federal Communications Commission (FCC)

National Institute of Standards and Technology (NIST)

Hilda is troubleshooting a problem with the encryption of data. At which layer of the OSI Reference Model is she working? Application Presentation Session Data Link

Presentation

Bob has a high-volume virtual private network (VPN). He would like to use a device that would best handle the required processing power. What type of device should he use? Unified threat management (UTM) Router VPN concentrator Firewall

VPN concentrator

What is the only unbreakable cipher when it is used properly? Blowfish Vernam Rivest-Shamir-Adelman (RSA) Elliptic Curve Diffie-Hellman in Ephemeral mode (ECDHE)

Vernam

Nearly any college or university can offer an information systems security or cybersecurity-related degree program once it obtains accreditation for the curriculum from that state's board of education.

True

Network access control (NAC) works on wired and wireless networks.

True

The main purpose of security training courses is to rapidly train students in one or more skills, or to cover essential knowledge in one or more specific areas.

True

The term "web defacement" refers to someone gaining unauthorized access to a web server and altering the index page of a site on the server.

True

Val would like to isolate several systems belonging to the product development group from other systems on the network, without adding new hardware. What technology can she use? Virtual private network (VPN) Firewall Virtual LAN (VLAN) Transport Layer Security (TLS)

Virtual LAN (VLAN)

Val would like to limit the websites that her users visit to those on an approved list of pre-cleared sites. What type of approach is Val advocating? Blacklisting Whitelisting Packet filtering Context-based screening

Whitelisting

What tool might be used by an attacker during the reconnaissance phase of an attack to glean information about domain registrations? Domain Name System (DNS) Ping Whois Simple Network Management Protocol (SNMP)

Whois

Forensics and incident response are examples of __________ controls. deterrent detective corrective preventive

corrective

A(n) _________ is an event that prevents a critical business function (CBF) from operating for a period greater than the maximum tolerable downtime. incident disaster emergency event

disaster

System infectors are viruses that attack document files containing embedded macro programming capabilities.

False

The four primary types of malicious code attacks are unplanned attacks, planned attacks, direct attacks, and indirect attacks. Group of answer choices

False

Which of the following is NOT an advantage to undertaking self-study of information security topics? Fixed pace Self-motivation Low cost Flexible materials

Fixed pace

What type of firewall security feature limits the volume of traffic from individual hosts? Network separation Loop protection Stateful inspection Flood guard

Flood guard

Juan comes across documentation from his organization related to several information security initiatives using different standards as their reference. Which International Organization for Standardization (ISO) standard provides current guidance on information security management? ISO 27002 ISO 17799 ISO 9000 ISO 14001

ISO 27002

When Patricia receives a message from Gary, she wants to be able to demonstrate to Sue that the message actually came from Gary. What goal of cryptography is Patricia attempting to achieve? Integrity Nonrepudiation Confidentiality Authentication

Nonrepudiation

Beth is conducting a risk assessment. She is trying to determine the impact a security incident will have on the reputation of her company. What type of risk assessment is best suited to this type of analysis? Objective Quantitative Financial Qualitative

Qualitative

Which data source comes first in the order of volatility when conducting a forensic investigation? Swap and paging files Logs RAM Data files on disk

RAM

What firewall approach is shown in the figure? Bastion host Screened subnet Border firewall Multilayered firewall

Screened subnet

What type of network device normally connects directly to endpoints and uses MAC-based filtering to limit traffic flows? Switch Hub Router Access point

Switch

Which set of characteristics describes the Caesar cipher accurately?

Symmetric, stream, substitution

Purchasing an insurance policy is an example of the ____________ risk management strategy. reduce avoid transfer accept

transfer

What ISO security standard can help guide the creation of an organization's security policy? 42053 17259 27002 12333

27002

Henry's last firewall rule must allow inbound access to a Windows Terminal Server. What port must he allow? 3389 989 143 443

3389

What series of Special Publications does the National Institute of Standards and Technology (NIST) produce that covers information systems security activities? 800 600 700 900

800

Which Institute of Electrical and Electronics Engineers (IEEE) standard covers wireless LANs? 802.16 802.18 802.11 802.3

802.11

Donna is building a security awareness program designed to meet the requirements of the Payment Card Industry Data Security Standard (PCI DSS) 3.2. How often must she conduct training for all current employees? Semi-annually Biannually Monthly Annually

Annually

Mary is designing a software component that will function at the Presentation Layer of the Open Systems Interconnection (OSI) model. What other two layers of the model will her component need to interact with? Session and Transport Network and Session Application and Session Application and Transport

Application and Session

Norm recently joined a new organization. He noticed that the firewall technology used by his new firm opens separate connections between the devices on both sides of the firewall. What type of technology is being used? Stateful inspection Network address translation Application proxying Packet filtering

Application proxying

What is NOT one of the four main purposes of an attack? Data modification Data import Denial of availability Launch point

Data import

What is a key principle of risk management programs? Apply controls in ascending order of risk. Security controls should be protected through the obscurity of their mechanisms. Don't spend more to protect an asset than it is worth. Risk avoidance is superior to risk mitigation.

Don't spend more to protect an asset than it is worth.

What protocol is responsible for assigning IP addresses to hosts on most networks? Dynamic Host Configuration Protocol (DHCP) Transport Layer Security (TLS) Virtual LAN (VLAN) Simple Mail Transfer Protocol (SMTP)

Dynamic Host Configuration Protocol (DHCP)

What type of security communication effort focuses on a common body of knowledge? Acceptable use policy (AUP) Education Emails Professional development

Education

A physical courier delivering an asymmetric key is an example of in-band key exchange.

False

A professional certification is typically offered as part of an evening curriculum thatleads to a certificate of completion.

False

A subnet mask is a partition of a network based on IP addresses.

False

The standard bachelor's designation is a two-year degree program.

False

How many years of post-secondary education are typically required to earn a bachelor's degree in a non-accelerated program? Six Two Three Four

Four

What type of function generates the unique value that corresponds to the contents of a message and is used to create a digital signature? Elliptic curve Hash Encryption Decryption

Hash

What type of system is intentionally exposed to attackers in an attempt to lure them out? Honeypot Database server Web server Bastion host

Honeypot

Brian needs to design a control that prevents piggybacking, only allowing one person to enter a facility at a time. What type of control would best meet this need? Video surveillance Motion detectors Biometrics Mantraps

Mantraps

What term describes the longest period of time that a business can survive without a particular critical system? Recovery time objective (RTO) Emergency operations center (EOC) Recovery point objective (RPO) Maximum tolerable downtime (MTD)

Maximum tolerable downtime (MTD)

What government agency sponsors the National Centers of Academic Excellence (CAE) for the Cyber Operations Program? Central Intelligence Agency (CIA) National Institute of Standards and Technology (NIST) National Security Agency (NSA) Federal Bureau of Investigation (FBI)

National Security Agency (NSA)

A wireless access point (WAP) is the connection between a wired and wireless network.

True

Administrative controls develop and ensure compliance with policy and procedures.

True

An electronic mail bomb is a form of malicious macro attack that typically involves an email attachment that contains macros designed to inflict maximum damage.

True

Attacks against confidentiality and privacy, data integrity, and availability of services are all ways malicious code can threaten businesses.

True

Because people inside an organization generally have more detailed knowledge of the IT infrastructure than outsiders do, they can place logic bombs more easily.

True

Defense in depth is the practice of layering defenses to increase overall security and provide more reaction time to respond to incidents.

True

Deterrent controls identify that a threat has landed in your system.

True

In a chosen-ciphertext attack, cryptanalysts submit data coded with the same cipher and key they are trying to break to the decryption device to see either the plaintext output or the effect the decrypted message has on some system.

True

Message authentication confirms the identity of the person who started a correspondence.

True

Security awareness training should remind employees to ensure confidentiality by not leaving any sensitive information or documents on their desks.

True

TCP/IP is a suite of protocols that operates at both the Network and Transport layers of the OSI Reference Model.

True

The International Electrotechnical Commission (IEC) was instrumental in the development of standards for electrical measurements, including gauss, hertz, and weber.

True

Visa, MasterCard, and other payment card vendors helped to create the Payment Card Industry Data Security Standard (PCI DSS).

True

Whereas a master of science (MS) program prepares students to perform information security work, a master of business administration (MBA) program prepares students to manage and maintain the people and environment of information security.

True

A personnel safety plan should include an escape plan.

true