Block 5, Appraisal 19 (All Units)

1A. Name the destructive behavior where the attacker changes entries in records.

2A. What service has this drawback: if an account is compromised, a hacker can access multiple servers rather than one?

4A. What should be placed in a private zone?

6C. Which of the following is NOT part of baselining a system?

2C. Which software development life cycle requires completion of each development phase before moving to the next phase?

2D. What is a cryptographic processor stored on a separate card and installed on a system as an add-on device?

1C. A worm has the unique characteristic of being able to replicate without needing _________ to activate the virus.

8C. We aim to defeat our enemy's cryptanalysis efforts with our _________ systems.

5C. All involved personnel should ID and ______ all relevant information about a network incident for future analysis.

2D. To prevent data theft and worms, USB data ports are _________ on Department of Defense computers.

8C. What level of classification, if disclosed, could cause exceptionally grave damage to national security?

2D. Why are Universal Serial Bus (USB) devices particularly dangerous to computer systems and networks?

2B. What protocol does DIAMETER use to send and secure data during transmission?

5B. The goal of a network incident first responder is to _________ the incident.

1B. A targeted social engineering attack on a specific user for his/her specific likes is known as an insider attack.

2A. Which of the following is NOT an authentication factor?

2D. When using Full Disk Encryption (FDE), what stores the cryptographic keys within the system?

2C. What risk is posed by enabling the "Remember Me" feature with internet browsers?

2C. The code is checked for functionality in what stage of the SDLC?

1C. What are the two common pathways from criminals to users?

8A. What security program focuses on end-point security, ports, protocols, and service management within the Air Force?

2A. What type of authentication factor is based on user habits like typing patterns?

2A. Combining username & password is considered multi-factor authentication.

5A. A/an _________ is an observable occurance in a system and/or network.

1D. A third party contractor gaining _______ unauthorized access to information systems is considered an insider threat.

6C. When creating a baseline, what metric will change the perspective of your data?

2A. When Network Access Control connects to a network, what can it scan for on the system?

1C. File infector viruses will infect what type of files?

2A. What type of authentication factor requires a biometrics system?

1A. Per the STRIDE model, what term is described by exhausting resources needed to provide service?

2A. What must be supplied by a user who’s attempting to connect to a network secured with 802.1X?

5A. What document should define each team member's roles and responsibilities?

2B. Any network resources the user consumes during their session is logged. What is this process called?

5C. What document identifies potential foreign threats to Department of Defense networks?

4A. In what security zone would you put a Wi-Fi network?

6D. It's necessary to maintain a/an _________ to revert the system after changes if needed.

4A. When creating a firewall plan, you will typically create all of the following zones EXCEPT what?

1C. What malware has the defining factor of being able to replicate itself without user interaction?

6A. By having secure network user habits, the cyber _________ of the network is ensured.

5A. How would the following incident/event be categorized: normal functionality is denied.

1D. Cybersecurity in the supply chain can be viewed as an information technology problem only.

2A. The use of biometrics is what type of authentication factor?

6A. Before you dispose of a computer you should use a wipe utility program to _________ the entire hard drive.

1C. Where does a "boot-sector virus" reside?

6E. In which step would you gather and document equipment, policies, telephone numbers, and other valuable documents?

8D. Which security program is a continuous process and an inherent part of military culture?

1D. Ensuring a third party is ___________ data is an important prerequisite when considering cloud computing.

6C. What is the starting point for all future configuration assessments?

5A. How would the following incident/event be categorized: authorized user breaches AF policy.

1A. What are the ways to characterize an attack?

2A. Dissolvable agents run the NAC check for a current status of the system and remain installed on the system.

6E. In which step would you form a team to assist in the entire disaster recovery operation?

5B. During an incident, what must the incident handling staff do with the data to allow for further incident analysis?

1A. Per the STRIDE model, what threat involves claiming you didn't do something or were not responsible for an action?

6A. How often should antivirus software be set up to automatically perform security scans?

5A. What incident response team role has technical expertise to assess and identify the scale of the security incident?

2C. During the Agile SDLC process, when can developers backtrack or repeat steps?

8B. _________ vulnerabilities come from unintentionally emitted signals or compromising emanations.

8C. _______ is applying cryptosecurity techniques to each situation so our intercepted signals will be unintelligible.

6E. Which backup method backs up files that were altered since the last backup and clears the archive flag after?

2B. What AAA protocol gives less reliable/secure service through User Datagram Protocol (UDP)?

1B. Which of the following is NOT a purpose of social engineering?

5B. If a virus is discovered on a system, who should isolate the computer from the network?

6C. Baselining will require updating to make it current with a desired configuration.

3A. Which NTFS permission gives a user all permission possible?

4A. In what security zone would you put a limited-access server?

5B. What part of post-incident analysis captures lessons learned, initial root cause, and other problems?

2A. Agentless Network Access Control does not require a/an agent _________ to be installed on a client.

8C. TRANSEC results from all measures designed to protect intentional transmissions by means other than what?

6A. To ensure antivirus definitions are kept up to date, users should allow their software to perform automatic updates.

8A. Having the goals of Confidentiality, Integrity, and Availability best describes which security program?

3A. Group policy can be centrally configured for the network through _____________.

2C. In what attack is malicious code injected into a web application via a script?

5A. A/an _________ is an assessed occurance in a system and/or network that jeopardizes the information system.

5C. During which phase should personnel continuously review the incident to ensure accuracy?

3A. What provides web filtering?

1A. Which network attack is difficult to address because it sends more requests to one machine than it can handle?

2B. What's defined as presenting information about yourself to a system?

5B. Name the all-source report that focuses on individuals, groups, or organizations ID'd as threats to DoD networks.

2D. Storage Drive encryption can encrypt what kinds of storage drives?

8B. TEMPEST is a security program that identifies compromising _________ in information systems

8C. Cryptography is the use of coding systems to _________ information.

8D. OPSEC reduces mission vulnerabilities by eliminating or reducing adversary collection of _______.

5B. What's the first incident response phase where the AF detects activity with a variety of means and capabilities?

5A. How would the following incident/event be categorized: event undergoing further review.

5A. How would the following incident/event be categorized: event that is a false alarm.

1C. Malicious code is a category including _________ and website scripts that can be uploaded into a vulnerable system.

1B. What involves psychological manipulation of people to divulge information or perform actions that benefit attackers?

4A. What security zone contains the internet?

8C. Which of the following would be considered the LEAST classified compared to the others?

2D. When Bitlocker is enabled, Windows 7 and newer versions can't boot without a key. What type of encryption is this?

3A. Network administrators implement permissions on files and folders to build what?

5C. When should gathering information take place during root cause analysis?

2C. Websites store cookies containing user preferences and _________ information.