quiz 1 + Quiz 2 + Quiz 6 + Quiz 5 + Quiz 4 + quiz 3

Screen locks are a form of endpoint device security control.

As a follow-up to her annual testing Isabella would conduct quarterly disaster recovery tests What test should she condu

In which domain of a typical IT infrastructure is the first layer of defense for a layered security strategy?

A wireless access point (WAP) is the connection between a wired network and wireless devices.

The (RTO) expresses the maximum allowable time in which to recover the function after a major interruption.

Which of the following is an example of an authorization control?

A man-in-the-middle attack takes advantage of the multihop process used by many types of networks.

The protocols in the (TCP/IP) suite work together to allow any two computers to be connected and thus create a network

Vehicles that have Wi-Fi access and onboard computers require software patches and upgrades from the manufacturer.

Bluejacking is an attack in which wireless traffic is sniffed between Bluetooth devices.

Violet deploy an intrusion prevention system on her network as security control What type of control has Violet deployed

For businesses under recent compliance laws, data classification standard typically include private, confidentia, intern

(TCP/IP) is a suite of protocols that operates at both the Network and Transport layers of the (OSI) Reference Model

Which of the following is not true of gap analysis?

Preventive controls merely attempt to suggest that a subject not take a specific action, whereas corrective controls do

There are large number of protocol & program that use port number to make computer connect which do not use port number

Which of the ff is the point at which two error rate of biometric sys are equal and is the measure of the sys percentage

A company's IT manager has advised the business executives to use a method of decentralized access control rather than

Authentication by action is based on something you do, such as typing.

Maria is writing a policy defines her organization data classification standard The policy designate IT asset critical

Inherently insecure Transmission Control Protocol/Internet Protocol (TCP/IP) applications

Unauthorized access to data centers and downtime of servers are risks to which domain of an IT infrastructure?

In MAC access rules are closely managed by the security administrator and not by the system owner or ordinary user for

Adam is evaluating the security of web server before it goes live that an issue in the code allow a cross-site scripting

The Data Link Layer of the OSI Reference Model is responsible for transmitting information on computers connected to LAN

The ping utility identifies the path that packets travel through a network.

Gwen company is planning to accept credit card over Internet What governs this type of activity and include provision

Rachel is investigating an info security incident that took place at high school. She suspect that student broke in

Each layer of the Open Systems Interconnection Reference Model needs to be able to talk to the layers above and below it

Which type of attack involves eavesdropping on transmissions and redirecting them for unauthorized use?

A router is a security appliance that is used to filter Internet Protocol (IP) packets and block unwanted packets

 Authorization; process of granting right to use an organization IT asset, system, application, & data to a specific user

Authentication by knowledge is based on something the user knows, such as a password, passphrase, or (PIN).

Which of the following would govern the use of Internet of Things by health care providers such as physicians & hospital

 In a watering-hole attack, targeted user is lured to commonly visited website on which malicious code has been planted

Tomahawk Industries develops weapons control systems for the military Which principle of security is this following?

E-commerce systems and applications demand strict confidentiality, integrity, and availability (CIA) security controls.

MDM includes a software application that allows organizations to monitor control data wipe, or data delete business data

Which of the following is not a market driver for the Internet of Things (IoT)?

Impact refers to the amount of risk or harm caused by a threat or vulnerability that is exploited by a perpetrator.

What is a primary risk to the Workstation Domain, the Local Area Network (LAN) Domain, and the System/Application Domain

The business continuity plan (BCP) identifies the resources for which a business impact analysis (BIA) is necessary.

Isabella is in charge of the disaster recovery plan (DRP) team. What option is described in this scenario?

Remote wiping is a device security control that allows an organization to remotely erase data or email in the event loss

Carl recently joined a new organization noticed that the firewall tech used by the firm open separate connection btn the

To create the most secure network configure the firewall to allow all messages except the one that are explicitly denied

 A threat analysis identifies and documents threats to critical resources, which means considering the types of disaster

What protocol is responsible for assigning Internet Protocol (IP) addresses to hosts on many networks?

What type of firewall security feature limits the volume of traffic from individual hosts?

Maria If the exposure factor (EF) for a $10 million facility is 20 percent, what is the single loss expectancy (SLE)?

A smishing attack is a type of phishing attack involving voice communication.

security perspective, what should organization expect will occur as they become more dependent on the Internet of Things

Which password attack is used on weak password & compare hash value of password to sys password file to find a match

 Transmitting private or sensitive data unencrypted is risk in both the (LAN) & WAN Domains of typical IT infrastructure

Which type of attack involve capturing data packet from network & retransmitting them to produce an unauthorized effect

Rodrigo is a security professional is creating policy Which approach to mobile devices is Rodrigo focusing on the policy

Which element of security policy framework require approval from upper management and applies to the entire organization

Which action is the best step toward protecting (IoT) devices from becoming the entry point for security vulnerabilities

Which network device is designed to block network connections that are identified as potentially malicious?

Wen is network engineer like to isolate several system belonging to product development group from other system

Anya is a cybersecurity engineer for a high-secrecy government installation. She is configuring biometric security that

(IoT) upgrades can be difficult to distribute and deploy, leaving gaps in the remediation of IoT devices or endpoints.

Hajar investigating denial of service attack against her network She notice that ICMP What type of attack is taking plac

Hypertext Transfer Protocol (HTTP) encrypts data transfers between secure browsers and secure webpages.

Tom is the IT manager for an organization that experienced a server failure that affected a single business function. 

A hospital is planning to introduce a new point-of-sale system in the cafeteria that will handle credit card transaction

hacker who stole logon IDs & password The hacker is now attempting to gain unauthorized access to a public-facing web

Bob is info security & compliance manager for financial institution Which regulation is likely to directly apply to emp

In which type of attack does the attacker attempt to take over an existing connection between two systems?

 Authentication controls include passwords and personal identification numbers (PINs).

SSO can provide for greater security because with only 1 password to remember user is generally willing to use stronger

Isabella is network engineer She authentication to wireless network and posture check What tech should Isabella use

What measures the average amount of time between failures for a particular system?

Physical access to network equipment is required to eavesdrop on a network connection.

A BCP directs all activitie required to ensure that organization critical business functions continue when interruption 

A social engineering consensus tactic relies on the position that "everyone else has been doing it" as proof that it is

Safeguards address gaps or weaknesses in the controls that could otherwise lead to a realized threat.

Maria is using accounting software to compile sensitive financial information What access control compromise is this

Miriam is a network administrator She would like to use a wireless authentication tec What technology should she deploy?

Dawn is selecting an alternative processing facility for her organization's primary data center What is appropriate opt

Barry discover an attacker is running access point in building adjacent to his company What type attack is taking place

Wen is network engineer For months he has been designing sys of control to allow & restrict access to network assets

A brute-force password attack & theft of a mobile worker laptop are risk most likely found domain of typical IT infrastr

What is the main purpose of risk identification in an organization?

In a masquerade attack, one user or computer pretends to be another user or computer.

She want cloud-based service that will allow her to load operating system on vm What service is Keisha looking for

The term "risk management" describes the process of identifying, assessing, prioritizing, and addressing risks.

Authorization controls include biometric devices.

A home user connecting to a website over the Internet is an example of a wide area network (WAN) connection.

Forensics and incident response are examples of __________ controls.

 phishing email is a fake or bogus email intended to trick the recipient into clicking on an embedded link or opening

The term "risk methodology" refers to a list of identified risks that results from the risk identification process.

 A dictionary password attack is a type of attack in which one person, program, or computer disguises itself as another

Remote access security ensure user connecting to an organization network is who the user claim to be. A usernam, biometr

A ________ is used to identify the part of an Ethernet network where all hosts share the same host address.

 Content-depend access control require the access control mechanism to look at the data to decide who should get to see

What is the first priority when responding to a disaster recovery effort?

 Physically disabled user have difficulty with biometric sys accessibility specifically with performance-based biometric

Ron IT director at a med-sized company He get request from employee who want to select customized mobile devices.

In e-business, secure web application 1 of critical security control that each organization implement to reduce risk.

Arturo is a network engineer. He wants to implement an access control system in which the owner of the resource decides

Access control lists (ACLs) are used to permit and deny traffic in an Internet Protocol (IP) router.

Brian notice attack taking place on his network When he dig he realize that attacker has a physical presence the local

Corrective controls are implemented to address a threat in place that does not have a straightforward risk-mitigating

Aditya is the security manager for a midsized business company has suffered several data losses when laptops were stolen

Which of the following is an example of a reactive disaster recovery plan?

Each 5G device has a unique Internet Protocol (IP) address and appears just like any other wired device on a network.

Devaki is capturing traffic on her network notice connection using ports 20, 22, 23, and 80. Which port normally hosts

What term describes the risk that exists after an organization has performed all planned countermeasures and controls?

Which term describes an action that can damage or compromise an asset?

He is tasked with assessing the institution risk What compliance regulation applies specifically to Aditya's institution

Data classificatio standard provide consistent definit for how an organizati should handle and secure diff type of data

A border router can provide enhanced features to internal networks and help keep subnet traffic separate.

Which security control is most helpful in protecting against eavesdropping on wide area network (WAN) transmissions?

Which of the following is an example of a direct cost that might result from a business disruption?

Which organization pursue standard for (IoT) device & is widely recognized as the authority for creating standard on in

Passphrases are less secure than passwords.

Vendor or service provider that have remote access to (IoT) device may be able to pull info or data from your device

Internet Protocol version 4 uses the (ICMP) within a network to automatically assign an IP address to each computer

Which attack is typically used specifically against password files that contain cryptographic hashes?

What is not a commonly used endpoint security technique?

An attacker attempting to break into facility pulls the fire alarm to distract the security guard manning an entry point

The Physical Layer of the OSI Reference Model must translate the binary ones and zero of computer language into language

What is key to implementing a consistent Internet of Things (IoT) device, connectivity, and communications environment

 A firewall can be used to segment a network.

 A protocol is a set of rules that govern the format of messages that computers exchange.

Kerberos is an example of a biometric method.

Log files are one way to prove accountability on a system or network.

Devaki is evaluating different biometric systems. She understands that users might not want to subject themselves to

What type of attack against a web application uses a newly discovered vulnerability that is not patchable?

Hypertext Transfer Protocol (HTTP) is the communication protocol between web browser and website with data in cleartext.

Which element of the security policy framework offers suggestions rather than mandatory actions?

What is the maximum value for any octet in an Internet Protocol version 4 (IPv4) address?

Lincoln is a network security specialist  He is updating the password policy for his company's computing infrastructure

Which term best describes how a wide variety of object, device, sensors, and everyday items can connect and be accessed?

Cryptography is the practice of making data unreadable.

If a fire occurred it would likely cause $2 million in damage to the facility, which has a $10 million value what is ALE

In a browser or (URL) hijacking attack, users are directed to websites other than what they requested, usually to fake

Kaira company switch to calendaring system provided by a vendor Kaira and other users connect to the system, hosted at t

A (UTM) device can provide content inspection, where some or all network packet content is inspected to determine

What level of technology infrastructure should you expect to find in a cold site alternative data center facility?

Purchasing an insurance policy is an example of the ____________ risk management strategy.

Which term describe the sale of good and service on Internet whereby online customer buy those good & service from vendo

The Sarbane Oxley Act (SOX) require all types of financial institution to protect customer private financial information

A phishing attack "poisons" a domain name on a domain name server (DNS).

What network port number is used for unencrypted web-based communication by default?

What term describes data that has been stripped of personally identifiable information for privacy reasons?

The term "router" a device that connects two or more networks and selectively interchanges packets of data between them.

Which of the following is an example of a business-to-consumer (B2C) application of the Internet of Things (IoT)?

Authentication by characteristics/biometrics is based on something you have, such as a smart card, a key, a badge,

Which type of authentication includes smart cards?

 Metadata of (IoT) devices is sometimes sold to companies seeking demographic marketing data about user & spending habit

The number of failed logon attempts that trigger an account action is called an audit logon event.

 Encrypting data within databases and storage devices gives an added layer of security.

The four central components of access control are users, resources, actions, and features.

Because network computers or devices may host several services, programs need a way to tell one service from another. 

(IoT) devices cannot share & communicate your IoT device data to other systems & applications without your authoriza

 An alteration threat violates information integrity.

Storage segmentation is a mobile device control that physically separates personal data from business data.

An authentication, authorization, and accounting (AAA) server, such as Remote Authentication Dial-In User Service RADIUS

Networks, routers, and equipment require continuous monitoring and management to keep (WAN) service available.

Posting a comment on social media is an example of real-time communication.

Changes to external requirement such as legislation regulation or industry standards, that require control change result

Which term describe level of exposure some event that has effect on asset usually likelihood something bad will happen

Maria is a freelance network consultant This feature filter the network cards of any wireless computer not on the list

Availability is the tenet of information security that deals with uptime and downtime.

Which is the typical risk equation?

What is an example of a logical access control?

The ownership of Internet of Things (IoT) data, as well as the metadata of that data, is sometimes in question.

What is an example of two-factor authentication (2FA)?

Jackson is a cybercriminal He is attempting to keep group of company high-level users from accessing their work network

Common methods used to identify a user to a system include username, smart card, and biometrics.

Internet of Things (IoT) devices are typically physically secure.

What element of IT security policy framework give detail written definitions for hard&software & how they are to be used

Anti-malware programs and firewalls cannot detect most phishing scams because the scams do not contain suspect code.

Hajar is developing a business impact assessment for her organization. Which of the following is Hajar determining?

True or False? Bring Your Own Device (BYOD) opens the door to considerable security issues.

Voice pattern biometrics are accurate for authentication because voices cannot easily be replicated by computer software

 packet-filtering firewall remembers information about the status of a network communication.

Susan is troubleshooting a problem with computer network cabling At which layer of OSI Reference Model is she working