True/False Security +

Cipher locks are the same as combination padlocks. Answer: True False

false

Nearly all operating systems and applications accept non-keyboard characters in passwords. Answer: True False

false

PGP and SSL function at the same layer of the Open System Interconnection (OSI) model. Answer: True False

false

Passwords provide strong protection. Answer: True False

false

An access point can bridge a LAN and a WLAN. Answer: True False

true

When a policy violation is detected by the DLP agent, it is reported back to the DLP server. Answer: True False

true

When security is done right, an organization would create a different baseline for each class of computer. Answer: True False

true

DNS uses port 35. Answer: True False

False

The dangerous aspect of a client-side Web attack is that compromised Web sites initiate connections with clients in an attempt to infect them. Answer: True False

False

IPsec is an optional protocol with IPv4 but not with IPv6. Answer: True False

True

A VPN concentrator is hardware that compacts a VPN into a smaller footprint, allowing for more throughput. Answer: True False

false

A hash that is created from a set of data can be reversed. Answer: True False

false

A risk retention pool is a variation of accepting the risk. Answer: True False

false

A security policy determines how security is to be enforced; a baseline determines what must be protected. Answer: True False

false

A strength of RADIUS is that messages are always directly sent between the wireless device and the RADIUS server. Answer: True False

false

ARP poisoning is successful because there are few authentication procedures to verify ARP requests and replies. Answer: True False

false

According to Panda, over 30 million new specimens of malware were created in a ten month period in 2010. Answer: True False

false

According to researchers at GTRI, a password with fewer than 7 characters will be vulnerable very soon. Answer: True False

false

Approximately two out of three malicious Web attacks have been developed using one of four popular attack toolkits. True or False

false

Attack toolkits range in price from only $400 to as much as $8,000. True or False

false

Attackers seldom use buffer overflow attacks to install malware on the target computer. Answer: True False

false

Attacks that can be written and deployed in a single day are known as zero day attacks. Answer: True False

false

Authorization and access are viewed as synonymous and in access control, they are the same step. Answer: True False

false

Because PEAP can be vulnerable to specific types of attacks, Cisco now recommends that users migrate to a more secure EAP than PEAP. Answer: True False

false

Because antennas are generally positioned to provide the broadest area of coverage, APs should be located at the end of the coverage area. Answer: True False

false

Because of the many complex rules required in a rule based firewall, they operate at a higher level than a settings based firewall. Answer: True False

false

Because of the minor role it plays, DNS is never the focus of attacks. Answer: True False

false

Because the XSS is a widely known attack, the number of Web sites that are vulnerable is small. Answer: True False

false

Cryptography cannot be applied to entire disks. Answer: True False

false

Cryptography cannot protect data as it is being transported across a network. Answer: True False

false

DNS poisoning can be done in two locations: the local lmhosts table or the external DNS server. Answer: True False

false

Digital certificates cannot be used to identify objects other than users. Answer: True False

false

EFS uses GPG to encrypt and decrypt files. Answer: True False

false

Even though rootkits are difficult to detect and remove, ultimately they can always be safely removed without reformatting the hardrive and re-installing the Operating System. True or False

false

IIS Web servers are vulnerable to command injection because Web sites are given root account access permissions. Answer: True False

false

IP telephony and Voice over IP (VoIP) are identical. Answer: True False

false

If a SQL injection attack returns the message "Server Failure" the attacker knows that a SQL attack cannot be rendered on the site. Answer: True False

false

Implicit deny commands override all other commands and will block access regardless of what is specifically allowed. Answer: True False

false

In 2010, 75% of attacks against Microsoft Office and Internet Explorer would have been prevented if the user had not been logged in as an administrator. Answer: True False

false

In a general sense, assurance may be defined as the necessary steps to protect a person or property from harm. Answer: True False

false

In an empty box test, the tester has no prior knowledge of the network infrastructure that is being tested. Answer: True False

false

In software development, the design review phase is conducted after the initial writing of the code before the verification phase. Answer: True False

false

Keyed entry locks are much more difficult to defeat than deadbolt locks. Answer: True False

false

Like a virus, a worm needs the user to perform an action such as starting a program or opening an e-mail attachment to start the infection. True or False

false

Psychological approaches to social engineering often involve impersonation, phishing, spam, and hoaxes. True or False

false

Registered TCP/IP port numbers are reserved for the most universal applications. Answer: True False

false

Removing a rootkit from an infected computer is difficult. True or False

false

Risk assessments should focus on the impact to the individual area(s) affected by an attacked asset and not the organization as a whole. Answer: True False

false

SSL is more likely to be faster than IPSEC. Answer: True False

false

Standard access points are also referred to as independent access points. Answer: True False

false

Stealth scans are so named because they can pass through firewalls undected. Answer: True False

false

Switches, not individual switch ports are configured for MAC limiting and filtering. Answer: True False

false

TACACS+ and RADIUS are designed to support hundreds of remote connections. Answer: True False

false

TCP is responsible for addressing packets and sending them on the correct route to the destination, while IP is responsible for reliable packet transmission. Answer: True False

false

TCP/IP uses its own five-layer architecture that includes Network Interface, Internet, Control, Transport, and Application. Answer: True False

false

The FBI defines cyberterrorism as any premeditated, politically motivated attack against information, computer systems, computer programs, and data owned and operated by government and military organizations. Answer: True False

false

The OSI model breaks networking steps down into a series of six layers. Answer: True False

false

The demand for IT professionals who know how to secure networks and computers is at an all-time low. Answer: True False

false

The most common Web application attacks are XSS, XML injection, and Macro injection. Answer: True False

false

Trusted OSs have been used since the late 1960s, initially for government and military applications. Answer: True False

false

Using a rainbow table to crack a password requires three steps. Answer: True False

false

Vulnerability scans are usually performed from outside the security perimeter. Answer: True False

false

Workgroup switches must work faster than core switches. Answer: True False

false

A DoS attack is designed to flood a system with so many requests that the target system eventually stops responding or crashes. Answer: True False

true

A baseline is the standard by which the level of security in an organization is measured. Answer: True False

true

A computer user may be authorized or granted permission to log on to a system by presenting valid credentials, yet that authorization does not mean that the user can then access any and all resources. Answer: True False

true

A shield icon warns users if they attempt to access any feature that requires UAC permission. Answer: True False

true

A vulnerability of PSK is that keys are shared manually in plain text. Answer: True False

true

According to a major security vendor, 34% of all known malware was created in 2010. True or Fals

true

Although traditional network security devices can block traditional network attacks, they cannot always block Web application attacks. Answer: True False

true

An advantage of TPM is that malicious software cannot attack it. Answer: True False

true

An example of a smurf DoS attack is when an attacker spoofs broadcasted ICMP packets to make them appear as though they came from the target of the attack. Answer: True False

true

Because of the weaknesses of WEP, it is possible for an attacker to identify two packets derived from the same IV. Answer: True False

true

Block ciphers are considered more secure than stream ciphers because they are more random. Answer: True False

true

Cryptography is used in the encryption process but not in the steganography process. Answer: True False

true

Data, once restricted to papers in the office filing cabinet, now flows freely both in and out of organizations, among employees, customers, contractors, and business partners. Answer: True False

true

Despite its promise to dramatically impact IT, cloud computing raises significant security concerns. Answer: True False

true

Digital signatures actually only show that the public key labeled as belonging to person was used to encrypt the digital signature. Answer: True False

true

Hubs work in the OSI physical layer to pass traffic from one device to another. Answer: True False

true

IEEE 802.1x is commonly used on wireless networks. Answer: True False

true

If port 20 is available, then an attacker can assume that FTP is being used. Answer: True False

true

In the DAC model, permissions are inherited from the subject and granted to programs the subject runs. Answer: True False

true

It has been found that about 90% of passwords have an ending suffix. Answer: True False

true

Office File Validation is only available in Microsoft Office 2010. Answer: True False

true

One of the duties of a CA is to distribute public key certificates. Answer: True False

true

One security concern with ActiveX is that it has full access to the Windows operating system. Answer: True Fals

true

Public keys can be stored by embedding them within digital certificates, while private keys can be stored on the user's local system. Answer: True False

true

Recent employment trends indicate that employees with security certifications are in high demand. Answer: True False

true

Securing the host involves protecting the physical device itself, securing the operating system software on the system, using security-based software applications, and monitoring logs. Answer: True False

true

Security is enhanced by subnetting a single network into multiple smaller subnets in order to isolate groups of hosts. Answer: True False

true

Self-encrypting HDD is commonly found in copiers and multifunction printers as well as point-of-sale systems used in government, financial, and medical environments. Answer: True False

true

Software keyloggers are programs that silently capture all keystrokes, including passwords and sensitive information. True or False

true

Steganography can use image files, audio files, or even video files to contain hidden information. Answer: True False

true

Tailgating is when a spam message gets through a spam filter while the filter is allowing a legitimate email through. True or False

true

The "omnipresence" of access from any computer with only an Internet connection and a Web browser has made Web applications an essential element of organizations today. Answer: True False

true

The CompTIA Security+ Certification is aimed at an IT security professional with the recommended background of a minimum of two years experience in IT administration, with a focus on security. Answer: True False

true

Today's operating systems have roots dating back 20 or more years, well before security was identified as a critical process. Answer: True False

true

War driving is searching for wireless signals. Answer: True False

true

Weakness in software can be more quickly uncovered and exploited with new software tools and techniques. Answer: True False

true

Well known TCP/IP port numbers fall into the lowest range of port numbers. Answer: True False

true