stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
Cyber Security Module 4 Review Flashcards | StudBud
Explore
/
Cyber Security Module 4 Review
Cyber Security Module 4 Review
48 terms
·
StudBud Administration
·
444 plays
Imported from external platform
Flashcards
48 cards
F
Practice quiz
P
Host live
L
Questions
48
Answers
1
What is the primary purpose of forcing employees to take mandatory vacations every year?
To test their knowledge of security
To check for evidence of fraud
o prevent the buildup of significant vacation time
To cut costs on travel
2
What is the primary goal of business continuity planning?
Minimizing the risk from interruptions in providing service
Maintaining operations with reduced capabilities/resources.
Minimize decision making during the development process
Protecting an organiz. from major computer services failure.
3
Question 45
Proxy server
User awareness training
Close unused firewall ports
Account lockout
4
In which phase of the system life cycle is software testing performed?
System Design Specifications
Software Development
Functional Design Analysis and Planning
Installation
5
Which of the following defines system high mode?
Multiple levels of classified data reside on the one system.
Each user must eat 5 sandwiches to gain access to the matrix
Protecting a system based on highest priority first.
All users must have formal, need-to-know clearance
6
What is the most common failure of a security policy in an environment?
Lack of user awareness
Improperly outlined procedures
Failure to assign responsibilities
Overlooked critical assets
7
What type of document tracks evidence from discovery to presentation in court?
FIPS-140
CPS (certificate practice statement)
Chain of custody
Rules of evidence
8
Question 38
Structured programming
Object-oriented programming
Clean room
Waterfall planning
9
Question 46
Non-compete agreement
Acceptable use agreement
Employee monitoring agreement
Non-disclosure agreement
10
By definition, which security concept ensures that only authorized parties can access data?
Confidentiality
Integrity
Non-repudiation
Authentication
11
In which phase of the system life cycle is security integrated into the product?
Installation
Project Initiation
Software Development
Maintenance
12
Which of the following actions is most likely to destroy critical evidence?
Disconnecting the system from the network
Restricting physical access to the system
Copying the contents of memory to removable media
Rebooting the system
13
ALE Question
25
100
75
175
14
You find a rogue wireless access point on your network. Which action should you take first?
Connect to the access point and examine its logs for info.
See who is connected to the access point
Disconnect the access point from the network
Run a packet sniffer to monitor traffic
15
Which of the following best describes the concept ofdue care or due diligence due diligence?
Legal disclaimers are conspicuously displayed on systems.
Availability supersedes security
Security by port stealthing.
Reasonable precautions are utilized and documented.
16
Which below is a policy that defines inappropriate activities and usage for resources?
Business Impact Analysis (BIA)
Disaster Recovery Plan (DRP)
Acceptable use policy
Business Continuity Plan (BCP)
17
Question 36
Protection Profile (PP)
Security Target (ST)
Target of Evaluation (TOE)
Subject
18
Social Engineering Question #4
MAC spoofing
Masquerading
Whaling
Passive
19
Which is an action which must take place during the release stage of the SDLC?
Venders develop and release patches
It goes into major production and is developed by coders.
Certification, accreditation, and auditing are performed.
20
Which of the following is an example of a strong password?
desktop#7
at9iov45a
a8bT11$yi
Robert694
21
Which of the following is a high-level statement about the role of security in the organiz.?
Standard
Baseline
Policy
Guideline
22
What is the primary purpose of imposing software life cycle management concepts?
Reduce product returns
Decrease development overhead
Increase the quality of software
Increase interoperability
23
HIPAA is a set of federal regulations that define security guidelines that protect what?
Non-repudiation
Privacy
Integrity
Availability
24
ALE Question #2
Purchase the insurance policy.
Implement countermeasure B.
Implement countermeasure A.
Accept the risk or find another countermeasure.
25
Social Eng. Question #3
Create a strong password policy
Secure all terminals with screensaver passwords
Establish and enforce a document destruction policy
Mandate the use of Integrated Windows Authentication
26
What is the weakest point in an organization's security infrastructure?
People
Procedures
Technology
Physical structure
27
What is the average number of times that a specific risk is likely to be realized?
Annualized Rate of Occurrence
Annualized Loss Expectancy
Exposure factor
Estimated Maximum Downtime
28
Which of the following is NOT a protection against collusion? a protection against collusion?
Two-man control
Cross training
Principle of least privilege
Separation of duties
29
Which of the following is an example of an internal threat?
A backdoor allows an attacker on the Internet to gain access
A water pipe in the server room breaks
A delivery man is able to walk in and steal a laptop
A user accidentally deletes the new product designs
30
Social Engineering Question
Session hijacking
Phishing
Adware
Man-in-the-middle
31
When informing an employee that they are being terminated, what is the most important activity?
Giving them two week's notice
Allowing them to collect their personal items
Allowing them to complete their current work projects
Disabling their network access
32
Which of the following is not a form of social engineering? a form of social engineering?
Impersonating a utility repair technician
Impersonating a manager over the phone
A virus hoax e-mail message
Impersonating a user by logging on with stolen credentials
33
What is the primary countermeasure to social engineering?
Awareness
Traffic filters
A written security policy
Heavy management oversight
34
How often should change control management be implemented?
Any time a production system is altered.
Only when a production system is altered greatly.
At regular intervals throughout the year.
Only when changes are made which affect senior management.
35
Question 34
Confinement
Abstraction
Layering
Bounds
36
Which of the following activities assigns a security level to different types of data?
Degaussing
PII
Information classification
Acceptable use
37
Which of the following are examples of social engineering? (Select one correct)
War dialing
Port scanning
Dumpster diving
Shoulder surfing
38
Which of the following best defines Single Loss Expectancy (SLE)?
The total cost of all countermeasures for a vulnerability
The statistical probability of a malicious event
The total monetary loss associated with a single threat
The monetary value of an employee's loss of productivity.
39
During a forensic investigation, and the attack has been stopped, which action should go first?
Remove the hard drive
Stop all running processes
Document what's on the screen
Turn off the system
40
A code of ethics provides for all but which of the following?
Establishes a baseline for managing complex situations
Improves the professionalism of your organization
Serves as a ref. for the creation of acceptable use policies
Clearly defines course of action when a complex issue is met
41
Question 35
External auditing
Accreditation
Penetration testing
Perturbation
42
Which of the following is a contract which defines the technical support that IT will provide.
Final audit report
Mutual aid agreement
Service level agreement
Certificate practice statement
43
Which method can be used to verify that a copy of a hard drive is an exact clone of another?
Hashing
Serial number notation
File directory listing
Photographs
44
Which of the following social engineering attacks use Voice over IP to gain information?
Tailgating
Masquerading
Spear phishing
Vishing
45
Which of the following is the correct definition of a threat?
Instance of being exposed to losses from an attacker
Absence or weakness of a safeguard that could be exploited
Any danger to the confidentiality, integrity, or avail.
The likelihood of an attack taking adv. of a vulnerability
46
Social Engineering Question #2
Delete the e-mail.
Open a Web browser and type the URL included in the e-mail
Verify that the e-mail was sent by the administrator
Click on the link in the e-mail
47
Which of the following is an example of avulnerability?
Denial of service attack
Virus infection
Misconfigured server
Unauthorized access to confidential resources
48
A term used to describe confidence that the eval. methods were thorough and complete?
Assurance
Effectiveness
Evaluation
Functionality
