Which of the following is a procedure designed to test and perhaps bypass a system’s security Which of the following is considered a denial of service attack?

30. Which of the following is the principle that objects retain their veracity and are only intention- ally modified by authorized subjects?

A. Privacy

B. Authentication

C. Integrity

D. Data hiding 31. E-mail is the most common delivery vehicle for which of the following? A. Viruses

B. Worms

C. Malicious code

D. All of the above

32. What type of physical security controls are access controls, intrusion detection, alarms, CCTV,

monitoring, HVAC, power supplies, and fire detection and suppression?

A. Technical

B. Administrative

C. Physical

D. Preventative 33. In the United States, how are the administrative determinations of federal agencies promulgated? A. Code of Federal Regulations

B. United States Code

C. Supreme Court decisions

D. Administrative declarations

34. What is the first step of the Business Impact Assessment process?

A. Identification of priorities

B. Likelihood assessment

C. Risk identification

D. Resource prioritization 35. If Renee receives a digitally signed message from Mike, what key does she use to verify that the message truly came from Mike? A. Renee’s public key

B. Renee’s private key

C. Mike’s public key

D. Mike’s private key

36. The “something you are” authentication factor is also known as what?

A. Type 1

B. Type 2

C. Type 3

D. Type 4 37. What is the primary goal of risk management? A. To produce a 100-percent risk-free environment

B. To guide budgetary decisions

C. To reduce risk to an acceptable level

D. To provide an asset valuation for insurance

Answers to Assessment Test

1. C. The Managed phase of the SW-CMM involves the use of quantitative development metrics.

The Software Engineering Institute SEI defines the key process areas for this level as Quanti- tative Process Management and Software Quality Management. For more information, please see Chapter 7.

2. A, C. Because your organization needs to ensure confidentiality, you should choose the Bell-

LaPadula model. To ensure the integrity of your data, you should also use the Clark-Wilson model, which addresses separation of duties. This feature offers better protection from internal and external attacks. For more information, please see Chapter 12. 3. A. The purpose of a military and intelligence attack is to acquire classified information. The det- rimental effect of using such information could be nearly unlimited in the hands of an enemy. Attacks of this type are launched by very sophisticated attackers. It is often very difficult to ascer- tain what documents were successfully obtained. So when a breach of this type occurs, you some- times cannot know the full extent of the damage. For more information, please see Chapter 18.

4. B. The MD5 algorithm produces a 128-bit message digest for any input. For more information,

please see Chapter 10.

5. B. Network-based IDSs are usually able to detect the initiation of an attack or the ongoing

attempts to perpetrate an attack including DoS. They are, however, unable to provide infor- mation about whether an attack was successful or which specific systems, user accounts, files, or applications were affected. Host-based IDSs have some difficulty with detecting and tracking down DoS attacks. Vulnerability scanners don’t detect DoS attacks; they test for possible vul- nerabilities. Penetration testing may cause a DoS or test for DoS vulnerabilities, but it is not a detection tool. For more information, please see Chapter 2.

6. D. Annualized loss expectancy ALE is the possible yearly cost of all instances of a specific

realized threat against a specific asset. The ALE is calculated using the formula SLEARO. For more information, please see Chapter 6.

7. C. A fence that is 8 feet high with 3 strands of barbed wire deters determined intruders. For

more information, please see Chapter 19.

8. D. A VPN link can be established over any other network communication connection. This

could be a typical LAN cable connection, a wireless LAN connection, a remote access dial-up connection, a WAN link, or even an Internet connection used by a client for access to the office LAN. For more information, please see Chapter 4.

9. D. Biba is also a state machine model based on a classification lattice with mandatory access

controls. For more information, please see Chapter 1.

10. D. Remote mirroring maintains a live database server at the remote site and comes at the high-

est cost. For more information, please see Chapter 16.

11. A. The

∨ symbol represents the OR function, which is true when one or both of the input bits are true. For more information, please see Chapter 9.