ISA 3300 Final Chapter 7-12

Ace your homework & exams now with Quizwiz!

Workers hired to perform specific services for the organization.

d. contract employees

A process of assigning financial value or worth to each information asset.

h. asset valuation

The __________ risk treatment strategy attempts to shift the risk to other assets, processes, or organizations.

transference transfer

A wireless access point is a device used to connect wireless networking users and their devices to the rest of the organization's network(s). __________

True

All systems that are mission critical should be enrolled in platform security validation (PSV) measurement. a. True b. False

True

Also known as an economic feasibility study, the formal assessment and presentation of the economic expenditures needed for a particular security control, contrasted with its projected value to the organization, is known as cost-benefit analysis (CBA). __________

True

The KDC component of Kerberos knows the secret keys of all clients and servers on the network. a. True b. False

True

The best method of remediation in most cases is to repair a vulnerability. __________

True

The principle of limiting users' access privileges to the specific information required to perform their assigned tasks is known as need-to-know. __________

True

The process of identifying and documenting specific and provable flaws in the organization's information asset environment is called vulnerability assessment (VA). __________

True

The risk treatment strategy that attempts to reduce the impact of the loss caused by a realized incident, disaster, or attack through effective contingency planning and preparation is known as the mitigation risk treatment strategy. __________

True

The NIST risk management approach includes all but which of the following elements? a. inform b. assess c. frame d. respond

Which of the following policies requires that every employee be able to perform the work of at least one other staff member? a. collusion b. job rotation c. two-person control d. separation of duties

Which of the following policies requires that two individuals review and approve each other's work before the task is considered complete? a. task rotation b. two-person control c. separation of duties d. job rotation

The Microsoft Risk Management Approach includes four phases; which of the following is NOT one of them? a. conducting decision support b. implementing controls c. evaluating alternative strategies d. measuring program effectiveness

Which of the following policies makes it difficult for an individual to violate InfoSec and is quite useful in monitoring financial affairs? a. task rotation b. mandatory vacations c. separation of duties d. job rotation

Which of the following risk treatment strategies describes an organization's attempt to shift risk to other assets, other processes, or other organizations? a. acceptance b. avoidance c. transference d. mitigation

In the _________ firewall architecture, a single device configured to filter packets serves as the sole security point between the two networks. a. state-managed firewall b. screened-subnet firewall c. single-homed firewall d. single bastion host

In which contingency plan testing strategy do individuals follow each and every IR/DR/BC procedure, including the disruption of service, restoration of data from backups, and notification of appropriate individuals? a. desk check b. simulation c. structured walk-through d. full-interruption

Which of the following is true about firewalls and their ability to adapt in a network? a. Firewalls can interpret human actions and make decisions outside their programming. b. Because firewalls are not programmed like a computer, they are less error prone. c. Firewalls are flexible and can adapt to new threats. d. Firewalls deal strictly with defined patterns of measured observation.

Which of the following risk treatment strategies describes an organization's efforts to reduce damage caused by a realized incident or disaster? a. acceptance b. avoidance c. transference d. mitigation

Which type of IDPS works like antivirus software? a. network-based b. anomaly-based c. host-based d. signature-based

Access is granted based on a set of rules specified by the central authority.

d. rule-based access controls

A(n) __________ occurs when an attack affects information resources and/or assets, causing actual damage or other disruptions.

incident

The __________ plan is a detailed set of processes and procedures that anticipate, detect, and mitigate the effects of an unexpected event that might compromise information resources and assets.

incident response (IR)

Effective contingency planning begins with effective __________.

policy

To keep up with the competition, organizations must design and create a __________ environment in which business processes and procedures can function and evolve effectively.

secure

A goal of 100 percent employee InfoSec training as an objective for the training program is an example of a performance __________.

target measure metric

The requirement that all critical tasks can be performed by multiple individuals is known as __________.

task rotation

An examination of how well a particular solution is supportable given the organization's current technological infrastructure and resources is known as __________.

technical feasibility

. The __________ risk treatment strategy eliminates all risk associated with an information asset by removing it from service.

termination

Under TCSEC, the combination of all hardware, firmware, and software responsible for enforcing the security policy is known as the __________.

trusted computing base (TCB)

The organization of a task or process so it requires at least two individuals to work together to complete is known as __________ control.

two person two man

When dealing with an incident, the incident response team must conduct a(n) __________, which entails a detailed examination of the events that occurred from first detection to final recovery.

After action review (AAR)

__________ planning ensures that critical business functions can continue if a disaster occurs.

Business continuity (BC)

If operations at the primary site cannot be quickly restored, the __________ occurs concurrently with the DR plan, enabling the business to continue at an alternate site.

Business continuity plan (BCP)

__________ is the financial savings from using the defense risk treatment strategy to implement a control and eliminate the financial ramifications of an incident.

Cost avoidance

__________ channels are unauthorized or unintended methods of communications hidden inside a computer system, including storage and timing channels.

Covert

__________ is a backup technique that stores duplicate online transaction data along with duplicate databases at the remote site on a redundant server.

Database shadowing

__________ encompasses a requirement that the implemented standards continue to provide the required level of protection.

Due diligence

A company striving for "best security practices" makes every effort to establish security program elements that meet every minimum standard in their industry. a. True b. False

False

A general guideline for performance of hard drives suggests that when the amount of data stored on a particular hard drive averages 95% of available capacity for a prolonged period, you should consider an upgrade for the drive. a. True b. False

False

An effective information security governance program requires no ongoing review once it is well established. a. True b. False

False

An intranet vulnerability scan starts with the scan of the organization's default Internet search engine. a. True b. False

False

Documentation procedures are not required for configuration and change management processes. a. True b. False

False

ISO 27001 certification is only available to companies that do business internationally. a. True b. False

False

In most organizations, the COO is responsible for creating the IR plan. a. True b. False

False

Performance measurements are seldom required in today's regulated InfoSec environment. a. True b. False

False

Separation of duties is the principle by which members of the organization can access the minimum amount of information for the minimum amount of time necessary to perform their required duties. a. True b. False

False

Technical controls alone, when properly configured, can secure an IT environment. a. True b. False

False

The "something a person has" authentication mechanism takes advantage of something inherent in the user that is evaluated using biometrics. a. True b. False

False

The Information Technology Infrastructure Library provides guidance in the development and implementation of an organizational InfoSec governance structure. a. True b. False

False

The defense risk treatment strategy may be accomplished by outsourcing to other organizations. a. True b. False

False

The internal monitoring domain is the component of the maintenance model that focuses on identifying, assessing, and managing the physical security of assets in an organization. a. True b. False

False

The principle of limiting users' access privileges to the specific information required to perform their assigned tasks is known as minimal access. a. True b. False

False

The target selection step of Internet vulnerability assessment involves using the external monitoring intelligence to configure a test engine (such as Nessus) for the tests to be performed. a. True b. False

False

Threats cannot be removed without requiring a repair of the vulnerability. a. True b. False

False

Training should be as specialized as possible; personnel who are responsible for one duty should not be trained on other duties to avoid confusion during a disaster. a. True b. False

False

Under the Clark-Wilson model, internal consistency means that the system is consistent with similar data at the organization's competitors. a. True b. False

False

Using a practice called baselining, you are able to compare your organization's efforts to those of other organizations you feel are similar in size, structure, or industry. a. True b. False

False

When an incident takes place, the disaster recovery (DR) plan is invoked before the incident response (IR) plan. a. True b. False

False

When performing full-interruption testing, normal operations of the business are not impacted. a. True b. False

False

Wireless vulnerability assessment begins with the planning, scheduling, and notification of all Internet connections, using software such as Wireshark. a. True b. False

False

management model such as the ISO 27000 series deals with methods to maintain systems. a. True b. False

False

Boundary controls regulate the admission of users into trusted areas of the organization. __________

False - Access

Standardization is an attempt to improve information security practices by comparing an organization's efforts against those of a similar organization or an industry-developed standard to produce results it would like to duplicate. __________

False - Benchmarking

US-CERT is a set of moderated mailing lists full of detailed, full-disclosure discussions and announcements about computer security vulnerabilities. It is sponsored in part by SecurityFocus. __________

False - Bugtraq

Intense packet inspection is a firewall function that involves examining multiple protocol headers and even content of network traffic, all the way through the TCP/IP layers and including encrypted, compressed, or encoded data. __________

False - Deep

The internal vulnerability assessment is usually performed against every device that is exposed to the Internet, using every possible penetration testing approach. __________

False - Internet

Collusion is the requirement that every employee be able to perform the work of at least one other employee. __________

False - Job rotation

Two-person control is the requirement that all critical tasks can be performed by multiple individuals. _________

False - Task rotation

The risk treatment strategy that indicates the organization is willing to accept the current level of risk and do nothing further to protect an information asset is known as the termination risk treatment strategy. ____________

False - acceptance

A(n) wrap-up review is a detailed examination and discussion of the events that occurred during an incident or disaster, from first detection to final recovery. __________

False - after action

Specific warning bulletins are issued when developing threats and specific assets pose a measurable risk to the organization. __________

False - attacks

A(n) credit check can uncover past criminal behavior or other information that suggests a potential for future misconduct or a vulnerability that might render a job candidate susceptible to coercion or blackmail. __________

False - background

A progression is a measurement of current performance against which future performance will be compared. __________

False - baseline

A security metric is an assessment of the performance of some action or process against which future performance is assessed. __________

False - baseline

A bollard host is a device placed between an external, untrusted network and an internal, trusted network. __________

False - bastion

The biggest barrier to baselining in InfoSec is the fact that many organizations do not share information about their attacks with other organizations. __________

False - benchmarking

In information security, a framework or security model customized to an organization, including implementation details, is known as a template. __________

False - blueprint

In a lattice-based access control, a restriction table is the row of attributes associated with a particular subject (such as a user). __________

False - capabilities

A smart chip is an authentication component, similar to a dumb card, that contains a computer chip to verify and validate several pieces of information instead of just a PIN. __________

False - card

A standard of due process is a legal standard that requires an organization and its employees to act as a "reasonable and prudent" individual or organization would under similar circumstances. __________

False - care

The action level is a predefined assessment level of an IDPS that triggers a predetermined response when surpassed. __________

False - clipping

A conspiracy or cooperation between two or more individuals or groups to commit illegal or unethical actions is known as racketeering. __________

False - collusion

Tracking monitoring involves assessing the status of the program as indicated by the database information and mapping it to standards established by the agency. __________

False - compliance

In some organizations, asset management is the identification, inventory, and documentation of the current information system's status—hardware, software, and networking configurations. __________

False - configuration

The risk treatment strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards is the protect risk treatment strategy, also known as the avoidance strategy.

False - defense

Dumpster exploitation is an information attack that involves searching through a target organization's trash and recycling bins for sensitive information. __________

False - diving

In wireless networking, the waveprint is the geographic area in which there is sufficient signal strength to make a network connection. __________

False - footprint

In information security, a specification of a model to be followed during the design, selection, and initial and ongoing implementation of all subsequent security controls is known as a blueprint. __________

False - framework

The primary goal of the external monitoring domain is to maintain an informed awareness of the state of all the organization's networks, information systems, and information security defenses. __________

False - internal

The data access principle that ensures no unnecessary access to data exists by regulating members so they can perform only the minimum data manipulation necessary is known as required privilege. __________

False - least

To be put to the most effective use, the information that comes from the IDPS must be integrated into the inventory process. __________

False - maintenance

The systems development life cycle (SDLC) is the overall process of developing, implementing, and retiring information systems through a multistep approach—from initiation to use. __________

False - maintenance to disposal

The NIST SP 800-100 Information Security Handbook provides technical guidance for the establishment and implementation of an information security program. __________

False - managerial

An alert digest is a description of the incident or disaster that usually contains just enough information so that each person knows what portion of the IR or DR plan to implement without slowing down the notification process. __________

False - message

The Information Technology Infrastructure Library (ITIL) is a collection of policies and practices for managing the development and operation of IT infrastructures. __________

False - methods

In e-commerce situations, some cryptographic tools can be used for misrepresentation in order to assure that parties to the transaction are authentic, and that they cannot later deny having participated in a transaction. __________

False - nonrepudiation

In a cost-benefit analysis, the expected frequency of an attack expressed on a per-year basis is known as the annualized risk of likelihood. __________

False - occurrence

Data or the trends in data that may indicate the effectiveness of security countermeasures or controls—technical and managerial—implemented in the organization are known as progress measurements. __________

False - performance

A semialphabetic substitution cipher is one that incorporates two or more alphabets in the encryption process. __________

False - polyalphabetic

A security monitor is a conceptual piece of the system within the trusted computer base that manages access controls—in other words, it mediates all access to objects by subjects. __________

False - reference

The final process in the vulnerability assessment and remediation domain is the maintenance phase. __________

False - remediation

. CERT stands for "computer emergency recovery team." __________

False - response

An effective information security governance program requires constant change. __________

False - review

An affidavit is used as permission to search for evidentiary material at a specified location and/or to seize items to return to an investigator's lab for examination after being signed by an approving authority. __________

False - search warrant

The information security principle that requires significant tasks to be split up so that more than one individual is required to complete them is called isolation of duties. __________

False - separation

A validity table is a tabular record of the state and context of each packet in a conversation between an internal and external user or system. __________

False - state

An examination of how well a particular solution is supportable given the organization's current technological infrastructure and resources, which include hardware, software, networking, and personnel, is known as operational feasibility. __________

False - technical

The risk treatment strategy that attempts to shift risk to other assets, other processes, or other organizations is known as the defense risk treatment strategy. __________

False - transference

You can document the results of the verification of a vulnerability by saving the results in what is called a(n) profile. __________

False - trophy

A user ticket is opened when a user calls about an issue. __________

False - trouble False - help desk False - support

WLAN stands for "wide local area network." __________

False - wireless

__________ channels are TCSEC-defined covert channels that communicate by modifying a stored object, such as in steganography.

Storage

. A(n) war game puts a subset of plans in place to create a realistic test environment. __________

True

A firewall is any device that prevents a specific type of information from moving between the untrusted network and the trusted network. a. True b. False

True

A hot site is a fully configured computing facility that includes all services, communications links, and physical plant operations. a. True b. False

True

A packet filtering firewall is a networking device that examines the header information of data packets that come into a network and determines whether to drop them (deny) or forward them to the next network connection (allow), based on its configuration rules. __________

True

A password should be difficult to guess. __________

True

A requirement that all employees take time off from work, which allows the organization to audit the individual's areas of responsibility, is known as a mandatory vacation policy. __________

True

A security clearance is an access control model in which each user of an information asset is assigned an authorization level that identifies the level of classified information he or she is cleared to access. __________

True

A slow-onset disaster occurs over time and gradually degrades the capacity of an organization to withstand its effects. __________

True

An example of the type of vulnerability exposed via traffic analysis occurs when an organization is trying to determine if all its device signatures have been adequately masked. __________

True

Biometrics are the use of physiological characteristics to provide authentication of an identification. __________

True

CM assists in streamlining change management processes and prevents changes that could detrimentally affect the security posture of a system before they happen. __________

True

Disaster classification is the process of examining an adverse event or incident and determining whether it constitutes an actual disaster. __________

True

Due care and due diligence occur when an organization adopts a certain minimum level of security—that is, what any prudent organization would do in similar circumstances. __________

True

External monitoring entails forming intelligence from various data sources and then giving that intelligence context and meaning for use by decision makers within the organization.

True

For configuration management and control, it is important to document the proposed or actual changes in the system security plan. __________

True

If an organization deals successfully with change and has created procedures and systems that can be adjusted to the environment, the existing security improvement program will probably continue to work well. a. True b. False

True

In a cold site there are only rudimentary services, with no computer hardware or peripherals. a. True b. False

True

In an IDPS, a sensor is a piece of software that resides on a system and reports back to a management server. __________

True

In information security, a security blueprint is a framework or security model customized to an organization, including implementation details. a. True b. False

True

In some instances, risk is acknowledged as being part of an organization's business process. a. True b. False

True

Intelligence for external monitoring can come from a number of sources: vendors, CERT organizations, public network sources, and membership sites. a. True b. False

True

Inventory characteristics for hardware and software assets that record the manufacturer and versions are related to technical functionality, and should be highly accurate and updated each time there is a change. a. True b. False

True

Lattice-based access control specifies the level of access each subject has to each object, if any. a. True b. False

True

Major planning components should be reviewed on a periodic basis to ensure that they are current, accurate, and appropriate. a. True b. False

True

One of the critical tasks in the measurement process is to assess and quantify what will be measured and how it is measured. __________

True

One question you should ask when choosing among recommended practices is "Can your organization afford to implement the recommended practice?" a. True b. False

True

Organizations should have a carefully planned and fully populated inventory of all their network devices, communication channels, and computing devices. __________

True

Over time, external monitoring processes should capture information about the external environment in a format that can be referenced across the organization as threats emerge and for historical use. a. True b. False

True

Over time, policies and procedures may become inadequate due to changes in the organization's mission and operational requirements, threats, or the environment. a. True b. False

True

Patch and proceed is an organizational CP philosophy that focuses on the defense of information assets and preventing reoccurrence rather than the attacker's identification and prosecution. __________

True

Policy needs to be reviewed and refreshed from time to time to ensure that it's providing a current foundation for the information security program. a. True b. False

True

Recommended or best practices are those security efforts that seek to provide a superior level of performance in the protection of information. __________

True

Rehearsal adds value by exercising the procedures, identifying shortcomings, and providing security personnel the opportunity to improve the security plan before it is needed. a. True b. False

True

Remediation of vulnerabilities can be accomplished by accepting or transferring the risk, removing the threat, or repairing the vulnerability. a. True b. False

True

Risks can be avoided by countering the threats facing an asset or by eliminating the exposure of an asset. a. True b. False

True

Secure Shell (SSH) provides security for remote access connections over public networks by creating a secure and persistent connection. a. True b. False

True

Temporary workers—often called temps—may not be subject to the contractual obligations or general policies that govern other employees. a. True b. False

True

The CISO uses the results of maintenance activities and the review of the information security program to determine if the status quo can adequately meet the threats at hand. __________

True

The ISO 27005 Standard for InfoSec Risk Management has a five-stage management methodology that includes risk treatment and risk communication. a. True b. False

True

The basic function of the external monitoring process is to monitor activity, report results, and escalate warnings. __________

True

The criterion most commonly used when evaluating a strategy to implement InfoSec controls and safeguards is economic feasibility. a. True b. False

True

The false accept rate is the rate at which fraudulent users or nonusers are allowed access to systems or areas as a result of a failure in the biometric device. __________

True

The risk treatment strategy that eliminates all risk associated with an information asset by removing it from service is known as the termination risk treatment strategy. ____________

True

The simplest kind of validation, the desk check, involves distributing copies of the appropriate plans to all individuals who will be assigned roles during an actual incident or disaster. a. True b. False

True

The vulnerability database, like the risk, threat, and attack database, both stores and tracks information. a. True b. False

True

US-CERT is generally viewed as the definitive authority for computer emergency response teams. a. True b. False

True

Unlike many other risk management frameworks, FAIR relies on the qualitative assessment of many risk components using scales with value ranges. a. True b. False

True

When possible, major incident response plan elements should be rehearsed. __________

True

. In which type of site are no computer hardware or peripherals provided? a. cold site b. warm site c. timeshare d. hot site

A private, secure network operated over a public and insecure network. a. VPN b. transport mode c. SSL d. PKI e. digital certificate f. asymmetric encryption g. Vernam cipher h. transposition cipher i. content filter j. footprinting

A step commonly used for Internet vulnerability assessment includes __________, which occurs when the penetration test engine is unleashed at the scheduled time using the planned target list and test selection. a. scanning b. subrogation c. delegation d. targeting

A useful tool for resolving the issue of what business function is the most critical, based on criteria selected by the organization, is the __________. a. weighted table analysis or weighted factor analysis b. threats-vulnerability-assets worksheet or TVA c. business impact assessment or BIA d. critical patch method assessment or CPMA

According to NIST's SP 800-34, Rev. 1, which of the following is NOT one of the stages of the business impact assessment? a. Calculate asset valuation and combine with the likelihood and impact of potential attacks in a TVA worksheet. b. Determine mission/business processes and recovery criticality. c. Identify resource requirements. d. Identify recovery priorities for system resources.

Although COBIT was designed to be an IT __________ and management structure, it includes a framework to support InfoSec requirements and assessment needs. a. governance b. policy c. auditing d. awareness

Because even the implementation of new technologies does not necessarily guarantee an organization can gain or maintain a competitive lead, the concept of __________ has emerged as organizations strive not to fall behind technologically. a. competitive disadvantage b. future shock c. competitive advantage d. innovation hedge

Contingency planning is primarily focused on developing __________. a. plans for unexpected adverse events b. policies for breach notifications c. plans for normal operations d. policies for normal operation

Creating a blueprint by looking at the paths taken by organizations similar to the one whose plan you are developing is known as which of the following? a. benchmarking b. corporate espionage c. baselining d. due diligence

Employees new to an organization should receive an extensive InfoSec briefing that includes all of the following EXCEPT: a. signing the employment contract b. security policies c. security procedures d. access levels

Employees pay close attention to job __________, and including InfoSec tasks in them will motivate employees to take more care when performing these tasks. a. performance evaluations b. descriptions c. quarterly reports d. vacation requests

In which cipher method are values rearranged within a block to create the ciphertext? a. permutation b. Vernam c. substitution d. monoalphabetic

In which form of access control is access to a specific set of information contingent on its subject matter? a. content-dependent access controls b. constrained user interfaces c. temporal isolation d. none of these

Incorporating InfoSec components into periodic employee performance evaluations can __________. a. heighten InfoSec awareness b. frighten employees c. demotivate workers d. reduce compliance to policy

NIST's Risk Management Framework follows a three-tiered approach, with most organizations working from the top down, focusing first on aspects that affect the entire organization, such as __________. a. governance b. information and information flows c. policy d. environment of operation

One of the most widely referenced InfoSec management models, known as Information Technology—Code of Practice for Information Security Management, is also known as __________. a. ISO 27002 b. IEC 27100 c. NIST SP 800-12 d. IEEE 801

Organizations are required by privacy laws to protect sensitive or personal employee information, including __________. a. personally identifiable information (PII) b. corporate financial information c. internal business contact information d. employee salaries

The Hartford insurance company estimates that, on average, __________ businesses that don't have a disaster plan go out of business after a major loss like a fire, a break-in, or a storm. a. over 40 percent of b. at least 60 percent of c. about 20 percent of d. two percent of

The ISO certification process takes approximately six to eight weeks and involves all of the following steps EXCEPT: a. rejection of the certification application based on lack of compliance or failure to remediate shortfalls b. initial assessment of the candidate organization's InfoSec management systems, procedures, policies, and plans c. writing of a manual documenting all procedural compliance d. presentation of certification by the certification organization

The Information Security __________ is a managerial model provided by an industry working group, National Cyber Security Partnership, which provides guidance in the development and implementation of organizational InfoSec structures and recommends the responsibilities that various members should have in an organization. a. Governance Framework b. Security Blueprint c. Risk Model d. Compliance Architecture

The Information Technology Infrastructure Library (ITIL) is a collection of methods and practices primarily for __________. a. managing the development and operation of IT infrastructures b. operation of IT control systems to improve security c. managing the security infrastructure d. developing secure Web applications

The __________ Web site is home to the leading free network exploration tool, Nmap. a. insecure.org b. Packet Storm c. Security Focus d. Snort-sigs

The __________ is a statement of the boundaries of the RA. a. scope b. disclaimer c. footer d. head

The __________ vulnerability assessment is a process designed to find and document selected vulnerabilities that are likely to be present on the organization's internal network. a. intranet b. Internet c. LAN d. WAN

The __________ vulnerability assessment is designed to find and document vulnerabilities that may be present in the organization's wireless local area networks. a. wireless b. phone-in c. battle-dialing d. network

The benefits of ISO certification to an organization's employees include all of the following EXCEPT: a. reduced employee turnover due to misinterpreted security policies and practices b. lower risk of accidents and incidents associated with critical or sensitive information c. employee confidence in organizational security practices d. improved productivity and job satisfaction from more clearly defined InfoSec roles and responsibilities

The benefits of ISO certification to organizations include all of the following EXCEPT: a. increased opportunities for government contracts b. reduced costs associated with incidents c. smoother operations resulting from more clearly defined processes and responsibilities d. improved public image of the organization, as certification implies increased trustworthiness

The managerial tutorial equivalent of NIST SP 800-12, providing overviews of the roles and responsibilities of a security manager in the development, administration, and improvement of a security program, is NIST __________. a. SP 800-100: Information Security Handbook: A Guide for Managers (2007) b. SP 800-18, Rev. 1: Guide for Developing Security Plans for Federal Information Systems (2006) c. SP 800-14: Generally Accepted Principles and Practices for Securing Information Technology Systems (1996) d. SP 800-110, Rev. 1: Manager's Introduction to Information Security (2016)

The process of obtaining the plaintext message from a ciphertext message without knowing the keys used to perform the encryption is known as __________. a. cryptanalysis b. cryptology c. cryptography d. nonrepudiation

The steps in IR are designed to: a. stop the incident, mitigate incident effects, provide information for recovery from the incident b. control legal exposure, avoid unfavorable media attention, and minimize impact on stock prices c. delay the incident progress, backtrack the attack to its source IP, and apprehend the intruder d. stop the incident, inventory affected systems, and determine appropriate losses for insurance settlement

The total amount of time the system owner or authorizing official is willing to accept for a business process outage or disruption, including all impact considerations, is known as __________. a. maximum tolerable downtime (MTD) b. recovery point objective (RPO) c. work recovery time (WRT) d. recovery time objective (RTO)

This NIST publication provides information on the elements of InfoSec, key roles and responsibilities, an overview of threats and vulnerabilities, a description of the three NIST security policy categories, and an overview of the NIST RM Framework and its use, among other topics needed for a foundation in InfoSec. a. SP 800-12, Rev. 1: An Introduction to Information Security (2017) b. SP 800-18, Rev. 1: Guide for Developing Security Plans for Federal Information Systems (2006) c. SP 800-34, Rev. 1: Contingency Planning Guide for Federal Information Systems (2010) d. SP 800-55, Rev. 1: Performance Measurement Guide for Information Security (2008)

To evaluate the performance of a security system, administrators must establish system performance __________. a. baselines b. profiles c. maxima d. means

Treating risk begins with which of the following? a. an understanding of risk treatment strategies b. applying controls and safeguards that eliminate risk c. understanding the consequences of choosing to ignore certain risks d. rethinking how services are offered

Under lattice-based access controls, the column of attributes associated with a particular object (such as a printer) is referred to as which of the following? a. access control list b. capabilities table c. access matrix d. sensitivity level

What does FAIR rely on to build the risk management framework that is unlike many other risk management frameworks? a. qualitative assessment of many risk components b. quantitative valuation of safeguards c. subjective prioritization of controls d. risk analysis estimates

What is the organized research and investigation of Internet addresses owned or controlled by a target organization? a. footprinting b. content filtering c. deciphering d. fingerprinting

What is the result of subtracting the postcontrol annualized loss expectancy and the annualized cost of the safeguard from the precontrol annualized loss expectancy? a. cost-benefit analysis b. exposure factor c. single loss expectancy d. annualized rate of occurrence

When a disaster renders the current business location unusable, which plan is put into action? a. business continuity b. crisis management c. incident response d. business impact analysis

When vulnerabilities have been controlled to the degree possible, what is the remaining risk that has not been completely removed, shifted, or planned for? a. residual risk b. risk appetite c. risk assurance d. risk tolerance

Which access control principle limits a user's access to the specific information required to perform the currently assigned task? a. need-to-know b. eyes only c. least privilege d. separation of duties

Which alternative risk management methodology is a process promoted by the Computer Emergency Response Team (CERT) Coordination Center (www.cert.org) that has three variations for different organizational needs, including one known as ALLEGRO? a. OCTAVE b. FAIR c. ANDANTE d. DOLCE

Which of the following determines how well the proposed InfoSec treatment alternatives will contribute to the efficiency, effectiveness, and overall operation of an organization? a. organizational feasibility b. political feasibility c. technical feasibility d. behavioral feasibility

Which of the following is NOT a method employed by IDPSs to prevent an attack from succeeding? a. sending DoS packets to the source b. terminating the network connection c. reconfiguring network devices d. changing the attack's content

Which of the following is NOT a phase in the NIST InfoSec performance measures development process? a. Identify relevant stakeholders and their interests in InfoSec measurement. b. Integrate the organization's process improvement activities across all business areas. c. Identify and document the InfoSec performance goals and objectives that would guide security control implementation for the InfoSec program. d. Review any existing measurements and data repositories that can be used to derive measurement data.

Which of the following is NOT one of the methods noted for selecting the best risk management model? a. Use the methodology most similar to what is currently in use. b. Study known approaches and adapt one to the specifics of the organization. c. Hire a consulting firm to provide a proprietary model. d. Hire a consulting firm to develop a proprietary model.

Which of the following is a "possible" indicator of an actual incident, according to Donald Pipkin? a. unusual consumption of computing resources b. activities at unexpected times c. presence of hacker tools d. reported attacks

Which of the following is a generic model for a security program? a. framework b. methodology c. security standard d. blueprint

Which of the following is a mathematical tool that is useful in assessing the relative importance of business functions based on criteria selected by the organization? a. weighted table analysis b. BIA questionnaire c. recovery time organizer d. MTD comparison

Which of the following is a part of the incident recovery process? a. identifying the vulnerabilities that allowed the incident to occur and spread b. determining the event's impact on normal business operations and, if necessary, making a disaster declaration c. supporting personnel and their loved ones during the crisis d. keeping the public informed about the event and the actions being taken to ensure the recovery of personnel and the enterprise

Which of the following is an organizational CP philosophy for overall approach to contingency planning reactions? a. protect and forget b. pre-action review c. transfer to local/state/federal law enforcement d. track, hack, and prosecute

Which of the following is the best example of a rapid-onset disaster? a. flood b. hurricane c. famine d. environmental degradation

Which of the following is the process of examining a possible incident and determining whether it constitutes an actual incident? a. incident classification b. incident identification c. incident registration d. incident verification

Which of the following is true about symmetric encryption? a. It uses a secret key to encrypt and decrypt. b. It uses a private and public key. c. It is also known as public key encryption. d. It requires four keys to hold a conversation.

Which of the following is used in conjunction with an algorithm to make computer data secure from anybody except the intended recipient of the data? a. key b. plaintext c. cipher d. cryptosystem

Which of the following provides advice about the implementation of sound controls and control objectives for InfoSec, and was created by ISACA and the IT Governance Institute? a. COBIT b. COSO c. NIST d. ISO

Which of the following provides an identification card of sorts to clients who request services in a Kerberos system? a. ticket granting service b. authentication server c. authentication client d. key distribution center

Which of the following refers to the backup of data to an off-site facility in close to real time based on transactions as they occur? a. remote journaling b. electronic vaulting c. database shadowing d. timesharing

Which of the following terms is described as the process of designing, implementing, and managing the use of the collected data elements to determine the effectiveness of the overall security program? a. performance management b. baselining c. best practices d. standards of due care/diligence

Which type of device can react to network traffic and create or modify configuration rules to adapt? a. dynamic packet filtering firewall b. proxy server c. intrusion detection system d. application layer firewall

__________ is used to respond to network change requests and network architectural design proposals. a. Network connectivity RA b. Dialed modem RA c. Application RA d. Vulnerability RA

__________ penetration testing is usually used when a specific system or network segment is suspect and the organization wants the pen tester to focus on a particular aspect of the target. a. White box b. Black box c. Gray box d. Green box

__________, a level beyond vulnerability testing, is a set of security tests and evaluations that simulate attacks by a malicious external source (hacker). a. Penetration testing b. Penetration simulation c. Attack simulation d. Attack testing

A framework or security model customized to an organization, including implementation details.

a. blueprint

A conspiracy or cooperation between two or more individuals or groups to commit illegal or unethical actions.

a. collusion

A risk treatment strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards.

a. defense risk treatment strategy

The __________ risk treatment strategy indicates the organization is willing to accept the current level of residual risk.

acceptance

Best security practices balance the need for user __________ to information with the need for adequate protection while simultaneously demonstrating fiscal responsibility.

access

The selective method by which systems specify who may use a particular resource and how they may use it is called __________.

access control

A(n) __________ is an event with negative consequences that could threaten the organization's information assets or operations.

adverse event incident candidate

62. A(n) _________ is a description of the incident or disaster that usually contains just enough information so that each person knows what portion of the IR or DR plan to implement without slowing down the notification process.

alert message

A(n) __________ is a document containing contact information of the individuals to notify in the event of an actual incident.

alert roster

The goal of InfoSec is not to bring residual risk to zero; rather, it is to bring residual risk in line with an organization's risk __________.

appetite

A __________ is the recorded condition of a particular revision of a software or hardware configuration item. a. state b. version c. configuration d. baseline

A process called __________ examines the traffic that flows through a system and its associated devices to identify the most frequently used devices. a. difference analysis b. traffic analysis c. schema analysis d. data flow assessment

After an incident, but before returning to its normal duties, the CSIRT must do which of the following? a. Create the incident damage assessment. b. Conduct an after-action review. c. Restore data from backups. d. Restore services and processes in use.

All of the following are rules of thumb for selecting a risk treatment strategy EXCEPT: a. When a vulnerability exists in an important asset, implement security controls to reduce the likelihood of a vulnerability being exploited. b. When the likelihood of an attack is high and the impact is great, outsource security efforts so that any resulting loss is fiscally someone else's responsibility. c. When a vulnerability can be exploited, apply layered protections, architectural designs, and administrative controls to minimize the risk or prevent the occurrence of an attack. d. When the potential loss is substantial, apply design principles, architectural designs, and technical and nontechnical protections to limit the extent of the attack, thereby reducing the potential for loss.

An ATM that limits what kinds of transactions a user can perform is an example of which type of access control? a. content-dependent b. constrained user interface c. temporal isolation d. nondiscretionary

Application of training and education among other approach elements is a common method of which risk treatment strategy? a. mitigation b. defense c. acceptance d. transferal

By multiplying the asset value by the exposure factor, you can calculate which of the following? a. annualized cost of the safeguard b. single loss expectancy c. value to adversaries d. annualized loss expectancy

Contract employees—or simply contractors—should not be allowed to do what? a. Work on the premises. b. Wander freely in and out of facilities. c. Visit the facility without an escort. d. Be compensated based on hourly rates.

Detailed __________ on the highest risk warnings can include identifying which vendor updates apply to which vulnerabilities as well as which types of defenses have been found to work against the specific vulnerabilities reported. a. escalation b. intelligence c. monitoring d. elimination

Each of the following is a commonly used quantitative approach for asset valuation EXCEPT: a. value to owners b. value to competitors c. value retained from past maintenance d. value to adversaries

Each of the following is a recommendation from the FDIC when creating a successful SLA EXCEPT: a. determining objectives b. forecasting costs c. defining requirements d. setting measurements

If a temporary worker (temp) violates a policy or causes a problem, what is the strongest action that the host organization can usually take, depending on the SLA? a. Nothing, the organization has no control over temps. b. Terminate the relationship with the individual and request that he or she be censured. c. Fine the temp or force the temp to take unpaid leave, like permanent employees. d. Sue the temp agency for cause, demanding reparations for the actions of the temp.

In IPSec, an encryption method in which only a packet's IP data is encrypted, not the IP headers themselves; this method allows intermediate nodes to read the source and destination addresses. a. VPN b. transport mode c. SSL d. PKI e. digital certificate f. asymmetric encryption g. Vernam cipher h. transposition cipher i. content filter j. footprinting

In the event of an incident or disaster, which planning element is used to guide off-site operations? a. project management b. business continuity c. disaster recovery d. incident response

In which contingency plan testing strategy do individuals participate in a role-playing exercise in which the CP team is presented with a scenario of an actual incident or disaster and expected to react as if it had occurred? a. desk check b. simulation c. structured walk-through d. parallel testing

InfoSec measurements collected from production statistics depend greatly on which of the following factors? a. types of performance measures developed b. number of systems and users of those systems c. number of monitored threats and attacks d. activities and goals implemented by the business unit

One approach that can improve the situational awareness of the information security function is to use a process known as __________ to quickly identify changes to the internal environment. a. baselining b. difference analysis c. differentials d. revision

One of the fundamental challenges in InfoSec performance measurement is defining what? a. interested stakeholders b. effective security c. appropriate performance measures d. the proper assessment schedule

The InfoSec measurement development process recommended by NIST is divided into two major activities. Which of the following is one of them? a. development and selection of qualified personnel to gauge the implementation, effectiveness, efficiency, and impact of the security controls b. identification and definition of the current InfoSec program c. maintenance of the vulnerability management program d. comparison of organizational practices against similar organizations

The __________ commercial site focuses on current security tool resources. a. Nmap-hackerz b. Packet Storm c. Security Laser d. Snort-SIGs

The actions taken by senior management to specify the organization's efforts and actions if an adverse event becomes an incident or disaster are known as __________. a. risk management b. contingency planning c. business impact d. disaster readiness

The financial savings from using the defense risk treatment strategy to implement a control and eliminate the financial ramifications of an incident is known as __________. a. probability estimate b. cost avoidance c. risk acceptance premium d. asset valuation

The goal of InfoSec is not to bring residual risk to __________; rather, it is to bring residual risk in line with an organization's risk appetite. a. de minimus b. zero c. its theoretical minimum d. below the cost-benefit break-even point

The rate at which authentic users are denied or prevented access to authorized areas as a result of a failure in the biometric device is known as the __________. a. reset error ratio b. false reject rate c. crossover error rate d. false accept rate

To maintain optimal performance, one typical recommendation suggests that when the memory usage associated with a particular CPU-based system averages __________% or more over prolonged periods, you should consider adding more memory. a. 40 b. 60 c. 10 d. 100

Under the Common Criteria, which term describes the user-generated specifications for security requirements? a. Target of Evaluation (ToE) b. Protection Profile (PP) c. Security Target (ST) d. Security Functional Requirements (SFRs)

What tool would you use if you want to collect information as it is being transmitted on the network and analyze the contents for the purpose of solving network problems? a. port scanner b. packet sniffer c. vulnerability scanner d. content filter

Which control category discourages an incipient incident—e.g., video monitoring? a. preventative b. deterrent c. remitting d. compensating

Which of the following access control processes confirms the identity of the entity seeking access to a logical or physical area? a. identification b. authentication c. authorization d. accountability

Which of the following can be described as the quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility? a. residual risk b. risk appetite c. risk assurance d. risk termination

Which of the following determines acceptable practices based on consensus and relationships among the communities of interest? a. organizational feasibility b. political feasibility c. technical feasibility d. operational feasibility

Which of the following determines the scope of the breach of confidentiality, integrity, and availability of information and information assets? a. incident report b. incident damage assessment c. information loss assessment d. damage report

Which of the following is NOT a category of access control? a. preventative b. mitigating c. deterrent d. compensating

Which of the following is NOT a common type of background check that may be performed on a potential employee? a. identity b. political activism c. motor vehicle records d. drug history

Which of the following is NOT a factor critical to the success of an information security performance program? a. strong upper-level management support b. high level of employee buy-in c. quantifiable performance measurements d. results-oriented measurement analysis

Which of the following is NOT a question to be used as a self-assessment for recommended security practices in the category of people? a. Do you perform background checks on all employees with access to sensitive data, areas, or access points? b. Are the user accounts of former employees immediately removed on termination? c. Would the typical employee recognize a security issue? d. Would the typical employee know how to report a security issue to the right people?

Which of the following is NOT a task that must be performed if an employee is terminated? a. former employee must return all media b. former employee's home computer must be audited c. former employee's office computer must be secured d. former employee should be escorted from the premises

Which of the following is a commonly used criterion for comparing and evaluating biometric technologies? a. false accept rate b. crossover error rate c. false reject rate d. valid accept rate

Which of the following is a possible result of failure to establish and maintain standards of due care and due diligence? a. baselining b. legal liability c. competitive disadvantage d. certification revocation

Which of the following is the first major task in the BIA, according to NIST SP 800-34, Rev. 1? a. Calculate asset valuation and combine with the likelihood and impact of potential attacks in a TVA worksheet. b. Determine mission/business processes and recovery criticality. c. Identify resource requirements. d. Identify recovery priorities for system resources.

Which piece of the Trusted Computing Base's security system manages access controls? a. trusted computing base b. reference monitor c. covert channel d. verification module

Which security architecture model is part of a larger series of standards collectively referred to as the "Rainbow Series"? a. Bell-LaPadula b. TCSEC c. ITSEC d. Common Criteria

Which tool can best identify active computers on a network? a. packet sniffer b. port scanner c. trap and trace d. honey pot

Which type of IDPS is also known as a behavior-based intrusion detection system? a. network-based b. anomaly-based c. host-based d. signature-based

Which type of device exists to intercept requests for information from external users and provide the requested information by retrieving it from an internal server? a. dynamic packet filtering firewall b. proxy server c. intrusion detection system d. application layer firewall

Which type of firewall keeps track of each network connection established between internal and external systems? a. packet filtering b. stateful packet inspection c. application layer d. cache server

Controls implemented at the discretion or option of the data user.

b. DAC

An assessment of the performance of some action or process against which future performance is assessed.

b. baseline

A risk treatment strategy that attempts to reduce the impact of the loss caused by a realized incident, disaster, or attack through effective contingency planning and preparation.

b. mitigation risk treatment strategy

A practice related to benchmarking is __________, which is a measurement against a prior assessment or an internal goal.

baselining

As part of the CBA, __________ is the value to the organization of using controls to prevent losses associated with a specific vulnerability

benefit

In information security, a framework or security model customized to an organization, including implementation details, is known as a(n) __________.

blueprint

A(n) __________ process is a task performed by an organization or one of its units in support of the organization's overall mission.

business

The four components of contingency planning are the __________, the incident response plan, the disaster recovery plan, and the business continuity plan.

business impact analysis (BIA)

A time-release safe is an example of which type of access control? a. content-dependent b. constrained user interface c. temporal isolation d. nondiscretionary

An information attack that involves searching through a target organization's trash and recycling bins for sensitive information is known as __________. a. rubbish surfing b. social engineering c. dumpster diving d. trash trolling

At what point in the incident life cycle is the IR plan initiated? a. before an incident takes place b. after the DRP is activated c. when an incident is detected that affects the organization d. after the BCP is activated

Control __________ baselines are established for network traffic and for firewall performance and IDPS performance. a. system b. application c. performance d. environment

Controls that remedy a circumstance or mitigate damage done during an incident are categorized as which of the following? a. preventative b. deterrent c. corrective d. compensating

In an IDPS, a piece of software that resides on a system and reports back to a management server is known as a(n) __________. a. agent b. sensor c. Both of these are correct. d. Neither of these is correct.

NIST recommends the documentation of performance measurements in a standardized format to ensure ____________. a. the suitability of performance measure selection b. the effectiveness of performance measure corporate reporting c. the repeatability of measurement development, customization, collection, and reporting activities d. the acceptability of the performance measurement program by upper management

Once a control strategy has been selected and implemented, what should be done on an ongoing basis to determine its effectiveness and to estimate the remaining risk? a. analysis and adjustment b. review and reapplication c. monitoring and measurement d. evaluation and funding

Strategies to reestablish operations at the primary site after an adverse event threatens continuity of business operations are covered by which of the following plans in the mitigation control approach? a. incident response plan b. business continuity plan c. disaster recovery plan d. damage control plan

The amount of effort (expressed as elapsed time) needed to make business functions work again after the technology element is recovered is known as __________. a. minimum tolerable downtime (MTD) b. recovery point objective (RPO) c. work recovery time (WRT) d. recovery time objective (RTO)

The bastion host is usually implemented as a __________, as it contains two network interfaces: one that is connected to the external network and one that is connected to the internal network, such that all traffic must go through the device to move between the internal and external networks. a. state-linked firewall b. screened-subnet firewall c. dual-homed host d. double bastion host

The group of senior managers and project members organized to conduct and lead all CP efforts is known as the __________. a. contingency planning management team (CPMT) b. disaster recovery planning team (DRPT) c. crisis management planning team (CMPT) d. incident response planning team (IRPT)

The intermediate area between trusted and untrusted networks is referred to as which of the following? a. unfiltered area b. semi-trusted area c. demilitarized zone d. proxy zone

The only use of the acceptance strategy that is recognized as valid by industry practices occurs when the organization has done all but which of the following? a. determined the level of risk posed to the information asset b. performed a thorough cost-benefit analysis c. determined that the costs to control the risk to an information asset are much lower than the benefit gained from the information asset d. assessed the probability of attack and the likelihood of a successful exploitation of a vulnerability

The team responsible for designing and managing the IR plan by specifying the organization's preparation, reaction, and recovery from incidents is known as the __________. a. contingency planning management team (CPMT) b. disaster recovery planning team (DRPT) c. computer security incident response team (CSIRT) d. incident response planning team (IRPT)

Was developed by Netscape in 1994 to provide security for online e-commerce transactions. a. VPN b. transport mode c. SSL d. PKI e. digital certificate f. asymmetric encryption g. Vernam cipher h. transposition cipher i. content filter j. footprinting

What do you call the legal requirements that an organization must adopt a standard based on what a prudent organization should do, and then maintain that standard? a. certification and accreditation b. best practices c. due care and due diligence d. baselining and benchmarking

What is an application that entices individuals who are illegally perusing the internal areas of a network by providing simulated rich content areas while the software notifies the administrator of the intrusion? a. port scanner b. sacrificial host c. honey pot d. content filter

Which NIST publication describes the philosophical guidelines that the security team should integrate into the entire InfoSec process, beginning with "Security supports the mission of the organization"? a. SP 800-12, Rev. 1: An Introduction to Information Security (2017) b. SP 800-18, Rev. 1: Guide for Developing Security Plans for Federal Information Systems (2006) c. SP 800-14: Generally Accepted Principles and Practices for Securing Information Technology Systems (1996) d. SP 800-55, Rev. 1: Performance Measurement Guide for Information Security (2008)

Which access control principle specifies that no unnecessary access to data exists by regulating members so they can perform only the minimum data manipulation necessary? a. need-to-know b. eyes only c. least privilege d. separation of duties

Which of the following NIST Cybersecurity Framework (CSF) stages relates to reacting to an incident? a. Identify b. Detect c. Respond d. Protect

Which of the following biometric authentication systems is the most accepted by users? a. keystroke pattern recognition b. fingerprint recognition c. signature recognition d. retina pattern recognition

Which of the following determines whether the organization already has or can acquire the technology necessary to implement and support the proposed treatment? a. organizational feasibility b. political feasibility c. technical feasibility d. operational feasibility

Which of the following is NOT a change control principle of the Clark-Wilson model? a. no changes by unauthorized subjects b. no unauthorized changes by authorized subjects c. no changes by authorized subjects without external validation d. the maintenance of internal and external consistency

Which of the following is NOT a question a CISO should be prepared to answer before beginning the process of designing, collecting, and using performance measurements, according to Kovacich? a. Why should these measurements be collected? b. Where will these measurements be collected? c. What affect will measurement collection have on efficiency? d. Who will collect these measurements?

Which of the following is NOT a valid rule of thumb on risk treatment strategy selection? a. When a vulnerability exists: Implement security controls to reduce the likelihood of a vulnerability being exploited. b. When a vulnerability can be exploited: Apply layered protections, architectural designs, and administrative controls to minimize the risk or prevent the occurrence of an attack. c. When the attacker's potential gain is less than the costs of attack: Apply protections to decrease the attacker's cost or reduce the attacker's gain by using technical or operational controls. d. When the potential loss is substantial: Apply design principles, architectural designs, and technical and non-technical protections to limit the extent of the attack, thereby reducing the potential for loss.

Which of the following is NOT among the three types of authentication mechanisms? a. something a person knows b. something a person has c. something a person says d. something a person can produce

Which of the following is NOT one of the administrative challenges to the operation of firewalls? a. training b. uniqueness c. replacement d. responsibility

Which of the following is NOT one of the types of InfoSec performance measures used by organizations? a. those that determine the effectiveness of the execution of InfoSec policy b. those that determine the effectiveness and/or efficiency of the delivery of InfoSec services c. those that evaluate the frequency with which employees access internal security documents d. those that assess the impact of an incident or other security event on the organization or its mission

Which of the following is a Kerberos service that initially exchanges information with the client and server by using secret keys? a. authentication server b. authentication client c. key distribution center d. ticket granting service

Which of the following is a responsibility of the crisis management team? a. restoring the data from backups b. evaluating monitoring capabilities c. keeping the public informed about the event and the actions being taken d. restoring the services and processes in use

Which of the following is not a step in the FAIR risk management framework? a. identify scenario components b. evaluate loss event frequency c. assess control impact d. derive and articulate risk

Which of the following is the first component in the contingency planning process? a. business continuity training b. disaster recovery planning c. business impact analysis d. incident response planning

Which of the following is true about a hot site? a. It is an empty room with standard heating, air conditioning, and electrical service. b. It includes computing equipment and peripherals with servers but not client workstations. c. It duplicates computing resources, peripherals, phone systems, applications, and workstations. d. All communications services must be installed after the site is occupied.

Which of the following specifies the authorization level that each user of an information asset is permitted to access, subject to the need-to-know principle? a. discretionary access controls b. task-based access controls c. security clearances d. sensitivity levels

Which technology employs sockets to map internal private network addresses to a public address using one-to-many mapping? a. network-address translation b. screened-subnet firewall c. port-address translation d. private address mapping

Which technology has two modes of operation: transport and tunnel? a. Secure Hypertext Transfer Protocol b. Secure Shell c. IP Security Protocol d. Secure Sockets Layer

Which type of access controls can be role-based or task-based? a. constrained b. content-dependent c. nondiscretionary d. discretionary

Workers typically hired to perform specific services for the organization and hired via a third-party organization are known as __________. a. temporary workers b. consultants c. contract employees d. business partners

__________ allows for major security control components to be reviewed on a periodic basis to ensure that they are current, accurate, and appropriate. a. System review b. Project review c. Program review d. Application review

A risk treatment strategy that indicates the organization is willing to accept the current level of risk, is making a conscious decision to do nothing to protect an information asset from risk, and accepts the outcome from any resulting exploitation.

c. acceptance risk treatment strategy

An attempt to improve information security practices by comparing an organization's efforts against practices of a similar organization or an industry-developed standard to produce results it would like to duplicate.

c. benchmarking

Controls access to a specific set of information based on its content.

c. content-dependent access controls

The process of examining an adverse event or incident candidate and determining whether it constitutes an actual incident is known as incident __________.

classification

A conspiracy or cooperation between two or more individuals or groups to commit illegal or unethical actions is known as __________.

collusion

In the COSO framework, __________ activities include those policies and procedures that support management directives.

control

The last phase in NIST performance measures implementation is to apply __________ actions, which closes the gap found in Phase 2.

corrective

A primary mailing list for new vulnerabilities, called simply __________, provides time-sensitive coverage of emerging vulnerabilities, documenting how they are exploited and reporting on how to remediate them. Individuals can register for the flagship mailing list or any one of the entire family of its mailing lists. a. Bugs b. Bugfix c. Buglist d. Bugtraq

A(n) __________ item is a hardware or software item that is to be modified and revised throughout its life cycle. a. revision b. update c. change d. configuration

An integrated system of software, encryption methodologies, protocols, legal agreements, and third-party services that enables users to communicate securely through the use of digital certificates. a. VPN b. transport mode c. SSL d. PKI e. digital certificate f. asymmetric encryption g. Vernam cipher h. transposition cipher i. content filter j. footprinting

Common vulnerability assessment processes include: a. Internet VA b. wireless VA c. intranet VA d. all of these

Each of the following is an item that affects the cost of a particular risk treatment strategy EXCEPT: a. cost of maintenance (labor expense to verify and continually test, maintain, train, and update) b. cost of development or acquisition (hardware, software, and services) c. cost of implementation (installing, configuring, and testing hardware, software, and services) d. cost of IT operations (keeping systems operational during the period of treatment strategy development)

In information security, a framework or security model customized to an organization, including implementation details, is a _________. a. security standard b. methodology c. security policy d. blueprint

In which technique does a group rate or rank a set of information, compile the results, and repeat until everyone is satisfied with the result? a. OCTAVE b. FAIR c. hybrid measures d. Delphi

Organizations must consider all but which of the following during development and implementation of an InfoSec measurement program? a. Measurements must yield quantifiable information. b. Data that supports the measures needs to be readily obtainable. c. Only repeatable InfoSec processes should be considered for measurement. d. Measurements must be useful for tracking non-compliance by internal personnel.

Problems with benchmarking include all but which of the following? a. Organizations don't often share information on successful attacks. b. Organizations being benchmarked are seldom identical. c. Recommended practices change and evolve, so past performance is no indicator of future success. d. Benchmarking doesn't help in determining the desired outcome of the security process.

The COSO framework is built on five interrelated components. Which of the following is NOT one of them? a. control environment b. risk assessment c. control activities d. InfoSec governance

The ISO 27005 Standard for Information Security Risk Management includes all but which of the following stages? a. risk assessment b. risk treatment c. risk communication d. risk determination

The __________ is a center of Internet security expertise and is located at the Software Engineering Institute, a federally funded research and development center operated by Carnegie Mellon University. a. US-CERT b. Bugtraq c. CM-CERT d. CERT/CC

The __________ mailing list includes announcements and discussion of a leading open-source IDPS. a. Nmap-hackers b. Packet Storm c. Security Focus d. Snort

The __________ process is designed to find and document vulnerabilities that may be present because there are misconfigured systems in use within the organization. a. ASP b. ISP c. SVP d. PSV

The combination of a system's TCP/IP address and a service port is known as a __________. a. portlet b. NAT c. packet d. socket

The maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact on other system resources and supported business processes is known as __________. a. maximum tolerable downtime (MTD) b. recovery point objective (RPO) c. work recovery time (WRT) d. recovery time objective (RTO)

The optimum approach for escalation is based on a thorough integration of the monitoring process into the __________. a. IDE b. CERT c. ERP d. IRP

The process of assigning financial value or worth to each information asset is known as __________. a. probability estimate b. cost estimation c. risk acceptance premium d. asset valuation

What is most commonly used for the goal of nonrepudiation in cryptography? a. block cipher b. digital certificate c. PKI d. digital signature

What is the final stage of the business impact analysis when using the NIST SP 800-34 approach? a. Identify resource requirements. b. Identify business processes. c. Determine mission/business processes and recovery criticality. d. Identify recovery priorities for system resources.

What is the information security principle that requires significant tasks to be split up so that more than one individual is required to complete them? a. need-to-know b. eyes only c. least privilege d. separation of duties

What is the next phase of the pre-attack data gathering process after an attacker has collected all of an organization's Internet addresses? a. footprinting b. content filtering c. deciphering d. fingerprinting

When an information security team is faced with a new technology, which of the following is NOT a recommended approach? a. Determine if the benefits of the proposed technology justify the expected costs. b. Include costs for any additional risk control requirements that are mandated by the new technology. c. Consider how the proposed solution will affect the organization's risk exposure. d. Evaluate how the new technology will enhance employee skills.

When hiring security personnel, which of the following should be conducted before the organization extends an offer to any candidate, regardless of job level? a. new hire orientation b. covert surveillance c. organizational tour d. background check

Which international standard provides a structured methodology for evaluating threats to economic performance in an organization and was developed using the Australian/New Zealand standard AS/NZS 4360:2004 as a foundation? a. ISO 27001 b. ISO 27005 c. NIST SP 800-39 d. ISO 31000

Which of the following NIST Cybersecurity Framework (CSF) stages relates to implementation of effective security controls (policy, education, training and awareness, and technology)? a. Identify b. Detect c. Respond d. Protect

Which of the following affects the cost of a control? a. liability insurance b. CBA report c. asset resale d. maintenance

Which of the following biometric authentication systems is considered to be truly unique, suitable for use, and currently cost-effective? a. gait recognition b. signature recognition c. voice pattern recognition d. fingerprint recognition

Which of the following characteristics currently used for authentication purposes is the LEAST unique? a. fingerprints b. iris c. retina d. face geometry

Which of the following determines how well a proposed treatment will address user acceptance and support, management acceptance and support, and the system's compatibility with the requirements of the organization's stakeholders? a. behavioral feasibility b. political feasibility c. technical feasibility d. operational feasibility

Which of the following is NOT a consideration when selecting recommended best practices? a. threat environment is similar b. resource expenditures are practical c. organization structure is similar d. same certification and accreditation agency or standard

Which of the following is NOT a major component of contingency planning? a. incident response b. disaster recovery c. business continuity d. threat assessment

Which of the following is NOT a stage in the NIST Cybersecurity Framework (CSF)? a. Identify b. Detect c. Recover d. React

Which of the following is NOT one of the three levels in the U.S. military data classification scheme for National Security Information? a. confidential b. secret c. top secret d. for official use only

Which of the following is a backup method that uses bulk batch transfer of data to an off-site facility and is usually conducted via leased lines or secure Internet connections? a. database shadowing b. timesharing c. traditional backups d. electronic vaulting

Which of the following is a definite indicator of an actual incident, according to Donald Pipkin? a. unusual system crashes b. reported attack c. presence of new accounts d. use of dormant accounts

Which of the following is the original purpose of ISO/IEC 17799? a. Use within an organization to obtain a competitive advantage b. Implementation of business-enabling information security c. Use within an organization to ensure compliance with laws and regulations d. To offer guidance for the management of InfoSec to individuals responsible for their organization's security programs

Which security architecture model is based on the premise that higher levels of integrity are more worthy of trust than lower ones? a. Clark-Wilson b. Bell-LaPadula c. Common Criteria d. Biba

__________ are a component of the "security triple." a. Threats b. Assets c. Vulnerabilities d. All of the above

A risk treatment strategy that eliminates all risk associated with an information asset by removing it from service.

d. termination risk treatment strategy

The __________ risk treatment strategy attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards in an effort to change the likelihood of a successful attack on an information asset.

defense

The approach known as the avoidance strategy is more properly known as the __________ risk treatment strategy.

defense

Public key container files that allow PKI system components and end users to validate a public key and identify its owner. a. VPN b. transport mode c. SSL d. PKI e. digital certificate f. asymmetric encryption g. Vernam cipher h. transposition cipher i. content filter j. footprinting

The actions that demonstrate that an organization has made a valid effort to protect others and that the implemented standards continue to provide the required level of protection.

e. due diligence

The quantity and nature of risk that organizations are willing to accept.

e. risk appetite

Requires that significant tasks be split up in such a way that more than one individual is responsible for their completion.

e. separation of duties

The bulk batch transfer of data to an off-site facility is known as __________.

electronic vaulting

When a vulnerability (flaw or weakness) exists in an important asset, implement security controls to reduce the likelihood of a vulnerability being __________.

exploited

A cryptographic method that incorporates mathematical operations involving both a public key and a private key to encipher or decipher a message. a. VPN b. transport mode c. SSL d. PKI e. digital certificate f. asymmetric encryption g. Vernam cipher h. transposition cipher i. content filter j. footprinting

When the ISO 27002 standard was first proposed, several countries, including the United States, Germany, and Japan, refused to adopt it, claiming that it had fundamental problems; which of the following is NOT one of them? a. It was not as complete as other frameworks. b. The standard lacked the measurement precision associated with a technical standard. c. The standard was hurriedly prepared. d. It was feared it would lead to government intrusion into business matters.

The formal assessment and presentation of the economic expenditures needed for a particular security control, contrasted with its projected value to the organization.

f. cost-benefit analysis

The requirement that every employee be able to perform the work of at least one other employee.

f. job rotation

Ratings of the security level for a specified collection of information (or user) within a mandatory access control scheme.

f. sensitivity levels

framework

In __________ testing of contingency plans, the individuals follow each and every procedure, including interruption of service, restoration of data from backups, and notification of appropriate individuals.

full interruption

A cryptographic technique developed at AT&T and known as the "one-time pad," this cipher uses a set of characters for encryption operations only one time and then discards it. a. VPN b. transport mode c. SSL d. PKI e. digital certificate f. asymmetric encryption g. Vernam cipher h. transposition cipher i. content filter j. footprinting

The financial savings from using the defense risk treatment strategy to implement a control and eliminate the financial ramifications of an incident.

g. cost avoidance

One of the TCSEC's covert channels, which communicate by modifying a stored object.

g. storage channel

The requirement that all critical tasks can be performed by multiple individuals.

g. task rotation

A cryptographic operation that involves simply rearranging the values within a block based on an established pattern. a. VPN b. transport mode c. SSL d. PKI e. digital certificate f. asymmetric encryption g. Vernam cipher h. transposition cipher i. content filter j. footprinting

A legal standard that requires an organization and its employees to act as a reasonable and prudent individual or organization would under similar circumstances.

h. standard of due care

A form of nondiscretionary control where access is determined based on the tasks assigned to a specified user.

h. task-based controls

A software program or hardware/software appliance that allows administrators to restrict content that comes into or leaves a network—for example, restricting user access to Web sites with material that is not related to business, such as pornography or entertainment. a. VPN b. transport mode c. SSL d. PKI e. digital certificate f. asymmetric encryption g. Vernam cipher h. transposition cipher i. content filter j. footprinting

An examination of how well a particular solution fits within the organization's strategic planning objectives and goals.

i. organizational feasibility

The data or the trends in data that may indicate the effectiveness of security countermeasures or controls—technical and managerial—implemented in the organization.

i. performance measurements

A TCSEC-defined covert channel, which transmits information by managing the relative timing of events.

i. timing channel

ISO/IEC 27001 provides implementation details on how to implement ISO/IEC 27002 and how to set up a(n) __________.

information security management system (ISMS)

The organized research and investigation of Internet addresses owned or controlled by a target organization. a. VPN b. transport mode c. SSL d. PKI e. digital certificate f. asymmetric encryption g. Vernam cipher h. transposition cipher i. content filter j. footprinting

Within TCSEC, the combination of all hardware, firmware, and software responsible for enforcing the security

j. TCB

The calculated value associated with the most likely loss from a single attack.

j. single loss expectancy

Workers brought in by organizations to fill positions for a short time or to supplement the existing workforce.

j. temporary workers

The requirement that every employee be able to perform the work of at least one other employee is known as __________.

job rotation

The data access principle that ensures no unnecessary access to data exists by regulating members so they can perform only the minimum data manipulation necessary is called __________.

least privilege

A requirement that all employees take time off from work, which allows the organization to audit the individual's areas of responsibility, is known as __________ vacation policy.

mandatory

The risk treatment strategy that seeks to reduce the impact of a successful attack through the use of IR, DR, and BC plans is __________.

mitigation mitigate

The __________ principle is based on the requirement that people are not allowed to view data simply because it falls within their level of clearance.

need to know

The __________ is the point in time before a disruption or system outage to which business process data can be recovered after the outage, given the most recent backup copy of the data.

recovery point objective (RPO)

Within TCB, a conceptual piece of the system that manages access controls—in other words, it mediates all access to objects by subjects—is known as a __________.

reference monitor

To design a security program, an organization can use a(n) __________, which is a generic outline of the more thorough and organization-specific blueprint.

security model framework

A(n) __________ is an agency that provides physical facilities for a fee, in the case of DR/BC planning.

service bureau

In a cost-benefit analysis, the calculated value associated with the most likely loss from an attack (impact) is known as __________. It is the product of the asset's value and the exposure factor.

ISA 3300 Final Chapter 7-12

Related study sets

Delegation and Leadership

respiratory II lab

Physics - 26, 27, 28

FINAL

BIO115 - Quiz 1

Chapter 8 Joints

CH 10 Security in network designs

Questions Chapter 17

BSAD 329- Quiz #1

History 17B "Howard Zinn A people's History of the United States"

Leadership Styles

Cranium test

mri review

Physics 1-II Final Practice (Atomic Nature of Matter)

ORGB320-EXAM2-CH5-S3

Introduction To Python Midterm Exam Review: Practice questions

Spanish 1-School Words

BISC 102 EXAM 5

VBC Quiz Questions

AP Psychology Myers Chapter 4 (Nature/Nurture) Extra Study Material