EXAM 2 FULL STUDY GUIDE
Donna is building a security awareness program designed to meet the requirements of the Payment Card Industry Data Security Standard (PCI DSS) 3.2. How often must she conduct training for all current employees? :Monthly Semi-annually Annually Biannually
Annually
Mary is designing a software component that will function at the Presentation Layer of the Open Systems Interconnection (OSI) model. What other two layers of the model will her component need to interact with? Network and Session Session and Transport Application and Session Application and Transport
Application and Session
Taylor is a security professional working for a retail organization. She is hiring a firm to conduct the Payment Card Industry Data Security Standard (PCI DSS) required quarterly vulnerability scans. What credential should she seek in a vendor? Qualified security assessor (QSA) Self-assessment vendor (SAV) Approved scanning vendor (ASV) Independent Scanning Assessor (ISA)
Approved scanning vendor (ASV)
What level of academic degree requires the shortest period of time to earn and does NOT require any other postsecondary degree as a prerequisite? Bachelor's degree Master's degree Doctoral degree Associate's degree
Associate's degree
Which of the following is NOT a role described in DoD Directive 8140, which covers cyber security training? Attack Protect and defend Operate and maintain Investigate
Attack
Howard is leading a project to commission a new information system that will be used by a federal government agency. He is working with senior officials to document and accept the risk of operation prior to allowing use. What step of the risk management framework is Howard completing? Implement security controls in IT systems. Assess security controls for effectiveness. Authorize the IT system for processing. Continuously monitor security controls.
Authorize the IT system for processing.
Alice would like to send a message to Bob securely and wishes to encrypt the contents of the message. What key does she use to encrypt this message? Answers: Alice's public key Alice's private key Bob's public key Bob's private key
Bob's public key
Joe is the CEO of a company that handles medical billing for several regional hospital systems. How would Joe's company be classified under the Health Insurance Portability and Accountability Act (HIPAA)? Covered entity as a health plan Covered entity as a healthcare clearinghouse Covered entity as a provider Business associate of a covered entity
Business associate of a covered entity
Jim is an experienced security professional who recently accepted a position in an organization that uses Check Point firewalls. What certification can Jim earn to demonstrate his ability to administer these devices? CISSP CCIE Security+ CCSA
CCSA
Rod has been a Certified Information Systems Security Professional (CISSP) for 10 years. He would like to earn an advanced certification that demonstrates his ability in information security architecture. Which of the following CISSP concentrations would meet Rod's needs? CISSP-ISASP CISSP-ISSEP CISSP-ISSMP CISSP-ISSAP
CISSP-ISSAP
Karen would like to use a wireless authentication technology similar to that found in hotels where users are redirected to a webpage when they connect to the network. What technology should she deploy? Answers: Remote Authentication Dial-In User Service (RADIUS) Lightweight Extensible Authentication Protocol (LEAP) Captive portal Protected Extensible Authentication Protocol (PEAP)
Captive portal
Which information security objective allows trusted entities to endorse information? Answers: Validation Authorization Certification Witnessing
Certification
Richard would like to earn a certification that demonstrates his ability to manage the information security function. What certification would be most appropriate for Richard? Certified Information Security Manager (CISM) Certified Information Systems Auditor (CISA) Certified in the Governance of Enterprise IT (CGEIT) Certified in Risk and Information Systems Control (CRISC)
Certified Information Security Manager (CISM)
Which of the following certifications cannot be used to satisfy the security credential requirements for the advanced Certified Internet Webmaster (CIW) certifications? Security+ GIAC Certified Firewall Analyst (GCFW) Certified Information Security Manager (CISM) Certified Information Systems Security Professional (CISSP)
Certified Information Security Manager (CISM)
What certification focuses on information systems audit, control, and security professionals? Certified Information Security Manager (CISM) Certified Information Systems Auditor (CISA) Certified in the Governance of Enterprise IT (CGEIT) Certified in Risk and Information Systems Control (CRISC)
Certified Information Systems Auditor (CISA)
Which of the following certifications is considered the flagship Information Systems Security Certification Consortium, Inc. (ISC) 2 certification and the gold standard for information security professionals? Certified Authorization Professional (CAP) Certified Cloud Security Professional (CCSP) Certified Information Systems Security Professional (CISSP) Systems Security Certified Practitioner (SSCP)
Certified Information Systems Security Professional (CISSP)
Colin is a software developer. He would like to earn a credential that demonstrates to employers that he is well educated on software security issues. What certification would be most suitable for this purpose? Certified Information Systems Security Professional (CISSP) Certified Secure Software Lifecycle Professional (CSSLP) Certified Cyber Forensics Professional (CCFP) HealthCare Certified Information Security Privacy Practitioner (HCISPP)
Certified Secure Software Lifecycle Professional (CSSLP)
Which of the following circumstances would NOT trigger mandatory security training for a federal agency under Office of Personnel Management (OPM) guidelines? Change of senior leadership Change in security environment Change in security procedures Change in employee responsibilities
Change of senior leadership
Federal agencies are required to name a senior official in charge of information security. What title is normally given to these individuals? Chief information officer (CIO) Chief technology officer (CTO) Chief information security officer (CISO) Chief financial officer (CFO)
Chief information security officer (CISO)
Betty visits a local library with her young children. She notices that someone using a computer terminal in the library is visiting pornographic websites. What law requires that the library filter offensive web content for minors? Children's Online Privacy Protection Act (COPPA) Sarbanes-Oxley Act (SOX) Family Educational Rights and Privacy Act (FERPA) Children's Internet Protection Act (CIPA)
Children's Internet Protection Act (CIPA)
Which of the following Cisco certifications demonstrates the most advanced level of security knowledge? Cisco Certified Technician (CCT) Security Cisco Certified Network Associate (CCNA) Security Cisco Certified Network Professional (CCNP) Security Cisco Certified Internetwork Expert (CCIE) Security
Cisco Certified Internetwork Expert (CCIE) Security
Alison discovers that a system under her control has been infected with malware, which is using a key logger to report user keystrokes to a third party. What information security property is this malware attacking? Integrity Availability Accounting Confidentiality
Confidentiality
Alan withdraws cash from an ATM belonging to Bank X that is coming from his account with Bank Y. What is Alan's relationship with Bank X? Owner Covered entity Business associate Consumer
Consumer
Maya is creating a computing infrastructure compliant with the Payment Card Industry Data Security Standard (PCI DSS). What type of information is she most likely trying to protect? Health records Credit card information Educational records Trade secrets
Credit card information
Larry recently viewed an auction listing on a website. As a result, his computer executed code that popped up a window that asked for his password. What type of attack has Larry likely encountered? SQL injection Command injection XML injection Cross-site scripting (XSS)
Cross-site scripting (XSS)
What program, released in 2013, is an example of ransomware? BitLocker Crypt0L0cker FileVault CryptoVault
Crypt0L0cker
Which element is NOT a core component of the ISO 27002 standard? Risk assessment Cryptography Asset management Access control
Cryptography
Alan withdraws cash from an ATM belonging to Bank X that is coming from his account with Bank Y. What is Alan's relationship with Bank Y? Customer Covered entity Business associate Consumer
Customer
What is NOT one of the four main purposes of an attack? Denial of availability Data import Data modification Launch point
Data import
Betty receives a cipher text message from her colleague Tim. What type of function does Betty need to use to read the plaintext message? Answers: Encryption Hashing Decryption Validation
Decryption
What is the highest level of academic degree that may be earned in the field of information security? Bachelor of science (BS) Master of business administration (MBA) Doctor of philosophy (PhD) Master of science (MS)
Doctor of philosophy (PhD)
What type of security communication effort focuses on a common body of knowledge? Emails Acceptable use policy (AUP) Education Professional development
Education
What type of security communication effort focuses on a common body of knowledge? Emails Acceptable use policy (AUP) Education Professional development
Education
Tonya is working with a team of subject matter experts to diagnose a problem with her system. The experts determine that the problem likely resides at the Presentation Layer of the Open Systems Interconnection (OSI) model. Which technology is the most likely suspect? User interface Encryption Routing Signaling
Encryption
Which technology category would NOT likely be the subject of a standard published by the International Electrotechnical Commission (IEC)? Semiconductors Solar energy Encryption Consumer appliances
Encryption
Which organization creates information security standards that specifically apply within the European Union? International Telecommunication Union (ITU) American National Standards Institute (ANSI) European Telecommunications Standards Institute (ETSI) Cyber Security Technical Committee (TC CYBER) Institute of Electrical and Electronics Engineers (IEEE)
European Telecommunications Standards Institute (ETSI) Cyber Security Technical Committee (TC CYBER)
What mathematical problem forms the basis of most modern cryptographic algorithms? answers: Factoring large primes Traveling salesman problem Quantum mechanics Birthday problem
Factoring large primes
A professional certification is typically offered as part of an evening curriculum that leads to a certificate of completion. True False
False
A professional certification is typically offered as part of an evening curriculum thatleads to a certificate of completion. True False
False
A worm is a self-contained program that has to trick users into running it. True False
False
Advantages of self-study programs include self-motivation, low-cost, and interaction with other students or an instructor. True False
False
All request for comments (RFC) originate from the Internet Engineering Task Force (IETF). True False
False
Cisco offers certifications only at the Associate, Professional, and Expert levels. True False
False
In general, security training programs are identical to security education programs with respect to their focus on skills and in their duration. True False
False
Information Systems Security Certification Consortium, Inc. (ISC)2 is the baseline for federal and DoD work-role definitions. True False
False
Most prospective employers value unaccredited programs as much as accredited programs. True False
False
Privacy is the process used to keep data private. True Fals
False
Privacy is the process used to keep data private. True False
False
Retro viruses counter the ability of antivirus programs to detect changes in infected files. True False
False
Sarbanes-Oxley Act (SOX) Section 404 compliance requirements are highly specific. True False
False
Special Publications (SPs) are standards created by the National Institute of Standards and Technology (NIST). True False
False
Spyware does NOT use cookies. True False
False
System infectors are viruses that attack document files containing embedded macro programming capabilities. True False
False
The CISSP-ISSEP concentration requires that a candidate demonstrate two years of professional experience in the area of architecture. True False
False
The Centers for Medicare & Medicaid Services (CMS) investigates and responds to complaints from people who claim that a covered entity has violated the Health Insurance Portability and Accountability Act (HIPAA). True False
False
The Certified Secure Software Lifecycle Professional (CSSLP) credential measures the knowledge and skills necessary for professionals involved in the process of authorizing and maintaining information systems. True False
False
The Family Educational Rights and Privacy Act (FERPA) requires that specific information security controls be implemented to protect student records. True False
False
The Gramm-Leach-Bliley Act (GLBA) applies to the financial activities of both consumers and privately held companies. True False
False
The ISACA Certified in Risk and Information Systems Control (CRISC) certification targets security professionals who ensure that their organization satisfies IT governance requirements. True False
False
The International Standard Book Number (ISBN) is an IEEE standard. True False
False
The National Institute of Standards and Technology (NIST) is a nongovernmental organization whose goal is to develop and publish international standards. True False
False
The National Institute of Standards and Technology (NIST) is the main United Nations agency responsible for managing and promoting information and technology issues. True False
False
The National Institute of Standards and Technology (NIST) publishes the IEEE 802 LAN/MAN standard family. True False
False
The Payment Card Industry (PCI) Council has only one priority: to assist merchants and financial institutions in understanding and implementing standards for security policies, technologies, and ongoing processes that protect their payment systems from breaches and theft of cardholder data. True False
False
The four main areas in NIST SP 800-50 are awareness, training, certification, and professional development. True False
False
The four primary types of malicious code attacks are unplanned attacks, planned attacks, direct attacks, and indirect attacks. True False
False
The main goal of the Gramm-Leach-Bliley Act (GLBA) is to protect investors from financial fraud. True False
False
The skills necessary to manage a technical environment are the same as the skills necessary to perform technical work. True False
False
The standard bachelor's designation is a two-year degree program. True False
False
The standard bachelor's designation is a two-year degree program. True False
False
Trojans are self-contained programs designed to propagate from one host machine to another using the host's own network communications protocols. True False
False
Under the Gramm-Leach-Bliley Act (GLBA), a customer is any person who gets a consumer financial product or service from a financial institution. True False
False
Under the Health Insurance Portability and Accountability Act (HIPAA), a security incident is any impermissible use or disclosure of unsecured PHI that harms its security or privacy. True False
False
What entity is responsible for overseeing compliance with Family Educational Rights and Privacy Act (FERPA)? Family Policy Compliance Office (FPCO) Department of Defense (DOD) Federal Communications Commission (FCC) Federal Trade Commission (FTC)
Family Policy Compliance Office (FPCO)
What is NOT a common motivation for attackers? Answers: Money Fame Revenge Fear
Fear
Which of the following agencies is NOT involved in the Gramm-Leach-Bliley Act (GLBA) oversight process? Securities and Exchange Commission (SEC) Federal Trade Commission (FTC) Federal Deposit Insurance Corporation (FDIC) Federal Communications Commission (FCC)
Federal Communications Commission (FCC)
Donna is building a security awareness program designed to meet the requirements of the Payment Card Industry Data Security Standard (PCI DSS) 3.2. How often must she conduct training for all current employees? Monthly Semi-annually Annually Biannually
Annually
Erin is a system administrator for a federal government agency. What law contains guidance on how she may operate a federal information system? Family Educational Rights and Privacy Act (FERPA) Federal Information Security Management Act (FISMA) Gramm-Leach-Bliley Act (GLBA) Sarbanes-Oxley (SOX) Act
Federal Information Security Management Act (FISMA)
David would like to connect a fibre channel storage device to systems over a standard data network. What protocol can he use? Answers: Internet Small Computer System Interface (iSCSI) Fibre Channel (FC) Fibre Channel over Ethernet (FCoE) Secure Shell (SSH)
Fibre Channel over Ethernet (FCoE)
Norm recently joined a new organization. He noticed that the firewall technology used by his new firm opens separate connections between the devices on both sides of the firewall. What type of technology is being used? Answers: Packet filtering Application proxying Stateful inspection Network address translation
Application proxying
Which of the following is NOT an advantage to undertaking self-study of information security topics? Self-motivation Flexible materials Fixed pace Low cost
Fixed pace
What type of firewall security feature limits the volume of traffic from individual hosts? Answers: Loop protection Network separation Stateful inspection Flood guard
Flood guard
Jonas is an experienced information security professional with a specialized focus on evaluating computers for evidence of criminal or malicious activity and recovering data. Which GIAC certification would be most appropriate for Jonas to demonstrate his abilities? GIAC Systems and Network Auditor (GSNA) GIAC Certified Forensic Examiner (GCFE) GIAC Certified Firewall Analyst (GCFW) GIAC Certified Penetration Tester (GPEN)
GIAC Certified Forensic Examiner (GCFE)
Vincent recently went to work for a hospital system. He is reading about various regulations that apply to his new industry. What law applies specifically to health records? Health Insurance Portability and Accountability Act (HIPAA) Sarbanes-Oxley (SOX) Act Payment Card Industry Data Security Standard (PCI DSS) Gramm-Leach-Bliley Act (GLBA)
Health Insurance Portability and Accountability Act (HIPAA)
What type of system is intentionally exposed to attackers in an attempt to lure them out? Honeypot Bastion host Web server Database server
Honeypot
Gary is troubleshooting a security issue on an Ethernet network and would like to look at the Ethernet standard. What publication should he seek out? NIST 800-53 IEEE 802.3 ANSI x.1199 ISO 17799
IEEE 802.3
What organization offers a variety of security certifications that are focused on the requirements of auditors? International Information Systems Security Certification Consortium, Inc. (ISC)2 CompTIA Global Information Assurance Certification (GIAC) ISACA
ISACA
Juan comes across documentation from his organization related to several information security initiatives using different standards as their reference. Which International Organization for Standardization (ISO) standard provides current guidance on information security management? ISO 17799 ISO 9000 ISO 27002 ISO 14001
ISO 27002
Gary is sending a message to Patricia. He wants to ensure that nobody tampers with the message while it is in transit. What goal of cryptography is Gary attempting to achieve? answers: Confidentiality Integrity Authentication Nonrepudiation
Integrity
Tim is implementing a set of controls designed to ensure that financial reports, records, and data are accurately maintained. What information security goal is Tim attempting to achieve? Integrity Accountability Availability Confidentiality
Integrity
Fran is interested in learning more about the popular Certified Ethical Hacker (CEH) credential. What organization should she contact? High Tech Crime Network International Council of E-Commerce Consultants (EC-Council) Software Engineering Institute - Carnegie Mellon University The International Society of Forensic Computer Examiners
International Council of E-Commerce Consultants (EC-Council)
Which cryptographic attack offers cryptanalysts the most information about how an encryption algorithm works? Answers: Chosen plaintext Ciphertext only Known plaintext Chosen ciphertext
Chosen plaintext
DoD Directive 8570.01 is a voluntary certification requirement. True False
False
What certification organization began as an offshoot of the SANS Institute training programs? International Information Systems Security Certification Consortium, Inc. (ISC)2 CompTIA Certified Internet Webmaster (CIW) Global Information Assurance Certification (GIAC)
Global Information Assurance Certification (GIAC)
Terry is troubleshooting a network that is experiencing high traffic congestion issues. Which device, if present on the network, should be replaced to alleviate these issues? Answers: Firewall Hub Switch Router
Hub
What federal government agency is charged with the responsibility of creating information security standards and guidelines for use within the federal government and more broadly across industries? National Security Administration (NSA) National Institute of Standards and Technology (NIST) Department of Defense (DoD) Federal Communications Commission (FCC)
National Institute of Standards and Technology (NIST)
Adam discovers a virus on his system that is using encryption to modify itself. The virus escapes detection by signature-based antivirus software. What type of virus has he discovered? Answers: Polymorphic virus Stealth virus Cross-platform virus Multipartite virus
Polymorphic virus
Hilda is troubleshooting a problem with the encryption of data. At which layer of the OSI Reference Model is she working? Answers: Application Presentation Session Data Link
Presentation
Which of the following programs requires passing a standardized examination that is based upon a job-task analysis? Certificate of completion Professional certification Bachelor's degree Doctoral degree
Professional certification
Bob is developing a web application that depends upon a database backend. What type of attack could a malicious individual use to send commands through his web application to the database? Cross-site scripting (XSS) XML injection SQL injection LDAP injection
SQL injection
What firewall approach is shown in the figure? Answers: Border firewall Bastion host Screened subnet Multilayered firewall
Screened subnet
A GIAC credential holder may submit a technical paper that covers an important area of information security. If the paper is accepted, it adds the Gold credential to the base GIAC credential. True False
True
A successful denial of service (DoS) attack may create so much network congestion that authorized users cannot access network resources. True False
True
Distance learning is another term for online study. True False
True
You must always use the same algorithm to encrypt information and decrypt the same information. Answers: true or false
false
A keyword mixed alphabet cipher uses a cipher alphabet that consists of a keyword, minus duplicates, followed by the remaining letters of the alphabet true or false
true
Digital signatures require asymmetric key cryptography. true or false
true
What file type is least likely to be impacted by a file infector virus? .exe .docx .com .dll
.docx
Bill is conducting an analysis of a new IT service. He would like to assess it using the Open Systems Interconnection (OSI) model and would like to learn more about this framework. What organization should he turn to for the official definition of OSI? Ocean Surveillance Information System (OSIS) International Organization for Standardization (ISO) National Institute of Standards and Technology (NIST) Information Systems Audit and Control Association (ISACA)
International Organization for Standardization (ISO)
Which organization promotes technology issues as an agency of the United Nations? International Telecommunication Union (ITU) Institute of Electrical and Electronics Engineers (IEEE) American National Standards Institute (ANSI) Internet Assigned Numbers Authority (IANA)
International Telecommunication Union (ITU)
Yolanda would like to prevent attackers from using her network as a relay point for a smurf attack. What protocol should she block? Hypertext Transfer Protocol (HTTP) Transmission Control Protocol (TCP) Internet Control Message Protocol (ICMP) User Datagram Protocol (UDP)
Internet Control Message Protocol (ICMP)
Which of the following graduate degree programs focuses on managing the process of securing information systems, rather than the technical aspects of information security? MBA MS MSc MScIT
MBA
Alison retrieved data from a company database containing personal information on customers. When she looks at the SSN field, she sees values that look like this: "XXX-XX-9142." What has happened to these records? Encryption Truncation Hashing Masking
Masking
Helen is an experienced information security professional who earned a four-year degree while a full-time student. She would like to continue her studies on a part-time basis. What is the next logical degree for Helen to earn? Bachelor's degree Master's degree Doctoral degree Associate's degree
Master's degree
What federal agency is charged with the mission of promoting "U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life?" National Institute of Standards and Technology (NIST) Federal Communications Commission (FCC) Federal Trade Commission (FTC) National Aeronautics and Space Administration (NASA)
National Institute of Standards and Technology (NIST)
What government agency sponsors the National Centers of Academic Excellence (CAE) for the Cyber Operations Program? National Security Agency (NSA) Central Intelligence Agency (CIA) Federal Bureau of Investigation (FBI) National Institute of Standards and Technology (NIST)
National Security Agency (NSA)
Which term accurately describes Layer 3 of the Open Systems Interconnection (OSI) model? Network Application Physical Session
Network
Brian would like to conduct a port scan against his systems to determine how they look from an attacker's viewpoint. What tool can he use for this purpose? Ping Simple Network Management Protocol (SNMP) agent Nmap Remote Access Tool (RAT)
Nmap
When Patricia receives a message from Gary, she wants to be able to demonstrate to Sue that the message actually came from Gary. What goal of cryptography is Patricia attempting to achieve? Answers: Confidentiality Integrity Authentication Nonrepudiation
Nonrepudiation
Which of the following allows a certificate authority (CA) to revoke a compromised digital certificate in real time? Answers: Certificate revocation list (CRL)International Data Encryption Algorithm (IDEA) Transport Layer Security (TLS) Online Certificate Status Protocol (OCSP)
Online Certificate Status Protocol (OCSP)
Brian is the information security training officer for a health care provider. He wants to develop a training program that complies with the provisions of Health Insurance Portability and Accountability Act (HIPAA). Which of the following topics must be included? Password management Medical records formats Prescribing procedures Patient safety
Password management
A security awareness program that focuses on an organization's Bring Your Own Device (BYOD) policy is designed to cover the use of what type of equipment? Servers Workstations Printers Personally owned device
Personally owned devices
Which document is the initial stage of a standard under the Internet Engineering Task Force (IETF) process? Proposed Standard (PS) Draft Standard (DS) Standard (STD) Best Current Practice (BCP)
Proposed Standard (PS)
What type of organizations are required to comply with the Sarbanes-Oxley (SOX) Act? Non-profit organizations Publicly traded companies Government agencies Privately held companies
Publicly traded companies
Which approach to cryptography provides the strongest theoretical protection? Answers: Quantum cryptography Asymmetric cryptography Elliptic curve cryptography Classic cryptography
Quantum cryptography
What type of malicious software allows an attacker to remotely control a compromised computer? Worm Polymorphic virus Remote Access Tool (RAT) Armored virus
Remote Access Tool (RAT)
What type of publication is the primary working product of the Internet Engineering Task Force (IETF)? Special Publication (SP) Request for comment (RFC) ISO standard Public service announcement (PSA)
Request for comment (RFC)
Under the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, what type of safeguards must be implemented by all covered entities, regardless of the circumstances? Addressable Standard Security Required
Required
What type of security role is covered by the Committee on National Security Systems (CNSS) Training Standard CNSS-4016? Senior System Managers System Administrators Information Assurance Officers Risk Analysts
Risk Analysts
What is NOT a symmetric encryption algorithm? Rivest-Shamir-Adelman (RSA) Data Encryption Standard (DES) International Data Encryption Algorithm (IDEA) Carlisle Adams Stafford Tavares (CAST)
Rivest-Shamir-Adelman (RSA)
Taylor is preparing to submit her company's Payment Card Industry Data Security Standard (PCI DSS)self-assessment questionnaire. The company uses a payment application that is connected to the Internet but does not conduct e-commerce. What self-assessment questionnaire (SAQ) should she use? SAQ A SAQ B SAQ C SAQ D
SAQ C
Helen has no experience in security. She would like to earn a certification that demonstrates that she has the basic knowledge necessary to work in the information security field. What certification would be an appropriate first step for her? Certified Information Systems Security Professional (CISSP) GIAC Security Expert (GSE) Security+ CompTIA Advanced Security Practitioner (CASP)
Security+
What type of security role is covered by the Committee on National Security Systems (CNSS) Training Standard CNSS-4012? Senior System Managers System Administrators Information Assurance Officers Risk Analysts
Senior System Manager
Gwen is investigating an attack. An intruder managed to take over the identity of a user who was legitimately logged into Gwen's company's website by manipulating Hypertext Transfer Protocol (HTTP) headers. Which type of attack likely took place? Session hijacking XML injection Cross-site scripting SQL injection
Session hijacking
Barbara is investigating an attack against her network. She notices that the Internet Control Message Protocol (ICMP) echo replies coming into her network far exceed the ICMP echo requests leaving her network. What type of attack is likely taking place? Answers: Teardrop Land Smurf Cross-site scripting (XSS)
Smurf
The CEO of Kelly's company recently fell victim to an attack. The attackers sent the CEO an email informing him that his company was being sued and he needed to view a subpoena at a court website. When visiting the website, malicious code was downloaded onto the CEO's computer. What type of attack took place? Spear phishing Pharming Adware Command injection
Spear phishing
What is NOT an area where the Internet Architecture Board (IAB) provides oversight on behalf of the Internet Engineering Task Force (IETF)? Architecture for Internet protocols and procedures Editorial and publication procedures for requests for comments (RFCs) Confirmation of IETF chairs Subject matter expertise on routing and switching
Subject matter expertise on routing and switching
What type of network device normally connects directly to endpoints and uses MAC-based filtering to limit traffic flows? Answers: Router Hub Access point Switch
Switch
Which set of characteristics describes the Caesar cipher accurately? answers: Asymmetric, block, substitution Asymmetric, stream, transposition Symmetric, stream, substitution Symmetric, block, transposition
Symmetric, stream, substitution
Which type of virus targets computer hardware and software startup functions? Hardware infector System infector File infector Data infector
System infector
Ben is working toward a position as a senior security administrator and would like to earn his first International Information Systems Security Certification Consortium, Inc. (ISC) 2 certification. Which certification is most appropriate for his needs? Systems Security Certified Practitioner (SSCP) Certified Information Systems Security Professional (CISSP) Certified Secure Software Lifecycle Professional (CSSLP) Certified Cloud Security Professional (CCSP)
Systems Security Certified Practitioner (SSCP)
Bobbi recently discovered that an email program used within her healthcare practice was sending sensitive medical information to patients without using encryption. She immediately corrected the problem because it violated the company's security policy and standard rules. What level of the Health Insurance Portability and Accountability Act (HIPAA) violation likely took place? Tier A Tier B Tier C Tier D
Tier A
Which of the following items would generally NOT be considered personally identifiable information (PII)? Name Driver's license number Trade secret Social Security number
Trade secret
Breanne's system was infected by malicious code after she installed an innocent-looking solitaire game that she downloaded from the Internet. What type of malware did she likely encounter? Virus Worm Trojan horse Logic bomb
Trojan horse
A certificate of completion is a document that is given to a student upon completion of a continuing education program and is signed by the instructor. True False
True
A certification is an official statement that validates that a person has satisfied specific job requirements. True False
True
A common method for identifying what skills a security professional possesses is his or her level of certification. True False
True
A computer virus is an executable program that attaches to, or infects, other executable programs. True False
True
ANSI produces standards that affect nearly all aspects of IT. True False
True
American National Standards Institute (ANSI) was formed in 1918 through the merger of five engineering societies and three government agencies. True False
True
An electronic mail bomb is a form of malicious macro attack that typically involves an email attachment that contains macros designed to inflict maximum damage. True False
True
Attacks against confidentiality and privacy, data integrity, and availability of services are all ways malicious code can threaten businesses. True False
True
Backdoor programs are typically more dangerous than computer viruses. True False
True
Because people inside an organization generally have more detailed knowledge of the IT infrastructure than outsiders do, they can place logic bombs more easily. True False
True
CompTIA Security+ is an entry-level security certification. True False
True
Compliance not only includes the actual state of being compliant, but it also includes the steps and processes taken to become compliant. True False
True
Defense Information Systems Agency (DISA) is the agency arm of the U.S. Department of Defense that provides information technology and communications support to the White House, Secretary of Defense, and all military sectors that contribute to the defense of the United States of America. True False
True
Defense in depth is the practice of layering defenses to increase overall security and provide more reaction time to respond to incidents. True False
True
DoD and NSA have adopted several training standards to serve as a pathway to satisfy Directive 8140. Although they are called standards, they are really training requirements for specific job responsibilities. True False
True
ISO/IEC 27002 provides organizations with best-practice recommendations on information security management. True False
True
Information systems security is about ensuring the confidentiality, integrity, and availability of IT infrastructures and the systems they comprise. True False
True
It is common for rootkits to modify parts of the operating system to conceal traces of their presence. True False
True
Juniper Networks offers vendor-specific certifications. True False
True
Many security training courses specifically prepare students for certification exams. True False
True
Master of science (MS) degree programs prepare a student to enter the field of information security and perform the work of securing systems. True False
True
Master's programs are generally broad and don't focus on a particular field of study. True False
True
Most professional certifications require certification holders to pursue additional education each year to keep their certifications current. True False
True
Nearly any college or university can offer an information systems security or cybersecurity-related degree program once it obtains accreditation for the curriculum from that state's board of education. True False
True
One requirement of the GIAC Security Expert (GSE) credential is that candidates must hold three GIAC credentials, with two of the credentials being Gold. True False
True
Payment Card Industry Data Security Standard (PCI DSS) version 3.2 defines 12 requirements for compliance, organized into six groups, called control objectives. True False
True
RSA is a global provider of security, risk, and compliance solutions for enterprise environments. True False
True
Sarbanes-Oxley Act (SOX) Section 404 requires an organization's executive officers to establish, maintain, review, and report on the effectiveness of the company's internal controls over financial reporting (ICFR). True False
True
Security awareness training should remind employees to ensure confidentiality by not leaving any sensitive information or documents on their desks. True False
True
Standards provide guidelines to ensure that products in today's computing environments work together. True False
True
The (ISC) 2 Systems Security Certified Practitioner (SSCP) credential covers the seven domains of best practices for information security. True False
True
The Certified Cloud Security Professional (CCSP) certification was created by both (ISC) 2 and the Cloud Security Alliance (CSA). True False
True
The Federal Information Security Management Act (FISMA) of 2014 defines the roles, responsibilities, accountabilities, requirements, and practices that are needed to fully implement FISMA security controls and requirements. True False
True
The HealthCare Certified Information Security and Privacy Practitioner (HCISPP) credential recognizes the knowledge and skills necessary to perform and conduct security and privacy work for health care organizations. True False
True
The Institute of Electrical and Electronics Engineers (IEEE) publishes or sponsors more than 13,000 standards and projects. True False
True
Henry is creating a firewall rule that will allow inbound mail to the organization. What TCP port must he allow through the firewall? 22 25 53 80
25
What is the maximum value for any octet in an IPv4 IP address? 65 129 255 513
255
What ISO security standard can help guide the creation of an organization's security policy? 12333 17259 27002 42053
27002
Henry's last firewall rule must allow inbound access to a Windows Terminal Server. What port must he allow? Answers: 143 443 989 3389
3389
Henry would like to create a different firewall rule that allows encrypted web traffic to reach a web server. What port is used for that communication? Answers: 80 143 443 3389
443
Continuing professional education (CPE) credits typically represent ________ minutes of classroom time per CPE unit. 30 50 60 120
50
How many domains of knowledge are covered by the Certified Information Systems Security Professional (CISSP) exam? 7 8 9 10
8
What series of Special Publications does the National Institute of Standards and Technology (NIST) produce that covers information systems security activities? 600 700 800 900
800
Which Institute of Electrical and Electronics Engineers (IEEE) standard covers wireless LANs? 802.3 802.11 802.16 802.18
802.11
What DoD directive requires that information security professionals in the government earn professional certifications? 8088 8140 8270 8540
8140
The International Electrotechnical Commission (IEC) is the predominant organization for developing and publishing international standards for technologies related to electrical and electronic devices and processes. True False
True
The International Electrotechnical Commission (IEC) was instrumental in the development of standards for electrical measurements, including gauss, hertz, and weber. True False
True
The International Organization for Standardization (ISO) organizes its standards by both the International Classification for Standards (ICS) and the Technical Committee (TC) to which it assigns each standard. True False
True
The International Telecommunication Union (ITU) was formed in 1865 as the International Telegraph Union to develop international standards for the emerging telegraph communications industry. True False
True
The Internet Architecture Board (IAB) is a subcommittee of the IETF. True False
True
The Internet Architecture Board (IAB) serves as an advisory body to the Internet Society (ISOC). True False
True
The National Institute of Standards and Technology (NIST) 800 Series publications cover all NIST-recommended procedures for managing information security. True False
True
The Office of Personnel Management (OPM) requires that federal agencies provide the training suggested by the National Institute of Standards and Technology (NIST) guidelines. True False
True
The function of homepage hijacking is to change a browser's homepage to point to the attacker's site. True False
True
The main purpose of security training courses is to rapidly train students in one or more skills, or to cover essential knowledge in one or more specific areas. True False
True
The purpose of continuing education is to provide formal training courses that lead to a certificate or professional certification and NOT a degree. True False
True
The term "web defacement" refers to someone gaining unauthorized access to a web server and altering the index page of a site on the server. True False
True
Unlike viruses, worms do NOT require a host program in order to survive and replicate. True False
True
Visa, MasterCard, and other payment card vendors helped to create the Payment Card Industry Data Security Standard (PCI DSS). True False
True
How many years of specialized experience are required to earn one of the Certified Information Systems Security Professional (CISSP) concentrations? Two Three Four Five
Two
What is NOT an effective key distribution method for plaintext encryption keys? Answers: Paper Unencrypted email CD Smart card
Unencrypted email
What is NOT a typical sign of virus activity on a system? Unexplained decrease in available disk space Unexpected error messages Unexpected power failures Sudden sluggishness of applications
Unexpected power failures
Bob has a high-volume virtual private network (VPN). He would like to use a device that would best handle the required processing power. What type of device should he use? Answers: Firewall Unified threat management (UTM) Router VPN concentrator
VPN concentrator
Val would like to isolate several systems belonging to the product development group from other systems on the network, without adding new hardware. What technology can she use? Answers: Firewall Virtual LAN (VLAN) Virtual private network (VPN) Transport Layer Security (TLS)
Virtual LAN (VLAN)
Val would like to limit the websites that her users visit to those on an approved list of pre-cleared sites. What type of approach is Val advocating? Blacklisting Context-based screening Packet filtering Whitelisting
Whitelisting
What tool might be used by an attacker during the reconnaissance phase of an attack to glean information about domain registrations? Whois Simple Network Management Protocol (SNMP) Ping Domain Name System (DN
Whois
What type of network connects systems over the largest geographic area? Answers: Wide area network (WAN) Metropolitan area network (MAN) Local area network (LAN) Storage area network (SAN)
Wide area network (WAN)
What standard is NOT secure and should never be used on modern wireless networks? Answers: Wired Equivalent Privacy (WEP) Wi-Fi Protected Access (WPA) Wi-Fi Protected Access version 2 (WPA2) 802.11ac
Wired Equivalent Privacy (WEP)
What is NOT a service commonly offered by unified threat management (UTM) devices? Answers: URL filtering Wireless network access Malware inspection Content inspection
Wireless network access
Allie is working on the development of a web browser and wants to make sure that the browser correctly implements the Hypertext Markup Language (HTML) standard. What organization's documentation should she turn to for the authoritative source of information? International Electrotechnical Commission (IEC) National Institute of Standards and Technology (NIST) World Wide Web Consortium (W3C) Internet Engineering Task Force (IETF)
World Wide Web Consortium (W3C)
A border router can provide enhanced features to internal networks and help keep subnet traffic separate. Answers: true or false
false
A digitized signature is a combination of a strong hash of a message and a secret key. Answers: true or false
false
A packet-filtering firewall remembers information about the status of a network communication. Answers: true or false
false
A private key cipher is also called an asymmetric key cipher. true or false
false
A subnet mask is a partition of a network based on IP addresses. Answers: true or false
false
Another name for a border firewall is a DMZ firewall. Answers: true or false
false
Cryptographic key distribution is typically done by phone. Answers: true or false
false
IP addresses are eight-byte addresses that uniquely identify every device on the network. Answers: true or false
false
Implicit deny is when firewalls look at message addresses to determine whether a message is being sent around an unending loop. Answers: true or false
false
Internet Control Message Protocol (ICMP) is a method of IP address assignment that uses an alternate, public IP address to hide a system's real IP address. Answers: true or false
false
Product cipher is an encryption algorithm that has no corresponding decryption algorithm. Answers: true or false
false
The Transport Layer of the OSI Reference Model creates, maintains, and disconnects communications that take place between processes over the network. Answers: true or false
false
The term certificate authority (CA) refers to a trusted repository of all public keys. Answers: true or false
false
A firewall is a basic network security defense tool. Answers: true or false
true
A network attacker wants to know IP addresses used on a network, remote access procedures, and weaknesses in network systems. Answers: true or false
true
A network protocol governs how networking equipment interacts to deliver data across the network. Answers: true or false
true
A person demonstrates anonymity when posting information to a web discussion site without authorities knowing who he or she is. Answers: true or false
true
A salt value is a set of random characters you can combine with an actual input key to create the encryption key. Answers: true or false
true
A wireless access point (WAP) is the connection between a wired and wireless network. Answers: true or false
true
Digital signatures require asymmetric key cryptography. Answers: true or false
true
In a chosen-ciphertext attack, cryptanalysts submit data coded with the same cipher and key they are trying to break to the decryption device to see either the plaintext output or the effect the decrypted message has on some system. true or false?
true
Internet Small Computer System Interface (iSCSI) is a storage networking standard used to link data storage devices to networks using IP for its transport layer. Answers: true or false
true
Message authentication confirms the identity of the person who started a correspondence. Answers: true or false
true
Network access control (NAC) works on wired and wireless networks Answers: true or false
true
Network access control (NAC) works on wired and wireless networks. Answers: true or false
true
TCP/IP is a suite of protocols that operates at both the Network and Transport layers of the OSI Reference Model. Answers: true or false
true
The Data Link Layer of the OSI Reference Model is responsible for transmitting information on computers connected to the same local area network (LAN) Answers: true or false
true
The Data Link Layer of the OSI Reference Model is responsible for transmitting information on computers connected to the same local area network (LAN). Answers: true or false
true
The Diffie-Hellman (DHE) algorithm is the basis for several common key exchange protocols, including Diffie-Hellman in Ephemeral mode (DHE) and Elliptic Curve DHE (ECDHE). Answers: true or false
true
The OSI Reference Model is a theoretical model of networking with interchangeable layers. Answers: true or false
true
The Physical Layer of the OSI Reference Model must translate the binary ones and zeros of computer language into the language of the transport medium. Answers: true or false
true
The financial industry created the ANSI X9.17 standard to define key management procedures. true or false
true
The hash message authentication code (HMAC) is a hash function that uses a key to create a hash, or message digest. true or false
true
The term "router" describes a device that connects two or more networks and selectively interchanges packets of data between them. Answers: true or false
true
The three main categories of network security risk are reconnaissance, eavesdropping, and denial of service. Answers: true or false
true
________ refers to a program of study approved by the State Department of Education in the state that a school operates. Continuing education Accredited Continuing professional education (CPE) Certificate of completion
Accredited
Bob received a message from Alice that contains a digital signature. What cryptographic key does Bob use to verify the digital signature? Answers: Alice's public key Alice's private key Bob's public key Bob's private key
Alice's public key
Which organization created a standard version of the widely used C programming language in 1989? Institute of Electrical and Electronics Engineers (IEEE) International Organization for Standardization (ISO) American National Standards Institute (ANSI) European Telecommunications Standards Institute (ETSI)
American National Standards Institute (ANSI)
