What type of detected incident allows the most time for an investigation?

Answers to Assessment Test

1. C. The Managed phase of the SW-CMM involves the use of quantitative development metrics.

The Software Engineering Institute SEI defines the key process areas for this level as Quanti- tative Process Management and Software Quality Management. For more information, please see Chapter 7.

2. A, C. Because your organization needs to ensure confidentiality, you should choose the Bell-

LaPadula model. To ensure the integrity of your data, you should also use the Clark-Wilson model, which addresses separation of duties. This feature offers better protection from internal and external attacks. For more information, please see Chapter 12. 3. A. The purpose of a military and intelligence attack is to acquire classified information. The det- rimental effect of using such information could be nearly unlimited in the hands of an enemy. Attacks of this type are launched by very sophisticated attackers. It is often very difficult to ascer- tain what documents were successfully obtained. So when a breach of this type occurs, you some- times cannot know the full extent of the damage. For more information, please see Chapter 18.

4. B. The MD5 algorithm produces a 128-bit message digest for any input. For more information,

please see Chapter 10.

5. B. Network-based IDSs are usually able to detect the initiation of an attack or the ongoing

attempts to perpetrate an attack including DoS. They are, however, unable to provide infor- mation about whether an attack was successful or which specific systems, user accounts, files, or applications were affected. Host-based IDSs have some difficulty with detecting and tracking down DoS attacks. Vulnerability scanners don’t detect DoS attacks; they test for possible vul- nerabilities. Penetration testing may cause a DoS or test for DoS vulnerabilities, but it is not a detection tool. For more information, please see Chapter 2.

6. D. Annualized loss expectancy ALE is the possible yearly cost of all instances of a specific

realized threat against a specific asset. The ALE is calculated using the formula SLEARO. For more information, please see Chapter 6.

7. C. A fence that is 8 feet high with 3 strands of barbed wire deters determined intruders. For

more information, please see Chapter 19.

8. D. A VPN link can be established over any other network communication connection. This

could be a typical LAN cable connection, a wireless LAN connection, a remote access dial-up connection, a WAN link, or even an Internet connection used by a client for access to the office LAN. For more information, please see Chapter 4.

9. D. Biba is also a state machine model based on a classification lattice with mandatory access

controls. For more information, please see Chapter 1.

10. D. Remote mirroring maintains a live database server at the remote site and comes at the high-

est cost. For more information, please see Chapter 16.

11. A. The

∨ symbol represents the OR function, which is true when one or both of the input bits are true. For more information, please see Chapter 9. 12. D. In multilevel security mode, some users do not have a valid security clearance for all infor- mation processed by the system. For more information, please see Chapter 11.

13. B. ITSEC was developed in Europe for evaluating systems. Although TCSEC also called the

Orange Book would satisfy the evaluation criteria, only ITSEC evaluates functionality and assurance separately. For more information, please see Chapter 12. 14. B. The SYN packet is first sent from the initiating host to the destination host. The destination host then responds with a SYNACK packet. The initiating host sends an ACK packet and the connection is then established. For more information, please see Chapter 8.

15. B. One of the requirements of change management is that all changes must be capable of being

rolled back. For more information, please see Chapter 5. 16. C. Penetration testing is the attempt to bypass security controls to test overall system security. For more information, please see Chapter 14.

17. A. Network hardware devices, including routers, function at layer 3, the Network layer. For

more information, please see Chapter 3. 18. B. Not all instances of DoS are the result of a malicious attack. Errors in coding OSs, services, and applications have resulted in DoS conditions. Some examples of this include a process failing to release control of the CPU or a service consuming system resources out of proportion to the service requests it is handling. Social engineering and sniffing are typically not considered DoS attacks. For more information, please see Chapter 2.

19. C. Examples of detective controls are audit trails, logs, CCTV, intrusion detection systems,

antivirus software, penetration testing, password crackers, performance monitoring, and CRCs. For more information, please see Chapter 13.

20. B. Parameter checking is used to prevent the possibility of buffer overflow attacks. For more

information, please see Chapter 8.

21. B. Multiprocessing computers use more than one processor, in either a symmetric multipro-

cessing SMP or massively parallel processing MPP scheme. For more information, please see Chapter 11. 22. D. Differential backups store all files that have been modified since the time of the most recent full or incremental backup. For more information, please see Chapter 16.

23. C. The USA Patriot Act granted broad new powers to law enforcement, including the solicita-

tion of voluntary ISP cooperation. For more information, please see Chapter 17.

24. D. Scanning incidents are generally reconnaissance attacks. The real damage to a system comes

in the subsequent attacks, so you may have some time to react if you detect the scanning attack early. For more information, please see Chapter 18.

25. A. Auditing is a required factor to sustain and enforce accountability. For more information,

please see Chapter 14. 26. D. Dynamic packet-filtering firewalls enable real-time modification of the filtering rules based on traffic content. For more information, please see Chapter 3.