stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
IT 3530 Final Exam Flashcards | StudBud
Explore
/
IT 3530 Final Exam
IT 3530 Final Exam
74 terms
·
StudBud Administration
·
64 plays
Imported from external platform
Flashcards
74 cards
F
Practice quiz
P
Host live
L
Questions
74
Answers
1
What name is given to random characters that you can combine with an actual input key to create the encryption key?
checksum
salt value
private key
hash
2
What name is given to an encryption cipher that rearranges characters or bits of data?
transposition cipher
substitution cipher
one-time pad cipher
Vigenère cipher
3
________ states that users must never leave sensitive information in plain view on an unattended desk or workstation
Procedure management
Clean desk/clear screen policy
Emergency operations policy
Security administration policy
4
What name is given to an object that uses asymmetric encryption to bind a message or data to a specific entity?
public key cryptography
algorithm
hash
digital signature
5
The regulating agency for the Federal Information Systems Management Act is the ________.
US Department of Homeland Security (DHS)
Office of Management and Budget (OMB)
US Department of Defense (DoD)
FTC
6
Which OSI Reference Model layer includes all programs on a computer that interact with the network?
Session layer
Presentation layer
Network layer
Application layer
7
What name is given to a protocol to implement a VPN connection between two computers?
Dynamic Host Configuration Protocol (DHCP)
screened subnet
Point-to-Point Tunneling Protocol (PPTP)
Internet Control Message Protocol (ICMP)
8
____________ is a person's right to control the use and disclosure of his or her own personal information.
Integrity
Disclosure
Security
Privacy
9
________ attack countermeasures such as antivirus signature files or integrity databases
Retro viruses
Stealth viruses
Slow viruses
Polymorphic viruses
10
The regulating agency for the Children's Internet Protection Act is the ________.
U.S. Department of Justice
Department of Health and Human Services
Federal Communications Commission (FCC)
U.S. Department of Education
11
What is meant by
rootkit
?
The attacker gets between two parties, intercepts messages before transfer
Malware that modifies or replaces existing programs to hide the fact that
Unwanted e-mail or instant messages.
A user or computer pretends to be another user or computer
12
A mechanism that limits access to computer systems and network resources is a
logical access control
actions
threshold mechanism
password mechanism
13
One of the best ways to avoid wasting your organization's resources is to ensure that you follow the
benchmark review cycle
security review cycle
monitoring review cycle
audit review cycle
14
What is meant by
multipartite virus
?
virus that uses a number of techniques to conceal itself
virus that infects other files and spreads in multiple ways
Virus that infects a data file and injects malicious macro commands
A type of virus that primarily infects executable programs
15
The regulating agency for the Gramm-Leach-Bliley Act is the ________.
FTC (Federal Trade Commission)
Securities and Exchange Commission
U.S. Department of Education
Office of Management and Budget
16
When you accept a __________, you take no further steps to resolve.
positive risk
risk probability
negative risk
residual risk
17
What is meant by
key distribution
?
A trusted entity that stores and distributes verified digital certificates
Issuing keys to valid users of a cryptosystem so they can communicate
A trusted repository of all public keys.
Encryption cipher that uses the same key to encrypt and decrypt information
18
The stated purpose of the ___________ is to develop protocols and guidelines that unify the World Wide Web
W3C
IETF
ANSI
IAB
19
The FAT32 and NTFS file systems are associated with which of the following?
macOS
Linux
Android
Windows
20
The regulating agency for the Sarbanes-Oxley Act is the ________.
Securities and Exchange Commission
FTC
Office of Management and Budget
Department of Homeland Security
21
This security appliance examines IP data streams for common attack and malicious intent patterns.
LAN-to-WAN Domain
IT security policy framework
IP default gateway router
intrusion detection system (IDS)
22
The primary difference between SOC 2 and SOC 3 reports is ________.
their focus
their audience
the number of auditors involved
their length
23
Which of the following is the definition of
botnet
?
a group of honeypots made to simulate a real live network, but isolated
a network of compromised computers that attackers use to launch attacks
a type of virus that primarily infects executable programs.
24
Software vendors must protect themselves from the liabilities of their own vulnerabilities with a(n) ____________.
disaster recovery plan (DRP)
IT security policy framework
acceptable use policy (AUP)
End-User License Agreement (EULA)
25
Audits also often look at the current configuration of a system as a snapshot in time to verify that it complies with
standards
plan
management
controls
26
What should organizations expect will occur as they become more dependent upon the Internet of Things (IoT)?
Security risks will be eliminated
Security risks will stay the same
Security risks will decrease.
Security risks will increase
27
________ is a document produced by the IETF that contains standards as well as other specifications.
The Special Publications 800 series
A Request for Comments (RFC)
ISO/IEC 27002
ISO 17799
28
A ________ is a type of virus that primarily infects executable programs.
system infector
program infector
data infector
file infector
29
Which principle of effective digital forensic investigations helps to ensure data in memory is not lost?
Consider data volatility
Do not exceed your knowledge
Enforce the rules of evidence
Minimize original data handling
30
Which OSI Reference Model layer is responsible for transmitting information on computers connected to the same LAN?
Presentation layer
Transport Layer
Session Layer
Data Link Layer
31
Which OSI Reference Model layer creates, maintains, and disconnects communications between processes over the network?
Presentation Layer
Data Link Layer
Transport Layer
Session Layer
32
What is the proportion of value of a particular asset likely to be destroyed by a given risk, expressed as a percentage?
Exposure factor (EF)
Annual rate of occurrence (ARO)
Business drivers
Risk management
33
_____________ are the main source of distributed denial of service (DDoS) attacks and spam.
Stealth viruses
Logic bombs
Trojans
Botnets
34
Which of the following is a digital forensics specialist least likely to need in-depth knowledge of?
Computer memory, such as cache and random access memory (RAM)
Operating systems, such as Windows, Linux, and macOS
Storage devices
Mainframes
35
If our company experiences the loss of intellectual property once per quarter, its ARO for this incident is
12.0
6.0
2.0
4.0
36
What is meant by
constrained user interface
?
Indicates a change from normal to abnormal behavior
Software that allows users to enter only specific information
Protected objects in a computing system
An authentication credential longer and more complex than a password
37
Which type of evidence is collected from individuals that supports and helps to interpret other types of evidence?
Documentary
Real
Testimonial
Demonstrative
38
Cryptography accomplishes four security goals: confidentiality, integrity, authentication, and ________________.
security
reliability
nonrepudiation
privacy
39
How often should an organization perform a risk management plan?
when a risk is identified
every couple of years
biannually
annually
40
________ attempts to describe risk in financial terms and put a dollar value on all the elements of a risk.
Quantitative risk analysis
Risk management
Qualitative risk analysis
Financial risk analysis
41
What is the determination that evidence is either acceptable or unacceptable to a court of law?
Admissibility
Preservation
Legal hold
Order of volatility
42
Which of the following is the definition of anomaly-based IDS?
The state of a device in with turned off or disabled unnecessary services
Using tools to determine the services running on an systems
An IDS that compares current activity with stored profiles
An IDS that uses pattern matching and stateful matching to compare curre
43
________ is the process of managing changes to computer/device configuration or application software.
Change control
Sprint
Procedure control
Proactive change management
44
Which of the following is the definition of
access control
?
Some value that indicates a change from normal to abnormal behavior.
A device used as a logon authenticator for remote users of a network.
Protecting a resource so that it is used only by those allowed
A property indicating a specific subject needs access to a specific object
45
Which type of evidence is any physical object that you can touch or otherwise directly observe, such as a hard drive?
Real
Testimonial
Demonstrative
Documentary
46
Malicious code attacks all three information security properties and can modify database records. This property is
integrity
security
confidentiality
availability
47
It's essential to match your organization's required __________ with its security structure.
recommendations
monitoring
permission level
operating system
48
Which one of the following is
NOT
a market driver for the Internet of Things (IoT)?
Global adoption of non-IP networking
Smaller and faster computing
Growth of cloud computing
Advancements in data analytics
49
What name is given to patient health information that is computer based?
personally identifiable information (PII)
electronic protected health information (EPHI)
directory information
privately held information
50
Which of the following describes an
asynchronous token
?
Associating actions with users for later reporting and research.
An authentication token processing challenge-response authentication
An authentication method using a single type of authentication credentials.
An authentication method that uses two types of authentication credentials
51
When an attacker discovers a __________, he or she can use it to bypass existing security controls
cookie
host device
backdoor
wiretapping device
52
Which OSI Reference Model layer translates the binary ones and zeros into the language of the transport medium?
Session Layer
Transport Layer
Data Link Layer
Physical Layer
53
A ___________ gives priorities to the functions an organization needs to keep going.
business impact analysis (BIA)
disaster recovery plan (DRP)
recovery time objective (RTO)
business continuity plan (BCP)
54
CompTIA's Security+ certification provides ________.
several credentials that focus on both general and Web-related security
more than 20 individual credentials that span several disciplines
four main credentials addressing a different security professional role
entry-level information security certification of choice
55
A company can discontinue or decide not to enter a line of business if the risk level is too high. This is known as
risk mitigation
risk avoidance
risk assignment
risk acceptance
56
What is meant by
promiscuous mode
?
Attack method that takes all the words from a dictionary file
The mode in which sniffers operate that is nonintrusive
A software program that used to monitor and capture network traffic
An event that results in a violation of any of the C-I-A security tenets.
57
In the legal system, ________ is the act of following laws, rules, and regulations that apply to organizations.
disclosure
compliance
control
responsibility
58
Protecting Internet of Things devices from becoming the entry point for security vulnerabilities is acahieved by...?
Using encryption for communications
Applying security updates promptly
Turning IoT devices off when not in use
Removing IoT devices from the network
59
What is meant by
risk register
?
The process of identifying, assessing, prioritizing, and addressing risks
The estimated loss due to a specific realized threat.
A list of identified risks resulting from the risk-identification process.
Comparison of controls needed to identify threats vs controls in place
60
Which is Cisco's highest level of certification?
Master
Expert
Professional
Architect
61
The primary task of an organization's __________ team is to control access to systems or resources.
compliance liaison
security administration
software development
management
62
________ is information that is publicly available about all students at a school
Personally identifiable information (PII)
Directory information
Minimum necessary rule
Nonpublic personal information (NPI)
63
______ uses various controls to reduce identified risks. These controls might be administrative, technical, or physical.
Risk assignment
Risk acceptance
Risk avoidance
Risk mitigation
64
Which is the highest level of Check Point certification for network security?
CCSE
CCMA
CCSPA
CCSA
65
Which one of the following is
NOT
an example of store-and-forward messaging?
Unified messaging
Telephone call
Email
Voicemail
66
A computing device does
not
play which role in a crime?
Instrument
Perpetrator
Target
Repository
67
The recovery point objective (RPO) identifies the amount of _________ that is acceptable.
risk
time to recover
data loss
support
68
Loss of financial assets due to ________ is a worst-case scenario for all organizations.
phishing
masquerade attacks
hijacking
malicious attacks
69
Which type of computer crime often involves nation-state attacks by well-funded cybercriminals?
Identity theft
Cyberterrorism
Online fraud
Cyberstalking
70
A(n) ________ is a measurable occurrence that has an impact on the business
critical business function
cost
event
corrective control
71
Today, people working in cyberspace must deal with new and constantly evolving ________.
applications
threats
policy
risks
72
What is meant by
certification
?
Acceptance of the risk of implementing the system.
A group that is responsible for protecting sensitive data
Technical evaluation providing assurance that you implemented the system
A strategy to minimize risk by rotating employees between various systems
73
Which of the following is the definition of
Vigenère cipher
?
Encryption cipher that is a product cipher with a 56-bit key
An encryption cipher that uses multiple encryption schemes in succession
Encryption cipher that shifts each letter in the English alphabet
Encryption cipher that replaces bits, characters, or blocks of information
74
________ is an international security standard that documents a comprehensive set of controls
The Internet Engineering Task Force (IETF)
ISO/IEC 27002
The International Electrotechnical Commission (IEC)
ISO 27000
