stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
IT 3530 Final Exam Flashcards | StudBud
Explore
/
IT 3530 Final Exam
IT 3530 Final Exam
74 terms
·
StudBud Administration
·
64 plays
Imported from external platform
Flashcards
74 cards
F
Practice quiz
P
Host live
L
Questions
74
Answers
1
A(n) ________ is a measurable occurrence that has an impact on the business
critical business function
event
cost
corrective control
2
Which OSI Reference Model layer includes all programs on a computer that interact with the network?
Session layer
Application layer
Network layer
Presentation layer
3
What is meant by
constrained user interface
?
Protected objects in a computing system
An authentication credential longer and more complex than a password
Indicates a change from normal to abnormal behavior
Software that allows users to enter only specific information
4
Software vendors must protect themselves from the liabilities of their own vulnerabilities with a(n) ____________.
IT security policy framework
disaster recovery plan (DRP)
acceptable use policy (AUP)
End-User License Agreement (EULA)
5
Which OSI Reference Model layer is responsible for transmitting information on computers connected to the same LAN?
Session Layer
Data Link Layer
Transport Layer
Presentation layer
6
The regulating agency for the Federal Information Systems Management Act is the ________.
FTC
US Department of Defense (DoD)
Office of Management and Budget (OMB)
US Department of Homeland Security (DHS)
7
Which one of the following is
NOT
a market driver for the Internet of Things (IoT)?
Smaller and faster computing
Growth of cloud computing
Advancements in data analytics
Global adoption of non-IP networking
8
CompTIA's Security+ certification provides ________.
entry-level information security certification of choice
more than 20 individual credentials that span several disciplines
four main credentials addressing a different security professional role
several credentials that focus on both general and Web-related security
9
The regulating agency for the Gramm-Leach-Bliley Act is the ________.
Office of Management and Budget
FTC (Federal Trade Commission)
Securities and Exchange Commission
U.S. Department of Education
10
What is meant by
rootkit
?
A user or computer pretends to be another user or computer
Unwanted e-mail or instant messages.
The attacker gets between two parties, intercepts messages before transfer
Malware that modifies or replaces existing programs to hide the fact that
11
Cryptography accomplishes four security goals: confidentiality, integrity, authentication, and ________________.
security
privacy
nonrepudiation
reliability
12
Malicious code attacks all three information security properties and can modify database records. This property is
confidentiality
integrity
security
availability
13
What is meant by
certification
?
Acceptance of the risk of implementing the system.
Technical evaluation providing assurance that you implemented the system
A strategy to minimize risk by rotating employees between various systems
A group that is responsible for protecting sensitive data
14
What name is given to patient health information that is computer based?
privately held information
directory information
electronic protected health information (EPHI)
personally identifiable information (PII)
15
____________ is a person's right to control the use and disclosure of his or her own personal information.
Disclosure
Integrity
Security
Privacy
16
What is the determination that evidence is either acceptable or unacceptable to a court of law?
Admissibility
Legal hold
Preservation
Order of volatility
17
________ is the process of managing changes to computer/device configuration or application software.
Procedure control
Proactive change management
Sprint
Change control
18
A computing device does
not
play which role in a crime?
Instrument
Repository
Perpetrator
Target
19
________ is a document produced by the IETF that contains standards as well as other specifications.
ISO/IEC 27002
ISO 17799
A Request for Comments (RFC)
The Special Publications 800 series
20
________ attack countermeasures such as antivirus signature files or integrity databases
Retro viruses
Slow viruses
Polymorphic viruses
Stealth viruses
21
_____________ are the main source of distributed denial of service (DDoS) attacks and spam.
Botnets
Stealth viruses
Logic bombs
Trojans
22
Which OSI Reference Model layer creates, maintains, and disconnects communications between processes over the network?
Presentation Layer
Session Layer
Transport Layer
Data Link Layer
23
The stated purpose of the ___________ is to develop protocols and guidelines that unify the World Wide Web
W3C
IAB
IETF
ANSI
24
________ is information that is publicly available about all students at a school
Minimum necessary rule
Directory information
Nonpublic personal information (NPI)
Personally identifiable information (PII)
25
Which type of computer crime often involves nation-state attacks by well-funded cybercriminals?
Online fraud
Cyberstalking
Cyberterrorism
Identity theft
26
What name is given to an encryption cipher that rearranges characters or bits of data?
transposition cipher
substitution cipher
one-time pad cipher
Vigenère cipher
27
______ uses various controls to reduce identified risks. These controls might be administrative, technical, or physical.
Risk acceptance
Risk avoidance
Risk mitigation
Risk assignment
28
What is meant by
promiscuous mode
?
An event that results in a violation of any of the C-I-A security tenets.
The mode in which sniffers operate that is nonintrusive
Attack method that takes all the words from a dictionary file
A software program that used to monitor and capture network traffic
29
Which of the following is the definition of
Vigenère cipher
?
Encryption cipher that shifts each letter in the English alphabet
Encryption cipher that is a product cipher with a 56-bit key
An encryption cipher that uses multiple encryption schemes in succession
Encryption cipher that replaces bits, characters, or blocks of information
30
A company can discontinue or decide not to enter a line of business if the risk level is too high. This is known as
risk acceptance
risk avoidance
risk assignment
risk mitigation
31
Which type of evidence is any physical object that you can touch or otherwise directly observe, such as a hard drive?
Documentary
Testimonial
Demonstrative
Real
32
Which type of evidence is collected from individuals that supports and helps to interpret other types of evidence?
Documentary
Real
Demonstrative
Testimonial
33
________ is an international security standard that documents a comprehensive set of controls
ISO 27000
ISO/IEC 27002
The International Electrotechnical Commission (IEC)
The Internet Engineering Task Force (IETF)
34
Which of the following is the definition of
botnet
?
a network of compromised computers that attackers use to launch attacks
a group of honeypots made to simulate a real live network, but isolated
a type of virus that primarily infects executable programs.
35
What name is given to an object that uses asymmetric encryption to bind a message or data to a specific entity?
digital signature
algorithm
hash
public key cryptography
36
Which of the following describes an
asynchronous token
?
An authentication method that uses two types of authentication credentials
Associating actions with users for later reporting and research.
An authentication method using a single type of authentication credentials.
An authentication token processing challenge-response authentication
37
When an attacker discovers a __________, he or she can use it to bypass existing security controls
backdoor
host device
wiretapping device
cookie
38
A ________ is a type of virus that primarily infects executable programs.
file infector
data infector
program infector
system infector
39
Which principle of effective digital forensic investigations helps to ensure data in memory is not lost?
Do not exceed your knowledge
Enforce the rules of evidence
Minimize original data handling
Consider data volatility
40
One of the best ways to avoid wasting your organization's resources is to ensure that you follow the
audit review cycle
benchmark review cycle
monitoring review cycle
security review cycle
41
Today, people working in cyberspace must deal with new and constantly evolving ________.
policy
applications
threats
risks
42
Which one of the following is
NOT
an example of store-and-forward messaging?
Email
Unified messaging
Telephone call
Voicemail
43
Which of the following is the definition of anomaly-based IDS?
The state of a device in with turned off or disabled unnecessary services
Using tools to determine the services running on an systems
An IDS that compares current activity with stored profiles
An IDS that uses pattern matching and stateful matching to compare curre
44
The recovery point objective (RPO) identifies the amount of _________ that is acceptable.
support
time to recover
data loss
risk
45
It's essential to match your organization's required __________ with its security structure.
permission level
operating system
recommendations
monitoring
46
Which is the highest level of Check Point certification for network security?
CCSE
CCMA
CCSA
CCSPA
47
What is meant by
risk register
?
Comparison of controls needed to identify threats vs controls in place
A list of identified risks resulting from the risk-identification process.
The estimated loss due to a specific realized threat.
The process of identifying, assessing, prioritizing, and addressing risks
48
If our company experiences the loss of intellectual property once per quarter, its ARO for this incident is
12.0
2.0
4.0
6.0
49
This security appliance examines IP data streams for common attack and malicious intent patterns.
LAN-to-WAN Domain
IP default gateway router
intrusion detection system (IDS)
IT security policy framework
50
In the legal system, ________ is the act of following laws, rules, and regulations that apply to organizations.
compliance
control
responsibility
disclosure
51
What name is given to random characters that you can combine with an actual input key to create the encryption key?
salt value
checksum
private key
hash
52
The regulating agency for the Sarbanes-Oxley Act is the ________.
FTC
Office of Management and Budget
Department of Homeland Security
Securities and Exchange Commission
53
Which is Cisco's highest level of certification?
Master
Architect
Expert
Professional
54
The primary task of an organization's __________ team is to control access to systems or resources.
security administration
management
software development
compliance liaison
55
________ states that users must never leave sensitive information in plain view on an unattended desk or workstation
Procedure management
Emergency operations policy
Security administration policy
Clean desk/clear screen policy
56
When you accept a __________, you take no further steps to resolve.
negative risk
risk probability
positive risk
residual risk
57
________ attempts to describe risk in financial terms and put a dollar value on all the elements of a risk.
Financial risk analysis
Risk management
Quantitative risk analysis
Qualitative risk analysis
58
What is meant by
multipartite virus
?
virus that uses a number of techniques to conceal itself
virus that infects other files and spreads in multiple ways
A type of virus that primarily infects executable programs
Virus that infects a data file and injects malicious macro commands
59
A ___________ gives priorities to the functions an organization needs to keep going.
business impact analysis (BIA)
recovery time objective (RTO)
business continuity plan (BCP)
disaster recovery plan (DRP)
60
Protecting Internet of Things devices from becoming the entry point for security vulnerabilities is acahieved by...?
Removing IoT devices from the network
Applying security updates promptly
Turning IoT devices off when not in use
Using encryption for communications
61
The FAT32 and NTFS file systems are associated with which of the following?
Android
Linux
Windows
macOS
62
What should organizations expect will occur as they become more dependent upon the Internet of Things (IoT)?
Security risks will be eliminated
Security risks will stay the same
Security risks will decrease.
Security risks will increase
63
How often should an organization perform a risk management plan?
every couple of years
annually
biannually
when a risk is identified
64
Loss of financial assets due to ________ is a worst-case scenario for all organizations.
phishing
masquerade attacks
hijacking
malicious attacks
65
Which of the following is the definition of
access control
?
Some value that indicates a change from normal to abnormal behavior.
A property indicating a specific subject needs access to a specific object
A device used as a logon authenticator for remote users of a network.
Protecting a resource so that it is used only by those allowed
66
Which of the following is a digital forensics specialist least likely to need in-depth knowledge of?
Operating systems, such as Windows, Linux, and macOS
Mainframes
Computer memory, such as cache and random access memory (RAM)
Storage devices
67
Which OSI Reference Model layer translates the binary ones and zeros into the language of the transport medium?
Physical Layer
Transport Layer
Session Layer
Data Link Layer
68
What is the proportion of value of a particular asset likely to be destroyed by a given risk, expressed as a percentage?
Annual rate of occurrence (ARO)
Business drivers
Exposure factor (EF)
Risk management
69
What is meant by
key distribution
?
A trusted entity that stores and distributes verified digital certificates
Issuing keys to valid users of a cryptosystem so they can communicate
Encryption cipher that uses the same key to encrypt and decrypt information
A trusted repository of all public keys.
70
A mechanism that limits access to computer systems and network resources is a
actions
password mechanism
threshold mechanism
logical access control
71
What name is given to a protocol to implement a VPN connection between two computers?
Point-to-Point Tunneling Protocol (PPTP)
Dynamic Host Configuration Protocol (DHCP)
Internet Control Message Protocol (ICMP)
screened subnet
72
The primary difference between SOC 2 and SOC 3 reports is ________.
their focus
the number of auditors involved
their audience
their length
73
The regulating agency for the Children's Internet Protection Act is the ________.
Department of Health and Human Services
U.S. Department of Justice
U.S. Department of Education
Federal Communications Commission (FCC)
74
Audits also often look at the current configuration of a system as a snapshot in time to verify that it complies with
controls
plan
management
standards
