IT 2531-Systems Security Mid-term
vulnerability
A weakness that allows a threat to be realized or to have an effect on an asset
Risk
Likelihood that something bad will happen to asset.
A disaster recovery plan (DRP) directs the actions necessary to recover resources after a disaster.
True
A functional policy declares an organization's management direction for security in such specific functional areas as email, remote access, and Internet surfing.
True
A phishing email is a fake or bogus email intended to trick the recipient into clicking on an embedded URL link or opening an email attachment.
True
A smart card is a token shaped like a credit card that contains one or more microprocessor chips that accept, store, and send information through a reader.
True
A trusted operating systems (TOS) provides features that satisfy specific government requirements for security.
True
Access control lists (ACLs) are used to permit and deny traffic in an IP router.
True
An bricks-and-mortar strategy includes marketing and selling goods and services on the Internet.
True
The tools for conducting a risk analysis can include the documents that define, categorize, and rank risks.
True
The weakest link in the security of an IT infrastructure is the server.
True
Unified messaging allows you to download both voice and email messages to a smartphone or tablet.
True
When servers need operating system upgrades or patches, administrators take them offline intentionally so they can perform the necessary work without risking malicious attacks.
True
Written security policies document management's goals and objectives.
True
Connectivity is one of the five critical challenges that the Internet of Things (IoT) has to overcome.
False
The Sarbanes-Oxley (SOX) Act requires all types of financial institutions to protect customers' private financial information.
False
The anti-malware utility is one of the most popular backdoor tools in use today.
False
The auto industry has not yet implemented the Internet of Things (IoT).
False
The first step in creating a comprehensive disaster recovery plan (DRP) is to document likely impact scenarios.
False
The four central components of access control are users, resources, actions, and features.
False
The idea that users should be granted only the levels of permissions they need in order to perform their duties is called the principle of least privilege.
False
The number of failed logon attempts that trigger an account action is called an audit logon event.
False
The term risk methodology refers to a list of identified risks that results from the risk-identification process.
False
Common methods used to identify a user to a system include username, smart card, and biometrics.
True
Devices that combine the capabilities of mobile phones and personal digital assistants (PDAs) are commonly called smartphones.
True
E-commerce systems and applications demand strict confidentiality, integrity, and availability (CIA) security controls.
True
Fingerprints, palm prints, and retina scans are types of biometrics.
True
Hypertext Transfer Protocol (HTTP) is the communications protocol between web browsers and websites with data in cleartext.
True
In e-business, secure web applications are one of the critical security controls that each organization must implement to reduce risk.
True
Networks, routers, and equipment require continuous monitoring and management to keep wide area network (WAN) service available.
True
World Wide Web
A system that defines how documents and resources are related across network machines
A remediation liaison makes sure all personnel are aware of and comply with an organization's policies.
False
A rootkit uses a directed broadcast to create a flood of network traffic for the victim computer.
False
An attacker uses exploit software when wardialing.
False
Bricks-and-mortar stores are completely obsolete now.
False
Continuity of critical business functions and operations is the first priority in a well-balanced business continuity plan (BCP).
False
Denial of service (DoS) attacks are larger in scope than distributed denial of service (DDoS) attacks.
False
Most enterprises are well prepared for a disaster should one occur.
False
Often an extension of a memorandum of understanding (MOU), the blanket purchase agreement (BPA) serves as an agreement that documents the technical requirements of interconnected assets.
False
Passphrases are less secure than passwords.
False
Procedures do NOT reduce mistakes in a crisis.
False
Regarding data center alternatives for disaster recovery, a mobile site is the least expensive option but at the cost of the longest switchover time.
False
Regarding the Internet of Things (IoT), a business involved in utilities, critical infrastructure, or environmental services can benefit from traffic-monitoring applications.
False
Voice pattern biometrics are accurate for authentication because voices can't easily be replicated by computer software.
False
Wardialers are becoming more frequently used given the rise of Voice over IP (VoIP).
False
You should use easy-to-remember personal information to create secure passwords.
False
A VPN router is a security appliance that is used to filter IP packets.
False Virtual private network (VPN) is a method of encryptingIP packets from one end to another, as in atunnel.
Service-level agreements (SLAs) are optical backbone trunks for private optical backbone networks.
False. An SLA is a contract that guarantees a minimum monthly availability of service for wide area network (WAN) and Internet access links. SLAs accompany WAN services and dedicated Internet access links. Availability measures a monthly uptime service-level commitment.
Information Systems Security
The collection of activities that protect the information system and the data stored in it
A DoS attack is a coordinated attempt to deny service by occupying a computer to perform large amounts of unnecessary tasks.
True
A dictionary attack works by hashing all the words in a dictionary and then comparing the hashed value with the system password file to discover a match.
True
Application service providers (ASPs) are software companies that build applications hosted in the cloud and on the Internet.
True
Failing to prevent an attack all but invites an attack.
True
One advantage of using a security management firm for security monitoring and is that it has a high level of expertise.
True
Organizations should start defining their IT security policy framework by defining an asset classification policy.
True
Rootkits are malicious software programs designed to be hidden from normal methods of detection.
True
Simple Network Management Protocol (SNMP) is used for network device monitoring, alarm, and performance.
True
Social engineering is deceiving or using people to get around security controls.
True
Standards are used when an organization has selected a solution to fulfill a policy goal.
True
The business impact analysis (BIA) identifies the resources for which a business continuity plan (BCP) is necessary.
True
The director of IT security is generally in charge of ensuring that the Workstation Domain conforms to policy.
True
The recovery point objective (RPO) is the maximum amount of data loss that is acceptable.
True
The term risk management describes the process of identifying, assessing, prioritizing, and addressing risks.
True
Threat
any action that can damage an asset.