The regulating agency for the Sarbanes-Oxley Act is the ________.

Securities and Exchange Commission

What name is given to a protocol to implement a VPN connection between two computers?

Point-to-Point Tunneling Protocol (PPTP)

Which of the following is the definition of botnet?

a network of compromised computers that attackers use to launch attacks

Which of the following is the definition of anomaly-based IDS?

An IDS that compares current activity with stored profiles

What is meant by rootkit?

Malware that modifies or replaces existing programs to hide the fact that

Protecting Internet of Things devices from becoming the entry point for security vulnerabilities is acahieved by...?

Applying security updates promptly

What is meant by key distribution?

Issuing keys to valid users of a cryptosystem so they can communicate

CompTIA's Security+ certification provides ________.

entry-level information security certification of choice

What name is given to patient health information that is computer based?

electronic protected health information (EPHI)

What is meant by certification?

Technical evaluation providing assurance that you implemented the system

Software vendors must protect themselves from the liabilities of their own vulnerabilities with a(n) ____________.

End-User License Agreement (EULA)

This security appliance examines IP data streams for common attack and malicious intent patterns.

intrusion detection system (IDS)

The regulating agency for the Children's Internet Protection Act is the ________.

Federal Communications Commission (FCC)

What is meant by promiscuous mode?

The mode in which sniffers operate that is nonintrusive

studbud

IT 3530 Final Exam

74 termsStudBud Administration64 plays

Imported from external platform

Flashcards74 cardsFPractice quizPHost liveL

Questions 74

Answers

1
A company can discontinue or decide not to enter a line of business if the risk level is too high. This is known as
risk mitigation
risk assignment
risk acceptance
risk avoidance
2
The regulating agency for the Sarbanes-Oxley Act is the ________.
FTC
Securities and Exchange Commission
Office of Management and Budget
Department of Homeland Security
3
What name is given to a protocol to implement a VPN connection between two computers?
screened subnet
Internet Control Message Protocol (ICMP)
Point-to-Point Tunneling Protocol (PPTP)
Dynamic Host Configuration Protocol (DHCP)
4
One of the best ways to avoid wasting your organization's resources is to ensure that you follow the
monitoring review cycle
security review cycle
benchmark review cycle
audit review cycle
5
Today, people working in cyberspace must deal with new and constantly evolving ________.
threats
applications
policy
risks
6
Audits also often look at the current configuration of a system as a snapshot in time to verify that it complies with
plan
management
controls
standards
7
Which OSI Reference Model layer is responsible for transmitting information on computers connected to the same LAN?
Session Layer
Transport Layer
Presentation layer
Data Link Layer
8
Which of the following is the definition of botnet?
a type of virus that primarily infects executable programs.
a group of honeypots made to simulate a real live network, but isolated
a network of compromised computers that attackers use to launch attacks
9
A ___________ gives priorities to the functions an organization needs to keep going.
business impact analysis (BIA)
recovery time objective (RTO)
disaster recovery plan (DRP)
business continuity plan (BCP)
10
______ uses various controls to reduce identified risks. These controls might be administrative, technical, or physical.
Risk mitigation
Risk assignment
Risk avoidance
Risk acceptance
11
________ attack countermeasures such as antivirus signature files or integrity databases
Polymorphic viruses
Stealth viruses
Slow viruses
Retro viruses
12
Which of the following is the definition of anomaly-based IDS?
Using tools to determine the services running on an systems
An IDS that compares current activity with stored profiles
The state of a device in with turned off or disabled unnecessary services
An IDS that uses pattern matching and stateful matching to compare curre
13
_____________ are the main source of distributed denial of service (DDoS) attacks and spam.
Botnets
Logic bombs
Trojans
Stealth viruses
14
What is meant by rootkit?
Unwanted e-mail or instant messages.
The attacker gets between two parties, intercepts messages before transfer
Malware that modifies or replaces existing programs to hide the fact that
A user or computer pretends to be another user or computer
15
Which OSI Reference Model layer translates the binary ones and zeros into the language of the transport medium?
Transport Layer
Physical Layer
Data Link Layer
Session Layer
16
What name is given to an encryption cipher that rearranges characters or bits of data?
Vigenère cipher
one-time pad cipher
substitution cipher
transposition cipher
17
How often should an organization perform a risk management plan?
annually
when a risk is identified
biannually
every couple of years
18
Protecting Internet of Things devices from becoming the entry point for security vulnerabilities is acahieved by...?
Turning IoT devices off when not in use
Using encryption for communications
Applying security updates promptly
Removing IoT devices from the network
19
When you accept a __________, you take no further steps to resolve.
residual risk
positive risk
negative risk
risk probability
20
The regulating agency for the Gramm-Leach-Bliley Act is the ________.
Securities and Exchange Commission
U.S. Department of Education
FTC (Federal Trade Commission)
Office of Management and Budget
21
What is meant by key distribution?
A trusted entity that stores and distributes verified digital certificates
Issuing keys to valid users of a cryptosystem so they can communicate
Encryption cipher that uses the same key to encrypt and decrypt information
A trusted repository of all public keys.
22
A computing device does not play which role in a crime?
Instrument
Perpetrator
Target
Repository
23
CompTIA's Security+ certification provides ________.
four main credentials addressing a different security professional role
several credentials that focus on both general and Web-related security
more than 20 individual credentials that span several disciplines
entry-level information security certification of choice
24
In the legal system, ________ is the act of following laws, rules, and regulations that apply to organizations.
disclosure
compliance
responsibility
control
25
Which type of computer crime often involves nation-state attacks by well-funded cybercriminals?
Identity theft
Cyberstalking
Online fraud
Cyberterrorism
26
Malicious code attacks all three information security properties and can modify database records. This property is
integrity
confidentiality
security
availability
27
Which OSI Reference Model layer includes all programs on a computer that interact with the network?
Network layer
Session layer
Presentation layer
Application layer
28
What should organizations expect will occur as they become more dependent upon the Internet of Things (IoT)?
Security risks will stay the same
Security risks will be eliminated
Security risks will decrease.
Security risks will increase
29
________ attempts to describe risk in financial terms and put a dollar value on all the elements of a risk.
Qualitative risk analysis
Risk management
Quantitative risk analysis
Financial risk analysis
30
A mechanism that limits access to computer systems and network resources is a
logical access control
password mechanism
threshold mechanism
actions
31
What name is given to patient health information that is computer based?
personally identifiable information (PII)
privately held information
directory information
electronic protected health information (EPHI)
32
________ states that users must never leave sensitive information in plain view on an unattended desk or workstation
Security administration policy
Emergency operations policy
Clean desk/clear screen policy
Procedure management
33
If our company experiences the loss of intellectual property once per quarter, its ARO for this incident is
4.0
2.0
12.0
6.0
34
Which of the following is a digital forensics specialist least likely to need in-depth knowledge of?
Operating systems, such as Windows, Linux, and macOS
Storage devices
Mainframes
Computer memory, such as cache and random access memory (RAM)
35
What is meant by certification?
A strategy to minimize risk by rotating employees between various systems
Acceptance of the risk of implementing the system.
A group that is responsible for protecting sensitive data
Technical evaluation providing assurance that you implemented the system
36
Cryptography accomplishes four security goals: confidentiality, integrity, authentication, and ________________.
privacy
nonrepudiation
security
reliability
37
The primary task of an organization's __________ team is to control access to systems or resources.
compliance liaison
software development
security administration
management
38
The FAT32 and NTFS file systems are associated with which of the following?
macOS
Android
Linux
Windows
39
________ is the process of managing changes to computer/device configuration or application software.
Change control
Sprint
Procedure control
Proactive change management
40
Software vendors must protect themselves from the liabilities of their own vulnerabilities with a(n) ____________.
acceptable use policy (AUP)
End-User License Agreement (EULA)
disaster recovery plan (DRP)
IT security policy framework
41
It's essential to match your organization's required __________ with its security structure.
operating system
permission level
monitoring
recommendations
42
Which type of evidence is collected from individuals that supports and helps to interpret other types of evidence?
Demonstrative
Documentary
Testimonial
Real
43
What is the proportion of value of a particular asset likely to be destroyed by a given risk, expressed as a percentage?
Annual rate of occurrence (ARO)
Exposure factor (EF)
Risk management
Business drivers
44
What is the determination that evidence is either acceptable or unacceptable to a court of law?
Legal hold
Admissibility
Order of volatility
Preservation
45
This security appliance examines IP data streams for common attack and malicious intent patterns.
IT security policy framework
IP default gateway router
intrusion detection system (IDS)
LAN-to-WAN Domain
46
A ________ is a type of virus that primarily infects executable programs.
program infector
file infector
data infector
system infector
47
The regulating agency for the Children's Internet Protection Act is the ________.
U.S. Department of Justice
Federal Communications Commission (FCC)
U.S. Department of Education
Department of Health and Human Services
48
What is meant by promiscuous mode?
The mode in which sniffers operate that is nonintrusive
A software program that used to monitor and capture network traffic
An event that results in a violation of any of the C-I-A security tenets.
Attack method that takes all the words from a dictionary file
49
What name is given to random characters that you can combine with an actual input key to create the encryption key?
checksum
private key
salt value
hash
50
The stated purpose of the ___________ is to develop protocols and guidelines that unify the World Wide Web
IETF
W3C
ANSI
IAB
51
The primary difference between SOC 2 and SOC 3 reports is ________.
their audience
their length
their focus
the number of auditors involved
52
Which principle of effective digital forensic investigations helps to ensure data in memory is not lost?
Consider data volatility
Minimize original data handling
Enforce the rules of evidence
Do not exceed your knowledge
53
Which one of the following is NOT an example of store-and-forward messaging?
Unified messaging
Voicemail
Email
Telephone call
54
The recovery point objective (RPO) identifies the amount of _________ that is acceptable.
risk
data loss
time to recover
support
55
Loss of financial assets due to ________ is a worst-case scenario for all organizations.
hijacking
malicious attacks
phishing
masquerade attacks
56
________ is information that is publicly available about all students at a school
Minimum necessary rule
Personally identifiable information (PII)
Nonpublic personal information (NPI)
Directory information
57
A(n) ________ is a measurable occurrence that has an impact on the business
corrective control
cost
critical business function
event
58
Which is the highest level of Check Point certification for network security?
CCSPA
CCSA
CCSE
CCMA
59
What name is given to an object that uses asymmetric encryption to bind a message or data to a specific entity?
public key cryptography
hash
algorithm
digital signature
60
Which one of the following is NOT a market driver for the Internet of Things (IoT)?
Smaller and faster computing
Global adoption of non-IP networking
Growth of cloud computing
Advancements in data analytics
61
Which of the following describes an asynchronous token?
An authentication method using a single type of authentication credentials.
Associating actions with users for later reporting and research.
An authentication token processing challenge-response authentication
An authentication method that uses two types of authentication credentials
62
________ is a document produced by the IETF that contains standards as well as other specifications.
The Special Publications 800 series
A Request for Comments (RFC)
ISO/IEC 27002
ISO 17799
63
Which is Cisco's highest level of certification?
Architect
Expert
Professional
Master
64
When an attacker discovers a __________, he or she can use it to bypass existing security controls
cookie
wiretapping device
host device
backdoor
65
Which of the following is the definition of Vigenère cipher?
Encryption cipher that is a product cipher with a 56-bit key
Encryption cipher that shifts each letter in the English alphabet
Encryption cipher that replaces bits, characters, or blocks of information
An encryption cipher that uses multiple encryption schemes in succession
66
What is meant by risk register?
A list of identified risks resulting from the risk-identification process.
Comparison of controls needed to identify threats vs controls in place
The estimated loss due to a specific realized threat.
The process of identifying, assessing, prioritizing, and addressing risks
67
________ is an international security standard that documents a comprehensive set of controls
ISO 27000
The Internet Engineering Task Force (IETF)
ISO/IEC 27002
The International Electrotechnical Commission (IEC)
68
The regulating agency for the Federal Information Systems Management Act is the ________.
FTC
US Department of Homeland Security (DHS)
US Department of Defense (DoD)
Office of Management and Budget (OMB)
69
____________ is a person's right to control the use and disclosure of his or her own personal information.
Privacy
Disclosure
Integrity
Security
70
What is meant by multipartite virus?
Virus that infects a data file and injects malicious macro commands
A type of virus that primarily infects executable programs
virus that infects other files and spreads in multiple ways
virus that uses a number of techniques to conceal itself
71
Which type of evidence is any physical object that you can touch or otherwise directly observe, such as a hard drive?
Documentary
Demonstrative
Testimonial
Real
72
What is meant by constrained user interface?
An authentication credential longer and more complex than a password
Software that allows users to enter only specific information
Indicates a change from normal to abnormal behavior
Protected objects in a computing system
73
Which OSI Reference Model layer creates, maintains, and disconnects communications between processes over the network?
Data Link Layer
Session Layer
Transport Layer
Presentation Layer
74
Which of the following is the definition of access control?
A device used as a logon authenticator for remote users of a network.
Protecting a resource so that it is used only by those allowed
A property indicating a specific subject needs access to a specific object
Some value that indicates a change from normal to abnormal behavior.

IT 3530 Final Exam Flashcards | StudBud