CNT 105 Final
Which statement describes a distributed denial of service attack?" One computer accepts data packets based on the MAC address of another computer. An attacker sends an enormous quantity of data that a server cannot handle.A n attacker builds a botnet comprised of zombies. An attacker views network traffic to learn authentication credentials.
An attacker sends an enormous quantity of data that a server cannot handle.
The employees in a company receive an email stating that the account password will expire immediately and requires a password reset within 5 minutes. Which statement would classify this email? It is a hoax. It is a DDoS attack .It is an impersonation attack. It is a piggy-back attack.
It is a hoax.
Which of the following products or technologies would you use to establish a baseline for an operating system? CVE Baseline Analyzer Microsoft Security Baseline Analyzer MS Baseliner SANS Baselining System (SBS)
Microsoft Security Baseline Analyzer
Which technology should be used to enforce the security policy that a computing device must be checked against the latest antivirus update before the device is allowed to connect to the campus network? NAS NAC SAN VPN
NAC
Which national resource was developed as a result of a U.S. Executive Order after a ten-month collaborative study involving over 3,000 security professionals? ISO OSI model ISO/IEC 27000 the National Vulnerability Database (NVD) NIST Framework
NIST Framework
Which technology would you implement to provide high availability for data storage? RAID software update shot standby N+1
RAID
What type of attack will make illegitimate websites higher in a web search result list? browser hijacker spam SEO poisoning DNS poisoning
SEO poisoning
You have been asked to implement a data integrity program to protect data files that need to be electronically downloaded by the sales staff. You have decided to use the strongest hashing algorithm available on your systems. Which hash algorithm would you select? MD5 SHA-1 AES SHA-256
SHA-256
Which protocol would be used to provide security for employees that access systems remotely from home? WPA SSH SCP Telnet
SSH
Which law was enacted to prevent corporate accounting-related crimes? Import/Export Encryption Act The Federal Information Security Management Act Sarbanes-Oxley Act Gramm-Leach-Bliley Act
Sarbanes-Oxley Act
What is a feature of a cryptographic hash function? The output has a variable length. The hash input can be calculated given the output value. Hashing requires a public and a private key .The hash function is a one-way mathematical function.
The hash function is a one-way mathematical function.
What technology should be implemented to verify the identity of an organization, to authenticate its website, and to provide an encrypted connection between a client and the website? digital signature digital certificate asymmetric encryption salting
digital certificate
Your organization will be handling market trades. You will be required to verify the identify of each customer who is executing a transaction. Which technology should be implemented to authenticate and verify customer electronic transactions? asymmetrical encryption symmetrical encryption digital certificates data hashing
digital certificates
What technology should you implement to ensure that an individual cannot later claim that he or she did not sign a given document? HMAC digital certificate digital signature asymmetric encryption
digital signature
Which technology can be used to protect VoIP against eavesdropping? strong authentication ARP SSH encrypted voice messages
encrypted voice messages
An organization has recently adopted a five nines program for two critical database servers. What type of controls will this involve? improving reliability and uptime of the servers limiting access to the data on these systems stronger encryption systems remote access to thousands of external users
improving reliability and uptime of the servers
Which method is used by steganography to hide text in an image file? data masking most significant bit data obfuscation least significant bit
least significant bit
What approach to availability involves using file permissions? layering obscurity limiting simplicity
limiting
An organization plans to implement security training to educate employees about security policies. What type of access control is the organization trying to implement? administrative technological physical logical
logical
Mutual authentication can prevent which type of attack? man-in-the-middle wireless poisoning wireless IP spoofing wireless sniffing
man-in-the-middle
Which utility uses the Internet Control Messaging Protocol (ICMP)? RIP ping NTP DNS
ping
Keeping data backups offsite is an example of which type of disaster recovery control? detective corrective management preventive
preventive
Your risk manager just distributed a chart that uses three colors to identify the level of threat to key assets in the information security systems. Red represents high level of risk, yellow represents average level of threat and green represents low level of threat. What type of risk analysis does this chart represent? quantitative analysis exposure factor analysis loss analysis qualitative analysis
qualitative analysis
Which hashing technology requires keys to be exchanged? MD5 HMAC AES salting
salting
What type of attack has an organization experienced when an employee installs an unauthorized device on the network to view network traffic? spoofing sniffing phishing spamming
sniffing
What is a nontechnical method that a cybercriminal would use to gather sensitive information from an organization? pharming ransomeware man-in-the-middle social engineering
social engineering
What are three states of data during which data is vulnerable? (Choose three.) data in-process purged data stored data data encrypted data decrypted data in-transit
stored data data in-transit data in-process
Which threat is mitigated through user awareness training and tying security awareness to performance reviews? user-related threats device-related threats cloud-related threats physical threats
user-related threats
Which type of networks poses increasing challenges to cybersecurity specialists due to the growth of BYOD on campus? sneaker net wireless networks wired networks virtual networks
wireless networks
A user has a large amount of data that needs to be kept confidential. Which algorithm would best meet this requirement? RSA ECC Diffie-Hellman 3DES
3DES
Which three protocols can use Advanced Encryption Standard (AES)? (Choose three.) WEP WPA2 802.11q 802.11i WPATKIP
802.11i WPA WPA2
Which statement describes a characteristics of block ciphers? Block ciphers result in compressed output .Block ciphers encrypt plaintext one bit at a time to form a block. Block ciphers result in output data that is larger than the input data most of the time .Block ciphers are faster than stream ciphers.
Block ciphers result in compressed output.
The awareness and identification of vulnerabilities is a critical function of a cybersecurity specialist. Which of the following resources can be used to identify specific details about vulnerabilities? NIST/NICE framework CVE national database ISO/IEC 27000 model Infragard
CVE national database
Which algorithm will Windows use by default when a user intends to encrypt files and folders in an NTFS volume? 3DES RSA DES AES
DES
What describes the protection provided by a fence that is 1 meter in height? It deters casual trespassers only. It offers limited delay to a determined intruder. The fence deters determined intruders. It prevents casual trespassers because of its height.
It deters casual trespassers only.
Technicians are testing the security of an authentication system that uses passwords. When a technician examines the password tables, the technician discovers the passwords are stored as hash values. However, after comparing a simple password hash, the technician then discovers that the values are different from those on other systems. What are two causes of this situation? (Choose two.) Both systems use MD5. Both systems scramble the passwords before hashing. The systems use different hashing algorithms. One system uses hashing and the other uses hashing and salting. One system uses symmetrical hashing and the other uses asymmetrical hashing.
The systems use different hashing algorithms. One system uses hashing and the other uses hashing and salting.
Which statement best describes a motivation of hacktivists? They are part of a protest group behind a political cause. They are interested in discovering new exploits .They are trying to show off their hacking skills. They are curious and learning hacking skills.
They are part of a protest group behind a political cause.
Technologies like GIS and IoE contribute to the growth of large data stores. What are two reasons that these technologies increase the need for cybersecurity specialists? (Choose two.) They collect sensitive information. They require 24-hour monitoring. They make systems more complicated. They contain personal information .They increase processing requirements.They require more equipment.
They collect sensitive information. They contain personal information
What are the two most effective ways to defend against malware? (Choose two.) Implement network firewalls. Update the operating system and other application software. Install and update antivirus software. Implement a VPN.Implement RAID. Implement strong passwords.
Update the operating system and other application software. Install and update antivirus software.
Alice and Bob use a pre-shared key to exchange a confidential message. If Bob wants to send a confidential message to Carol, what key should he use? the private key of Carol the public key of Bob a new pre-shared key the same pre-shared key he used with Alice
a new pre-shared key
The IT department is tasked to implement a system that controls what a user can and cannot do on the corporate network. Which process should be implemented to meet the requirement? a set of attributes that describes user access rights user login auditing observations to be provided to all employees a biometric fingerprint reader
a set of attributes that describes user access rights
Which technology can be implemented as part of an authentication system to verify the identification of employees? a virtual fingerprint SHA-1 hasha Man trapa smart card reader
a smart card reader
Which access control should the IT department use to restore a system back to its normal state? detective corrective compensative preventive
corrective
You have been asked to work with the data collection and entry staff in your organization in order to improve data integrity during initial data entry and data modification operations. Several staff members ask you to explain why the new data entry screens limit the types and size of data able to be entered in specific fields. What is an example of a new data integrity control? a limitation rule which has been implemented to prevent unauthorized staff from entering sensitive data data encryption operations that prevent any unauthorized users from accessing sensitive data data entry controls which only allow entry staff to view current data a validation rule which has been implemented to ensure completeness, accuracy, and consistency of data
a validation rule which has been implemented to ensure completeness, accuracy, and consistency of data
Which two values are required to calculate annual loss expectancy? (Choose two.) single loss expectancy quantitative loss value frequency factor asset value annual rate of occurrence exposure factor
annual rate of occurrence single loss expectancy
An organization wants to adopt a labeling system based on the value, sensitivity, and criticality of the information. What element of risk management is recommended? sasset standardization asset identification asset classification asset availability
asset classification
Which type of cybercriminal is the most likely to create malware to compromise an organization by stealing credit card information? script kiddies gray hat hacker swhite hat hackers black hat hackers
black hat hackers
What type of application attack occurs when data goes beyond the memory areas allocated to the application? RAM spoofing RAM Injection SQL injection buffer overflow
buffer overflow
A cybersecurity specialist is working with the IT staff to establish an effective information security plan. Which combination of security principles forms the foundation of a security plan? confidentiality, integrity, and availability secrecy, identify, and nonrepudiation encryption, authentication, and identification technologies, policies, and awareness
confidentiality, integrity, and availability
What are two incident response phases? (Choose two.) detection and analysis risk analysis and high availability containment and recovery prevention and containment mitigation and acceptance confidentiality and eradication
containment and recovery detection and analysis
