MIS 374-Practice Exam 2

Henry is creating a firewall rule that will allow inbound mail to the organization. What TCP port must he allow through the firewall?

25

Henry would like to create a different firewall rule that allows encrypted web traffic to reach a web server. What port is used for that communication?

443

What is NOT a valid encryption key length for use with the Blowfish algorithm?

512 bits

Ed wants to make sure that his system is designed in a manner that allows tracing actions to an individual. Which phase of access control is Ed concerned about?

Accountability

Alice would like to send a message to Bob using a digital signature. What cryptographic key does alice use to create the digital signature?

Alice's private key

Alice would like to send a message to Bob using a digital signature. What cryptographic key does Alice use to create the digital signature?

Alices private key

Ricky is reviewing security logs to independently assess security controls. Which security review process is Ricky engaging in?

Audit

During what phase of a remote access connection does the end user prove his or her claim of identity?

Authentication

During which phase of the access control process does the system answer the question, "What can the requestor access?"

Authorization

Janet is identifying the set of privileges that should be assigned to a new employee in her organization. Which phase of the access control process is she performing?

Authorization

Which information security objective allows trusted entities to endorse information?

Certification

which information security objective allows trusted entities to endorse information?

Certification

Which audit data collection method ensures that information gathering covers all relevant areas

Checklist

An algorithm used for cryptographic purposes is known as a __________.

Cipher

Alison discovers that a system under her control has been infected with malware, which is using a key logger to report user keystrokes to a third party. What information security property is this malware attacking?

Confidentiality

Which activity manages the baseline settings for a system or device?

Configuration control

Larry recently viewed an auction listing on a website. As a result, his computer executed code that popped up a window that asked for his password. What type of attack has Larry likely encountered?

Cross-site scripting (XSS)

Betty receives a cipher text message from her colleague Tim. What type of function does Betty need to use to read the plaintext message?

Decryption

Alice and Bob would like to communicate with each other using a session key but they do not already have a shared secret key. Which algorithm can they use to exchange a secret key?

Diffie-Hellman

A __________ is a representation of a physical signature stored in a digital format.

Digital signature

Gary would like to choose an access control model in which the owner of a resource decides who may modify permissions on that resource. Which model fits that scenario?

Discretionary access control (DAC)

The act of scrambling plaintext into ciphertext is known as __________.

Encryption

what mathematical problem forms the basis of most modern cryptographic algorithms?

Factoring Large Primes

A private key cipher is also called an asymmetric key cipher.

False

Anthony is responsible for tuning his organization's intrusion detection system. He notices that the system reports an intrusion alert each time that an administrator connects to a server using Secure Shell (SSH). What type of error is occurring?

False positive error

What is NOT a good approach for destroying data on a magnetic disc?

Formatting

what type of function generates the unique value that corresponds to the contents of a message and is used to create a digital signature?

Hash

which one of the following is an example of a logical access control?

Password

Bob is developing a web application that depends upon a database backend. What type of attack could a malicious individual use to send commands through his web application to the database?

SQL injection

In what type attack does the attacker send unauthorized commands directly to database?

SQL injection

There are several types of software development methods, but most traditional methods are based on the ________ model.

WaterFall

In what software development model does activity progress in a lock-step sequential process where no phase begins until the previous phase is complete?

Waterfall

What standard is NOT secure and should never be used on modern wireless networks?

Wired Equivalent Privacy (WEP)

What wireless security technology contains significant flaws and should never be used?

Wired Equivalent Privacy (WEP)

legacy encryption for wireless networks. it is weak and does not provide sufficient protection for most traffic

Wired Equivalent Privacy(WEP)

Which cryptographic attack offers cryptanalysts the most information about how an encryption algorithm works?

chosen plaintext

Which intrusion detection system strategy relies upon pattern matching?

signature detection

Bob received a message from Alice that contains a digital signature. What cryptographic key does Bob use to verify the digital signature?

Alices public key

Fran is conducting a security test of a new application. She does not have any access to the source code or other details of the application she is testing. What type of test is Fran conducting?

Black-box test

Alice would like to send a message to Bob securely and wishes to encrypt the contents of the message. What key does she use to encrypt this message?

Bobs public key

Which type of password attack attempts all possible combinations of a password in an attempt to guess the correct value?

Brute-force attack

Gary is sending a message to Patricia. He wants to ensure that nobody tampers with the message while it is in transit. What goal of cryptography is Gary attempting to achieve?

Integrity

which of the following is an example of a hardware security control?

MAC filtering

When should an organization's managers have an opportunity to respond to the findings in an audit?

Managers should include their responses to the draft audit report in the final audit report.

Which agreement type is typically less formal than other agreements and expresses areas of common interest?

Memorandum of understanding (MOU)

which security testing activity uses tools that scan for services running on system?

Network mapping

Which regulatory standard would NOT require audits of companies in the United States?

Personal Information Protection and Electronic Documents Act

what is NOT a goal of information security awareness programs ?

Punish users who violate policy

which item is an auditor least likely to review during a system controls audit?

Resumes of system administrators

In what type of attack does the attacker send unauthorized commands directly to a database?

SQL injection

Having one person authorized to write checks and another to issue checks is an example of

Separation of duties

An encryption cipher that uses the same key to encrypt and decrypt is called a(n) __________ key.

Symmetric

DES, IDEA, RC4, and WEP are examples of __________.

Symmetric algorithms

This security monitoring tool would identify an unauthorized change to a computer system

System integrity monitoring

Which type of cipher works by rearranging the characters in a message?

Transposition

Current encryption for wireless networks. Much stronger than WEP, it is the recommended encryption for wireless use

Wi-Fi Protected Access (WPA)

Karen is designing a process for issuing checks and decides that one group of users will have the authority to create new payees in the system while a separate group of users will have the authority to issue checks to those payees. The intent of this control is to prevent fraud. Which principle is Karen enforcing?

Separation of duties

Biyu is making arrangements to use a third-party service provider for security services. She wants to document a requirement for timely notification of security breaches. What type of agreement is most likely to contain formal requirements of this type?

Service level agreement (SLA)

Which set of characteristics describes the Caesar cipher accurately?

Symmetric, Stream, Substitution

Which set of characteristics describes the Caesar cipher accurately?

Symmetric, stream, substitution