Principles of Cybersecurity Midterm Review

The key difference between laws and ethics is that ethics carry the authority of a governing body and laws do not.

Good security programs begin and end with policy.

Which of the following is NOT a described IDPS control strategy?

__________ security is about what protecting the tangible items or areas of an organization from unauthorized access.

A type of SDLC in which each phase has results that flow into the next phase is called the __________ model.

Risk _________ is the application of security mechanisms to reduce the risks to an organization’s data and info systems.

A router's ability to restrict traffic to a specific service is an advanced feature and not considered standard.

__________ is the process of classifying IDPS alerts so that they can be more effectively managed.

To achieve defense in depth, an organization must establish multiple layers of security controls and safeguards.

As frustrating as viruses and worms are, perhaps more time and money is spent on resolving virus ____________________.

____ is any technology that aids in gathering information about a person or organization without their knowledge.

The first phase of risk management is _________.

Risk mitigation is the process of assigning a risk rating or score to each information asset.

An attack or breach of policy always constitutes a violation of law, requiring notification of law enforcement.

Accountability is the matching of an authenticated entity to information assets and corresponding access levels.

Redundancy can be implemented at a number of points throughout the security architecture, such as in ________.

In a ____________________ attack, a large no. of requests are sent to disrupt a target from a small no. of sources.

Best business practices are often called recommended practices.

A(n) __________ works like a burglar alarm...it detects a violation activates an alarm.

A(n) __________ IDPS is focused on protecting network information assets.

In info security, benchmarking is the comparison of past security activities against the org’s current performance.

The ____ is the individual responsible for the management, & implementation of info security in the organization.

The value of information to the organization's competition should influence the asset's valuation.

Packet-filtering firewalls scan data packets for compliance with the rules of the its database or violations of rules.

Security __________ are the areas of trust within which users can freely communicate.

Authentication is the process of validating and verifying an unauthenticated entity’s purported identity.

A cold site provides many of the same services and options of a hot site, but at a lower cost.

It is important that e-mail traffic reach your e-mail server and only your e-mail server.

During the __________ phase, specific technologies are selected to for alternatives identified in the prior phases.

The process of maintaining the C-I-A of data managed by a DBMS is known as __________ security.

The redirection of legitimate user Web traffic to illegitimate websites to collect personal infor is known as _______

__________ of information is the quality or state of being genuine or original.

__________ is the action of luring an individual into committing a crime to get a conviction.

Criminal or unethical __________ goes to the state of mind of the individual performing the act.

Which of the following acts defines and formalizes laws to counter threats from computer-related acts and offenses?

__________ are decoy systems designed to lure potential attackers away from critical systems.

Management of classified data includes its storage and _________.

Good firewall rules include denying all data that is not verifiably authentic.

A _________ assigns a status level to employees to designate the maximum level of classified data they may access.

Confidentiality is the right of individuals to protect themselves and their info from unauthorized access.

A subject or object’s ability to use, manipulate, modify, or affect another subject or object is known as ___________.

Unethical behavior is generally caused by ignorance, by accident, and by inadequate protection mechanisms

A formal development strategy for the design and implementation of an info system is referred to as a __________.

Web hosting services are usually arranged with an agreement defining minimum service levels known as a(n) ____.

A content filter is a set of scripts that restricts user access to certain networking protocols and Internet locations.

What is the subject of the Sarbanes-Oxley Act?

Acts of ____________________ can lead to unauthorized actions that enable info gatherers to enter premises or systems.

A device (or a software program) that can monitor data traveling on a network is known as a socket sniffer.

The difference between a policy and a law is that ignorance of a law is an acceptable defense.

Knowing yourself means identifying, examining, and understanding the threats facing the organization.

An extranet is a segment of the DMZ where no authentication and authorization controls are put into place.

Each policy should contain procedures and a timetable for periodic review.

The __________ defines stiffer penalties for prosecution of terrorist crimes.

Cyberterrorists hack systems to conduct terrorist activities via network or Internet pathways.