Deck 2: General Security Concepts

Question 1

Ensuring that users have access only to the files they need to complete their tasks is an example of which principle?

A)Separation of duties
B)Implicit deny
C)Least privilege
D)Keep it simple

Answer 1

C

Question 2

Which of the following is not one of the three general methods used in authentication?

A)Something you have
B)Something you do
C)Something you are
D)Something you know

Answer 2

B

Question 3

A database server is put on the network by the for a project manager.No one is told it is there except for the project manager,so that he can work on it without worrying that other individuals will try to get to it.This is an example of which principle?

A)Layered defense
B)Job rotation
C)Diversity of defense
D)Security through obscurity

Answer 3

D

Question 4

Jane is in the finance department.Although she should not be able to modify files or folders from the marketing department,she can,and does.This a problem of ___________.

A)confidentiality
B)integrity
C)availability
D)authentication
E)nonrepudiation

Question 5

The incident response team reviewed the security logs and discovered that the network had been breached,due to a misconfigured firewall.This is a failure of which element of the operational model of computer security?

A)Protection
B)Prevention
C)Detection
D)Response

Question 6

The network engineer suggests purchasing two firewalls from different companies so that a vulnerability affecting one type of firewall will not leave the entire network vulnerable.This is an example of which principle?

A)Layered defense
B)Job rotation
C)Diversity of defense
D)Security through obscurity

Question 7

A list of web sites that can be visited is created.Only sites that are on the list are allowed to be accessed.This is an example of which principle?

A)Least privilege
B)Separation of duties
C)Implicit deny
D)Keep it simple

Question 8

Bob inadvertently disconnects the cable from the company file server.This creates a problem of ________.

A)confidentiality
B)integrity
C)availability
D)authentication
E)nonrepudiation

Question 9

Requiring one employee to place an order and another employee to authorize the sale is an example of which principle?

A)Least privilege
B)Separation of duties
C)Implicit deny
D)Keep it simple

Question 10

The database administrator falls ill and is not able to come to work for three weeks.No one else in the company knows how to administer the database server.This is a result of not following which principle?

A)Layered defense
B)Job rotation
C)Diversity of defense
D)Security through obscurity

Question 11

The IDS fails to alert on an intruder's ping sweep and port scan.This is a failure of which element of the operational model of computer security?

A)Protection
B)Prevention
C)Detection
D)Response

Question 12

Ensuring that and individual is who they claim to be is the function of _________.

A)confidentiality
B)integrity
C)availability
D)authentication
E)nonrepudiation

Question 13

Reducing the number of services to the least number necessary for it to properly perform its functions is an example of which principle?

A)Least privilege
B)Separation of duties
C)Implicit deny
D)Keep it simple Services are functions,not privileges.Having fewer services on a computer reduces the complexity of the configuration.

Question 14

The hacker was successful in breaching the firewall,the packet filtering router,and the internal firewall,but was quickly detected and unable to get past the workstation personal firewall.This is an example of what principle?

A)Layered security
B)Job rotation
C)Diversity of defense
D)Security through obscurity

Question 15

Joe sends a scathing e-mail to his boss regarding increased work hours.Joe tries to deny sending the e-mail,but is unable to due to the use of digital signatures.This is an example of ________.

A)confidentiality
B)integrity
C)availability
D)authentication
E)nonrepudiation

Question 16

___________ places the focus on the security processes and the actual data.

A)Computer security
B)Network security
C)Information assurance
D)Communications security

Question 17

The term which refers to the attempt to gain unauthorized access to systems and computers used by a telephone company to operate its telephone network is a _______.

A)phone hacker
B)hacktivist
C)commh@ck3r
D)phreaker

Question 18

Jane is in the finance department.Although she should not be able to open files or folders from the marketing department,she can and does.This a problem of ___________.

A)confidentiality
B)integrity
C)availability
D)authentication
E)nonrepudiation

Question 19

A newly purchased server with a defect catches fire and all data on the device is lost.A backup was never performed.This is a failure of which element of the operational model of computer security?

A)Protection
B)Prevention
C)Detection
D)Response

Question 20

The operational model of security is _____________.

A)Prevention = Protection + (Detection + Response)
B)Prevention = Protection + (Detection x Response)
C)Protection = Prevention + (Detection + Response)
D)Protection = Prevention + (Detection x Response)

Question 21

Jane spends quite a bit of time on Facebook,and other social networking sites during work hours.This has resulted in reduced productivity.This is likely a violation of which policy?

A)Due diligence
B)E-mail policy
C)Need to know
D)Acceptable use

Question 22

Which of the following is a security model that addresses integrity?

A)Biba
B)Bell-LaPadula
C)Layered defense
D)Ring

Question 23

Authentication means that the person who sends and e-mail will be unable to deny sending the e-mail.

Question 24

Access controls,firewalls,and encryption are technologies used for prevention.

Question 25

Computer security and information assurance are the same thing.

Question 26

The policies of the Biba model are

A)Ring (no read down)and Low-Water-Mark (no write up)
B)*-Property (no write down)and Simple Security Rule (no read up)
C)*-Property (no write up)and Simple Security Rule (no read down)
D)Ring (no read up)and Low-Water-Mark (no write down)

Question 27

Background checks,drug testing,retirement,and termination are elements found in which type of policy?

A)Due diligence
B)Human resources
C)Equal opportunity
D)Privacy

Question 28

Auditability refers to whether a control can be verified as functioning or not.

Question 29

A person who tries to gradually obtain information necessary to compromise a network-by first appealing for help,and then,if necessary,by a more aggressive approach-is a(n)__________.

A)phreaker
B)social engineer
C)hacktivist
D)terrorist

Question 30

Nonrepudiation means that the person who sends an e-mail will be unable to deny sending the e-mail.

Question 31

The A in CIA refers to the term auditability.

Question 32

Audit logs,intrusion detection systems,and honeypots are technologies used for detection.

Question 33

During the day,it takes an employee twice as long to retrieve files from the server that is under attack.The attack has resulted in a degradation of availability.
If the employee is able to get the files,but it takes twice as long,it means that the employee can only get half as many files in a day.

Question 34

When files are modified by someone who is not authorized to do so,this is problem of confidentiality.

Question 35

The formula for the operational model of computer security is Prevention = Protection + (Detection + Response)

Question 36

A company doing business online conducted all financial transactions over the Internet without any encryption.As a result,customer information such as credit card numbers,expiration dates,and the security codes found on the back of the credit cards was stolen.This is a violation of which policy?

A)Due diligence
B)Due process
C)Need to know
D)Acceptable use

Question 37

John,who is in the development group,has admin passwords to both the development group files and the production group files.This might be a violation of which policy?

A)Due diligence
B)Due process
C)Need to know
D)Acceptable use

Question 38

Which of the following is a security model that uses transactions as the basis for its rules?

A)Biba
B)Bell-LaPadula
C)Layered defense
D)Clark-Wilson

Question 39

Rumors spread around the office that Mrs.Smith was stealing office supplies as well as talking badly about the senior management.This rumor eventually reached her boss,who then fired her.This is likely a violation of which policy?

A)Due diligence
B)Due process
C)Equal opportunity
D)Acceptable use

Question 40

The policies of the Bell-LaPadula model are

A)Ring (no read down)and Low-Water-Mark (no write up)
B)*-Property (no write up)and Simple Security Rule (no read down)
C)Ring (no read up)and Low-Water-Mark (no write down)
D)*-Property (no write down)and Simple Security Rule (no read up)

Question 41

Backups,incident response teams,and computer forensics are response technologies.

Question 42

_______________ deals with the ability to verify that a message has been sent and received and that the sender can be identified and verified.

Question 43

Ensuring that an individual is who they claim to be before allowing them to access information they are authorized to access is _______________.

Question 44

A security procedure is a high-level statement produced by senior management that outlines both what security means to the organization and the organization's goals for security.

Question 45

To ensure that only those individuals who have authority to view a piece of information may do so is called _______________.

Question 46

Bob works in a small office with a network of computers.Bob,along with all the other employees,is responsible for securing his own computer on the network.This is an example of network security.

Question 47

_______________ security takes a granular view of security by focusing on protecting each computer and device individually instead of addressing protection of the network as a whole.

Question 48

Three means of establishing auditability: something you know,something you have,or something you are.

Question 49

_______________ security places the emphasis on controlling access to internal computers from external entities.

Question 50

Network security places the emphasis on controlling access to external resources from internal entities.

Question 51

_______________ is the condition that a control can be verified as functioning.

Question 52

The ability to manage whether a subject can interact with an object is called _______________.

Question 53

Operating systems and applications all implement rights and permissions the same way.

Question 54

Gathering seemingly unimportant information and then combining it to discover potentially sensitive information is known as _______________.

Question 55

The concept of separation of duties applies to networks,but is inappropriate for physical environments.

Question 56

Ensuring that changes made to the data are only done by users who are authorized to do so protects the data's _______________.

Question 57

All applications,scripts,and batch files run in the same security context of the user who is logged in at the time.

Question 58

The objective of the Bell-LaPadula security model is integrity.

Question 59

_______________ ensures that the data,or the system itself,is available for use when the authorized user wants it.

Question 60

Making the effort to compromise a system more costly than the value of accomplishing it is the goal of security.

Question 61

During a job interview you are asked to explain in what ways you would secure the company's information if you were hired.Using any three security policies from the chapter,describe how you would secure their information.

Question 62

Describe the Bell-LaPadula and Biba security models and the policies they use to protect information.

Question 63

Your boss is concerned with information security issues concerning new employees and employees who leave the company and would like your recommendations.Describe what human resources policies should be in place.

Question 64

In the context of information security,what does the acronym CIA stand for? Explain each term.

Question 65

During a job interview you are asked to explain in what ways you would secure the company's information if you were hired.Using any three principles of security from the chapter,describe how you would secure their information.