Deck 4: Basic Information Security Model

Question 1

Vulnerabilities are

A) Safeguards used to minimize the impact of threats
B) Capabilities, intentions and attack methods of adversaries to cause harm to assets
C) Resource or information that is to be protected
D) Weaknesses in an information system that can lead to a compromise of an asset

Answer 1

D

Question 2

Assets are

A) Resources or information that is to be protected
B) Safeguards used to minimize the impact of threats
C) Capabilities, intentions and attack methods of adversaries to cause harm to assets
D) Weaknesses in an information system that can lead to a compromise of an asset

Answer 2

A

Question 3

Models are useful because

A) They highlight resource or information that is to be protected
B) They highlight weaknesses in information systems that can be compromised
C) They draw attention to the essential details of a problem
D) They describe safeguards used to minimize the impact of threats

Answer 3

C

Question 4

An unrestricted uploads vulnerability refers to a situation where

A) Files are accepted as input without verifying their specifications
B) Input from other users is supplied as output to other users
C) A program puts more data into a storage location than it can hold
D) User input is used without confirming its validity

Question 5

Phishing refers to

A) Programs that propagate through the network without a user's consent
B) Unauthorized prevention of access to resources
C) Attempting to compromise a user by masquerading as a trustworthy entity in electronic communication
D) Code specifically designed to exploit a computer or data, without the user's consent

Question 6

A SQL injection vulnerability is an example of a

A) Unrestricted uploads vulnerability
B) Cross-site scripting vulnerability
C) Buffer overflow vulnerability
D) Lack of input validation vulnerability

Question 7

Zeus and Spyeye are examples of

A) Viruses
B) Vulnerabilities
C) IDEs to create new attacks
D) Systems to defend against attacks

Question 8

Controls are

A) Safeguards used to minimize the impact of threats
B) Capabilities, intentions and attack methods of adversaries to cause harm to assets
C) Resource or information that is to be protected
D) Weaknesses in an information system that can lead to a compromise of an asset

Question 9

The NVD database

A) Describes likely impacts and measures to remove vulnerabilities
B) A list of all known viruses
C) A list of all known information security firms
D) An inventory of known software vulnerabilities

Question 10

A missing authorization vulnerability refers to a situation where

A) Users are allowed access to privileged parts of a program without verification of credentials
B) Input from other users is supplied as output to other users
C) A program puts more data into a storage location than it can hold
D) User input is used without confirming its validity

Question 11

A cross-site scripting vulnerability can occur when

A) Files are accepted as input without verifying their specifications
B) Input from other users is supplied as output to other users
C) A program puts more data into a storage location than it can hold
D) User input is used without confirming its validity

Question 12

Vulnerabilities in IT systems can be eliminated through secure coding practices

Question 13

A buffer overflow vulnerability refers to a situation where

A) Files are accepted as input without verifying their specifications
B) Input from other users is supplied as output to other users
C) A program puts more data into a storage location than it can hold
D) User input is used without confirming its validity

Question 14

The CVE list is

A) A list of all likely impacts of vulnerabilities
B) A list of all known viruses
C) A list of all known information security firms
D) An inventory of known software vulnerabilities

Question 15

Relative to physical security, information security is challenging because

A) Assets are largely invisible
B) Most assets are easily duplicated
C) Both the above
D) None of the above

Question 16

Threats are

A) Safeguards used to minimize the impact of threats
B) Capabilities, intentions and attack methods of adversaries to cause harm to assets
C) Resource or information that is to be protected
D) Weaknesses in an information system that can lead to a compromise of an asset

Question 17

As reported in the chapter, recent trends in vulnerabilities and threats indicate that

A) Increasing numbers of new vulnerabilities are being discovered, and the number of attacks is also going up
B) Decreasing numbers of new vulnerabilities are being discovered, but the number of attacks is going up
C) Decreasing numbers of new vulnerabilities are being discovered, and the number of attacks is also going down
D) Increasing numbers of new vulnerabilities are being discovered, but the number of attacks is going down

Question 18

Denial of service refers to

A) Programs that propagate through the network without a user's consent
B) Unauthorized prevention of access to resources
C) Attempting to compromise a user by masquerading as a trustworthy entity in electronic communication
D) Code specifically designed to exploit a computer or data, without the user's consent

Question 19

Malware refers to

A) Programs that propagate through the network without a user's consent
B) Unauthorized prevention of access to resources
C) Attempting to compromise a user by masquerading as a trustworthy entity in electronic communication
D) Code specifically designed to exploit a computer or data, without the user's consent

Question 20

A lack of input validation vulnerability refers to a situation where

A) Files are accepted as input without verifying their specifications
B) Input from other users is supplied as output to other users
C) A program puts more data into a storage location than it can hold
D) User input is used without confirming its validity

Question 21

Zombies are

A) Software used to hide the existence of malicious software on computer systems
B) Exploits that compromise a previously unknown software vulnerability
C) Computers that perform malicious tasks at the direction of a remote controller
D) Manipulating people into performing desired actions

Question 22

Zero-day exploits are

A) Software used to hide the existence of malicious software on computer systems
B) Exploits that compromise a previously unknown software vulnerability
C) Computers that perform malicious tasks at the direction of a remote controller
D) Manipulating people into performing desired actions

Question 23

Physical controls

A) Use non-technical methods of preventing harm
B) Are the security measures built into the information system itself
C) Perform malicious tasks at the direction of a remote controller
D) Manipulate people into performing desired actions

Question 24

Rootkits are

A) Software used to hide the existence of malicious software on computer systems
B) Exploits that compromise a previously unknown software vulnerability
C) Computers that perform malicious tasks at the direction of a remote controller
D) Manipulating people into performing desired actions

Question 25

Social engineering is

A) Software used to hide the existence of malicious software on computer systems
B) Exploits that compromise a previously unknown software vulnerability
C) Computers that perform malicious tasks at the direction of a remote controller
D) Manipulating people into performing desired actions