CYBR 3100 Final Exam Review (Chapter 6-12)
Intrusion __________ activities finalize the restoration of operations to a normal state and seek to identify the source and method of the intrusion in order to ensure that the same type of attack cannot occur again.
Correction
Alarm filtering may be based on combinations of frequency, similarity in attack signature, similarity in attack target, or other criteria that are defined by the system administrators.
False
An advance-fee fraud attack involves the interception of cryptographic elements to determine keys and encryption algorithms.
False
An effective information security governance program requires constant change.
False
Authentication is a mechanism whereby unverified entities or supplicants who seek access to a resource provide a label by which they are known to the system.
False
Digital forensics involves chemical and microscopic analysis of evidence using computerized laboratory instruments.
False
Discretionary access control is an access control approach whereby the organization specifies use of resources based on the assignment of data classification schemes to resources and clearance levels to users.
False
Encryption methodologies that require the same secret key to encipher and decipher the message are using what is called public key encryption.
False
Hashing functions require the use of keys.
False
In the early stages of planning, the project planner should attempt to specify completion dates only for major employees within the project.
False
The __________ is typically considered the top information security officer in the organization.
CISO
The International Society of Forensic Computer Examiners (ISFCE) offers which certifications?
Certified Computer Examiner (CCE) and Master Certified Computer Examiner (MCCE)
__________ is the requirement that every employee be able to perform the work of another employee.
Task rotation
The capacity of UPS devices is measured using the voltage output rating.
False
The information security function cannot be placed within protective services in an organization's management structure.
False
The most common credential for a CISO-level position is the Security+ certification.
False
Mandatory access controls (MACs)
A required, structured data classification scheme that rates each collection of information as well as each user
__________ benchmark and monitor the status of key system files and detect when an intruder creates, modifies, or deletes monitored files.
HIDPSs
__________ occurs when an authorized person opens a door, and other people, who may or may not be authorized, also enter.
Tailgating
The use of standard job descriptions can increase the degree of professionalism in the information security field.
True
Access Control
A selective method by which systems specify who may use a particular resource and how they may use it. Rely on the following mechanisms: identification, authentication, authorization, and accountability
Discretionary access controls (DACs)
Access controls that are implemented at the discretion or option of the data user
Nondiscretionary controls
Access controls that are implemented by a central authority
Class __________ fires are best extinguished by agents that remove oxygen from the fire.
B
To evaluate the performance of a security system, administrators must establish system performance __________.
Baselines
Class __________ fires are safely extinguished only with non-conducting agents.
C
A(n) __________ is used to justify that the project will be reviewed and verified prior to the development of the project plan.
CBA
The __________ is a center of Internet security expertise and is located at the Software Engineering Institute, a federally funded research and development center operated by Carnegie Mellon University.
CERT/CC
The __________ is an intermediate area between a trusted network and an untrusted network.
DMZ
One approach that can improve the situational awareness of the information security function uses a process known as __________ to quickly identify changes to the internal environment.
Difference analysis
A __________ system is designed to work in areas where electrical equipment is used. Instead of containing water, the system contains pressurized air.
Dry-pipe
__________ is the process of converting an original message into a form that is unreadable to unauthorized individuals.
Encryption
A technique used to compromise a system is known as a(n) ___________.
Exploit
A(n) _________ is an authorization issued by an organization for the repair, modification, or update of a piece of equipment.
FCO
A false positive is the failure of an IDPS system to react to an actual attack event.
False
The parallel operations strategy works well when an isolated group can serve as a test area, which prevents any problems with the new system from dramatically interfering with the performance of the organization as a whole.
False
The work breakdown structure (WBS) can only be prepared with a complex specialized desktop PC application.
False
Water damage from fire suppression systems is considered less dangerous to computer systems than hazardous chemicals like Halon.
False
Activities that scan network locales for active systems and then identify the network services offered by the host systems is known as __________.
Fingerprinting
The Computer __________ and Abuse Act of 1986 is the cornerstone of many computer-related federal laws and enforcement efforts.
Fraud
Technology __________ guides how frequently technical systems are updated, and how technical updates are approved and funded.
Governance
__________ functions are mathematical algorithms that generate a message summary or digest to confirm the identity of a specific message and to confirm that there have not been any changes to the content.
Hash
A(n) __________ works like a burglar alarm in that it detects a violation (some system activities analogous to an opened or broken window) and activates an alarm.
IDPS
The protection of the confidentiality, integrity, and availability of information assets, whether in storage, processing, or transmission, via the application of policy, education, training and awareness, and technology is known as ___________.
Information security
The model commonly used by large organizations places the information security department within the __________ department.
Information technology
Detailed __________ on the highest risk warnings can include identifying which vendor updates apply to which vulnerabilities as well as which types of defenses have been found to work against the specific vulnerabilities reported.
Intelligence
_________ is the entire range of values that can possibly be used to construct an individual key.
Keyspace
Using __________, the system reviews the log files generated by servers, network devices, and even other IDPSs.
LFM
In the __________ process, measured results are compared against expected results.
Negative feedback loop
In a __________ implementation, the entire security system is put in place in a single office, department, or division before expanding to the rest of the organization.
Pilot
Interior walls only partially reach to the next floor, which leaves a space above the ceiling. This space is called a(n) __________.
Plenum
More advanced substitution ciphers use two or more alphabets, and are referred to as __________ substitutions.
Polyalphabetic
By managing the __________, the organization can reduce unintended consequences by having a process to resolve potential conflict and disruption that uncoordinated change can introduce.
Process of change
Using a database of precomputed hashes from sequentially calculated passwords called a(n) __________, an attacker can simply look up a hashed password and read out the text version.
Rainbow table
In most common implementation models, the content filter has two components: __________.
Rating and filtering
A __________ port, also known as a monitoring port, is a specially configured connection on a network device that is capable of viewing all of the traffic that moves through the entire device.
SPAN
The dominant architecture used to secure network access today is the __________ firewall.
Screened subnet
__________ are the technically qualified individuals tasked to configure firewalls, deploy IDSs, implement security software, diagnose and troubleshoot problems, and coordinate with systems and network administrators to ensure that an organization's security technology is properly implemented.
Security technicians
__________ is a cornerstone in the protection of information assets and in the prevention of financial loss.
Separation of duties
Authentication factors
Something you know (password, passphrase); something you have (dumb card, smart card, synchronous tokens, asynchronous tokens); something you are (relies upon individual characteristics, strong authentication)
__________ inspection firewalls keep track of each network connection between internal and external systems.
Stateful
Tasks or action steps that come after the task at hand are called __________.
Successors
A method of encryption that requires the same secret key to encipher and decipher the message is known as __________ encryption.
Symmetric
Accountability
The access control mechanism that ensures all actions on a system—authorized or unauthorized—can be attributed to an authenticated identity. Also known as auditability
Authorization
The access control mechanism that represents the matching of an authenticated entity to a list of information assets and corresponding access levels
identification
The access control mechanism that requires the validation and verification of an unauthenticated entity's purported identity
Authentification
The access control mechanism that requires the validation and verification of an unauthenticated entity's purported identity.
A process called __________ examines the traffic that flows through a system and its associated devices to identifies the most frequently used devices.
Traffic analysis
In IPSec's __________ mode, the data within an IP packet is encrypted, but the header information is not.
Transport
__________ applications use a combination of techniques to detect an intrusion and then trace it back to its source.
Trap and trace
A mandatory vacation provides the organization with the ability to audit the work of an individual.
True
A permutation cipher simply rearranges the values within a block to create the ciphertext.
True
A(n) known vulnerability is a published weakness or fault in an information asset or its protective systems that may be exploited and result in loss.
True
Authentication is the process of validating and verifying an unauthenticated entity's purported identity.
True
Each organization has to determine its own project management methodology for IT and information security projects.
True
If an organization deals successfully with change and has created procedures and systems that can be adjusted to the environment, the existing security improvement program will probably continue to work well.
True
In DNS cache poisoning, valid packets exploit poorly configured DNS servers to inject false information to corrupt the servers' answers to routine DNS queries from other systems on the network.
True
In general, electrostatic discharge damage to chips produces two types of failures: immediate and latent.
True
Lattice-based access control is a form of access control in which users are assigned a matrix of authorizations for particular areas of access.
True
Over time, policies and procedures may become inadequate due to changes in the organization's mission and operational requirements, threats, or the environment.
True
Packet-filtering firewalls scan network data packets looking for compliance with the rules of the firewall's database.
True
Physical security is as important as logical security to an information security program.
True
The Digital Signature Standard established by NIST is used for electronic document authentication by federal information systems. It is based on a variant of the ElGamal algorithm.
True
The primary benefit of a VPN that uses _________ is that an intercepted packet reveals nothing about the true destination system.
Tunnel mode
A device that assures the delivery of electric power without interruption is a(n) __________.
UPS
A __________ is the recorded state of a particular revision of a software or hardware configuration item.
Version
The goal of the project __________ is to resolve any pending project-related issues, critique the overall effort of the project, and draw conclusions about how to improve the project management process for the future.
Wrap-up