Which of the following cables has the most twists per inch? Which of the following is not one of the most common LAN technologies? What is a TCP wrapper? By examining source and destination address, application usage, source of origin, and the rela-
17. B. Pretty Good Privacy PGP is a public-private key system that uses the IDEA algorithm to
encrypt files and e-mail messages. PGP is not a standard but rather an independently developed product that has wide Internet grassroots support.18. A. PAP, or Password Authentication Protocol, is a standardized authentication protocol for
PPP. PAP transmits usernames and passwords in the clear. It offers no form of encryption. It sim- ply provides a means to transport the logon credentials from the client to the authentication server.19. B. Frame Relay is a layer 2 connection mechanism that uses packet-switching technology to
establish virtual circuits between the communication endpoints. The Frame Relay network is a shared medium across which virtual circuits are created to provide point-to-point communica- tions. All virtual circuits are independent of and invisible to each other.20. B. The 169.254.x.x. subnet is in the APIPA range, which is not part of RFC 1918. The addresses
in RFC 1917 are 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, and 192.168.0.0– 192.168.255.255. Chapter 4 Communications Security and Countermeasures THE CISSP EXAM TOPICS COVERED IN THIS CHAPTER INCLUDE: Communications Security Techniques Packet and Circuit Switching WAN Technologies E-Mail Security Facsimile Security Secure Voice Communications Security Boundaries Network Attacks and Countermeasures Data residing in a static form on a storage device is fairly simple to secure. As long as physical access control is maintained and reasonable logical access controls are implemented, stored files remain confidential, retain their integrity, and are available to authorized users. However, once data is used by an application or transferred over a network connection, the process of securing it becomes much more difficult. Communications security covers a wide range of issues related to the transportation of elec- tronic information from one place to another. That transportation may be between systems on opposite sides of the planet or between systems on the same business network. Data becomes vulnerable to a plethora of threats to its confidentiality, integrity, and availability once it is involved in any means of transportation. Fortunately, many of these threats can be reduced or eliminated with the appropriate countermeasures. Communications security is designed to detect, prevent, and even correct data transportation errors i.e., integrity protection. This is done to sustain the security of networks while support- ing the need to exchange and share data. This chapter takes a look at the many forms of com- munications security, vulnerabilities, and countermeasures. The Telecommunications and Network Security domain for the CISSP certification exam deals with topics of communications security and vulnerability countermeasures. This domain is discussed in this chapter and in the preceding chapter Chapter 3. Be sure to read and study the materials from both chapters to ensure complete coverage of the essential material for the CISSP certification exam. Virtual Private Network VPN A virtual private network VPN is simply a communication tunnel that provides point-to-point transmission of both authentication and data traffic over an intermediary network. Most VPNs use encryption to protect the encapsulated traffic, but encryption is not necessary for the con- nection to be considered a VPN. VPNs are most commonly associated with establishing secure communication paths through the Internet between two distant networks. However, VPNs can exist anywhere, including within private networks or between end-user systems connected to an ISP. VPNs provide confidentiality and integrity over insecure or untrusted intermediary net- works. VPNs do not provide or guarantee availability.Parts
» Directory UMM :Networking Manual:
» What type of detected incident allows the most time for an investigation?
» What type of physical security controls are access controls, intrusion detection, alarms, CCTV,
» What is the first step of the Business Impact Assessment process?
» The “something you are” authentication factor is also known as what?
» C. The Managed phase of the SW-CMM involves the use of quantitative development metrics.
» A, C. Because your organization needs to ensure confidentiality, you should choose the Bell-
» B. The MD5 algorithm produces a 128-bit message digest for any input. For more information,
» B. Network-based IDSs are usually able to detect the initiation of an attack or the ongoing
» D. Annualized loss expectancy ALE is the possible yearly cost of all instances of a specific
» C. A fence that is 8 feet high with 3 strands of barbed wire deters determined intruders. For
» D. A VPN link can be established over any other network communication connection. This
» D. Biba is also a state machine model based on a classification lattice with mandatory access
» D. Remote mirroring maintains a live database server at the remote site and comes at the high-
» A. The Directory UMM :Networking Manual:
» B. ITSEC was developed in Europe for evaluating systems. Although TCSEC also called the
» B. One of the requirements of change management is that all changes must be capable of being
» A. Network hardware devices, including routers, function at layer 3, the Network layer. For
» C. Examples of detective controls are audit trails, logs, CCTV, intrusion detection systems,
» B. Parameter checking is used to prevent the possibility of buffer overflow attacks. For more
» B. Multiprocessing computers use more than one processor, in either a symmetric multipro-
» C. The USA Patriot Act granted broad new powers to law enforcement, including the solicita-
» D. Scanning incidents are generally reconnaissance attacks. The real damage to a system comes
» A. Auditing is a required factor to sustain and enforce accountability. For more information,
» What is access? What are the elements of the CIA Triad?
» Which of the following is not a reason why using passwords alone is a poor security mechanism?
» Which of the following is the least acceptable form of biometric device?
» B. The transfer of information from an object to a subject is called access.
» C. The subject is always the entity that receives information about or data from the object. The
» A. The essential security principles of confidentiality, integrity, and availability are often
» A. A preventative access control is deployed to stop an unwanted or unauthorized activity from
» B. Logicaltechnical access controls are the hardware or software mechanisms used to manage
» A. A Type 2 authentication factor is something you have. This could include a smart card, ATM
» C. Brute force attacks can be used against password database files and system logon prompts.
» D. Preventing password reuse increases security by preventing the theft of older password data-
» C. The point at which the FRR and FAR are equal is known as the Crossover Error Rate CER.
» C. Kerberos, SESAME, and KryptoKnight are examples of SSO mechanisms. TACACS is a cen-
» C. Mandatory access controls rely upon the use of labels. A system that employs discretionary
» B. A discretionary access control environment controls access based on user identity. If a user
» A. The most important aspect of a biometric factor is its accuracy. If a biometric factor is not
» D. Antivirus software is an example of a recovery or corrective access control.
» B. Of the options listed, retina scan is the least accepted form of biometric device because it
» An intrusion detection system IDS is primarily designed to perform what function?
» Which of the following is true for a host-based IDS?
» Which type of IDS can be considered an expert system?
» When a padded cell is used by a network for protection from intruders, which of the following
» When using penetration testing to verify the strength of your security policy, which of the fol-
» Spamming attacks occur when numerous unsolicited messages are sent to a victim. Because
» D. In most cases, when sufficient logging and auditing is enabled to monitor a system, so much
» A. An IDS automates the inspection of audit logs and real-time system events to detect abnormal
» B. A host-based IDS watches for questionable activity on a single computer system. A network-
» C. A knowledge-based IDS is effective only against known attack methods, which is its primary
» D. A behavior-based IDS can be labeled an expert system or a pseudo artificial intelligence sys-
» B. Honey pots are individual computers or entire networks created to serve as a snare for intrud-
» C. When an intruder is detected by an IDS, they are transferred to a padded cell. The transfer
» C. Vulnerability scanners are used to test a system for known security vulnerabilities and weak-
» B. Penetration testing should be performed only with the knowledge and consent of the man-
» A. A brute force attack is an attempt to discover passwords for user accounts by systematically
» C. Strong password policies, physical access control, and two-factor authentication all improve
» D. Spoofing is the replacement of valid source and destination IP and port addresses with false
» C. A SYN flood attack is waged by breaking the standard three-way handshake used by TCPIP
» A. In a land attack, the attacker sends a victim numerous SYN packets that have been spoofed
» D. In a teardrop attack, an attacker exploits a bug in operating systems. The bug exists in the
» B. A spamming attack is a type of denial of service attack. Spam is the term describing unwanted
» C. In a hijack attack, which is an offshoot of a man-in-the-middle attack, a malicious user is
» Which of the following is not true regarding firewalls?
» Which public-private key security system was developed independently of industry standards
» B. Encapsulation is adding a header and footer to data as it moves through the Presentation layer
» B. Layer 5, Session, manages simplex one-direction, half-duplex two-way, but only one direc-
» B. 10Base-T UTP is the least resistant to EMI because it is unshielded. Thinnet 10Base2 and
» D. 1000Base-T offers 1000Mbps throughput and thus must have the greatest number of twists
» D. Fiber-optic cable is difficult to tap.
» B. Ethernet, Token Ring, and FDDI are common LAN technologies. ATM is more common in
» A. Ethernet is based on the IEEE 802.3 standard.
» B. A TCP wrapper is an application that can serve as a basic firewall by restricting access based
» B. UDP is a connectionless protocol.
» B. Stateful inspection firewalls are known as third-generation firewalls.
» C. There are numerous dynamic routing protocols, including RIP, OSPF, and BGP, but RPC is
» C. IPSec, or IP Security, is a standards-based mechanism for providing encryption for point-to-
» B. Pretty Good Privacy PGP is a public-private key system that uses the IDEA algorithm to
» A. PAP, or Password Authentication Protocol, is a standardized authentication protocol for
» B. Frame Relay is a layer 2 connection mechanism that uses packet-switching technology to
» B. The 169.254.x.x. subnet is in the APIPA range, which is not part of RFC 1918. The addresses
» Which of the following VPN protocols do not offer encryption? Choose all that apply.
» Which of the following is not defined in RFC 1918 as one of the private IP address ranges that
» Which of the following is typically not an element that must be discussed with end users in
» Why is spam so difficult to stop?
» In addition to maintaining an updated system and controlling physical access, which of the fol-
» Which of the following is not a denial of service attack?
» B. Tunneling does not always use encryption. It does, however, employ encapsulation, is used to
» D. A stand-alone system has no need for tunneling because no communications between systems
» B. Most VPNs use encryption to protect transmitted data. In and of themselves, obscurity,
» D. Encryption is not necessary for the connection to be considered a VPN, but it is recom-
» D. An intermediary network connection is required for a VPN link to be established.
» C. SLIP is a dial-up connection protocol, a forerunner of PPP. It is not a VPN protocol.
» A, B. Layer 2 Forwarding L2F was developed by Cisco as a mutual authentication tunneling
» D. IPSec operates at the Network layer layer 3.
» A. The address range 16172.0.0–16191.255.255 is not listed in RFC 1918 as a public IP
» D. NAT does not protect against nor prevent brute force attacks.
» B. When transparency is a characteristic of a service, security control, or access mechanism, it
» D. The backup method is not an important factor to discuss with end users regarding e-mail
» B. Mailbombing is the use of e-mail as an attack mechanism. Flooding a system with messages
» B. It is often difficult to stop spam because the source of the messages is usually spoofed.
» C. Two types of messages can be formed using SMIME: signed messages and enveloped mes-
» B. Changing default passwords on PBX systems provides the most effective increase in security.
» C. A brute force attack is not considered a DoS.
» A. ISDN, or Integrated Services Digital Network, is a digital end-to-end communications mech-
» Which of the following contains the primary goals and objectives of security?
» Which of the following is a principle of the CIA Triad that means authorized subjects are granted
» Which of the following is not true?
» All but which of the following items require awareness for all individuals affected?
» What ensures that the subject of an activity or event cannot deny that the event occurred?
» Which of the following is not considered an example of data hiding?
» What is the primary objective of data classification schemes?
» What are the two common data classification schemes?
» Which commercial businessprivate sector data classification is used to control information
» B. The primary goals and objectives of security are confidentiality, integrity, and availability,
» A. Vulnerabilities and risks are evaluated based on their threats against one or more of the CIA
» B. Availability means that authorized subjects are granted timely and uninterrupted access to
» C. Hardware destruction is a violation of availability and possibly integrity. Violations of con-
» C. Violations of confidentiality are not limited to direct intentional attacks. Many instances of
» D. Without integrity, confidentiality cannot be maintained.
» B. Privacy is freedom from being observed, monitored, or examined without consent or knowledge.
» D. Users should be aware that e-mail messages are retained, but the backup mechanism used to
» D. A challengeresponse token device is almost exclusively used as an authentication factor, not
» C. Nonrepudiation ensures that the subject of an activity or event cannot deny that the event
» A. Preventing an authorized reader of an object from deleting that object is just an access con-
» D. The prevention of security compromises is the primary goal of change management.
» B. The primary objective of data classification schemes is to formalize and stratify the process
» B. Size is not a criteria for establishing data classification. When classifying an object, you
» A. Military or government and private sector or commercial business are the two common
» B. Of the options listed, secret is the lowest classified military data classification.
» Which of the following is the weakest element in any security solution?
» What is the primary purpose of an exit interview?
» Who is liable for failing to perform prudent due care?
» Which of the following policies is required when industry or legal standards are applicable to
» Which of the following would not be considered an asset in a risk analysis?
» When a safeguard or a countermeasure is not present or is not sufficient, what is created?
» When evaluating safeguards, what is the rule that should be followed in most cases?
» How is the value of a safeguard to a company calculated?
» Which security role is responsible for assigning the sensitivity label to objects?
» D. If no detailed step-by-step instructions or procedures exist, then turn to the guidelines for
» D. A countermeasure directly affects the annualized rate of occurrence, primarily because the
» Which one of the following malicious code objects might be inserted in an application by a dis-
» Which form of DBMS primarily supports the establishment of one-to-many relationships?
» What programming languages can be used to develop ActiveX controls for use on an Internet site?
» What database technique can be used to prevent unauthorized users from determining classified
» Which of the following acts as a proxy between two different systems to support interaction and
» In systems utilizing a ring protection scheme, at what level does the security kernel reside?
» Which of the following programming languages is least prone to the insertion of malicious code
» What transaction management principle ensures that two transactions do not interfere with each
» D. Logic bombs are malicious code objects programmed to lie dormant until certain logical con-
» A. Intelligent agents are code objects programmed to perform certain operations on behalf of a
» B. Hierarchical DBMS supports one-to-many relationships. Relational DBMS supports one-to-
» B. The major difference between viruses and worms is that worms are self-replicating whereas
» D. Microsoft’s ActiveX technology supports a number of programming languages, including
» A. Content-dependent access control is focused on the internal data of each field.
» D. In this case, the process the database user is taking advantage of is aggregation. Aggregation
» C. Polyinstantiation allows the insertion of multiple records that appear to have the same pri-
» B. Random access memory RAM allows for the direct addressing of any point within the
» D. The Next-Generation Intrusion Detection Expert System NIDES system is an expert sys-
» B. ODBC acts as a proxy between applications and the back-end DBMS.
» D. The spiral model allows developers to repeat iterations of another life cycle model such as
» A. The security kernel and reference monitor reside at Level 0 in the ring protection scheme,
» C. Contamination is the mixing of data from a higher classification level andor need-to-know
» C. Of the languages listed, VBScript is the least prone to modification by third parties because
» C. Configuration audit is part of the configuration management process rather than the change
» C. The isolation principle states that two transactions operating on the same data must be tem-
» A. The Data Manipulation Language DML is used to make modifications to a relational data-
» What is the size of the Master Boot Record on a system installed with a typical configuration?
» Which one of the following types of attacks relies upon the difference between the timing of two
» What advanced virus technique modifies the malicious code of a virus on each system it infects?
» What is the best defensive action that system administrators can take against the threat posed by
» What file is instrumental in preventing dictionary attacks against Unix systems?
» Which one of the following network attacks takes advantages of weaknesses in the fragment
» A hacker located at IP address 12.8.0.1 wants to launch a Smurf attack on a victim machine
» What is the minimum size a packet can be to be used in a ping of death attack?
» What technology does the Java language use to minimize the threat posed by applets?
» Which one of the following attacks uses a TCP packet with the SYN flag set and identical source
» B. The Master Boot Record is a single sector of a floppy disk or hard drive. Each sector is nor-
» C. The TCPIP handshake consists of three phases: SYN, SYNACK, and ACK. Attacks like the
» B. The time-of-check-to-time-of-use TOCTTOU attack relies upon the timing of the execution
» D. The Good Times virus is a famous hoax that does not actually exist.
» A. In an attempt to avoid detection by signature-based antivirus software packages, polymor-
» C. The vast majority of new malicious code objects exploit known vulnerabilities that were
» D. All of the other choices are forms of common words that might be found during a dictionary
» B. Shadow password files move encrypted password information from the publicly readable
» C. Trinoo and the Tribal Flood Network TFN are the two most commonly used distributed
» A. The teardrop attack uses overlapping packet fragments to confuse a target system and cause
» Which one of the following is not a goal of cryptographic systems?
» What is the length of the cryptographic key used in the Data Encryption Standard DES
» Which one of the following is not a possible key length for the Advanced Encryption Standard
» Which one of the following is a cryptographic goal that cannot be achieved by a secret key
» What is the output value of the mathematical function 16 mod 3?
» Which one of the following cipher types operates on large pieces of a message rather than indi-
» What is the minimum number of cryptographic keys required for secure two-way communica-
» What encryption algorithm is used by the Clipper chip, which supports the Escrowed Encryp-
» What approach to key escrow divides the secret key into several pieces that are distributed to
» What type of cryptosystem commonly makes use of a passage from a well-known book for the
» Matthew and Richard wish to communicate using symmetric cryptography but do not have a
» C. The four goals of cryptographic systems are confidentiality, integrity, authentication, and
» A. Nonrepudiation prevents the sender of a message from later denying that they sent it.
» A. DES uses a 56-bit key. This is considered one of the major weaknesses of this cryptosystem.
» B. Transposition ciphers use a variety of techniques to reorder the characters within a message.
» A. The Rijndael cipher allows users to select a key length of 128, 192, or 256 bits, depending
» A. Nonrepudiation requires the use of a public key cryptosystem to prevent users from falsely
» D. Assuming that it is used properly, the one-time pad is the only known cryptosystem that is
» B. Option B is correct because 16 divided by 3 equals 5, with a remainder value of 1.
» A. The cryptanalysts from the United States discovered a pattern in the method the Soviets used
» A. Symmetric key cryptography uses a shared secret key. All communicating parties utilize the
» D. In asymmetric public key cryptography, each communicating party must have a pair of
» D. Cipher Block Chaining and Cipher Feedback modes will carry errors throughout the entire
» C. The Skipjack algorithm implemented the key escrow standard supported by the U.S. government.
» B. To achieve added security over DES, 3DES must use at least two cryptographic keys.
» A. The Fair Cryptosystems approach would have independent third parties each store a portion of
» C. The Caesar cipher and other simple substitution ciphers are vulnerable to frequency attacks
» C. The Diffie-Hellman algorithm allows for the secure exchange of symmetric keys over an inse-
» Bob decrypts the message digest using Alice’s public key.
» Bob then compares the decrypted message digest he received from Alice with the message
» In the RSA public key cryptosystem, which one of the following numbers will always be largest?
» If Richard wants to send an encrypted message to Sue using a public key cryptosystem, which
» Acme Widgets currently uses a 1,024-bit RSA encryption standard companywide. The company
» Which one of the following message digest algorithms is the current U.S. government standard
» Which International Telecommunications Union ITU standard governs the creation and
» What TCPIP communications port is utilized by Secure Sockets Layer traffic?
» Which of the following security systems was created to support the use of stored-value payment
» What is the major disadvantage of using certificate revocation lists?
» B. The number n is generated as the product of the two large prime numbers p and q. Therefore,
» B. The El Gamal cryptosystem extends the functionality of the Diffie-Hellman key exchange
» C. Richard must encrypt the message using Sue’s public key so that Sue can decrypt it using her
» C. The major disadvantage of the El Gamal cryptosystem is that it doubles the length of any mes-
» A. The elliptic curve cryptosystem requires significantly shorter keys to achieve encryption that
» A. The SHA-1 hashing algorithm always produces a 160-bit message digest, regardless of the
» C. The MD4 algorithm has documented flaws that produce collisions, rendering it useless as a
» A. SHA-1 is the current U.S. government standard, as defined in the Secure Hashing Standard SHS,
» B. Sue would have encrypted the message using Richard’s public key. Therefore, Richard needs
» B. Richard should encrypt the message digest with his own private key. When Sue receives the
» C. The Digital Signature Standard allows federal government use of the Digital Signature Algo-
» C. Secure Sockets Layer utilizes TCP port 443 for encrypted clientserver communications.
» C. The meet-in-the-middle attack demonstrated that it took relatively the same amount of com-
» C. The MONDEX payment system, owned by MasterCard International, provides the crypto-
» C. The Wired Equivalent Privacy protocol encrypts traffic passing between a mobile client and
» B. Certificate revocation lists CRLs introduce an inherent latency to the certificate expiration
» D. The Merkle-Hellman Knapsack algorithm, which relies upon the difficulty of factoring
» B. IPSec is a security protocol that defines a framework for setting up a secure channel to
» Many PC operating systems provide functionality that enables them to support the simultaneous
» You have three applications running on a single-processor system that supports multitasking.
» What term describes the processor mode used to run the system tools used by administrators
» What type of memory chip allows the end user to write information to the memory only one time
» Which one of the following types of memory might retain information after being removed from
» What type of electrical component serves as the primary building block for dynamic RAM chips?
» In which of the following security modes can you be assured that all users have access permis-
» What type of memory device is normally used to contain a computer’s BIOS?
» In what type of addressing scheme is the data actually supplied to the CPU as an argument to
» What security principle helps prevent users from accessing memory spaces assigned to applica-
» Which security principle takes the concept of process isolation and implements it using physical
» C. Multitasking is processing more than one task at the same time. In most cases, multitasking is
» B. Although all electronic devices emit some unwanted emanations, monitors are the devices
» A. A single-processor system can operate on only one thread at a time. There would be a total
» A. In a dedicated system, all users must have a valid security clearance for the highest level of
» A. All user applications, regardless of the security permissions assigned to the user, execute in
» B. Programmable read-only memory PROM chips may be written once by the end user but
» C. EPROMs may be erased through exposure to high-intensity ultraviolet light. ROM and
» C. Secondary memory is a term used to describe magnetic and optical media. These devices will
» C. RAM chips are highly pilferable items and the single greatest threat they pose is the economic
» A. Dynamic RAM chips are built from a large number of capacitors, each of which holds a single
» C. Floppy disks are easily removed and it is often not possible to apply operating system access
» C. In system high mode, all users have appropriate clearances and access permissions for all
» D. In a multilevel security mode system, there is no requirement that all users have appropriate
» B. BIOS and device firmware are often stored on EEPROM chips in order to facilitate future
» C. Registers are small memory locations that are located directly on the CPU chip itself. The
» B. In immediate addressing, the CPU does not need to actually retrieve any data from memory.
» D. In indirect addressing, the location provided to the CPU contains a memory address. The
» C. Process isolation provides separate memory spaces to each process running on a system. This
» D. The principle of least privilege states that only processes that absolutely need kernel-level
» A. Hardware segmentation achieves the same objectives as process isolation but takes them to
» What is system certification?
» For what type of information system security accreditation are the applications and systems at
» What is a trusted computing base TCB?
» What part of the TCB validates access to every resource prior to granting the requested access?
» Which security models are built on a state machine model?
» Which Bell-LaPadula property keeps lower-level subjects from accessing objects with a higher
» What term describes an entry point that only the developer knows about into a system?
» How can electromagnetic radiation be used to compromise a system?
» B. A system certification is a technical evaluation. Option A describes system accreditation.
» A. Accreditation is the formal acceptance process. Option B is not an appropriate answer
» C. A closed system is one that uses largely proprietary or unpublished protocols and standards.
» C. A constrained process is one that can access only certain memory locations. Options A, B,
» D. A control limits access to an object to protect it from misuse from unauthorized users.
» B. The applications and systems at a specific, self-contained location are evaluated for DITSCAP
» C. The TCB is the part of your system you can trust to support and enforce your
» B. Option B is the only option that correctly defines a security model. Options A, C, and D
» D. The Bell-LaPadula and Biba models are built on the state machine model.
» A. Only the Bell-LaPadula model addresses data confidentiality. The other models address data
» A. An entry point that only the developer knows about into a system is a maintenance hook, or
» B. Option B defines the time-of-check TOC, which is the time at which a subject verifies the
» C. If a receiver is in close enough proximity to an electromagnetic radiation source, it can be
» B. By far, the buffer overflow is the most common, and most avoidable, programmer-generated
» Personnel management is a form of what type of control?
» Which of the following causes the vulnerability of being affected by viruses to increase?
» Which of the following is not an illegal activity that can be performed over a computer network?
» What is the best form of antivirus protection?
» What is the requirement to have access to, knowledge about, or possession of data or a resource
» Which of the following requires that archives of audit logs be kept for long periods of time?
» Which operation is performed on media so it can be reused in a less-secure environment?
» Which security tool is used to guide the security implementation of an organization?
» What type of trusted recovery process requires the intervention of an administrator?
» A. Personnel management is a form of administrative control. Administrative controls also include
» B. E-mail is the most common distribution method for viruses.
» C. As more software is installed, more vulnerabilities are added to the system, thus adding more
» B. In areas where technical controls cannot prevent virus infections, users should be trained on
» B. Laws and regulations must be obeyed and security concerns must be adjusted accordingly.
» C. Although wasting resources is considered inappropriate activity, it is not actually a crime in
» D. Everyone should be informed when records about their activities on a network are being
» C. Concentric circles of different solutions is the best form of antivirus protection.
» A. Workstation change is an effective means of preventing and detecting the presence of unap-
» C. Need-to-know is the requirement to have access to, knowledge about, or possession of data
» D. Classification is the most important aspect of marking media because it determines the pre-
» C. Purging of media is erasing media so it can be reused in a less-secure environment. The purg-
» C. A detective control is a security mechanism used to verify whether the directive and preven-
» D. When possible, operations controls should be invisible, or transparent, to users. This keeps
» C. The goal of change management is to ensure that any change does not lead to reduced or com-
» What is a methodical examination or review of an environment to ensure compliance with reg-
» Monitoring can be used to perform all but which of the following?
» What is the frequency of an IT infrastructure security audit or security review based on?
» Audit trails are considered to be what type of security control?
» Why should access to audit reports be controlled and restricted?
» Which of the following focuses more on the patterns and trends of data rather than the actual
» The standard for study and control of electronic signals produced by various types of electronic
» Which of the following is not an effective countermeasure against inappropriate content being
» B. Auditing is a methodical examination or review of an environment to ensure compliance with
» D. Deployment of countermeasures is not considered a type of auditing activity; rather, it’s an
» A. Monitoring is not used to detect the availability of new software patches.
» C. The frequency of an IT infrastructure security audit or security review is based on risk. You
» A. Failing to perform periodic security audits can result in the perception that due care is not
» B. Audit trails are a passive form of detective security control. Administrative, corrective, and
» B. Recommendations of the auditor are not considered basic and essential concepts to be
» B. Audit reports should be secured because they contain information about the vulnerabilities of
» C. Warning banners are used to inform would-be intruders or those who attempt to violate the
» B. Traffic analysis focuses more on the patterns and trends of data rather than the actual con-
» D. War dialing is the act of searching for unauthorized modems that will accept inbound calls
» A. Users often install unauthorized modems because of restricted and monitored Internet access.
» B. TEMPEST is the standard that defines the study and control of electronic signals produced by
» C. An IDS is not a countermeasure against inappropriate content.
» A. One of the most common vulnerabilities and hardest to protect against is the occurrence of
» C. In most cases, you must simply wait until the emergency or condition expires and things
» What is the first step that individuals responsible for the development of a business continuity
» What unit of measurement should be used to assign quantitative values to assets in the priority
» Which one of the following BIA terms identifies the amount of money a business expects to lose
» You are concerned about the risk that an avalanche poses to your 3 million shipping facility.
» Your manager is concerned that the Business Impact Assessment recently completed by the BCP
» Which task of BCP bridges the gap between the Business Impact Assessment and the Continuity
» Which one of the following concerns is not suitable for quantitative measurement during the
» Referring to the scenario in question 13, what is the annualized loss expectancy?
» What type of mitigation provision is utilized when redundant communications links are
» What is the formula used to compute the single loss expectancy for a risk scenario?
» B. The business organization analysis helps the initial planners select appropriate BCP team
» B. The first task of the BCP team should be the review and validation of the business organiza-
» C. The annualized loss expectancy ALE represents the amount of money a business expects to
» C. The maximum tolerable downtime MTD represents the longest period a business function
» B. The SLE is the product of the AV and the EF. From the scenario, you know that the AV is
» D. This problem requires you to compute the ALE, which is the product of the SLE and the
» D. The qualitative analysis portion of the BIA allows you to introduce intangible concerns, such
» C. The strategy development task bridges the gap between Business Impact Assessment and
» D. The safety of human life must always be the paramount concern in Business Continuity Plan-
» B. The single loss expectancy SLE is the amount of damage that would be caused by a single
» C. The annualized loss expectancy ALE is computed by taking the product of the single loss
» C. In the provisions and processes phase, the BCP team actually designs the procedures and mech-
» D. Redundant communications links are a type of alternative system put in place to provide
» C. Disaster recovery plans pick up where business continuity plans leave off. After a disaster
» A. The single loss expectancy SLE is computed as the product of the asset value AV and the
» What is the end goal of Disaster Recovery Planning?
» According to the Federal Emergency Management Agency, approximately what percentage of
» In the wake of the September 11, 2001 terrorist attacks, what industry made drastic changes that
» Which one of the following statements about Business Continuity Planning and Disaster Recov-
» In which one of the following database recovery techniques is an exact, up-to-date copy of the
» What Business Continuity Planning technique can help you prepare the business unit prioritiza-
» What is the typical time estimate to activate a warm site from the time a disaster is declared?
» What Disaster Recovery Planning tool can be used to protect an organization against the failure
» What combination of backup strategies provides the fastest backup creation time?
» C. Disaster Recovery Planning picks up where Business Continuity Planning leaves off. Once a
» C. A power outage is an example of a man-made disaster. The other events listed—tsunamis,
» D. As shown in Table 16.1, 40 of the 50 U.S. states are considered to have a moderate, high, or
» B. Most general business insurance and homeowner’s insurance policies do not provide any pro-
» C. The opposite of this statement is true—Disaster Recovery Planning picks up where Business
» D. When you use remote mirroring, an exact copy of the database is maintained at an alternative
» C. Redundant systemscomponents provide protection against the failure of one particular piece
» B. During the Business Impact Assessment phase, you must identify the business priorities of
» D. Warm sites and hot sites both contain workstations, servers, and the communications circuits
» C. In an electronic vaulting scenario, bulk transfers of data occur between the primary site and
» D. Software escrow agreements place the application source code in the hands of an independent
» C. Any backup strategy must include full backups at some point in the process. Incremental
» A. Any backup strategy must include full backups at some point in the process. If a combination
» B. Parallel tests involve moving personnel to the recovery site and gearing up operations, but
» Which criminal law was the first to implement penalties for the creators of viruses, worms, and
» What type of law does not require an act of Congress to implement at the federal level but,
» What is the broadest category of computer systems protected by the Computer Fraud and Abuse
» Mary is the cofounder of Acme Widgets, a manufacturing firm. Together with her partner, Joe,
» What law prevents government agencies from disclosing personal information that an individual
» What law formalizes many licensing arrangements used by the software industry and attempts
» Which one of the following is not a requirement that Internet service providers must satisfy in
» Which one of the following types of licensing agreements is most well known because it does not
» What industry is most directly impacted by the provisions of the Gramm-Leach-Bliley Act?
» Which one of the following is not a valid legal reason for processing information about an indi-
» What evidentiary principle states that a written contract is assumed to contain all of the terms
» C. The Computer Fraud and Abuse Act, as amended, provides criminal and civil penalties for
» A. The Computer Security Act requires mandatory periodic training for all persons involved in the
» C. The National Institute of Standards and Technology NIST is charged with the security man-
» C. The original Computer Fraud and Abuse Act of 1984 covered only systems used by the gov-
» B. The Fourth Amendment to the U.S. Constitution sets the “probable cause” standard that law
» A. Copyright law is the only type of intellectual property protection available to Matthew. It
» D. Mary and Joe should treat their oil formula as a trade secret. As long as they do not publicly
» C. Richard’s product name should be protected under trademark law. Until his registration is
» A. The Privacy Act of 1974 limits the ways government agencies may use information that pri-
» B. The Uniform Computer Information Transactions Act UCITA attempts to implement a stan-
» A. The Children’s Online Privacy Protection Act COPPA provides severe penalties for compa-
» A. The Digital Millennium Copyright Act does not include any geographical location require-
» C. The USA Patriot Act was adopted in the wake of the 911 terrorist attacks. It broadens the
» B. Shrink-wrap license agreements become effective when the user opens a software package.
» B. The Gramm-Leach-Bliley Act provides, among other things, regulations regarding the way
» C. United States patent law provides for an exclusivity period of 20 years beginning at the time
» C. Marketing needs are not a valid reason for processing personal information, as defined by the
» C. Real evidence must be either uniquely identified by a witness or authenticated through a doc-
» C. The parol evidence rule states that a written contract is assumed to contain all of the terms
» What goal is not a purpose of a financial attack?
» What is one possible goal of a terrorist attack?
» What are the primary reasons attackers engage in “fun” attacks? Choose all that apply.
» What would be a valid argument for not immediately removing power from a machine when an
» What type of incident is characterized by obtaining an increased level of privilege?
» If you need to confiscate a PC from a suspected attacker who does not work for your organiza-
» B. A financial attack focuses primarily on obtaining services and funds illegally.
» D. Any action that can harm a person or organization, either directly or through embarrass-
» A, C. Fun attacks have no reward other than providing a boost to pride and ego. The thrill of
» C. Although the other options have some merit in individual cases, the most important rule is to
» D. The most compelling reason for not removing power from a machine is that you will lose the
» C. Although an organization would not want to report a large number of incidents unless
» B. Some port scans are normal. An unusually high volume of port scan activity can be a recon-
» A. Any time an attacker exceeds their authority, the incident is classified as a system compro-
» C. Although options A, B, and D are actions that can make you aware of what attacks look like
» B. In this case, you need a search warrant to confiscate equipment without giving the suspect
» A. Log files contain a large volume of generally useless information. However, when you are try-
» D. Ethics are simply rules of personal behavior. Many professional organizations establish for-
» B. The second canon of the ISC
» Which of the following is the most important aspect of security?
» What type of physical security controls focus on facility construction and selection, site man-
» Which of the following does not need to be true in order to maintain the most efficient and
» Which of the following is a double set of doors that is often protected by a guard and is used to
» Which of the following is not a disadvantage of using security guards?
» What is the most common and inexpensive form of physical access control device?
» What is the most important goal of all security solutions?
» At what voltage level can static electricity cause destruction of data stored on hard drives?
» What is the best type of water-based fire suppression system for a computer facility?
» A. Physical security is the most important aspect of overall security. Without physical security,
» B. Critical path analysis can be used to map out the needs of an organization for a new facility.
» D. Equal access to all locations within a facility is not a security-focused design element. Each
» A. A computer room does not need to be human compatible to be efficient and secure. Having
» C. A mantrap is a double set of doors that is often protected by a guard and used to contain a
» D. Lighting is the most common form of perimeter security devices or mechanisms. Your entire
» A. Security guards are usually unaware of the scope of the operations within a facility, which
» B. The most common cause of failure for a water-based system is human error. If you turn off
» C. Key locks are the most common and inexpensive form of physical access control device.
» D. A capacitance motion detector senses changes in the electrical or magnetic field surrounding
» A. There is no preventative alarm. Alarms are always triggered in response to a detected intru-
» B. No matter what form of physical access control is used, a security guard or other monitoring
» C. Human safety is the most important goal of all security solutions.
» B. The humidity in a computer room should ideally be from 40 to 60 percent.
» D. Destruction of data stored on hard drives can be caused by 1,500 volts of static electricity.
» A. Water is never the suppression medium in Type B fire extinguishers because they are used on
» C. A preaction system is the best type of water-based fire suppression system for a computer
» D. Light is usually not damaging to most computer equipment, but fire, smoke, and the sup-
» 612 Directory UMM :Networking Manual:
» 580–581, 676 Digital Signature Standard DSS, 345–346, 676
» 580–581, 676 Directory UMM :Networking Manual:
» 586, 679 Directory UMM :Networking Manual:
» 679 Directory UMM :Networking Manual:
» 679 elliptic curve cryptography, 339–340, 679 Directory UMM :Networking Manual:
» 685 hashing algorithms, 316 Directory UMM :Networking Manual:
» 685 hoaxes, 264 Directory UMM :Networking Manual:
» 689 IDEAL model, 240, 241 Directory UMM :Networking Manual:
» 687 Directory UMM :Networking Manual:
Show more