haggerty final

The number of possible keys to a cipher is a ___________. A. checksum B. cryptosystem C. keyspace D. key directory

keyspace

The four main areas in NIST SP 800-50 are awareness, training, education, and __________________. A. academic excellence B. professional development C. certification D. responsibility

professional development

Unexplained increases in bandwidth consumption, high volumes of inbound and outbound e-mail during normal activity periods, a sudden increase in e-mail server storage utilization (this may trigger alarm thresholds set to monitor and manage disk/user partition space), and an unexplained decrease in available disk space are all telltale symptoms of a ________. A. worm B. Trojan C. logic bomb D. DoS

worm

____________ creates standards that federal agencies use to classify their data and IT systems. A. FERPA B. FISMA C. GLBA D. NIST

NIST

________ enables you to prevent a party from denying a previous statement or action. A. Authentication B. Integrity C. Nonrepudiation D. Confidentiality

Nonrepudiation

The regulating agency for the Federal Information Systems Management Act is the ________. A. FTC B. U.S. Department of Education C. Office of Management and Budget D. Securities and Exchange Commission

Office of Management and Budget

________ attempts to describe risk in financial terms and put a dollar value on all the elements of a risk. A. Risk management B. Quantitative risk analysis C. Qualitative risk analysis D. Financial risk analysis

Quantitative risk analysis

________ attack countermeasures such as antivirus signature files or integrity databases. A. Retro viruses B. Stealth viruses C. Polymorphic viruses D. Slow viruses

Retro viruses

____ is a risk management phase that includes assessment of various types of controls to mitigate the identified risks, selection of a control strategy, and justification of choice of controls. A. Risk identification B. Risk assessment C. Inventory of assets D. Identify threats and vulnerabilities

Risk assessment

Digital signatures require asymmetric key cryptography. A. True B. False

True

ISO 17799 is an international security standard. A. True B. False

True

Unlike viruses, worms do not require a host program in order to survive and replicate. A. True B. False

True

Malware developers often use _____________ to write boot record infectors. A. C programming language B. C++ programming language C. Java D. assembly language

assembly language

Which of the following describes the Internet Engineering Task Force (IETF)? A. An international nongovernmental organization with the goal of developing and publishing international standards. B. An international security standard that documents a comprehensive set of controls that represent information systems best practices. C. A standards organization that develops and promotes Internet standards. D. A U.S. standards organization whose goal is to empower its members and constituents to strengthen the U.S. marketplace position in the global economy, while helping to ensure the safety and health of consumers and the protection of the environment.

A standards organization that develops and promotes Internet standards.

What name is given to an encryption cipher that is a product cipher with a 56-bit key consisting of 16 iterations of substitution and transformation? A. Data Encryption Standard (DES) B. Keyword mixed alphabet cipher C. One-time pad cipher D. Substitution cipher

Data Encryption Standard (DES)

DoD Directive 8570.01 is a voluntary certification requirement and has increased the number of personnel who pursue certifications. A. True B. False

False

What term is used to describe any personally identifiable financial information that a consumer provides to a financial institution? A. covered entity B. nonpublic personal information (NPI) C. personally identifiable information (PII) D. directory information

nonpublic personal information (NPI)

Cryptography accomplishes four security goals: confidentiality, integrity, authentication, and ________________. A. security B. privacy C. nonrepudiation D. reliability

nonrepudiation

What name is given to patient health information that is computer based? A. personally identifiable information (PII) B. privately held information C. electronic protected health information (EPHI) D. directory information

electronic protected health information (EPHI)

CompTIA's Security+ certification provides ________. A. four main credentials, each addressing a different security professional role B. entry-level information security certification of choice for IT professionals C. several credentials that focus on both general and Web-related security D. more than 20 individual credentials that span several information security job disciplines

entry-level information security certification of choice for IT professionals

A(n) ________ is a measurable occurrence that has an impact on the business. A. corrective control B. event C. cost D. critical business function

event

________ is a document produced by the IETF that contains standards as well as other specifications or descriptive contents. A. A Request for Comments (RFC) B. ISO 17799 C. ISO/IEC 27002 D. The Special Publications 800 series

A Request for Comments (RFC)

Which of the following is the definition of packet-filtering firewall? A. An advanced firewall that processes all traffic between two systems. Instead of allowing a direct connection between two systems, it connects to each system separately and passes filtered traffic to the destination based on filtering rules. B. A firewall device that has three NICs. One NIC connects to the Internet, the second connects to the internal network, and the third connects to a DMZ. C. A firewall that examines each packet it receives and compares the packet to a list of rules configured by the network administrator. D. A protocol used on IP networks to provide configuration details automatically to client computers.

A firewall that examines each packet it receives and compares the packet to a list of rules configured by the network administrator.

The regulating agency for the Gramm-Leach-Bliley Act is the ________. A. FTC B. U.S. Department of Education C. Office of Management and Budget D. Securities and Exchange Commission

A. FTC

Which OSI Reference Model layer includes all programs on a computer that interact with the network? A. Presentation Layer B. Session Layer C. Network Layer D. Application Layer

Application Layer

The ____________ concentration from (ISC)2 is the road map for incorporating security into projects, applications, business processes, and all information systems. A. CISSP-ISSEP® B. CISSP-ISSAP® C. CISSP-ISSMP® D. CSSLP®

CISSP-ISSEP®

A ________ is one of the simplest substitution ciphers. It shifts each letter in the English alphabet a fixed number of positions, with Z wrapping back to A. A. Caesar cipher B. Vigenère cipher C. transposition cipher D. product cipher

Caesar cipher

What name is given to a document that verifies that a student has completed courses and earned a sufficient score on an assessment? A. National Centers of Academic Excellence in Information Assurance Education (CAE/IAE) B. Certificate of completion C. Accredited D. Continuing education diploma

Certificate of completion

The best fits for (ISC)2's _____________ are personnel responsible for developing and implementing processes used to assess risk and for establishing security requirements. A. Certified Secure Software Lifecycle Professional B. Certified Information Systems Security Professional C. Certified Authorization Professional D. Systems Security Certified Practitio

Certified Authorization Professional

ISC)2 offers the ________________ credential, which is one of the few credentials that address developing secure software. It evaluates professionals for the knowledge and skills necessary to develop and deploy secure applications. A. Certified Secure Software Lifecycle Professional B. Certified Information Systems Security Professional C. Certified Authorization Professional D. Systems Security Certified Practitioner

Certified Secure Software Lifecycle Professional

___ is the act of unscrambling ciphertext into plaintext. A. Hash B. Decryption C. Salt value D. Algorithm

Decryption

A __________________ signature is a representation of a physical signature stored in a digital format. A. Digital B. Digitized C. Private key D. Public key

Digital

_______ is information that is publicly available about all students at a school. A. Minimum necessary rule B. Nonpublic personal information (NPI) C. Personally identifiable information (PII) D. Directory information

Directory information

_______ allows the computer to get its configuration information from the network instead of the network administrator providing the configuration information to the computer. It provides a computer with an IP address, subnet mask, and other essential communication information, simplifying the network administrator's job. A. Internet Protocol Security (IPSec) B. Dynamic Host Configuration Protocol (DHCP) C. Point-to-Point Tunneling Protocol (PPTP) D. Internet Control Message Protocol (ICMP)

Dynamic Host Configuration Protocol (DHCP)

The regulating agency for the Children's Internet Protection Act is the ________. A. Department of Health and Human Services B. U.S. Department of Education C. Securities and Exchange Commission D. FCC

FCC

Trojans are self-contained programs designed to propagate from one host machine to another, using the host's own network communications protocols. A. True B. False

False

Unencrypted information is ciphertext. A. True B. False

False

The ________________ , enacted as part of the American Recovery and Reinvestment Act of 2009, was designed to promote the widespread adoption and standardization of health information technology. A. HITECH Act B. Federal Information Systems Management Act C. Sarbanes-Oxley Act D. Office for Civil Rights

HITECH Act

The _____________ is the preeminent organization for developing and publishing international standards for technologies related to electrical and electronic devices and processes. A. American National Standards Institute B. International Electrotechnical Commission (IEC) C. International Telecommunication Union D. National Institute of Standards and Technology

International Electrotechnical Commission (IEC)

________ is a suite of protocols designed to connect sites securely using IP networks. A. Dynamic Host Configuration Protocol (DHCP) B. Network access control (NAC) C. Point-to-Point Tunneling Protocol (PPTP) D. Internet Protocol Security (IPSec)

Internet Protocol Security (IPSec)

Obtaining the coveted CAE/IAE or CAE/R designation means the curriculum and research institutions meet or exceed the standards defined by the _______. A. OPM B. NIST C. NSA D. Computer Security Act of 1987

NSA

The ____________________ is responsible for FISMA compliance. A. FTC B. Securities and Exchange Commission C. Department of Health and Human Services D. Office of Management and Budget (OMB)

Office of Management and Budget (OMB)

______ include a separate encryption engine that stores the virus body in encrypted format while duplicating the main body of the virus. A. Retro viruses B. Stealth viruses C. Polymorphic viruses D. Multipartite viruses

Polymorphic viruses

Which OSI Reference Model layer is responsible for the coding of data? A. Presentation Layer B. Session Layer C. Data Link Layer D. Transport Layer

Presentation Layer

____________ is a person's right to control the use and disclosure of his or her own personal information. A. Security B. Disclosure C. Privacy D. Integrity

Privacy

___________ is the likelihood that a particular threat exposes a vulnerability that could damage your organization. A. Backup B. Incident C. Risk D. Preventive control

Risk

A process that creates the first secure communications session between a client and a server is the definition of ________. A. nonrepudiation B. certificate authority (CA) C. SSL handshake D. salt value

SSL handshake

In a __________, the attacker uses IP spoofing to send a large number of packets requesting connections to the victim computer. These appear to be legitimate but in fact reference a client system that is unable to respond. A. smurf attack B. phishing attack C. DoS attack D. SYN flood attack

SYN flood attack

The regulating agency for the Sarbanes-Oxley Act is the ________. A. FTC B. U.S. Department of Education C. Office of Management and Budget D. Securities and Exchange Commission

Securities and Exchange Commission

An encryption cipher that uses the same key to encrypt and decrypt is called a _______________ key. A. Symmetric (private) B. Asymmetric (public) C. Encrypting D. Hash E. None of the above

Symmetric (private)

________ are viruses that target computer hardware and software startup functions. A. File infectors B. System infectors C. Data infectors D. Stealth virus

System infectors

A computer virus is an executable program that attaches to, or infects, other executable programs. A. True B. False

True

A substitution cipher replaces bits, characters, or blocks of information with other bits, characters, or blocks. A. True B. False

True

A successful DoS attack crashes a server or network device or creates so much network congestion that authorized users cannot access network resources. A. True B. False

True

In information technology, perhaps the best-known ISO standard is the Open Systems Interconnection (OSI) Reference Model. This internationally accepted framework of standards governs how separate computer systems communicate using networks. A. True B. False

True

Increasing the key length generally increases the security of a substitution cipher. A. True B. False

True

Most certifications require certification holders to pursue additional education each year to keep their certifications current. A. True B. False

True

The best-known standard that relates to information security is the IEEE 802 LAN/MAN standard family. A. True B. False

True

The goal of cryptography is to make the cost or the time required to decrypt a message without the key exceed the value of the protected information. A. True B. False

True

The main purpose of security training courses is to rapidly train students in one or more skills, or to cover essential knowledge in one or more specific areas. A. True B. False

True

The purpose of DoD Directive 8570.01 is to reduce the possibility that unqualified personnel can gain access to secure information. A. True B. False

True

The two basic types of ciphers are transposition and substitution. A. True B. False

True

Today, one of the most common methods for identifying what skills a security professional possesses is his or her level of certification. A. True B. False

True

The regulating agency for the Family Educational Rights and Privacy Act is the ________. A. Department of Health and Human Services B. U.S. Department of Education C. Securities and Exchange Commission D. FTC

U.S. Department of Education

The stated purpose of the ___________ is to develop protocols and guidelines that unify the World Wide Web and ensure its long-term growth. A. IETF B. IAB C. W3C D. ANSI

W3C

How your organization responds to risk reflects the value it puts on its ___________. A. environment B. assets C. technology D. vulnerability

assets

One of the ways that malicious code can threaten businesses is by causing economic damage or loss due to the theft, destruction, or unauthorized manipulation of sensitive data. These are known as ________. A. attacks against confidentiality and privacy B. attacks against productivity and performance C. attacks against data integrity D. attacks that create legal liability

attacks against data integrity

Malicious code attacks all three information security properties. Malware can erase or overwrite files or inflict considerable damage to storage media. This property is ________. A. confidentiality B. integrity C. availability D. security

availability

Without any knowledge of the key, an attacker with access to an encrypted message and the decryption cipher could try every possible key to decode the message. This is referred to as ________. A. decryption B. breaking codes C. brute-force attack D. cryptanalysis

brute-force attack

Under HIPAA, an organization that performs a health care activity on behalf of a covered entity is known as a(n) ________. A. privately held company B. covered entity C. business associate D. agency

business associate

It is necessary to create and/or maintain a plan that makes sure your company continues to operate in the face of disaster. This is known as a ________. A. critical business function B. disaster plan C. business continuity plan D. risk management plan

business continuity plan

In the legal system, ________ is the act of following laws, rules, and regulations that apply to organizations. A. disclosure B. responsibility C. control D. compliance

compliance

Information regulated under the Gramm-Leach-Bliley Act is ________. A. corporate financial information B. consumer financial information C. federal information systems D. protected health information

consumer financial information

The purpose of ________ is to provide formal training courses that lead to a certificate or professional certification and not a degree. A. continuing education B. academic excellence C. National Centers of Academic Excellence D. standards

continuing education

Information regulated under the Sarbanes-Oxley Act is ________. A. protected health information B. federal information systems C. consumer financial information D. corporate financial information

corporate financial information

Forensics and incident response are examples of ___________ controls. A. preventive B. technical C. corrective D. detective

corrective

What name is given to an object that uses asymmetric encryption to bind a message or data to a specific entity? A. digital signature B. public key cryptography C. hash D. algorithm

digital signature

A ________ is a virus that attacks and modifies executable programs (like COM, EXE, SYS, and DLL files). A. file infector B. system infector C. data infector D. stealth virus

file infector

A ___________ controls the flow of traffic by preventing unauthorized network traffic from entering or leaving a particular portion of the network. A. hub B. firewall C. router D. switch

firewall

Malicious code attacks all three information security properties. Malware can modify database records either immediately or over a period of time. This property is ________. A. confidentiality B. integrity C. availability D. security

integrity

Whether software or hardware based, a ____________ captures keystrokes, or user entries, and then forwards that information to the attacker. A. botnet B. keystroke logger C. file infector D. logic bomb

keystroke logger

A ___________ is a program that executes a malicious function of some kind when it detects certain conditions. A. worm B. Trojan C. logic bomb D. DoS

logic bomb

A method to restrict access to a network based on identity or other rules is the definition of ________. A. screened subnet B. stateful inspection firewall C. network access control (NAC) D. Media Access Control (MAC)

network access control (NAC)

A ____________ tricks users into providing logon information on what appears to be a legitimate Web site but is in fact a Web site set up by an attacker to obtain this information. A. smurf attack B. DDoS attack C. phishing attack D. Trojan

phishing attack

"There are so many demands on your time, it is often difficult to justify setting aside time to study. Also, you may find that self-study takes more time than you planned." This is a disadvantage to choosing the self-study option that can be labeled ________. A. resource selection B. procrastination C. lack of interaction D. quality issues

procrastination

FISMA requires each federal agency to create an agency-wide information security program that includes a plan to fix weaknesses in the program. This is referred to as ________. A. testing and evaluation B. remedial action C. incident response D. subordinate plans

remedial action

A company can discontinue or decide not to enter a line of business if the risk level is too high. This is categorized as ________. A. risk mitigation B. risk assignment C. risk acceptance D. risk avoidance

risk avoidance

What name is given to a type of virus that uses a number of techniques to conceal itself from the user or detection software? A. polymorphic virus B. data infector C. multipartite virus D. stealth virus

stealth virus

A professional certification states that you have taken the course and completed the tasks and assignments. A. True B. False

False

Encryption ciphers fall into two general categories: symmetric (private) key and asymmetric (public) key. A. True B. False

True

The ANSI produces standards that affect nearly all aspects of IT. A. True B. False

True

The Payment Card Industry Data Security Standard (PCI DSS) is an international standard for handling transactions involving payment cards. A. True B. False

True

The Physical Layer must translate the binary ones and zeros of computer language into the language of the transport medium. A. True B. False

True

Which of the following is the definition of hub? A. A device that connects two or more networks and selectively interchanges packets of data between them. B. A network device that connects network segments, echoing all received traffic to all other ports. C. A firewall device that examines the state of a connection as well as simple address, port, and protocol rules to determine how to process a packet. D. A suite of protocols designed to connect sites securely using IP networks.

A network device that connects network segments, echoing all received traffic to all other ports.

Which of the following is the definition of continuing professional education (CPE)? A. A document that verifies that a student has completed courses and earned a sufficient score on an assessment. B. Educational institutions that meet specific federal information assurance educational guidelines. C. Refers to an educational institution that has successfully undergone evaluation by an external body to determine whether the institution meets applicable standards. D. A standard unit of credit that equals 50 minutes of instruction

A standard unit of credit that equals 50 minutes of instruction.

The ________ is a U.S. standards organization whose goal is to empower its members and constituents to strengthen the U.S. marketplace position in the global economy, while helping to ensure the safety and health of consumers and the protection of the environment. A. International Electrotechnical Commission (IEC) B. International Organization for Standardization (ISO) C. National Institute of Standards and Technology (NIST) D. American National Standards Institute (ANSI)

American National Standards Institute (ANSI)

The ________ is a regulation that covered entities may disclose only the amount of protected health information absolutely necessary to carry out a particular function. A. nonpublic personal information (NPI) B. directory information C. minimum necessary rule D. electronic protected health information (EPHI)

minimum necessary rule

What term is used to describe a method of IP address assignment that uses an alternate, public IP address to hide a system's real IP address? A. application proxy firewall B. network address translation (NAT) C. Internet Control Message Protocol (ICMP) D. network access control (NAC)

network address translation (NAT)

Employers do use certifications to help assess prospects, but the best assessment is the prospect's actual performance. A. True B. False

True

Which of the following is the definition of botnet? A. A botnet is a type of virus that primarily infects executable programs. B. A botnet consists of a network of compromised computers that attackers use to launch attacks and spread malware. C. A botnet is a type of virus that includes a separate encryption engine that stores the virus body in encrypted format while duplicating the main body of the virus. D. A botnet is a group of honeypots made to simulate a real live network, but isolated from it.

A botnet consists of a network of compromised computers that attackers use to launch attacks and spread malware.

_____________ are the main source of distributed denial of service (DDoS) attacks and spam. A. Logic bombs B. Botnets C. Stealth viruses D. Trojans

Botnets

___________ refers to the amount of harm a threat can cause by exploiting a vulnerability. A. Impact B. Threat C. Risk D. Incident

Impact

The four main credentials of the ________ are Systems Security Certified Practitioner (SSCP®), Certified Information Systems Security Professional (CISSP®), Certified Authorization Professional (CAP®), and Certified Secure Software Lifecycle Professional (CSSLP®). A. GIAC/SANS Institute B. Infotec Security Certified Program C. International Information Systems Security Certification Consortium, Inc. (ISC)2 D. Information Systems Audit and Control Association

International Information Systems Security Certification Consortium, Inc. (ISC)2

(ISC)2 offers the ________ credential, which is ideal for those who are working toward or already hold positions as senior network security engineers, senior security systems analysts, or senior security administrators. It covers the seven domains of best practices for information security. A. Certified Information Systems Security Professional B. Certified Secure Software Lifecycle Professional C. Certified Authorization Professional D. Systems Security Certified Practitioner

Systems Security Certified Practitioner

What is meant by checksum? A. A secret value that a cipher uses to encrypt or decrypt information. B. The output of a one-way algorithm; a mathematically derived numerical representation of some input. C. Prevents a party from denying a previous statement or action. D. An encryption algorithm that has no corresponding decryption algorithm.

The output of a one-way algorithm; a mathematically derived numerical representation of some input.

An educational program that is generally associated with a college or university that provides formal courses that do not lead to degrees is the definition of ________. A. continuing professional education (CPE) B. accreditation C. certificate of completion D. continuing education

continuing professional education (CPE)

Health plans, health care clearinghouses, and any health care provider that transmit PHI in an electronic form are known as ________ under HIPAA. A. covered entities B. business associates C. protected health information D. exceptions to the Privacy Rule

covered entities

A control involved in the process of developing and ensuring compliance with policy and procedures is the definition of ________. A. technical control B. preventive control C. safeguard D. administrative control

administrative control

What term is used to describe a type of cryptography that uses a cipher with two separate keys, one for encryption and one for decryption, so that correspondents do not first have to exchange secret information to communicate securely? A. hash B. key distribution C. asymmetric key cryptography D. symmetric key cryptography

asymmetric key cryptography

Another way that malicious code can threaten businesses is by using mass bulk e-mail (spam), spyware, persistence cookies, and the like, consuming computing resources and reducing user productivity. These are known as ________. A. attacks against confidentiality and privacy B. attacks against productivity and performance C. attacks against data integrity D. attacks that damage reputation

attacks against productivity and performance

FISMA requires each federal agency to create an agency-wide information security program that includes training employees, contractors, and any other users of their IT systems. This is referred to as ________. A. testing and evaluation B. remedial action C. security awareness training D. subordinate plans

security awareness training

A _____________ is a flaw or weakness in a system's security procedures, design, implementation, or internal controls. A. threat B. impact C. risk D. vulnerability

vulnerability