chapter 8
Which of the following statements are true? IT developments such as virtualization, Cloud computing, and the Internet of Things weaken information security. A large number of emergency changes is a potential red flag of other problems. Information security is improved when the CISO reports to the CIO. All of the statements are true. None of the statements are true.
IT developments such as virtualization, Cloud computing, and the Internet of Things weaken information security.
Which of the following set of authentication credentials provides the strongest access control? A password and a security question. A PIN and a smart card. Voice recognition and a fingerprint. All of the combinations of credentials are equally strong.
a PIN and a smart card
border router
a device that connects an organization's information system to the internet
biometric identifier
a physical or behavioral characteristic that is used as an authentication credential
deep packet inspection
a process that examines the data in the body of a TCP packet to control traffic, rather than looking only at the information in the IP and TCP headers
packet filtering
a process that uses various fields in a packet's IP and TCP headers to decide what to do with the packet
exploit
a program designed to take advantage of a known vulnerability
demilitarized zone
a separate network located outside the organization's internal information system that permits controlled access from the internet
Access Control List (ACL)
a set of IF-THEN rules used to determine what to do with arriving packets
Intrusion Detection System (IDS)
a system that creates logs of all network traffic that was permitted to pass the firewall and then analyzes those logs for signs of attempted or successful intrusions
Access Control Matrix
a table used to implement authorization controls
Computer Incident Response Team (CIRT)
a team that is responsible for dealing with major security incidents
Which of the following is a preventive control? a. training b. log analysis c. CIRT d. virtualization
a.
Which of the following techniques is the most effective way for a firewall to use to protect the perimeter? a. deep packet inspection b. packet filtering c. access control list d. All of the above are equally effective.
a.
penetration test
an authorized attempt to break into the organization's information system
The system employs a compatibility test to decide whether to let a particular employee update records in a particular file. The compatibility test is a part of the aspect of access control referred to as . authentication authorization accountability
authorization
vulnerability scanners
automated tools designed to identify whether a given system possesses any unused and unnecessary programs that represent potential security threats
The control procedure designed to restrict what portions of an information system an employee can access and what actions he or she can perform is called . a. authentication b. authorization c. intrusion prevention d. intrusion detection
b
Which of the following combinations of credentials is an example of multifactor authentication? a. voice recognition and a fingerprint reader b. a PIN and an ATM card c. a password and a user ID d. all of the above
b.
Which of the following is a corrective control designed to fix vulnerabilities? a. virtualization b. patch management c. penetration testing d. authorization
b.
Which of the following statements is true? a. The concept of defense-in-depth reflects the fact that security involves the use of a few sophisticated technical controls. b. Information security is necessary for protecting confidentiality, privacy, integrity of processing, and availability of information resources. c. The time-based model of security can be expressed in the following formula: P<D+RP<D+R d. Information security is primarily an IT issue, not a managerial concern.
b.
A weakness that an attacker can take advantage of to either disable or take control of a system is called a(n) . a. exploit b. patch c. vulnerability d. attack
c.
Which of the following is a detective control? a. hardening endpoints b. physical access controls c. penetration testing d. patch management
c.
patch
code released by software developers that fixes a particular vulnerability
endpoints
collective term for the workstations, servers, printers, and other devices that comprise an organization's network
Modifying default configurations to turn off unnecessary programs and features to improve security is called . a. user account management b. defense-in-depth c. vulnerability scanning d. hardening
d.
Which of the following statements is true? a. "Emergency" changes need to be documented once the problem is resolved. b. Changes should be tested in a system separate from the one used to process transactions. c. Change controls are necessary to maintain adequate segregation of duties. d. All of the above are true.
d.
A firewall that uses would be most effective in detecting and stopping an attempt to deface the organization's website by sending an HTML "PUT" command to its web server. static packet filtering stateful packet filtering deep packet inspection
deep packet inspection
Defense in Depth
employing multiple layers of controls to avoid a single point-of-failure
The set of instructions for taking advantage of a flaw in a program is called a(n) . vulnerability patch update exploit
exploit
Vulnerabilities
flaws in programs that can be exploited to either crash the system or take control of it
Time Based Model of Information Security
implementing a combination of controls that protect assets long enough to enable an organization to recognize that an attack is occurring and take steps to thwart it before any information is lost or compromised p>D+R
compatibility test
matching the user's authentication credentials against the access control matrix to determine whether that employee should be allowed to access that resource and perform the requested action
ABC bank wants to strengthen the security of its online bill-pay features. Therefore, it decides that in addition to a password, users must also correctly identify a picture that they have previously chosen to be one of their authentication credentials. This is an example of a process referred to as . multifactor authentication multimodal authentication neither of the above
multimodal authentication
In addition to encryption, organizations should to effectively secure wireless communications. place all wireless access points in the DMZ configure all wireless clients to operate in ad hoc mode do both of the above do none of the above
place all wireless access points in the DMZ
info security procedures protect info integrity by
preventing ficticious transactions
Trust Services Framework
principle of integrity is achieved when system produces data that is complete accurate and valid principle that states info should be protected from unauthorized disclosure is privacy
internet protocol
protocol specifies the route of packets sent over internet to get them to right destination
internet of things
refers to the embedding of sensors in a multitude of devices (lights, heating and air conditioning, appliances) so that those devices can now connect to the internet
A company's current password policy requires that passwords be alphanumeric, case-sensitive, and 10 characters long. Which one of the following changes to a company's password policy will increase password strength the most? Require passwords to also include special characters (such as $, &, etc.) Require passwords to be 15 characters long Both of the above changes would have the same effect on password strength
require passwords to be 15 characters long
Virtualization
running multiple systems simultaneously on one physical computer
Firewalls are most effective in reducing the ability of an attacker to . conduct initial reconnaissance research vulnerabilities and exploits scan and map the target all of the above are prevented by firewalls none of the above are prevented by firewalls
scan and map the target
transmission control protocol
sequencing of packets, re routes to the right place
Intrusion Prevention System (IPS)
software or hardware that monitors patterns in the traffic flow to identify and automatically block attacks
routers
special purpose devices that are designed to read the source and destination address fields in IP packet headers to decide where to send (route) the packet next
reconnaissance
steps criminals take to study target's physical layout to learn about controls it has in place
change control and change management
the formal process used to ensure that modifications to hardware, software, or processes do not reduce systems reliability
log analysis
the process of examining logs to identify evidence of possible attacks
hardening
the process of modifying the default configuration of endpoints to eliminate unnecessary settings and services
Patch Management
the process of regularly applying patches and updates to software
authorization
the process of restricting access of authenticated users to specific portions of the system and limiting what actions they are permitted to perform
multimodal authentication
the use of multiple authentication credentials of the same type to achieve a greater level of security
multifactor authentication
the use of two or more types of authentication credentials in conjunction to achieve a greater level of security
Cloud Computing
using a browser to remotely access software, data storage, hardware, and applications
Social Engineering
using deception to obtain unauthorized access to information resources
Authentication
verifying the identity of the person or device attempting to access the system
Security Life Cycle
1. assess threats and select risk response 2. develop and communicate policy 3. acquire and implement solutions 4. monitor performance
firewall
A special-purpose hardware device or software running a general-purpose computer that controls both inbound and outbound communication between the system behind the firewall and other networks.
