Intro to Computer Security Review

Lighter Than Air Industries expects that it would lose $10 million if a tornado struck its aircraft operations facility. It expects that a tornado might strike the facility once every 100 years. What is the single loss expectancy for this scenario?

$10,000,000

You are concerned about the risk that an avalanche poses to your $3 million shipping facility. Based on expert opinion, you determine that there is a 5 percent chance that an avalanche will occur each year. Experts advise you that an avalanche would completely destroy your building and require you to rebuild on the same land. Ninety percent of the $3 million value of the facility is attributed to the building and 10 percent is attributed to the land itself. What is the single loss expectancy of your shipping facility to avalanches?

$2,700,000

You are concerned about the risk that a hurricane poses to your corporate headquarters in South Florida. The building itself is values at $15 million. After consulting with the National Weather Service, you determine that there is a 10 percent likelihood that a hurricane will strike over the course of a year. You hired a team of architects and engineers who determined that the average hurricane would destroy approximately 50 percent of the building. What is the annualized loss expectancy (ALE).

$750,000

What is the output value of the mathematical function 18 mod 3

0

Acme Widgets currently uses a 1,024-bit RSA encryption standard companywide. The company plans to convert from RSA to an elliptic curve cryptosystem. If it wants to maintain the same cryptographic strength, what ECC key length should it use?

160 bits

What is the standard duration of patent protection in the United States?

20 years from the application date

How many encryption keys are required to fully implement an asymmetric algorithm with 10 participants?

20. Each participant needs two keys

How many possible keys exist in a 5-bit key space?

32. 2^n used to find

If a 2,048-bit plaintext message were encrypted with the El Gamal public key cryptosystem, how long would the resulting ciphertext message be?

4,096 bits

What is the ideal humidity range for a computer room?

40-60 percent

How many keys are required to fully implement a symmetric algorithm with 10 participants?

45. (n*(n-1))/2

What is the length of the cryptographic key used in the Data Encryption Standard (DES) cryptosystem?

56 bits

Which one of the following BIA terms identifies the amount of money a business expects to lose to a given risk each year?

ALE

How is the value of a safeguard to a company calculated?

ALE before safeguard - ALE after implementing the safeguard - annual cost of safeguard

If a security mechanism offers availability, then it offers a high level of assurance that authorized subjects can _____ the data, objects, and resources

Access

Which one of the following data roles is most likely to assign permissions to grant users access to data?

Administrator

You've performed a basic quantitative risk analysis on a specific threat/vulnerability/risk relation. You select a possible countermeasure. When performing the calculations again, which of the following factors will change?

Annualized rate of occurrence

Which of the following is not a valid definition for risk?

Anything that removes a vulnerability or protects against one or more specific threats

How is single loss expectancy (SLE) calculated?

Asset value ($) * exposure factor

Toby is attempting to log in to a secure system. He provides his username at the prompt and then is asked to provide a password. What stage of the access control process is taking place at that moment?

Authentication

What is the primary purpose of Kerberos?

Authentication

Accountability requires all of the following items except one. Which item is not required for accountability?

Authorization

Which of the following is a principle of the CIA Triad that means authorized subjects are granted timely and uninterrupted access to objects?

Availability

What industry is most directly impacted by the provisions of the Gramm‐Leach‐Bliley Act?

Banking

Which one of the following cipher types operates on large pieces of a message rather than individual characters or bits of a message?

Block cipher

What is the first step that individuals responsible for the development of a business continuity plan should perform?

Business organization analysis

Of the individuals listed, who would provide the best endorsement for a business continuity plan's statement of importance?

Chief executive officer

Which criminal law was the first to implement penalties for the creators of viruses, worms, and other types of malicious code that cause harm to computer system(s)?

Computer Fraud and Abuse Act

Which law first required operators of federal interest computer systems to undergo periodic training in computer security issues?

Computer Security Act

Matthew recently authored an innovative algorithm for solving a mathematical problem, and he wants to share it with the world. However, prior to publishing the software code in a technical journal, he wants to obtain some sort of intellectual property protection. Which type of protection is best suited to his needs?

Copyright

When seeking to hire new employees, what is the first step?

Create a job description

What method can be used to map out the needs of an organization for a new facility?

Critical path analysis

You are selecting an encryption algorithm for use in exchanging sensitive information over the Internet. Which one of the following algorithms would NOT be acceptable for use

DES

While performing a risk analysis, you identify a threat of fire and a vulnerability because there are no fire extinguishers. Based on this information, which of the following is a possible risk?

Damage to equipment

Which one of the following identifies the primary a purpose of information classification processes?

Define the requirements for protecting sensitive data

How can a group reach an anonymous consensus while all members of that group are in the same room?

Delphi technique

What technique is most effective for removing data stored on an SSD device

Destruction

Which of the following is the most secure method of deleting data on a DVD

Destruction

Which of the following authentication, authorization, and accounting (AAA) protocols is based on RADIUS and supports Mobile IP and Voice over IP?

Diameter

Which cryptographic algorithm forms the basis of the El Gamal cryptosystem?

Diffie-Hellman

When an employee is to be terminated, which of the following should be done?

Disable the employee's network access just as they are informed of the termination

What type of plan outlines the procedures to follow when a disaster interrupts the normal operations of a business?

Disaster recovery plan

What is the term for the percentage of loss an asset's value would experience in the event that a threat becomes realized

Exposure factor

What kind of attack makes the Caesar cipher virtually unusable?

Frequency analysis attack

Which of the following is NOT considered a violation of confidentiality

Hardware destruction

What is the most important goal of all security solutions?

Human safety

Which of the following is the weakest element in any security solution?

Humans

Which of the following best defines "rules of behavior" established by a data owner?

Identifying appropriate use and protection of data

Many cryptographic algorithms rely on the difficulty of factoring the product of large prime numbers. What characteristic of this problem are they relying on?

It is a one-way function.

What is the most common and inexpensive form of physical access control device?

Key locks

Data classifications are used to focus security controls over all but which of the following?

Layering

Which of the following is typically not a culprit in causing damage to computer equipment in the event of a fire and a triggered suppression?

Light

What is the most common form of perimeter security devices or mechanisms?

Lighting

Dave is developing a key escrow system that requires multiple people to retrieve a key but does not depend on every participant being present. What type of technique is he using?

M of N Control

What BIA metric can be used to express the longest time a business function can be unavailable without causing irreparable harm to the organization

MTD

What are the two common data classification schemes?

Military and private sector

John recently received an email message from Bill. What cryptographic goal would need to be met to convince John that Bill was actually the sender of the message?

Nonrepudiation

What ensures that the subject of an activity or event cannot deny that the event occurred?

Nonrepudiation

Which one of the following cannot be achieved by a secret key cryptosystem?

Nonrepudiation

What is the minimum number of cryptographic keys required for secure two-way communications in symmetric key cryptography?

One

When correctly implemented, what is the only cryptosystem known to be unbreakable?

One-time pad

Which one of the following Data Encryption Standard (DES) operating modes can be used for large messages with the assurance that an error early in the encryption/decryption process won't spoil results throughout the communication?

Output Feedback (OFB)

What compliance obligation relates to the processing of credit card information?

PCI DSS

What is the most common cause of failure for a water-based fire suppression system?

People

Which resource should you protect first when designing continuity plan provisions and processes?

People

What will be the major resource consumed by the BCP process during the BCP phase

Personnel

Which of the following statements correctly identifies a problem with sanitization methods?

Personnel can perform sanitization steps improperly

Which of the following is the most important aspect of security?

Physical security

Which of the following is not considered an example of data hiding?

Preventing an authorize reader of an object from deleting that object

What is the primary goal of change management?

Preventing security compromises

Which of the following is not a typical type of alarm that can be triggered for physical security?

Preventive

What do the principles of notice, choice, onward transfer, and access closely apply to?

Privacy

______ refers to keeping information confidential that is personally identifiable or which might cause harm, embarrassment, or disgrace to someone if revealed

Privacy

What law prevents government agencies from disclosing personal information that an individual supplies to the government under protected circumstances?

Privacy Act

In which business continuity planning task would you actually design procedures and mechanisms to mitigate risks deemed unacceptable by the BCP team?

Provisions and processes

Which of the following choices is the most reliable method of destroying data on a solid state drive?

Purging

Which would an administrator do to classified media before reusing it in a less secure environment?

Purging

Which of the following does not erase data?

Remanence

What type of cryptosystem commonly makes use of a passage from a well-known book for the encryption key?

Running key cipher

What is the formula used to compute the single loss expectancy for a risk scenario

SLE = AV * EF

Which of the following storage media would not be affected by a degausser

SSD

Which one of the following would administrators use to connect to a remote server securely for administration?

Secure Shell (SSH)

Which of the following is NOT an element of the risk analysis process?

Selecting appropriate safeguards and implementing them

What security control is directly focused on preventing collusion?

Separation of duties

Which of the following is an example of a Type 2 authentication factor?

Something you have

Which task of BCP bridges the gap between the business impact assessment and the continuity planning phases?

Strategy development

If Richard wants to send an encrypted message to Sue using a public key cryptosystem, which key does he use to encrypt the message?

Sue's public key

Your organization issues devices to employees. These devices generate one-time passwords every 60 seconds. A server hosted within the organization knows what this password is at any given time. What type of device is this?

Synchronous token

What is the broadest category of computer systems protected by the Computer Fraud and Abuse Act, as amended?

Systems used in interstate commerce

What element of data categorization management can override all other forms of access control?

Taking ownership

Which of the following contains the primary goals and objectives of security

The CIA triad

Within the context of the European Union (EU) Data Protection law, what is a data processor?

The entity that processes personal data on behalf of the data controller

Which one of the following is not a requirement that Internet service providers must satisfy in order to gain protection under the "transitory activities" clause of the Digital Millennium Copyright Act?

The service provider and the originator of the message must be located in different states.

Mary recently read about a new hacking group that is using advanced tools to break into the database servers of organizations running public websites. In risk management language, how would she describe this group of hackers

Threat

Mary is the co founder of Acme Widgets, a manufacturing firm. Together with her partner, Joe, she has developed a special oil that will dramatically improve the widget manufacturing process. TO keep the formula secret, Mary and Joe plan to make large quantities of the oil by themselves in the plant after the other workers have left. They want to protect this formula for as long as possible. What type of intellectual property protection best suits their needs

Trade secret

What type of cipher relies on changing the location of characters within a message to achieve confidentiality?

Transposition cipher

A biometric system has falsely rejected a valid user, indicating that the user is not recognized. What type of error is this?

Type 1 error

What law formalizes many licensing arrangements used by the software industry and attempts to standardize their use from state to state?

Uniform Computer Information Transactions Act

Which of the following would generally not be considered an asset in a risk analysis?

Users' personal files

What infrastructure component is often located in the same position across multiple floors in order to provide a convenient means of linking floor-based networks together?

Wiring closet