ISEC 5305 test 1
The Children's Online Privacy Protection Act (COPPA) restricts the collection of information online from children. What is the cutoff age for COPPA regulation?
13
? Bob is using a port scanner to identify open ports on a server in his environment. He is scanning a web server that uses Hypertext Transfer Protocol (HTTP). Which port should Bob expect to be open to support this service?
443
Bob is using a port scanner to identify open ports on a server in his environment. He is scanning a web server that uses Hypertext Transfer Protocol (HTTP). Which port should Bob expect to be open to support the service?
80
Which password attack is typically used specifically against password files that contain cryptographic hashes?
Birthday attacks
Jody would like to find a solution that allows real-time document sharing and editing between teams. Which technology would best suit her needs?
Collaboration
Jody would like to find a solution that allows realtime document sharing and editing between teams. Which technology would best suit her needs?
Collaboration
In Mobile IP, what term describes a device that would like to communicate with a mobile node (MN)?
Correspondent node
In Mobile IP, what term describes a device that would like to communicate with a mobile node(MN)?
Correspondent node (CN)
? Which network device is capable of blocking network connections that are identified as potentially malicious?
Demilitarized Zone (DMZ)
Which risk is most effectively mitigated by an upstream Internet Service Provider (ISP)?
Distributed Denial of Service (DDoS)
What is the first step in a disaster recovery effort?
Ensure that everyone is safe
Which type of attack involves the creation of some deception in order to trick unsuspecting users?
Fabrication
?True or False: A VPN router is a security appliance that is used to filter IP packets
False
True or False: A rootkit uses a directed broadcast to create a flood of network traffic for the victim computer.
False
True or False: Denial of service (DoS) attacks are larger in scope than Distributed Denial of Service (DDoS) attacks
False
True or False: Store-and-Forward communications should be used when you need to talk to someone immediately.
False
True or False: You should use easy-to-remember personal information to create secure passwords
False
True or False: Cryptography is the process of transforming data from cleartext to ciphertext.
False (Encryption not Cryptography)
True or False: In the Remote Access Domain, if private data or confidential data is compromised remotely, you should set automatic blocking for attempted logon retries.
False: Apply first level and second level tokens and biometrics
True or False: Cryptography is the process of transforming data from cleartext into ciphertext
False: Encryption
True or False: A security policy is a comparison of the security controls you have in place and the controls you need in order to address all identified threats.
False: Gap analysis
True or False: The anti-malware utility is one of the most popular backdoor tools in use today
False: Netcat
True or False: A phishing attack "poisons" a domain name on a domain name server.
False: Pharming
True or False: Vishing is a type of wireless network attack
False: Social Engineering attacks
True or False: User-based permission levels limit a person to executing certain functions and often enforces mutual exclusivity
False: Task-based
True or False: Bricks-and-mortar stores are completely obsolete now.
False: They have global reach
True or False: Voice patter biometrics are accurate for authentication because voices can't easily be replicated by computer software
False: easy to replicate
What compliance regulation applies specifically to the educational records maintained by schools about students?
Family Education Rights and Privacy Act (FERPA)
Which element of the security policy framework offers suggestions rather than mandatory actions?
Guideline
Bob recently accepted a position as the information security and compliance manager for a medical practice. Which regulation is likely to most directly apply to Bob's employer?
HIPPA
Which law governs the use of the IoT by healthcare providers, such as physicians and hospitals
HIPPA
Which act governs the use of Internet of Things (IoT) by healthcare providers, such as physicians and hospitals?
Health Insurance Portability and Accountability Act (HIPAA)
What do organizations expect to occur with the growth of the IoT?
Higher Risks
Rachel is investigating an information security incident that took place at the high school where she works. She suspects that students may have broken into the student records system and altered their grades. If correct, which one of the tenets of information security did this attack violate?
Integrity
Which organization pursues standards for the IoT devices and is widely recognized as the authority for creating standards of the Internet?
Internet Society
Which IoT challenge involves the difficulty of developing and implementing protocols that allow devices to communicate in a standard fashion?
Interoperability
Which type of denial of service attack exploits the existence of software flaws to disrupt a service?
Logic attack
Which element of the security policy framework requires approval from upper management and applies to the entire organization?
Policy
Which tool can capture the packets transmitted between systems over a network?
Protocol analyzer
Which formula is typically used to describe the components of information security?
Risk = Threat X Vulnerabilities
Earl is preparing a risk register for his organization's risk management program. Which data is LEAST likely to be included in a risk register?
Risk Survey results
Gary would like to choose an access control model in which the owner of a resource decides who may modify permissions on that resource. Which model fits that scenario?
Rule-based access control
Holly would like to run an annual major disaster recovery test that is as thorough and realistic as possible. She also wants to ensure that there is no disruption of activity at the primary site. What option is best in this scenario?
Simulation Test
Users throughout Alison's organization have been receiving unwanted commercial messages over the organization's instant messaging program. What type of attack is taking place?
Spim
Which element of the IT security policy framework provides detailed written definitions for hardware and software and how they are to be used?
Standard
Which term describes an action that can damage or compromise an asset?
Threat
What type of malicious software masquerades as legitimate software to entice the user to run it?
Trojan Horse
? True or False: IoT devices cannot share and communicate you IoT device data to other systems and applications without your authorization or knowledge
True
?True or False: Networks, routers, and equipment require continuous monitoring and management to keep WAN service available
True
True or False: A Chinese wall security policy defines a barrier and develops a set of rules that makes sure no subject gets to objects on the other side of the wall
True
True or False: A birthday attack is a type of cryptographic attack that is used to make brute-force attack of one-way hashes easier.
True
True or False: A phishing email is a fake or bogus email intended to trick the recipient into clicking on an embedded URL link or opening an email attachment.
True
True or False: A trusted operating system (TOS) provides features that satisfy specific government requirements for security.
True
True or False: An IT security policy framework is like an outline that identifies where security controls should be used
True
True or False: Authorization is the process of granting rights to use an organization's IT assets, systems, applications, and data to a specific user.
True
True or False: Authorization is the process of granting rights to use an organizations IT assets, systems, applications, and data to a specific user.
True
True or False: Bring your own device (BYOD) opens the door to considerable security risks
True
True or False: Cars that have Wi-Fi access and onboard computers require software patches and upgrades from the manufacturer.
True
True or False: Content-dependent access control requires the access control mechanism to look at the data to decide who should get to see it
True
True or False: Devices that combine the capabilities of mobile phones and personal digital assistants (PDAs) are commonly called smartphones
True
True or False: E-commerce systems and applications demand strict confidentiality, integrity, and availability (CIA) security controls.
True
True or False: Each 4g device has a unique Internet Protocol (IP) address and appears just like any other wired device on a network.
True
True or False: Encrypting the data within databases and storage devices gives an added layer of security
True
True or False: Failing to prevent an attack all but invites an attack
True
True or False: Hypertext Transfer Protocol (HTTP) is the communications protocol between web browsers and websites with data in cleartext.
True
True or False: IoT technology has a significant impact on developing economies, given that it can transform countries into e-commerce-ready nations
True
True or False: Metadata of IoT devices can be sold to companies seeking demographic marketing data about users and their spending habits
True
True or False: One of the first industries to adopt and widely use mobile applications was the healthcare industry
True
True or False: Organizations should start defining their IT security policy framework by defining as asset classification policy
True
True or False: Rootkits are malicious software programs designed to be hidden from normal methods of detection
True
True or False: The Director of IT security is generally in charge of ensuring that the Workstation Domain conforms to Policy
True
True or False: The Government Information Security Reform Act of 2000 focuses on management and evaluation of the security of unclassified and national security systems.
True
True or False: The most critical aspect of a WAN services contract is how the service provider supplies troubleshooting, network management, and security management services
True
True or False: The recovery point objective (RPO) is the maximum amount of data loss that is acceptable.
True
True or False: The system/application domain holds all the mission critical systems, applications, and data.
True
True or False: The term risk management describes the process of identifying, assessing, prioritizing, and addressing risks.
True
True or False: The tools for conducting a risk analysis can include the documents that define, categorize, and rank risks.
True
True or False: Using a secure logon and authentication process is one of the six steps to prevent malware.
True
True or False: When servers need operating system upgrades or patches, administrators take them offline intentionally so they can perform the necessary work without risking malicious attacks
True
Florian recently purchased a set of domain names that are similar to those of legitimate websites and used the newly purchased sites to host malware. Which type of attack is Florian using?
Typosquatting
Which of the following is an example of a hardware security control? a) Security Policy b) NTFS permission c) MAC filtering d) ID badge
d
Which of the following is an example of two-factor authentication? a) personal identification number (PIN) and password b) token and smart card c) password and security questions d) smart card and personal identification number (PIN)
d
Which of the following is NOT an area of critical infrastructure where the Internet of Things (IOT) is likely to spur economic development in less developed countries? a) Water Supply management b) Agriculture c) Wastewater Treatment d) E-commerce
d) e-commerce
True or False: A bricks-and-mortar strategy includes marketing and selling goods and services on the Internet
false: e-commerce
Maria's company recently experienced a major system outage due to the failure of a critical component. During that time period, the company did not register any sales through it's online site. Which type of loss did the company experience as a result of lost sales?
opportunity cost
