Deck 10: Security Structures and Identity and Access Management

Question 1

Which of the following IT security frameworks analyzes business requirements and then creates a "chain of traceability" through the concept, design, implementation, and continual phases of the business life cycle?

A) ISO
B) NIST
C) ISACA
D) SABSA

Answer 1

D

Question 2

Most U.S. organizations do not use a security framework.

Answer 2

False

Question 3

Which of the following IT security frameworks is a global non-profit association that develops practices, guidance, and benchmarks, and uses a tool called Control Objectives for Information and Related Technology (COBIT)?

A) ISO
B) NIST
C) ISACA
D) SABSA

Answer 3

C

Question 4

A(n) ________________ defines the actions users may perform while accessing devices and networks that belong to the organization.

Question 5

Which of the following types of controls includes multifactor authentication, firewalls, and intrusion detection systems?

A) Administrative controls
B) Logical controls
C) Physical controls
D) Online controls

Question 6

In social engineering _______________, a threat actor masquerades as a real or fictitious character and then plays out the role on a victim.

Question 7

In which of the following does an attacker secretly relay and possibly alter communications between two parties who believe that they are directly communicating with each other?

A) Session hijacking
B) Man-in-the-middle attack
C) Cross-site scripting
D) Privilege escalation

Question 8

To address security issues with directory services, many organizations are turning to what framework of business processes, policies, and technologies that facilitates the management of digital identities?

Question 9

In which of the following does a threat actor take advantage of web applications that accept user input without validating it before presenting it back to the user?

A) Session hijacking
B) Man-in-the-middle attack
C) Cross-site scripting
D) Privilege escalation

Question 10

Which of the following does not refer to the process of using a single authentication credential to access multiple accounts, networks, or applications?

A) TACACS+
B) Identity management
C) SSO
D) Federation