CISSP+ test bank.Top Exam Questions with accurate answer, graded A+

Document Content and Description Below

CISSP+ test bank.Top Exam Questions with accurate answer, graded A+ Message Handling Services - ✔✔X.400 Directory Services - ✔✔X.500 How does S-HTTP encrypt? - ✔✔S-HTTP encrypts Indiv... idual messages. How does HTTPS encrypt? - ✔✔HTTPS encrypts the entire comm channel using TLS. At what OSI layer is a Segment found? - ✔✔Segments are found at the Transport Layer. At what layer of the OSI model are Packets found? - ✔✔Packets are found at the Network Layer. At what layer of the OSI model are Frames found? - ✔✔Frames are found at the Data Link Layer. At what layer of the OSI model are Bits found? - ✔✔Bits are found at Layer 1: the Physical Layer. At what OSI layers are Data Streams found? - ✔✔Data Streams are found At the top 3 layers of the OSI model: Session, Presentation and Application. In IPv6, what kind of address is designated ::1? - ✔✔::1 is the IPv6 loopback address, equivalent to 127.0.0.1 in IPv4 What kind of IPv6 address begins with the hextet FF01? - ✔✔FF01 is the first hextet of an IPv6 multicast address. What does the prefix IPv6 hextet FEC0 designate? - ✔✔FEC0 is the first hextet of an IPv6 site-local address or SLA, equivalent to IPv4 private addresses. RFC 3879 degrades IPv6 site-local addresses in favor of the *locally assigned* unique local addresses, or ULA. What kind of IPv6 address begins with the hextet FE80? - ✔✔FE80 is the first hextet of an IPv6 link-local address: equivalent to an IPv4 APIPA address. What does the IPv6 prefix FC00 designate? - ✔✔FC00 is the first hextet of an IPv6 centrally-assigned unique local address or ULA. What does the IPv6 prefix FD00 designate? - ✔✔FD00 is the first hextet of an IPv6 *locally-configured* unique local address or ULA What kind of IPv6 addresses begin with 2000, 2001, 2002, 2003, etc.? - ✔✔IPv6 global unicast address. These are equivalent to unique public IPv4 routable addresses. Which mode of ESP encrypts only the data payload? - ✔✔ESP Transport Mode encrypts only the data payload. Which mode of ESP encrypts the entire packet? - ✔✔ESP Tunnel Mode encrypts the entire packet. Which ports are identified as the System/Well-Known Ports? - ✔✔Ports 0-1023. Which ports are identified as the Registered/User Ports? - ✔✔Ports 1024-49151. Which ports are identified as the Dynamic/Private/Ephemeral Ports? - ✔✔Ports 49152-65535. Is T1 Packet, Circuit or Cell Switched? - ✔✔Circuit Switched Is Frame Relay Packet, Circuit or Cell Switched? - ✔✔Packet Switched Is ATM Packet, Circuit or Cell Switched? - ✔✔Cell Switched: 53 bytes How do you create ciphertext in binary? - ✔✔To create ciphertext in binary, XOR the original plaintext with the generated keystream. How do you compute XOR on two bits? - ✔✔if only one of the values is true, then the result is true. Otherwise, false. What is it called when a biometric system grants access to an unauthorized person? - ✔✔When a biometric system grants access to an unauthorized person, that is known as a False Positive, or a Type 1 Biometric Error. What is it called when a biometric system denies access to an authorized person? - ✔✔When a biometric system denies access to an authorized person, that is known as a False Negative, or a Type 2 Biometric Error. What is IEE 802.11? - ✔✔IEEE 802.11 is WiFi. What is IEEE 802.15? - ✔✔IEEE 802.15 is Bluetooth. What is IEEE 802.16? - ✔✔WiMax - cellphone broadband using microwave towers. It is an acronym standing for *"Worldwide Interoperability for Microwave Access".* What is IEEE 802.20? - ✔✔IEEE 802.20 is mobile broadband on cellphones also known as MBWA (Mobile Broadband Wireless Access). What electronic devices and WiFi standards run in the 2.4 GHz range? - ✔✔Bluetooth, microwaves, some older wireless phones as well as wireless standards b, g, and n all run in the 2.4GHz range. Unlike the others in this list, wireless n also has the option of running at 5GHz. Whch wireless standards use the 5 GHz band? - ✔✔5 GHz is the frequency band in which wireless a, optionally n, and ac run. Which wireless standard can run in both the 2.4GHz and 5GHz frequency bands? - ✔✔Wireless n can run in both the 2.4GHz and the 5GHz frequency bands. What avoidance technology is built into WiFi standard 802.11a? - ✔✔Wireless a is the WiFi standard with RADAR (Radio Detection and Ranging) avoidance technology built in to it. What does MIMO stand for? - ✔✔MIMO is an acronym which stands for Multiple Input, Multiple Output. It is a technology which employs multiple transmitters and receiver antennae to increase data throughput. MIMO was Introduced with wireless n. What is Diversity in wireless networking? - ✔✔Diversity is a method for improving the *reliability* of a WiFi transmission by using two or more communication channels. What is Channel Bonding? - ✔✔Channel bonding is a feature in 802.11n that allows for the use of multiple simultaneous frequencies to increase usable bandwidth. What is BOND an acronym for? - ✔✔"Bandwidth on Demand". An aggregation of multiple communications channels or frequencies to increase data throughput. What signal technology does Bluetooth use? - ✔✔Bluetooth uses Frequency Hopping Spread Spectrum, or FHSS. What does the acronym FHSS stand for? - ✔✔FHSS is Frequency Hopping Spread Spectrum. What signal technology do 802.11a, 802.11g and 802.11n use? - ✔✔802.11 *a*, *g* and *n* use Orthogonal Frequency Division Multiplexing or OFDM. What does the acronym OFDM stand for? - ✔✔OFDM is Orthogonal Frequency Division Multiplexing What signal technology does 802.11b use? - ✔✔802.11b uses Digital Sequence Spread Spectrum or DSSS. What does the acronym DSSS stand for? - ✔✔DSSS is Direct Sequence Spread Spectrum. What is a VLAN? - ✔✔VLAN is short for Virtual Area Network, in which virtual subnets are segregated using switch ports, eliminating the need for physical moves, adds and changes. What do 802.11a and 802.11n share and how do they differ? - ✔✔Both are 802.11a and 802.11n are WiFi standards which can run at 5GHz, and yet they are not interoperable. What is a switch? - ✔✔A switch is a network device which creates a *separate collision domain on each port*, while remaining within a single broadcast domain. What is Real Evidence? - ✔✔Real Evidence is Physical evidence, like a hard disk drive. What is Corroborative Evidence? - ✔✔Corroborative Evidence supports other evidence, and it may include expert testimony. What is Direct Evidence? - ✔✔Direct Evidence includes eyewitness accounts and descriptions. What is Circumstantial Evidence? - ✔✔Circumstantial evidence indirectly establishes a fact through inference. What is Risk Management? - ✔✔Risk management is determining the cost-effectiveness of mitigating a risk. What is Risk Assessment? - ✔✔Risk Assessment is the evaluation of threats to determine vulnerabilities. What is Vulnerability Assessment? - ✔✔Vulnerability Assessment is the process of quantifying asset weaknesses. What is a Brownout? - ✔✔A Brownout is a long power drop. What is a Sag? - ✔✔A Sag is a short power drop. What is a Blackout? - ✔✔A Blackout is a long power loss. What is a Fault? - ✔✔A Fault is a short power loss. What is a Spike? - ✔✔A Spike is a short power surge. What is RAID 0? - ✔✔a Striped Set. What is RAID 1? - ✔✔Mirrored Set. What is RAID 10? - ✔✔Striped Mirror (nested RAID). What is RAID 3? - ✔✔Striped Bytes with Parity What is RAID 4? - ✔✔Striped Blocks with Parity What is a PDU? - ✔✔PDU stands for Protocol Data Unit What is Bluetooth's Practical Maximum Range? - ✔✔Bluetooth's maximum practical range is roughly 33 feet. What is the Speed of E1? - ✔✔Data on an E1 line travels at 2.048 megabits per second. What is the Speed of T1? - ✔✔1.544 megabits per second What is the Speed of T3? - ✔✔Data on a T3 line travels at 44.736 megabits per second; normally rounded up to 45. What is the Speed of E3? - ✔✔E3 = 34.368 megabits per second What is the formula for calculating Single Loss Expectancy (SLE)? - ✔✔SLE= EF x AV What is the formula for Annualized Loss Expectancy? (ALE) - ✔✔*ALE = SLE x ARO* In risk management, what is the formula for "Residual Risk" (RR)? - ✔✔Residual Risk = Total Risk x Countermeasures Which DES mode can propagate encryption errors? - ✔✔Cipher Block Chaining (CBC). Which DES mode can leave patterns in ciphertext? - ✔✔Electronic Code Book is the DES mode which can leave patterns in ciphertext. What is the Recovery Point Objective? - ✔✔The Recovery Point Objective amount of time business can endure system unavailability or data loss. Recovery Point Objective is a temporal measure used to determine how often systems should be backed up. What is the Recovery Time Objective? - ✔✔The Recovery Time Objective defines how quickly we must be back up and running. What type of Authentication is Something You Know? - ✔✔Something You Know is also known as Type 1 Authentication. A Password is a typical example of Type 1 Authentication. What type of Authentication is Something You Have? - ✔✔Something You Have is also known at Type 2 Authentication or Transient Authentication. It usually refers to a physical token, such as a Common Access Card (CAC) in the DoD. What type of Authentication is Something You Are? - ✔✔Something You Are is also known as Type 3 Authentication. Type 3 Authentication generally refers to biometric authentication methods. What Kind of Authentication is Something You Do? - ✔✔This can be referred to as behavioral biometrics. An example of this is typing keystroke rhythm, determined by measuring key dwell (how long you rest on a key) and flight time (the time it takes you to get from one key to the next). What Kind of Authentication is Somewhere You Are? - ✔✔An example of this would be authentication through GPS coordinates on a cellphone or other mobile device in your possession. What is the first step in the Business Continuity Planning (BCP) process? - ✔✔The first step in BCP planning is to determine scope. Backing up data remotely over the wire is known as? - ✔✔Electronic Vaulting. What is an alternate location for storing backup media known as? - ✔✔Off-site storage is the name for when backup media is stored at an alternate location. Who resumes critical business operations at the alternate site? - ✔✔The Recovery Team resumes critical business operations at the alternate site. Who returns the primary site to normal business operations? - ✔✔The Salvage team returns the primary site to normal business operations. What is keeping data current at an alternate site known as? - ✔✔Remote journaling is the process of keeping data current at an alternate site. Unlike electronic vaulting, this is a continuous process. Also, remotely journaling will generally store only transaction logs, not data. What is ITIL? - ✔✔ITIL stands for *Information Technology (IT) Infrastructure Library.* It is a set of best practices at the heart of IT service management, and was originally developed in the UK. ITIL has become ISO/IEC standard 20000. What is ISO 27002? - ✔✔It is a code of practice that provides *GUIDANCE*, providing an internationally accepted framework for best practice in Information Security Management (ISM) and systems interoperability. It also provides guidance for a certification-ready ISMS (Information Security Management System). What is ISO 27001? - ✔✔It is a vendor-neutral and technology-independent *SPECIFICATION* for an Information Security Management System (ISMS). Although it mandates the use of ISO 27002 as a source of guidance on controls, it does not preclude choosing controls from other sources as well. What is the most common legal system in the world? - ✔✔Civil Law (or tort law) What legal system do the US and UK base their laws on? - ✔✔Common Law (or statutory law) What is Mixed Law? - ✔✔Mixed Law is a combination of any two types of law (except for Administrative Law) *Usually Common Law + Civil Law*, but can also combine *Religious Law and Customary Law*. What is Common Law? - ✔✔Common law is legislated, relying on case rulings and precedents. Common law usually has a governmental body as the plaintiff, not a company or an individual. Most criminal proceedings fall under common law. Common law can also be referred to as statutory law (based on statute). What is Civil Law? - ✔✔Civil law is does not rely on case rulings and precedents. It is usually between individual plaintiffs and defendants. What is Customary Law? - ✔✔Customary law is not legislated, but instead reflects best practices of a community or business sector. Customary law can also include ingrained cultural practices which do not rely on the interpretation of religious doctrines. What is Religious Law? - ✔✔Religious law is based on the interpretation of religious doctrines. What step comes last in the development of a Business Contingency Plan (BCP)? - ✔✔The IT Contingency Plan What contingency or emergency planning discipline focuses on the restoration of specific IT services? - ✔✔The Disaster Recovery Plan (DRP). It is a subset of the Business Continuity Plan (BCP). What OSI layer do circuit-level proxy firewalls operate at? - ✔✔Session Layer What OSI layer do application-level proxy firewalls operate at? - ✔✔Application Layer Which two types of firewalls operate at both the Network and the Transport layers? - ✔✔Packetfiltering and Stateful Packet Inspection (SPI) firewalls. Rainbow Series Red Book? - ✔✔Trusted Network Infrastructure (TNI) What is the Rainbow Series Orange Book? - ✔✔Trusted Computing Base At what OSI layer do switches broadcast frames? - ✔✔Data Link At what OSI layer do routers operate? - ✔✔Network Link Encryption - ✔✔Encrypts not only the message payload, but also the routing information. Requires decrypting and re-encrypting at each communications node. Performed by communication service providers. Original cleartext is vulnerable to interception if a node is compromised. End-to-End Encryption - ✔✔Starts at the origination point, and is not decrypted until arrival at the destination. Routing information remains visible. Vulnerable to traffic analysis. Block Cipher - ✔✔Encrypts message one block at a time. Uses both transposition and substitution, making it stronger than stream-based ciphers, but it consumes more processing resources. Larger block sizes increase encryption strength. Usually implemented in software vs. hardware. Key Length - ✔✔The size of the key, generally measured in bits or bytes. Risk Acceptance - ✔✔When a company chooses to leave an asset unprotected. This occurs only when the risk or consequences are low. At what layer of the OSI model do DNS and DHCP operate? - ✔✔DNS and DHCP operate at the Application layer of the OSI model. In risk management calculations, which factor is expressed as a whole number or percentage instead of as a monetary (dollar) value? - ✔✔Annualized Rate of Occurrence (ARO) Risk Avoidance - ✔✔This is when the use of a technology or service is altogether eliminated rather than dealing with the risks that are incurred by implementation of that technology or service. Recovery Point Objective (RPO) - ✔✔The Recovery Point Objective (RPO) indicates the amount of data loss or system unavailability, measured in units of time, that a business can endure. The RPO rating can be used to determine how often a system should be backed up. Often synonymous with Maximum Tolerable Downtime (MTD). Which is it called when an intrusion detection system (IDS) or intrusion prevention system (IPS) fails to identify malicious traffic that enters the network? - ✔✔A False Negative. False Negatives should be reduced to the greatest degree possible, even at the cost of increasing false positives. What is it called when IDS or IPS identifies non-malicious traffic as malicious? - ✔✔A False Positive. Although False Negatives (allowing malicious code to pass through into the network), pose a greater threat than false positives, tuning must be performed to minimize false positives while eliminating false negative. This could be viewed as "balancing the threat". What is Database Replication? - ✔✔Copying data between live mirrors of a single database. Database replication serves not only to create a backup, but also supports high-availability and redundancy (clustering and load balancing). Database Shadowing - ✔✔Copies data from a live database to a read only copy. The database shadow is an offline backup, which is only made available in instances when the primary database is 'incapacitated'. What is an IPv4 address with all bits on? - ✔✔It is an IPv4 *Layer 3 Network limited broadcast address.* Limited broadcast addresses are sent to all devices on a broadcast domain; they are not forwarded by routers. What is an IPv4 address with only the last octet set to 255? - ✔✔It is an IPv4 *Layer 3 Network directed broadcast address.* These are sent to all devices on a *specific subnet* and can be forwarded by routers. What is Network Interface Card hex address with all bits on (FF)? - ✔✔A *Data Link Layer Ethernet broadcast* are sent to all nodes on a switch; they are not forwarded by routers. It is a message to all MAC addresses on the broadcast domain. What are the four steps of managing access control in an organization? - ✔✔1) Defining resources; 2) Determining users; 3) Specifying use; and, 4) Enforcing accountability. What type of controls can a background check provide? - ✔✔Although a background check is fundamentally an administrative personnel access control, it can also serve as a preventive, a detective, and a deterrent access control. What is Due Care? - ✔✔A legal liability concept that defines the minimum level of information protection that an organization must achieve. It also known as "Duty of Care". What is the Prudent Man Rule? - ✔✔The Prudent Man rule is the process of measuring business practices against the judgment of any reasonable individual. What is Due Diligence? - ✔✔Due diligence is a legal liability concept that requires an organization to continually review its practices to ensure that protection requirements are met. Due diligence is a process that typically follows due care. What are the OECD Guidelines? - ✔✔The Organization for Economic Cooperation and Development (OECD) Guidelines were created in 1980 to provide a framework for how information traverses international borders. What are the eight Principles of the OECD Guidelines? - ✔✔1) Collection Limitation; 2) Data Quality; 3) Purpose Specification; 4) Use Limitation; 5) Security Safeguards; 6) Openness; 7) Individual Participation; and, 8) Accountability. What is the OECD Collection Limitation Principle? - ✔✔Personal data collection must be limited to legal means and requires the individual's permission. What is the OECD Data Quality Principle? - ✔✔Requires that the integrity of the personal data be intact and maintained. What is the OECD Purpose Specification Principle? - ✔✔Requires the disclosure of and adherence to the purpose for collecting the personal information. What is the OECD Use Limitation Principle? - ✔✔Requires that information not be disclosed to other parties without the individual's permission. What is the OECD Security Safeguards Principle? - ✔✔Requires the reasonable protection of data against modification by or disclosure to unauthorized individuals. What is the OECD Openness Principle? - ✔✔Requires that the information collection policy be available for scrutiny. What is the OECD Individual Participation Principle? - ✔✔Requires that an entity allow individuals to inquire about whether that entity is storing the individual's personal information. This principle also enables the individual to challenge and update the content of the personal information. What is the OECD Accountability Principle? - ✔✔Requires that an entity adhere to the other seven OECD Principles. What Ports does FTP use, and for what purposes? - ✔✔FTP uses TCP Port 20 for data transfer and TCP Port 21 for control commands. What are the 3 opposing forces to the CIA triad? - ✔✔Disclosure; Alteration; and, Destruction. What is the advantage of ARP scanning over ICMP scanning? - ✔✔ARP scanning can discover firewalled devices on a local network. ARP does not cross routers; it stays within local networks. What is the function of Domain Name System (DNS)? - ✔✔DNS maps IP addresses to Fully-Qualified Domain Names (FQDNs). What computer component is most likely to be directly connected to the CPU? - ✔✔The Northbridge is the computer component that is most likely to be connected directly to the CPU. The Northbridge is a computer bus connected to the system's CPU and RAM. What is the Southbridge? - ✔✔The Southbridge is connected to the Northbridge and to all other peripheral and external devices, such as HDD, monitor, keyboard and mouse. What is Mandatory Access Control (MAC)? - ✔✔Mandatory Access Control uses permissions that are determined by organizational policy and a user's need to know. What does an attacker have in a Known Plaintext Attack? - ✔✔In a Known Plaintext Attack, the attacker has access to both the plaintext and the ciphertext. The attacker uses both of these and attempts to extract the original encryption key. What does an attacker have in a Ciphertext-Only Attack? - ✔✔If a Ciphertext-Only Attack, the attacker has access to the ciphertext alone. The attacker will seek to acquire multiple ciphertext messages in order to perform a statistical analysis on the messages to try to identify patterns or trends. Kerberos is a Single-Sign On (SSO) solution that uses what method to prevent replay attacks? - ✔✔Kerberos requires devices to be synchronized to the same time to prevent replay attacks, typically to a tolerance of five minutes. NTP (Network Time Protocol) can be used to synchronize the time between a Kerberos server and its clients so that authentication is not rejected. What element in the CIA triad is not directly provided by cryptography? - ✔✔Availability. What Risk Management equation is used when performing Risk Analysis? - ✔✔ALE = ARO X SLE What are the European Union (EU) privacy principles that govern the way an organization conducts itself when monitoring employees? - ✔✔1) Legitimacy; 2) Necessity; 3) Finality; 4) Transparency; 5) Proportionality; 6) Data Accuracy; 7) Security; and, 8) Awareness of the staff. EU Necessity - ✔✔The method of monitoring must be absolutely necessary. If a less-intrusive method exists it must be used. EU Legitimacy - ✔✔Data collected on employees must be used in a way that is legal or with the employee's consent. EU Finality - ✔✔Data collected on employees must be used for a specific, explicit, and legitimate purpose. EU Transparency - ✔✔Employer must completely disclose the monitoring process and the reasons for monitoring to employees. EU Proportionality - ✔✔Employee monitoring policies must be customized to the level of risk the employer incurs from the employee. EU Data Accuracy - ✔✔Private information must be kept accurate and up-to-date. EU Security - ✔✔Employer must take reasonable security precautions to protect the confidentiality of the employee's data. EU Awareness of the Staff - ✔✔Requires that the staff who handle data be properly trained. What is Implicit Deny? - ✔✔A firewall rule that automatically blocks traffic that is not specifically granted access. What is Explicit Allow? - ✔✔A firewall rule that permits specific traffic to pass through that firewall. What is the Bridge Model in Federated Identity Management? - ✔✔This is another name for the trusted third-party certification model. The trusted third-party model uses a single organization to manage the authentication and verification process for each company that is participating in the model. What is Federated Identity Management? - ✔✔The process of providing access to a company's data resources to organizations or parties that are not owned by the company. What is the Cross-Certification Trust Model in Federated Identity Management? - ✔✔This model involves creating a trust from each organization to every other organization that is participating in the model. Each participant must verify the trustworthiness of every other participant. PGP and GPG use the cross-certification trust model. What is true about all firewalls? - ✔✔All firewalls are multi-homed devices. A multi-homed device is a device that has more than one network connection. The purpose of a firewall is to block undesired network traffic and to allow desired network traffic to pass from one network interface to another. What occurs in a SYN FLOOD Attack? - ✔✔TCP packets with a spoofed source address request a connection to the target network. This attack disrupts the three-way TCP handshake by continually sending SYN packets to a host network, but never acknowledging the SYN-ACK packet reply from that target network. What occurs in a FRAGGLE Attack? - ✔✔Fraggle attacks send the UDP Echo packets to the broadcast address of a target network using a spoofed IP address. What occurs in a TEARDROP Attack? - ✔✔The Length and Fragmentation offset fields of sequential IP packets are modified, causing the target system to crash. What occurs in SMURF Attack? - ✔✔ICMP Echo Request packets are sent to the broadcast address of a target network by using a spoofed IP address. What is a deterrent access control? - ✔✔A deterrent access control is used to dissuade potential attacks or inappropriate use. What are the 7 categories of access controls? - ✔✔1) Directive; 2) Deterrent; 3) Preventive; 4) Compensating; 5) Detective; 6) Corrective; and 7) Recovery What is a compensating access control? - ✔✔A secondary access control that typically enforces elements of a primary access control that cannot be enforced by the primary access control itself. What is a corrective access control? - ✔✔A corrective access control is used to repair damage caused by malicious events. What is a recovery access control? - ✔✔Used to restore a system to a normal state after malicious activity has occurred. What is a preventive access control? - ✔✔Used to stop potential attacks by preventing users from performing specific actions or functions on a system. What are the 8 steps in the change management process? - ✔✔Request; Impact Assessment; Approval / Disapproval; Build and Test; Notification; Implementation; Validation & Documentation. What is the Requests step of the Change Management Process? - ✔✔Involves the written submission of proposed changes to a management committee. What is the Impact Assessment step of the Change Management Process? - ✔✔Determining of all the positive and negative effects that will result from accepting the change. What is the Approval/Disapproval step of the Change Management process? - ✔✔The point at which the committee formally accepts or rejects the proposed change. What is the Build and Test step of the Change Management Process? - ✔✔Developing and testing proposed changes in an offline environment. What is the Notification Step of the Change Management process? - ✔✔Users are notified that the change is going to be deployed. What is the Implementation step of the Change Management process? - ✔✔Incremental deployment is used so that effects can be monitored. What is the Validation step of the Change Management process? - ✔✔Reviews how implementation went. What is the Documentation step of the Change Management process? - ✔✔Reports on the results of a system change, including the modifications that were made and any important information discovered. What is Configuration Management? - ✔✔The process of developing a standard method of securing or hardening systems within an organization. What is an International Common Criteria Security Target (ST)? - ✔✔The *documentation* for a system or product that is to be tested. What are the International Common Criteria? - ✔✔Standards used to test the security of IT products. What is the goal of the International Common Criteria? - ✔✔To identify and remove *known* vulnerabilities from a product; not the discovery of new vulnerabilities. What are the 4 elements of the International Common Criteria testing process? - ✔✔1) ToE; 2) ST 3) PP; and 4) EAL. What is the ToE (Target of Evaluation)? - ✔✔Refers to the system or product that is to be tested. What is an ST (Security Target)? - ✔✔It is the documentation that describes the security requirements for the Target of Evaluation (ToE). What is PP (Protection Profile) ? - ✔✔A set of security objects for the type of product to be tested. What is an EAL (Evaluation Assurance Level)? - ✔✔A rating level that is assigned to the product after the product has been tested. What are the 7 Evaluation Assurance Level (EAL) Ratings? - ✔✔1) Functionally Tested; 2) Structurally Tested; 3) Methodically tested and checked; 4) Methodically designed, tested and reviewed; 5) Semi-formally designed and tested; 6) Semi-formally verified, designed and tested; and, 7) Formally verified, designed and tested. What is EAL1? - ✔✔Functionally Tested. What is EAL2? - ✔✔Structurally Tested What is EAL3? - ✔✔Methodically tested and checked. What is EAL4? - ✔✔Methodically Designed, Tested and Reviewed. What is EAL5? - ✔✔Semi-Formally Designed and Tested. What is EAL6? - ✔✔Semi-Formally Verified, Designed and Tested. What is EAL7? - ✔✔Formally Verified, Designed and Tested. What is Database Shadowing? - ✔✔With two or more databases that are running simultaneously, updates made to the primary database are replicated to one or more databases which can be located either locally or remotely. What is Remote Journaling? - ✔✔Remote Journaling involves sending the database transaction log to a remote location. What is Electronic Vaulting? - ✔✔Electronic Vaulting involves transmitting bulk data to an offsite backup storage facility. What is Encapsulation in Object-Oriented Programming (OOP)? - ✔✔It ensures that a class defines only the data that it requires. What is Inheritance in Object-Oriented Programming (OOP)? - ✔✔It ensures that a subclass receives the characteristics of its parent class. What is Polyinstantiation in Object-Oriented Programming (OOP)? - ✔✔Polyinstantiation allows different versions of the same data to exist at different sensitivity levels. What is an ICMP FLOOD attack? - ✔✔Large numbers of ICMP "Echo Request" packets are sent to the target network to consume available bandwidth and/or system resources. What is a TEARDROP Attack? - ✔✔The Length and Fragmentation offset fields of sequential IP packets are modified, causing the target system to crash. What is UDP FLOOD Attack? - ✔✔Large numbers of UDP packets are sent to the target network to consume available bandwidth and/or system resources. What is a transient? - ✔✔A momentary electrical line noise disturbance. What is the Take-Grant model? - ✔✔A security model that specifies the rights that a subject can transfer to or from another subject or object. Why is Kerberos not susceptible to eavesdropping? - ✔✔Because Kerberos credentials are encrypted by using a secret key before being sent over the network. Why would a user need to re-authenticate to a Kerberos authentication server? - ✔✔Because Kerberos session keys have a specific lifetime. That lifetime can be configured so that a user need only reauthenticate to a server once per day. Why should caution be exercised when configuring the lifetime of a Kerberos session key? - ✔✔A Kerberos session key with too long a lifetime makes the Kerberos realm more vulnerable to replay attacks. In VPN access, what is the advantage of callback over Caller ID? - ✔✔Caller ID numbers can be easily spoofed on most systems. What is the advantage of employing contract security guards over proprietary security guards? - ✔✔They are generally less expensive. What is the best gas-based fire suppression system to install in a data center? - ✔✔FM-200 (a halon replacement) is the best gas-based fire suppression system to install in a data center. It works by using a chemical reaction that lowers the temperature of the fire and removes the fuel from the fire. What is the focus of a Disaster Recovery Plan (DRP)? - ✔✔A DRP focuses on the restoration of specific IT services so that a company can recover from a disaster quickly. A Disaster Recovery Plan (DRP) is subset of the Business Continuity Plan (BCP). What is a Business Impact Analysis (BIA)? - ✔✔Identifies business systems and processes that are critical for a company to continue to operate. What is a Business Continuity Plan (BCP)? - ✔✔A BCP focuses on maintaining business operations no matter what events a business faces, and contains procedures (DRP) that should be performed in the event of a disaster. A BCP also includes the order in which the procedures should be implemented. What security architecture framework creates a chain of traceability through six different perspectives of security design? - ✔✔The Sherwood Applied Business Security Architecture (SABSA). What security architecture framework enables the viewing of an architecture from six different perspectives? - ✔✔Zachmann is ACM-based framework. Unlike SABSA, Zachmann doesn't create a chain of traceability. What are the 6 different perspectives of the Zachmann security architecture framework? - ✔✔Contextual, Conceptual, Logical, Physical, Component & Operational. What is the security architecture framework that was inspired by frameworks that were developed by the DoD? - ✔✔The Open Group Architecture Framework (TOGAF) developed by The Open Group in the 1990s was inspired by Department of Defense (DoD) frameworks. What are the four basic security architecture domains of The Open Group Architecture Framework (TOGAF)? - ✔✔Business, Application, Data and Technology. What does the TOGAF Business Domain contain? - ✔✔Information about the business strategy and processes. What does the TOGAF Application Domain contain? - ✔✔Information about specific business applications that will be deployed and how those applications relate to business processes. What does the TOGAF Data Domain contain? - ✔✔Information about the company's data assets and data management. What does the TOGAF Technical Domain contain? - ✔✔Information about hardware, software, and network infrastructure. What is TOGAF's iterative development process known as? - ✔✔The Architecture Development Method (ADM). Describe TOGAF's ADM process. - ✔✔The Architectural Development Model is a cyclic process in which the results of each phase of the process are compared to the requirements and expectations of the design. What is the advantage of an Iris Scan over other biometric access controls? - ✔✔Iris scans are the most accurate and non-invasive of the biometric access controls. An iris scan is a fully passive access control: the user being authenticated is not required to touch anything or actively provide information to the authenticating system. What are the halon replacements for fire suppression? - ✔✔FM-200; FE-13; Argon & Inergen. Which halon replacement is safest for humans? - ✔✔FE-13 What is the purpose of a ticket-granting server in Kerberos? - ✔✔A TGS sends a session key to an authenticated user in a Kerberos network *when that user needs to access a network device.* WS-SecureConversation - ✔✔Creates security contexts for fast message exchanges. WS-Security - ✔✔Provides integrity, encryption and authentication for Simple Object Access Protocol (SOAP) messages. What is SOAP? - ✔✔Simple Object Access Protocol is a messaging protocol that allows programs that run on disparate operating systems (such as Windows and Linux) to communicate using Extensible Markup Language (XML). WS-Trust - ✔✔Creates security tokens and brokers trust relationships between messaging participants. WS-Policy - ✔✔Advertises security, Quality of Service and other policies for web services. What type of backup archives only the files that have changed since the last backup of any type? - ✔✔Incremental. What type of backup archives only files that have changed since the last *full* backup? - ✔✔Differential. What memory protection technique copies a *fixed-length block* of memory to disk? - ✔✔Paging. What memory protection technique copies an *entire process* to disk? - ✔✔Swapping. What is Virtual Memory? - ✔✔The mapping of hardware memory addresses to applications, using swapping or paging. What is Object Encapsulation? - ✔✔A means of process isolation that helps prevent processes on a system from interfering with one another. It requires that a process run as a black box, in which the process sends and receives information but does not share its functions with other processes. What is Time Multiplexing? - ✔✔Time Multiplexing enables multiple processes to share system resources by allocating dedicated time slots to each process. Which asymmetric encryption algorithm is not vulnerable to replay attacks? - ✔✔RSA. What are the three private IPv4 address ranges according to RFC 1918? - ✔✔10 172.16 - 172.32 192.168 What are the three IPv4 classful address ranges? - ✔✔0-126 (127 is reserved for loopback) 128-191 192-233 Which security architecture models combines elements of both Bell-LaPadula and Biba? - ✔✔The Lipner security architecture model combines elements of both Bell-LaPadula and Biba. Bell-LaPadula protects data confidentiality, while Biba protects data integrity. Lipner protects both confidentiality and integrity. How does the Graham-Denning security architecture model work? - ✔✔Through an access control matrix (ACM) to map subjects and objects to a series of 8 rules. What are the rules of Graham-Denning? - ✔✔create or delete an object; create or delete a subject; access: read, grant, delete or transfer. How does the Harrison-Ruzzo-Ullman security architecture model work? - ✔✔It extends GrahamDenning by including a rights integrity protection system that prevents a subject or object from being created if that subject or object already exists in the access control matrix (ACM). What is CoBIT? - ✔✔An IT management framework created by the Information Systems Audit and Control Association (ISACA) and the IT Governance Institute (ITGI). What are the four domains of CoBIT? - ✔✔Planning and organization; Acquisition and implementation; Delivery and support & Monitoring and evaluation. What are the main tasks of ITIL? - ✔✔Service strategy, design, transition, operation and continual improvement. Service Strategy task of ITIL - ✔✔Describes how new business needs will be deployed and managed. Service Design task of ITIL - ✔✔Process of designing the services described in the Service Strategy. Service Transition task of ITIL - ✔✔A project management structure to transition from design into operation. Service Operation task of ITIL - ✔✔The point at which all services are deployed to users & metrics are being captured. Continual Service Improvement task of ITIL - ✔✔Uses metrics from the Service Operations task to determine what improvements need to be made to the system. To allow hosts from a specific domain to access your intranet when you have a firewall in place with an implicit deny rule, what ACL (access control list) rule should you implement first? - ✔✔You should implement an "allow" ACL rule for that particular domain first. ACLs typically follow a specific-to-general pattern of matching. The last rule in the ACL is typically the most general rule. How are ACL rules evaluated by a firewall? - ✔✔1) If the packet matches a statement that allows the packet, the firewall then allows the traffic to pass through and no further ACL rules are processed. 2) If the packet matches a statement that denies the packet, the firewall drops the packet and no further ACL rules are processed. 3) If the packet does not match any of the ACL statements, the firewall will apply its default rule. What runs in OS Ring 0? - ✔✔The OS kernel and memory resident components What runs in OS Ring 1? - ✔✔Other OS components. What runs in OS Ring 2? - ✔✔Drivers and protocols. What runs in OS Ring 3? - ✔✔User-level programs and applications Which OS Ring has the highest level of privilege? - ✔✔OS Ring 0. Which OS Ring has the lowest level of privilege? - ✔✔OS Ring 3. Which OS Ring(s) run in supervisory mode? - ✔✔OS Rings 0-2 Which OS Ring(s) run in user mode? - ✔✔Only OS Ring 3 runs in user mode What is the OS kernel? - ✔✔The part of an OS that always remains resident in memory. Where do the non-resident OS components reside? - ✔✔OS Ring 1. These components are called ondemand as needed by the kernel. Where do I/O drivers and system utilities reside? - ✔✔OS Ring 2. These access peripheral devices, access special files, and perform data file system operations such as read, write and delete. Where do applications and user-accessible programs reside? - ✔✔OS Ring 3. Using mediated-access mode, Ring 3 programs ask a handler or driver in one of the lower numbered rings for file and printer access, for example. What is P2PE? - ✔✔Point-to-Point Encryption. It is part of the PCI DSS standard. It encrypts cardholder data as soon as it swiped. That data remains encrypted until it reaches the payment processor. What type of cipher operates by rearranging groups of characters? - ✔✔Block transposition cipher. What type of investigation typically uses decompiling or reverse engineering to detect malicious activity? - ✔✔Software analysis. It can be part of the digital forensics process. What type of lighting is most appropriate in foggy conditions? - ✔✔Sodium vapor lights are most appropriate in foggy conditions. They emit a soft yellow light that reduces glare in fog. The yellow color of sodium vapor light does not disperse through the moisture in the air as readily as white light does. What is the disadvantage of using fluorescent lighting outdoors? - ✔✔Fluorescent lighting operates on the principle of a non-reactive gas excited by the application of a current to produce light. It is sensitive to temperature changes, and will dim once sufficient energy is lost due to low temperatures. When should user accounts be deleted? - ✔✔Upon termination of employees who are unlikely to return to the company, and the user's account is not tied to data that cannot be easily accessed by another user account, such as encrypted information. When should a user account be disabled? - ✔✔When there is a possibility that the user may return, or upon termination of a disgruntled employee who has access to encrypted files. What Configuration Management task is most likely to involve the monitoring of security configuration changes over time? - ✔✔Baselining, which is the process of taking a snapshot of the system's security configuration at a given point in time. When should Baselines be updated? - ✔✔When controlled security changes (through change management) are implemented on a system. What is Patch Management? - ✔✔Patch Management is the management of system or application software updates. What is Vulnerability Scanning? - ✔✔The process of examining a system for unpatched, known vulnerabilities and unsecure configurations. What is Vulnerability Management? - ✔✔Vulnerability Management is a process of addressing any vulnerabilities or configuration problems that were discovered during vulnerability scanning. What is Change Management? - ✔✔The process of understanding, communicating, and documenting changes to a system so that negative effects from change can be avoided, or at least minimized. What are the steps of the Change Management process? - ✔✔Identify and propose the change; determine the risk of the change and test it; schedule the change and notify users; implement the change and document the results. What method of Fire Detection is typically used by Smoke Sensors? - ✔✔An electrical charge is the method of fire detection that is typically used by smoke sensors. Both ionization and photoelectric smoke sensors create an electrical charge that can be interrupted by the presence of smoke. How do Ionization Smoke Sensors create the electrical charge they use in fire detection? - ✔✔By use of a radioactive emission to create the electrical charge that they use in fire detection. How do Photoelectric Smoke Sensors create the electrical charge they use in fire detection? - ✔✔They use a light emitting diode (LED) that creates the electrical charge that sends a signal to the sensor. When smoke interrupts the electric charge, the sensor will trigger an alarm. What can cause Smoke Detectors to generate false positives? - ✔✔Dust or other airborne contaminants can be misinterpreted by these sensors as smoke. What methods of Fire Detection are used by Flame Sensors? - ✔✔Flame Sensors detect fires by detecting infrared and ultraviolet light from fire. Flame Sensors must have a line of sight with the source of fire. What method of Fire Detection is used by Heat Sensors? - ✔✔Heat Sensors use temperature for fire detection. they work by measuring the ambient temperature of an area. If that temperature exceeds a predetermined threshold, or if the temperature begins to rise faster than a predetermined rate, then the sensor will trigger an alarm. Which organization is responsible for the Ten Commandments of Computer Ethics? - ✔✔The Computer Ethics Institute (CEI). They are modeled after the King James Version (KJV) of the Decalogue. What are the CEI's Ten Commandments of Computer Ethics? - ✔✔1) Thou shalt not use a computer to harm other people. 2) Thou shalt not interfere with other people's computer work. 3) Thou shalt not snoop around in other people's computer files. 4) Thou shalt not use a computer to steal. 5) Thou shalt not use a computer to bear false witness. 6) Thou shalt not copy or use proprietary software for which you have not paid. 7) Thou shalt not use other people's computer resources without authorization or proper compensation. 8) Thou shalt not appropriate other people's intellectual output. 9) Thou shalt think about the social consequences of the program you are writing or the system you are designing. 10) Thou shalt always use a computer in ways that ensure consideration and respect for your fellow humans. Where can the Internet Activities Board (IAB) code of ethics be found? - ✔✔The IAB code of ethics is found in RFC 1087 which was first published in 1987. It is entitled "Ethics and the Internet." What are considered to be unethical behaviors according to "Ethics and the Internet" (IAB)? - ✔✔1) Seeking to gain unauthorized access to the resources of the Internet; 2) Disrupting the intended use of the Internet; 3) Wasting resources (people, capacity or computer) through unethical actions; 4) Destroying the integrity of computer-based information; and, 5) Compromising the privacy of users. What are the four canons of the (ISC)2 Code of Ethics? - ✔✔1) Protect society, common good, public trust and confidence, and infrastructure; 2) Be honorable, honest, just, responsible and legal in all actions; 3) Provide diligent and competent service to principals; and, 4) Advance and protect the profession. What is the First Commandment of Computer Ethics? - ✔✔Thou shalt not use a computer to harm other people. What is the Second Commandment of Computer Ethics? - ✔✔Thou shalt not interfere with other people's computer work. What is the Third Commandment of Computer Ethics? - ✔✔Thou shalt not snoop around in other people's computer files. What is the Fourth Commandment of Computer Ethics? - ✔✔Thou shalt not use a computer to steal. What is the Fifth Commandment of Computer Ethics? - ✔✔Thou shalt not use a computer to bear false witness. What is the Sixth Commandment of Computer Ethics? - ✔✔Thou shalt not copy or use proprietary software for which you have not paid. What is the Seventh Commandment of Computer Ethics? - ✔✔Thou shalt not use other people's computer resources without authorization or proper compensation. What is the Eighth Commandment of Computer Ethics? - ✔✔Thou shalt not appropriate other people's intellectual output. What is the Ninth Commandment of Computer Ethics? - ✔✔Thou shalt think about the social consequences of the program you are writing or the system you are designing. What is the Tenth Commandment of Computer Ethics? - ✔✔Thou shalt always use a computer in ways that ensure consideration and respect for your fellow humans. What is the First Unethical Behavior according to "Ethics and the Internet"? - ✔✔Seeking to gain unauthorized access to the resources of the Internet. What is the Second Unethical Behavior according to "Ethics and the Internet?" - ✔✔Disrupting the intended use of the Internet. What is the Third Unethical Behavior according to "Ethics and the Internet?" - ✔✔Wasting resources such as people, capacity or computers through unethical actions. What is the Fourth Unethical Behavior according to "Ethics and the Internet?" - ✔✔Destroying the integrity of computer-based information. What is the Fifth Unethical Behavior according to "Ethics and the Internet?" - ✔✔Compromising the privacy of users. What is the first ACL rule that is evaluated by a firewall? - ✔✔If the packet matches a statement that allows the packet, the firewall then allows the traffic to pass through. What is the second ACL rule that is evaluated by a firewall? - ✔✔If the packet matches a statement that denies the packet, the firewall drops the packet. What is the third ACL rule that is evaluated by a firewall? - ✔✔If the packet does not match any of the specific ACL statements, the firewall will apply its default rule. What is the difference between the Recovery Time Objective and the Recovery Point Objective? - ✔✔The RTO is the maximum time that an organization can continue function with critical functions degraded while the RPO is the amount of data loss an organization can accept (measured in time to create or recreate) and still remain functional. What is the difference between Disaster Recovery and Business Continuity Plans? - ✔✔A disaster recovery plan revolves around getting critical systems *back online* so that mission is not negatively affected. A business continuity plan focuses on long-term strategy to keep an organization functioning *without interruption* after a disaster. Which types of firewalls make decisions based only on the Network and Transport layer of the OSI model? - ✔✔Packet filter and stateful firewalls operate at the OSI Network and Transport layers. In what PDU are Segments encapsulated? - ✔✔Segments are encapsulated in Packets. In what PDU are Packets encapsulated? - ✔✔Packets are encapsulated in Frames. In what PDU is Application Data encapsulated? - ✔✔Application Data is encapsulated in a Segment at the Transport Layer. At what layer are Frames converted to Bits? - ✔✔Frames are converted to Bits at the Data Link layer. Bits are not de-encapsulated from Frames. What is another name for DNS cache poisoning? - ✔✔Pharming What three attack vectors use spoofed Media Access Control (MAC) addresses? - ✔✔1) ARP cache poisoning; 2) CAM table flooding; and, 3) Denial of Service. What is Tripwire? - ✔✔HIDS How are EUI-64 addresses constructed? - ✔✔Split the 48-bit MAC address down the middle, into OUI and EUI; place hex FF and FE between them; convert the first 8 bits of the OUI to binary and flip the seventh bit; then convert the first 8 bits back to hex. What is the advantage of SLIP over PPP? - ✔✔Lower overhead. SLIP is a bare-bones protocol, often used by microcontrollers for IP packet encapsulation. What will occur if a router must send a 2,500-byte packet over an Ethernet interface? - ✔✔The router will fragment the packet into two packets, unless the Don't Fragment (DF) bit is set. What is the Maximum Transmission Unit size of an Ethernet packet? - ✔✔1,500 bytes. When encrypting the contents of a disk, should symmetric or asymmetric encryption be used? - ✔✔Symmetric encryption should be used to encrypt the contents of a disk, as the same key is used for encrypt and decrypt. What is the longest hash that can be created by the Secure Hash Algorithm? - ✔✔SHA can create up to a 512-bit hash value. To what type of attack is RSA susceptible? - ✔✔Chosen ciphertext, because an attacker can use the victim's public key to encrypt plaintext and then decrypt the resulting ciphertext in order to determine exploitable patterns. To what does the attacker have access in a brute-force attack? - ✔✔In a brute-force attack, the attacker only has access to the ciphertext. What purpose does it serve to have employees of a company acknowledge that they have read and understood the company's security policy? - ✔✔By having employees acknowledge that they have read and understood a company's security policy--whether they actually have or haven't done so--legally protects the company, and allows the company to hold employees responsible if they violate the policy. What is the Annualized Rate of Occurrence, or ARO? - ✔✔The ARO is the frequency at which a risk event occurs and is expressed as the number of losses that occur in one year. In the case of a component or piece of equipment that fails once every two years has an ARO of 0.5; every four years would be an ARO of 0.25. What is the Single Loss Expectancy, or SLE? - ✔✔The SLE is the total cost of a specific loss. What is the Annualized Loss Expectancy, or ALE? - ✔✔ALE is the average yearly cost of a risk. It is determined by multiplying the number of losses that occur in one year by the total cost of a specific loss. What should an organization do if the cost of a loss due to risk is less than mitigating that risk? - ✔✔Accept the risk, provided that there are no significant moral or ethical considerations or legal requirements involved. When would assessors be most likely to perform a quantitative risk assessment vs qualitative? - ✔✔When the assessors have extensive experience performing risk assessments. What focuses on the restoration of specific IT services? - ✔✔A Disaster Recovery Plan. What is the difference between a Business Continuity Plan and a Disaster Recovery Plan? - ✔✔BCPs focus on maintaining business operations no matter what events a business faces, while DRPs focus on the restoration of specific IT services. A DRP is a subset of the BCP, which contains procedures that should be performed in the event of a disaster. What three metrics influence CVSS scoring? - ✔✔In order, the CVSS metrics are: 1) Base metrics; 2) Temporal metrics; and, 3) Environmental metrics. Which CVSS score is used by an organization to prioritize their responses to vulnerabilities? - ✔✔The CVSS Environmental Score is the final score that determines priority of response to vulnerabilities. What are the difference between Point-to-Point Encryption and End-to-End Encryption? - ✔✔P2PE encrypts cardholder data as soon as it is swiped. The data is not decrypted until it reaches the payment processor. E2EE although it also encrypts cardholder data once swiped, is de-crypted and re-encrypted at each step along the path to the payment processor. P2PE thus precludes merchants from performing key management. In which countries are T1 and T3 lines used? - ✔✔T1 and T3 lines are used in the United States, Canada, Japan and South Korea. Where are E1 and E3 lines used? - ✔✔The United Kingdom and Europe. Which WiFi Standards use Orthogonal Frequency Division Multiplexing? - ✔✔802.11a, 802.11g and 802.11n all use Orthogonal Frequency Division Multiplexing, or OFDM. What is another name for the False Reject Rate in biometric controls? - ✔✔This occurs when a biometric control system fails to validate an authorized user. A False Reject is also known as a Type 1 biometric error. What is another name for a False Accept--or False Po [Show More]

Last updated: 1 year ago

Preview 1 out of 112 pages