IS-577 Chapter 11
For as long as it appears on the device
A TOTP token code is generally valid for what period of time? Only while the user presses SEND Until an event occurs For as long as it appears on the device For up to 24 hours
Jailbreaking
A friend of Ukrit told him that he has just downloaded and installed an app that allows him to circumvent the built-in limitations on his Apple iOS smartphone. What is this called? Ducking Rooting Sideloading Jailbreaking
Infrared
Agape was asked to make a recommendation regarding short-range wireless technologies to be supported in a new conference room that was being renovated. Which of the following would she NOT consider due to its slow speed and its low deployment levels today? Infrared NFC Bluetooth ANT
Type D
Calista is designing the specifications for new laptop computers to be purchased by her company. She is comparing the different types and sizes of USB connections found on the devices. Which type USB connection would she NOT find on a laptop? Type D Standard Micro Mini
geolocation
Creating a pattern of where a user accesses a remote web account is an example of which of the following? Cognitive biometrics Time-Location Resource Monitoring (TLRM) Keystroke dynamics Geolocation
Privileged accounts
Each of the following accounts should be prohibited EXCEPT: Shared accounts Generic accounts Privileged accounts Guest accounts
reset to factory settings
Gaetan has attempted to enter the passcode for his mobile device but keeps entering the wrong code. Now he is asked to enter a special phrase to continue. Which configuration setting is enabled on Gaetan's mobile device? extend lockout period lock device enable high security reset to factory settings
It takes more time to generate candidate password digests.
How is key stretching effective in resisting password attacks? It does not require the use of salts. It requires the use of GPUs. It takes more time to generate candidate password digests. The license fees are very expensive to purchase and use it.
OAuth
Ilya has been asked to recommend a federation system technology that is an open source federation framework that can support the development of authorization protocols. Which of these technologies would he recommend? NTLM Shibboleth Open ID Connect OAuth
CYOD
In her job interview, Xiu asks about the company policy regarding smartphones. She is told that employees may choose from a limited list of approved devices but that she must pay for the device herself; however, the company will provide her with a monthly stipend. Which type of enterprise deployment model does this company support? COPE CYOD Corporate-owned BYOD
push notification services
Jabez needs to alert through an SMS text message those corporate users who have a specific brand and type of mobile device regarding a serious malware incident. What technology will she use?
Connecting a mobile device as a peripheral to an infected computer could allow malware to be sent to that device.
Paavo was reviewing a request by an executive for a new subnotebook computer. The executive said that he wanted USB OTG support and asked Paavo's opinion regarding its security. What would Paavo tell him about USB OTG security? a. Subnotebooks do not support USB OTG. b. Connecting a mobile device as a peripheral to an infected computer could allow malware to be sent to that device. c. USB OTG uses strong security and the executive should have no concerns. d. An unsecured mobile device could infect other tethered mobile devices or the corporate network.
Wireless carriers are reluctant to provide firmware OTA updates because of the bandwidth it consumes on their wireless networks.
Pakpao has been asked to provide research regarding a new company initiative to add Android smartphones to a list of approved devices. One of the considerations is how frequently the smartphones receive firmware OTA updates. Which of the following reasons would Pakpao NOT list in his report as a factor in the frequency of Android firmware OTA updates? A. Wireless carriers are reluctant to provide firmware OTA updates because of the bandwidth it consumes on their wireless networks. B. Both OEMs and wireless carriers are hesitant to distribute Google updates because it limits their ability to differentiate themselves from competitors if all versions of Android start to look the same through updates. C. Because many of the OEMs had modified Android, they are reluctant to distribute updates that could potentially conflict with their changes. D. Because OEMs and wireless carriers want to sell as many devices as possible, they have no financial incentive to update mobile devices that users would then continue to use indefinitely.
Brute force attack
Timur was making a presentation regarding how attackers break passwords. His presentation demonstrated the attack technique that is the slowest yet most thorough attack that is used against passwords. Which of these password attacks did he demonstrate? Hybrid attack Custom attack Dictionary attack Brute force attack
single sign-on
Using one authentication credential to access multiple accounts or applications is known as _____. identification authentication single sign-on credentialization federal login
mobile device management (MDM)
What allows a device to be managed remotely? a. mobile device management (MDM) b. mobile application management (MAM) c. mobile resource management (MRM) d. mobile wrapper management (MWM)
It separates personal data from corporate data
What does containerization do? a. It splits operating system functions only on specific brands of mobile devices. b. It separates personal data from corporate data. c. It places all keys in a special vault. d. It slows down a mobile device to half speed.
geofencing
What enforces the location in which an app can function by tracking the location of the mobile device? Graphical Management Tracking (GMT) GPS tagging location resource management geofencing
Cost
What is a disadvantage of biometric readers? Speed Weight Standards Cost
An attack that combines a dictionary attack with a mask attack
What is a hybrid attack? A brute force attack that uses special tables An attack that combines a dictionary attack with a mask attack An attack that slightly alters dictionary words An attack that uses both automated and user input
Multifactor authentication system
What is a token system that requires the user to enter the code along with a PIN called? Multifactor authentication system Dual-prong verification system Token-passing authentication system Single-factor authentication system
geolocation
What is the process of identifying the geographical location of a mobile device?
screen lock
What prevents a mobile device from being used until the user enters the correct passcode? swipe identifier (SW-ID) touch swipe screen timeout screen lock
What you do
Which authentication factor is based on a unique talent that a user possesses? What you know What you do What you have What you are
Height
Which human characteristic is NOT used for biometric identification? Height Iris Retina Fingerprint
Plaintext password
Which of the following should NOT be stored in a secure password database? Plaintext password Password digest Salt Iterations
MMS
Which of the following technologies provides for pictures, video, or audio to be included in text messages? ANT SMS MMS QR
A long password
Which of these is NOT a characteristic of a weak password? Using a predictable sequence of characters Using personal information A common dictionary word A long password
Most sites force users to create weak passwords even though they do not want to.
Which of these is NOT a reason why users create weak passwords? A security policy requires a password to be changed regularly. A lengthy and complex password can be difficult to memorize. Most sites force users to create weak passwords even though they do not want to. Having multiple passwords makes it hard to remember all of them.
Public networks are faster than local networks and can spread malware more quickly to mobile devices.
Which of these is NOT a risk of connecting a mobile device to a public network? a. Public networks are faster than local networks and can spread malware more quickly to mobile devices. b. Public networks are beyond the control of the employee's organization. c. Replay attacks can occur on public networks. d. Public networks may be susceptible to man-in-the-middle attacks.
last known good configuration
Which of these is NOT a security feature for locating a lost or stolen mobile device? remote lockout thief picture alarm last known good configuration
Common Access Card (CAC)
Which of these is a U.S. Department of Defense (DoD) smart card that is used for identification of active-duty and reserve military personnel? Personal Identity Verification (PIV) card Secure ID Card (SIDC) Government Smart Card (GSC) Common Access Card (CAC)
password
Which of these is considered the strongest type of passcode to use on a mobile device? fingerprint swipe password PIN draw connecting dots pattern
HOTP
Which one-time password is event-driven? POTP TOTP HOTP ROTP
physical keyboard
Which technology is NOT a core feature of a mobile device? data synchronization capabilities physical keyboard local non-removable data storage small form factor
MAM
Which tool manages the distribution and control of apps? MAM MCM MDM MFM
RTOS
Which type of OS is typically found on an embedded system? RTOS OTG COPE SoC
Mask attack
Which type of password attack is a more targeted brute force attack that uses placeholders for characters in certain positions of the password? Rule attack Pass the hash attack Mask attack Rainbow attack
It could decrease calls to the help desk.
Why should the account lockout threshold not be set too low? It could decrease calls to the help desk. The network administrator would have to reset the account manually. The user would not have to wait too long to have her password reset. It could result in denial of service (DoS) attacks.
Cognitive
_____ biometrics is related to the perception, thought processes, and understanding of the user. Behavioral Cognitive Intelligent Standard
