Deck 15: Vulnerability Assessment and Third Party Integration

Question 1

​What term below describes a prearranged purchase or sale agreement between a government agency and a business?

A)​Service Level Agreement (SLA)
B)​Memorandum of Understanding (MOU)
C)​Blanket Purchase Agreement (BPA)
D)​Interconnection Security Agreement (ISA)

Answer 1

C

Question 2

What is the name of the process that takes a snapshot of the current security of an organization?

A)threat analysis
B)vulnerability appraisal
C)risk assessment
D)threat assessment

Answer 2

B

Question 3

What term below describes the start-up relationship between partners?​

A)​Off-boarding
B)​Uptaking
C)​On-boarding
D)​Uploading

Answer 3

C

Question 4

What is the name for the code that can be executed by unauthorized users within a software product?

A)vulnerability surface
B)risk profile
C)input surface
D)attack surface

Question 5

A port in what state below implies that an application or service assigned to that port is listening for any instructions?

A)open port
B)empty port
C)closed port
D)interruptible system

Question 6

A port scanner can be used to search a system for port vulnerabilities. The RADMIN port scanner is an example of this type of software.

Question 7

If TCP port 20 is open, then an attacker can assume that FTP is being used.

Question 8

An administrator running a port scan wants to ensure that no processes are listening on port 23. What state should the port be in?

A)open port
B)open address
C)closed address
D)closed port

Question 9

Which is the term for a computer typically located in an area with limited security and loaded with software and data files that appear to be authentic, yet they are actually imitations of real data files.

A)port scanner
B)write blocker
C)honeypot
D)honeycomb

Question 10

Which item below is an imaginary line by which an element is measured or compared, and can be seen as the standard?

A)profile
B)threat
C)control
D)baseline

Question 11

An administrator needs to view packets and decode and analyze their contents. What type of application should the administrator use?

A)application analyzer
B)protocol analyzer
C)threat profiler
D)system analyzer

Question 12

Which scan examines the current security, in a passive method?

A)application scan
B)system scan
C)threat scan
D)vulnerability scan

Question 13

During a vulnerability assessment, what type of software can be used to search a system for port vulnerabilities?

A)threat scanner
B)vulnerability profiler
C)port scanner
D)application profiler

Question 14

Vulnerability scans are usually performed from outside the security perimeter.

Question 15

Which tester has an in-depth knowledge of the network and systems being tested, including network diagrams, IP addresses, and even the source code of custom applications?

A)white box
B)black box
C)replay
D)system

Question 16

What is the end result of a penetration test?

A)penetration test profile
B)penetration test report
C)penetration test system
D)penetration test view

Question 17

The first step in a vulnerability assessment is to determine the assets that need to be protected.

Question 18

What is another term used for a security weakness?

A)threat
B)vulnerability
C)risk
D)opportunity

Question 19

What security goal do the following common controls address: hashing, digital signatures, certificates, nonrepudiation tools?​

A)​Confidentiality
B)​Integrity
C)​Availability
D)​Safety

Question 20

A healthy security posture results from a sound and workable strategy toward managing risks.

Question 21

What is the term for a network set up with intentional vulnerabilities?

A)honeynet
B)honeypot
C)honeycomb
D)honey hole

Question 22

____________________ for organizations are intended to identify vulnerabilities and alert network administrators to these problems.
​Matching
a.​Architectural design
b.Attack surface​
c.​Baseline reporting
d.Code review​
e.​Gray box

Question 23

When using a black box test, many testers use ____________________ tricks to learn about the network infrastructure from inside employees.

Question 24

Match the following terms to the appropriate definitions.
a. asset
b. cyberterrorism
c. hactivist
d. exploit kit
e. computer spy
f. risk
g. threat
h. threat agent
i. vulnerability
j. threat vector
In software development, presenting the code to multiple reviewers in order to reach agreement about its security.​

Question 25

Match the following terms to the appropriate definitions.
a. asset
b. cyberterrorism
c. hactivist
d. exploit kit
e. computer spy
f. risk
g. threat
h. threat agent
i. vulnerability
j. threat vector
​The termination of an agreement between parties.

Question 26

Match the following terms to the appropriate definitions.
a. asset
b. cyberterrorism
c. hactivist
d. exploit kit
e. computer spy
f. risk
g. threat
h. threat agent
i. vulnerability
j. threat vector
An agreement through which parties in a relationship can reach an understanding of their relationships and responsibilities.​

Question 27

Match the following terms to the appropriate definitions.
a. asset
b. cyberterrorism
c. hactivist
d. exploit kit
e. computer spy
f. risk
g. threat
h. threat agent
i. vulnerability
j. threat vector
​In software development, the process of defining a collection of hardware and software components along with their interfaces in order to create the framework for software development.

Question 28

A(n) ____________________ box test is one in which some limited information has been provided to the tester.

Question 29

Most vulnerability scanners maintain a(n) ____________________ that categorizes and describes the vulnerabilities that it can detect.

Question 30

The comparison of the present state of a system to its baseline is known as what?

A)Baseline reporting
B)Compliance reporting
C)Baseline assessment
D)Compliance review

Question 31

Match the following terms to the appropriate definitions.
a. asset
b. cyberterrorism
c. hactivist
d. exploit kit
e. computer spy
f. risk
g. threat
h. threat agent
i. vulnerability
j. threat vector
​Disabling unused application/service ports to reduce the number of threat vectors.

Question 32

The goal of what type of threat evaluation is to better understand who the attackers are, why they attack, and what types of attacks might occur?

A)​threat mitigation
B)​threat profiling
C)​risk modeling
D)​threat modeling

Question 33

Match the following terms to the appropriate definitions.
a. asset
b. cyberterrorism
c. hactivist
d. exploit kit
e. computer spy
f. risk
g. threat
h. threat agent
i. vulnerability
j. threat vector
A comparison of the present state of a system to its baseline.​

Question 34

Match the following terms to the appropriate definitions.
a. asset
b. cyberterrorism
c. hactivist
d. exploit kit
e. computer spy
f. risk
g. threat
h. threat agent
i. vulnerability
j. threat vector
The code that can be executed by unauthorized users in a software program​

Question 35

​A service contract between a vendor and a client that specifies what services will be provided, the responsibilities of each party, and any guarantees of service, is known as a:

A)​Blanket Purchase Agreement (BPA)
B)​Service Level Agreement (SLA)
C)​Memorandum of Understanding (MOU)
D)​Interconnection Security Agreement (ISA)

Question 36

Match the following terms to the appropriate definitions.
a. asset
b. cyberterrorism
c. hactivist
d. exploit kit
e. computer spy
f. risk
g. threat
h. threat agent
i. vulnerability
j. threat vector
A penetration test where some limited information has been provided to the tester.​

Question 37

Match the following terms to the appropriate definitions.
a. asset
b. cyberterrorism
c. hactivist
d. exploit kit
e. computer spy
f. risk
g. threat
h. threat agent
i. vulnerability
j. threat vector
​A computer typically located in an area with limited security and loaded with software and data files that appear to be authentic, but are actually imitations of real data files, to trick attackers into revealing their attack techniques.

Question 38

In a __________ test, the tester has no prior knowledge of the network infrastructure that is being tested.

Question 39

In order to minimize vulnerabilities in software, code should be subject to and analyzed while it is being written in what option below?

A)black box
B)code review
C)white box
D)scanner

Question 40

Match the following terms to the appropriate definitions.
a. asset
b. cyberterrorism
c. hactivist
d. exploit kit
e. computer spy
f. risk
g. threat
h. threat agent
i. vulnerability
j. threat vector
The start-up relationship agreement between parties.​

Question 41

Discuss one type of asset that an organization might have.

Question 42

List and describe the elements that make up a security posture.

Question 43

List two types of hardening techniques.

Question 44

When a security hardware device fails or a program aborts, which state should it go into?

Question 45

Discuss the purpose of OVAL.

Question 46

List and describe the three categories that TCP/IP divides port numbers into.

Question 47

List and describe two common uses for a protocol analyzer.

Question 48

Describe a penetration testing report.

Question 49

List four things that a vulnerability scanner can do.

Question 50

Describe the purpose of a honeypot.