Final Exam 2015+

Frage 1 von 113

1

Which of the following can be defined as the process of rerunning a portion of the test scenario or test plan to ensure that changes or corrections have not introduced new errors?

Wähle eine der folgenden:

Unit testing
Parallel testing
Regression testing
Pilot testing

Erklärung

Frage 2 von 113

1

At which layer of the OSI model do sniffers operate?

Wähle eine der folgenden:

Layer 2 - Data Link Layer
Layer 1 - Hardware layer
Layer 3 - Networking Layer
Layer 7 - Application layer

Erklärung

Frage 3 von 113

1

When two or more separate entities (usually persons) operating in concert to protect sensitive functions or information must combine their knowledge to gain access to an asset, this is known as?

Wähle eine der folgenden:

Segragation of duties
Separation of duties
Need to know
Dual Control

Erklärung

Frage 4 von 113

1

What is the name for a substitution cipher that shifts the alphabet by 13 places?

Wähle eine der folgenden:

Transposition cipher
Caesar cipher
Polyalphabetic cipher
ROT13 cipher

Erklärung

Frage 5 von 113

1

Your organization creates software applications that are sold to the public. Recently, management has become concerned about software piracy. Which organization deals with the prevention of this crime?

Wähle eine der folgenden:

CIA
DoD
SPA
NCSC

Erklärung

Frage 6 von 113

1

A potential problem related to the physical installation of the Iris Scanner in regards to the usage of the iris pattern within a biometric system is:

Wähle eine der folgenden:

Concern that the laser beam may cause eye damage.
The iris pattern changes as a person grows older.
There is a relatively high rate of false accepts.
The optical unit must be positioned so that the sun does not shine into the aperture.

Erklärung

Frage 7 von 113

1

In Mandatory Access Control, sensitivity labels attached to object contain what information?

Wähle eine der folgenden:

The item's classification
The item's classification and category set
The item's category
The items's need to know

Erklärung

Frage 8 von 113

1

Which of the following is true about Kerberos?

Wähle eine der folgenden:

It utilizes public key cryptography.
It encrypts data after a ticket is granted, but passwords are exchanged in plain text.
It depends upon symmetric ciphers.
It is a second party authentication system.

Erklärung

Frage 9 von 113

1

Which of the following is needed for System Accountability?

Wähle eine der folgenden:

Audit mechanisms.
Documented design as laid out in the Common Criteria.
Authorization.
Formal verification of system design.

Erklärung

Frage 10 von 113

1

What is Kerberos?

Wähle eine der folgenden:

A three-headed dog from the Egyptian mythology.
A trusted third-party authentication protocol.
A security model.
A remote authentication dial in user server.

Erklärung

Frage 11 von 113

1

Kerberos depends upon what encryption method?

Wähle eine der folgenden:

Public Key cryptography.
Secret Key cryptography.
El Gamal cryptography.
Blowfish cryptography.

Erklärung

Frage 12 von 113

1

A confidential number used as an authentication factor to verify a user's identity is called a:

Wähle eine der folgenden:

PIN
User ID
Password
Challenge

Erklärung

Frage 13 von 113

1

Individual accountability does not include which of the following?

Wähle eine der folgenden:

unique identifiers
policies & procedures
access rules
audit trails

Erklärung

Frage 14 von 113

1

Which of the following exemplifies proper separation of duties?

Wähle eine der folgenden:

Operators are not permitted modify the system time.
Programmers are permitted to use the system console.
Console operators are permitted to mount tapes and disks.
Tape operators are permitted to use the system console.

Erklärung

Frage 15 von 113

1

An access control policy for a bank teller is an example of the implementation of which of the following?

Wähle eine der folgenden:

Rule-based policy
Identity-based policy
User-based policy
Role-based policy

Erklärung

Frage 16 von 113

1

Which one of the following authentication mechanisms creates a problem for mobile users?

Wähle eine der folgenden:

Mechanisms based on IP addresses
Mechanism with reusable passwords
One-time password mechanism.
Challenge response mechanism.

Erklärung

Frage 17 von 113

1

Organizations should consider which of the following first before allowing external access to their LANs via the Internet?

Wähle eine der folgenden:

Plan for implementing workstation locking mechanisms.
Plan for protecting the modem pool.
Plan for providing the user with his account usage information.
Plan for considering proper authentication options.

Erklärung

Frage 18 von 113

1

Kerberos can prevent which one of the following attacks?

Wähle eine der folgenden:

Tunneling attack.
Playback (replay) attack.
Destructive attack.
Process attack.

Erklärung

Frage 19 von 113

1

In discretionary access environments, which of the following entities is authorized to grant information access to other people?

Wähle eine der folgenden:

Manager
Group Leader
Security Manager
Data Owner

Erklärung

Frage 20 von 113

1

What is the main concern with single sign-on?

Wähle eine der folgenden:

Maximum unauthorized access would be possible if a password is disclosed.
The security administrator's workload would increase.
The users' password would be too hard to remember.
User access rights would be increased.

Erklärung

Frage 21 von 113

1

Who developed one of the first mathematical models of a multilevel-security computer system?

Wähle eine der folgenden:

Diffie and Hellman.
Clark and Wilson.
Bell and LaPadula.
Gasser and Lipner.

Erklärung

Frage 22 von 113

1

Which of the following attacks could capture network user passwords?

Wähle eine der folgenden:

Data diddling
Sniffing
IP Spoofing
Smurfing

Erklärung

Frage 23 von 113

1

Which of the following would constitute the best example of a password to use for access to a system by a network administrator?

Wähle eine der folgenden:

holiday
Christmas12
Jenny
GyN19Za!

Erklärung

Frage 24 von 113

1

What physical characteristic does a retinal scan biometric device measure?

Wähle eine der folgenden:

The amount of light reaching the retina
The amount of light reflected by the retina
The pattern of light receptors at the back of the eye
The pattern of blood vessels at the back of the eye

Erklärung

Frage 25 von 113

1

The Computer Security Policy Model the Orange Book is based on is which of the following?

Wähle eine der folgenden:

Bell-LaPadula
Data Encryption Standard
Kerberos
Tempest

Erklärung

Frage 26 von 113

1

The end result of implementing the principle of least privilege means which of the following?

Wähle eine der folgenden:

Users would get access to only the info for which they have a need to know
Users can access all systems.
Users get new privileges added when they change positions.
Authorization creep.

Erklärung

Frage 27 von 113

1

Which of the following is the most reliable authentication method for remote access?

Wähle eine der folgenden:

Variable callback system
Synchronous token
Fixed callback system
Combination of callback and caller ID

Erklärung

Frage 28 von 113

1

Which of the following is true of two-factor authentication?

Wähle eine der folgenden:

It uses the RSA public-key signature based on integers with large prime factors.
It requires two measurements of hand geometry.
It does not use single sign-on technology.
It relies on two independent proofs of identity.

Erklärung

Frage 29 von 113

1

The primary service provided by Kerberos is which of the following?

Wähle eine der folgenden:

non-repudiation
confidentiality
authentication
authorization

Erklärung

Frage 30 von 113

1

There are parallels between the trust models in Kerberos and Public Key Infrastructure (PKI).
When we compare them side by side, Kerberos tickets correspond most closely to which of the following?

Wähle eine der folgenden:

public keys
private keys
public-key certificates
private-key certificates

Erklärung

Frage 31 von 113

1

In which of the following security models is the subject's clearance compared to the object's classification such that specific rules can be applied to control how the subject-to-object interactions take place?

Wähle eine der folgenden:

Bell-LaPadula model
Biba model
Access Matrix model
Take-Grant model

Erklärung

Frage 32 von 113

1

Which of the following was developed to address some of the weaknesses in Kerberos and uses public key cryptography for the distribution of secret keys and provides additional access control support?

Wähle eine der folgenden:

SESAME
RADIUS
KryptoKnight
TACACS+

Erklärung

Frage 33 von 113

1

Single Sign-on (SSO) is characterized by which of the following advantages?

Wähle eine der folgenden:

Convenience
Convenience and centralized administration
Convenience and centralized data administration
Convenience and centralized network administration

Erklärung

Frage 34 von 113

1

What is the primary role of smartcards in a PKI?

Wähle eine der folgenden:

Transparent renewal of user keys
Easy distribution of the certificates between the users
Fast hardware encryption of the raw data
Tamper resistant, mobile storage and application of private keys of the users

Erklärung

Frage 35 von 113

1

What kind of certificate is used to validate a user identity?

Wähle eine der folgenden:

Public key certificate
Attribute certificate
Root certificate
Code signing certificate

Erklärung

Frage 36 von 113

1

The following is not a security characteristic we need to consider while choosing a biometric identification systems:

Wähle eine der folgenden:

data acquisition process
cost
enrollment process
speed and user interface

Erklärung

Frage 37 von 113

1

In biometric identification systems, at the beginning, it was soon apparent that truly positive identification could only be based on physical attributes of a person.

This raised the necessity of answering 2 questions:

Wähle eine der folgenden:

what was the sex of a person and his age
what part of body to be used and how to accomplish identification that is viable
what was the age of a person and his income level
what was the tone of the voice of a person and his habits

Erklärung

Frage 38 von 113

1

In biometric identification systems, the parts of the body conveniently available for identification are:

Wähle eine der folgenden:

neck and mouth
hands, face, and eyes
feet and hair
voice and neck

Erklärung

Frage 39 von 113

1

Controlling access to information systems and associated networks is necessary for the preservation of their:

Wähle eine der folgenden:

Authenticity, confidentiality and availability
Confidentiality, integrity, and availability.
integrity and availability.
authenticity, confidentiality, integrity and availability.

Erklärung

Frage 40 von 113

1

To control access by a subject (an active entity such as individual or process) to an object (a passive entity such as a file) involves setting up:

Wähle eine der folgenden:

Access Rules
Access Matrix
Identification controls
Access terminal

Erklärung

Frage 41 von 113

1

Rule-Based Access Control (RuBAC) access is determined by rules.
Such rules would fit within what category of access control?

Wähle eine der folgenden:

Discretionary Access Control (DAC)
Mandatory Access control (MAC)
Non-Discretionary Access Control (NDAC)
Lattice-based Access control

Erklärung

Frage 42 von 113

1

The type of discretionary access control (DAC) that is based on an individual's identity is also called:

Wähle eine der folgenden:

Identity-based Access control
Rule-based Access control
Non-Discretionary Access Control
Lattice-based Access control

Erklärung

Frage 43 von 113

1

Which access control type has a central authority that determine to what objects the subjects have access to and it is based on role or on the organizational security policy?

Wähle eine der folgenden:

Mandatory Access Control
Discretionary Access Control
Non-Discretionary Access Control
Rule-based Access control

Erklärung

Frage 44 von 113

1

Which of the following control pairings include: organizational policies and procedures, pre- employment background checks, strict hiring practices, employment agreements, employee termination procedures, vacation scheduling, labeling of sensitive materials, increased supervision, security awareness training, behavior awareness, and sign-up procedures to obtain access to information systems and networks?

Wähle eine der folgenden:

Preventive/Administrative Pairing
Preventive/Technical Pairing
Preventive/Physical Pairing
Detective/Administrative Pairing

Erklärung

Frage 45 von 113

1

Technical controls such as encryption and access control can be built into the operating system, be software applications, or can be supplemental hardware/software units.
Such controls, also known as logical controls, represent which pairing?

Wähle eine der folgenden:

Preventive/Administrative Pairing
Preventive/Technical Pairing
Preventive/Physical Pairing
Detective/Technical Pairing

Erklärung

Frage 46 von 113

1

What is called the use of technologies such as fingerprint, retina, and iris scans to authenticate the individuals requesting access to resources?

Wähle eine der folgenden:

Micrometrics
Macrometrics
Biometrics
MicroBiometrics

Erklärung

Frage 47 von 113

1

What is called the access protection system that limits connections by calling back the number of a previously authorized location?

Wähle eine der folgenden:

Sendback systems
Callback forward systems
Callback systems
Sendback forward systems

Erklärung

Frage 48 von 113

1

What are called user interfaces that limit the functions that can be selected by a user?

Wähle eine der folgenden:

Constrained user interfaces
Limited user interfaces
Mini user interfaces
Unlimited user interfaces

Erklärung

Frage 49 von 113

1

Controls such as job rotation, the sharing of responsibilities, and reviews of audit records are associated with:

Wähle eine der folgenden:

Preventive/physical
Detective/technical
Detective/physical
Detective/administrative

Erklärung

Frage 50 von 113

1

The control measures that are intended to reveal the violations of security policy using software and hardware are associated with:

Wähle eine der folgenden:

Preventive/physical
Detective/technical
Detective/physical
Detective/administrative

Erklärung

Frage 51 von 113

1

The controls that usually require a human to evaluate the input from sensors or cameras to determine if a real threat exists are associated with:

Wähle eine der folgenden:

Preventive/physical
Detective/technical
Detective/physical
Detective/administrative

Erklärung

Frage 52 von 113

1

External consistency ensures that the data stored in the database is:

Wähle eine der folgenden:

in-consistent with the real world.
remains consistant when sent from one system to another.
consistent with the logical world.
consistent with the real world.

Erklärung

Frage 53 von 113

1

A central authority determines what subjects can have access to certain objects based on the organizational security policy is called:

Wähle eine der folgenden:

Mandatory Access Control
Discretionary Access Control
Non-Discretionary Access Control
Rule-based Access control

Erklärung

Frage 54 von 113

1

What is called the act of a user professing an identity to a system, usually in the form of a log-on ID?

Wähle eine der folgenden:

Authentication
Identification
Authorization
Confidentiality

Erklärung

Frage 55 von 113

1

Which one of the following factors is not one on which Authentication is based?

Wähle eine der folgenden:

Type 1 Something you know, such as a PIN or password
Type 2 Something you have, such as an ATM card or smart card
Type 3 Something you are (based upon one or more intrinsic physical or behavioral traits), such as a fingerprint or retina scan
Type 4 Something you are, such as a system administrator or security administrator

Erklärung

Frage 56 von 113

1

A central authority determines what subjects can have access to certain objects based on the organizational security policy is called:

Wähle eine der folgenden:

Mandatory Access Control
Discretionary Access Control
Non-Discretionary Access Control
Rule-based Access control

Erklärung

Frage 57 von 113

1

What is called the act of a user professing an identity to a system, usually in the form of a log-on ID?

Wähle eine der folgenden:

Authentication
Identification
Authorization
Confidentiality

Erklärung

Frage 58 von 113

1

What is called the verification that the user's claimed identity is valid and is usually implemented through a user password at log-on time?

Wähle eine der folgenden:

Authentication
Identification
Integrity
Confidentiality

Erklärung

Frage 59 von 113

1

Which one of the following factors is not one on which Authentication is based?

Wähle eine der folgenden:

Type 1 Something you know, such as a PIN or password
Type 2 Something you have, such as an ATM card or smart card
Type 3 Something you are (based upon one or more intrinsic physical or behavioral traits), such as a fingerprint or retina scan
Type 4 Something you are, such as a system administrator or security administrator

Erklärung

Frage 60 von 113

1

The act of requiring two of the three factors to be used in the authentication process refers to:

Wähle eine der folgenden:

Two-Factor Authentication
One-Factor Authentication
Bi-Factor Authentication
Double Authentication

Erklärung

Frage 61 von 113

1

Which type of password provides maximum security because a new password is required for each new log-on?

Wähle eine der folgenden:

One-time or dynamic password
Congnitive password
Static password
Passphrase

Erklärung

Frage 62 von 113

1

What is called a password that is the same for each log-on session?

Wähle eine der folgenden:

"one-time password"
"two-time password"
static password
dynamic password

Erklärung

Frage 63 von 113

1

What is called a sequence of characters that is usually longer than the allotted number for a password?

Wähle eine der folgenden:

passphrase
cognitive phrase
anticipated phrase
Real phrase

Erklärung

Frage 64 von 113

1

Which best describes a tool (i.e. keyfob, calculator, memory card or smart card) used to supply dynamic passwords?

Wähle eine der folgenden:

Tickets
Tokens
Token passing networks
Coupons

Erklärung

Frage 65 von 113

1

Which of the following would be true about Static password tokens?

Wähle eine der folgenden:

The owner identity is authenticated by the token
The owner will never be authenticated by the token.
The owner will authenticate himself to the system
The token does not authenticates the token owner but the system

Erklärung

Frage 66 von 113

1

In Synchronous dynamic password tokens:

Wähle eine der folgenden:

The token generates a new password value at fixed time intervals (this password could be based on the time of day encrypted with a secret key).
The token generates a new non-unique password value at fixed time intervals (this password could be based on the time of day encrypted with a secret key).
The unique password is not entered into a system or workstation along with an owner's PIN.
The authentication entity in a system or workstation knows an owner's secret key and PIN, and the entity verifies that the entered password is invalid and that it was entered during the invalid time window

Erklärung

Frage 67 von 113

1

In biometrics, "one-to-many" search against database of stored biometric images is done in:

Wähle eine der folgenden:

Authentication
Identification
Identities
Identity-based access control

Erklärung

Frage 68 von 113

1

Which of the following is true of biometrics?

Wähle eine der folgenden:

It is used for identification in physical controls and it is not used in logical controls
It is used for authentication in physical controls and for identification in logical controls
It is used for identification in physical controls and for authentication in logical controls.
Biometrics has not role in logical controls.

Erklärung

Frage 69 von 113

1

What is called the percentage of valid subjects that are falsely rejected by a Biometric Authentication system?

Wähle eine der folgenden:

False Rejection Rate (FRR) or Type I Error
False Acceptance Rate (FAR) or Type II Error
Crossover Error Rate (CER)
True Rejection Rate (TRR) or Type III Error

Erklärung

Frage 70 von 113

1

What is called the percentage of invalid subjects that are falsely accepted by a Biometric authentication system?

Wähle eine der folgenden:

False Rejection Rate (FRR) or Type I Error
False Acceptance Rate (FAR) or Type II Error
Crossover Error Rate (CER)
True Acceptance Rate (TAR) or Type III Error

Erklärung

Frage 71 von 113

1

What is called the percentage at which the False Rejection Rate equals the False Acceptance Rate?

Wähle eine der folgenden:

False Rejection Rate (FRR) or Type I Error
False Acceptance Rate (FAR) or Type II Error
Crossover Error Rate (CER)
Failure to enroll rate (FTE or FER)

Erklärung

Frage 72 von 113

1

Considerations of privacy, invasiveness, and psychological and physical comfort when using the system are important elements for which of the following?

Wähle eine der folgenden:

Accountability of biometrics systems
Acceptability of biometrics systems
Availability of biometrics systems
Adaptability of biometrics systems

Erklärung

Frage 73 von 113

1

Which of the following offers advantages such as the ability to use stronger passwords, easier password administration, one set of credential, and faster resource access?

Wähle eine der folgenden:

Smart cards
Single Sign-On (SSO)
Symmetric Ciphers
Public Key Infrastructure (PKI)

Erklärung

Frage 74 von 113

1

Which of the following describes the major disadvantage of many Single Sign-On (SSO) implementations?

Wähle eine der folgenden:

Once an individual obtains access to the system through the initial log-on, they have access to all resources within the environment that the account has access to.
The initial logon process is cumbersome to discourage potential intruders.
Once a user obtains access to the system through the initial log-on, they only need to logon to some applications.
Once a user obtains access to the system through the initial log-on, he has to logout from all other systems

Erklärung

Frage 75 von 113

1

Which of the following is implemented through scripts or smart agents that replays the users multiple log-ins against authentication servers to verify a user's identity which permit access to system services?

Wähle eine der folgenden:

Single Sign-On
Dynamic Sign-On
Smart cards
Kerberos

Erklärung

Frage 76 von 113

1

Which of the following is not true of the Kerberos protocol?

Wähle eine der folgenden:

Only a single login is required per session.
The initial authentication steps are done using public key algorithm
The KDC is aware of all systems in the network and is trusted by all of them
It performs mutual authentication

Erklärung

Frage 77 von 113

1

The authenticator within Kerberos provides a requested service to the client after validating which of the following?

Wähle eine der folgenden:

timestamp
client public key
client private key
server public key

Erklärung

Frage 78 von 113

1

Which of the following is addressed by Kerberos?

Wähle eine der folgenden:

Confidentiality and Integrity
Authentication and Availability
Validation and Integrity
Auditability and Integrity

Erklärung

Frage 79 von 113

1

Kerberos is vulnerable to replay in which of the following circumstances?

Wähle eine der folgenden:

When a private key is compromised within an allotted time window
When a public key is compromised within an allotted time window.
When a ticket is compromised within an allotted time window.
When the KSD is compromised within an allotted time window.

Erklärung

Frage 80 von 113

1

Like the Kerberos protocol, SESAME is also subject to which of the following?

Wähle eine der folgenden:

timeslot replay
password guessing
symmetric key guessing
asymmetric key guessing

Erklärung

Frage 81 von 113

1

RADIUS incorporates which of the following services?

Wähle eine der folgenden:

Authentication server and PIN codes.
Authentication of clients and static passwords generation.
Authentication of clients and dynamic passwords generation.
Authentication server as well as support for Static and Dynamic passwords.

Erklärung

Frage 82 von 113

1

Which of the following protects a password from eavesdroppers and supports the encryption of communication?

Wähle eine der folgenden:

Challenge Handshake Authentication Protocol (CHAP)
Challenge Handshake Identification Protocol (CHIP)
Challenge Handshake Encryption Protocol (CHEP)
Challenge Handshake Substitution Protocol (CHSP)

Erklärung

Frage 83 von 113

1

Which of the following represents the columns of the table in a relational database?

Wähle eine der folgenden:

attributes
relation
record retention
records or tuples

Erklärung

Frage 84 von 113

1

A database view is the results of which of the following operations?

Wähle eine der folgenden:

Join and Select.
Join, Insert, and Project
Join, Project, and Create.
Join, Project, and Select.

Erklärung

Frage 85 von 113

1

Which of the following is used to create and modify the structure of your tables and other objects in the database?

Wähle eine der folgenden:

SQL Data Definition Language (DDL)
SQL Data Manipulation Language (DML)
SQL Data Relational Language (DRL)
SQL Data Identification Language (DIL)

Erklärung

Frage 86 von 113

1

Which of the following is used to monitor network traffic or to monitor host audit logs in real time to determine violations of system security policy that have taken place?

Wähle eine der folgenden:

Intrusion Detection System
Compliance Validation System
Intrusion Management System (IMS)
Compliance Monitoring System

Erklärung

Frage 87 von 113

1

Which of the following monitors network traffic in real time?

Wähle eine der folgenden:

network-based IDS
host-based IDS
application-based IDS
firewall-based IDS

Erklärung

Frage 88 von 113

1

A host-based IDS is resident on which of the following?

Wähle eine der folgenden:

On each of the critical hosts
decentralized hosts
central hosts
bastion hosts

Erklärung

Frage 89 von 113

1

Which of the following usually provides reliable, real-time information without consuming network or host resources?

Wähle eine der folgenden:

network-based IDS
host-based IDS
application-based IDS
firewall-based IDS

Erklärung

Frage 90 von 113

1

The fact that a network-based IDS reviews packets payload and headers enable which of the following?

Wähle eine der folgenden:

Detection of denial of service
Detection of all viruses
Detection of data corruption
Detection of all password guessing attacks

Erklärung

Frage 91 von 113

1

Which of the following reviews system and event logs to detect attacks on the host and determine if the attack was successful?

Wähle eine der folgenden:

host-based IDS
firewall-based IDS
bastion-based IDS
server-based IDS

Erklärung

Frage 92 von 113

1

What would be considered the biggest drawback of Host-based Intrusion Detection systems
(HIDS)?

Wähle eine der folgenden:

It can be very invasive to the host operating system
Monitors all processes and activities on the host system only
Virtually eliminates limits associated with encryption
They have an increased level of visibility and control compared to NIDS

Erklärung

Frage 93 von 113

1

Attributes that characterize an attack are stored for reference using which of the following
Intrusion Detection System (IDS)?

Wähle eine der folgenden:

signature-based IDS
statistical anomaly-based IDS
event-based IDS
inferent-based IDS

Erklärung

Frage 94 von 113

1

Which of the following is an issue with signature-based intrusion detection systems?

Wähle eine der folgenden:

Only previously identified attack signatures are detected.
Signature databases must be augmented with inferential elements.
It runs only on the windows operating system
Hackers can circumvent signature evaluations.

Erklärung

Frage 95 von 113

1

Which of the following is an IDS that acquires data and defines a "normal" usage profile for the network or host?

Wähle eine der folgenden:

Statistical Anomaly-Based ID
Signature-Based ID
dynamical anomaly-based ID
inferential anomaly-based ID

Erklärung

Frage 96 von 113

1

Which of the following is most relevant to determining the maximum effective cost of access control?

Wähle eine der folgenden:

the value of information that is protected
management's perceptions regarding data importance
budget planning related to base versus incremental spending
the cost to replace lost data

Erklärung

Frage 97 von 113

1

Which of the following is not a factor related to Access Control?

Wähle eine der folgenden:

integrity
authenticity
confidentiality
availability

Erklärung

Frage 98 von 113

1

Which of the following is most appropriate to notify an external user that session monitoring is being conducted?

Wähle eine der folgenden:

Logon Banners
Wall poster
Employee Handbook
Written agreement

Erklärung

Frage 99 von 113

1

Which of the following pairings uses technology to enforce access control policies?

Wähle eine der folgenden:

Preventive/Administrative
Preventive/Technical
Preventive/Physical
Detective/Administrative

Erklärung

Frage 100 von 113

1

In the course of responding to and handling an incident, you work on determining the root cause of the incident. In which step are you in?

Wähle eine der folgenden:

Recovery
Containment
Triage
Analysis and tracking

Erklärung

Frage 101 von 113

1

Access control is the collection of mechanisms that permits managers of a system to exercise a directing or restraining influence over the behavior, use, and content of a system.
It does not permit management to:

Wähle eine der folgenden:

specify what users can do
specify which resources they can access
specify how to restrain hackers
specify what operations they can perform on a system

Erklärung

Frage 102 von 113

1

Access Control techniques do not include which of the following choices?

Wähle eine der folgenden:

Relevant Access Controls
Discretionary Access Control
Mandatory Access Control
Lattice Based Access Control

Erklärung

Frage 103 von 113

1

Which of the following statements relating to the Bell-LaPadula security model is false (assuming the Strong Star property is not being used)?

Wähle eine der folgenden:

A subject is not allowed to read up
The *- property restriction can be escaped by temporarily downgrading a high level subject.
A subject is not allowed to read down
It is restricted to confidentiality

Erklärung

Frage 104 von 113

1

When a biometric system is used, which error type deals with the possibility of granting access to impostors who should be rejected?

Wähle eine der folgenden:

Type I error
Type II error
Type III error
Crossover error

Erklärung

Frage 105 von 113

1

Which of the following is the FIRST step in protecting data's confidentiality?

Wähle eine der folgenden:

Install a firewall
Implement encryption
Identify which information is sensitive
Review all user access rights

Erklärung

Frage 106 von 113

1

Which of the following best ensures accountability of users for the actions taken within a system or domain?

Wähle eine der folgenden:

Identification
Authentication
Authorization
Credentials

Erklärung

Frage 107 von 113

1

Which of the following statements pertaining to biometrics is false?

Wähle eine der folgenden:

User can be authenticated based on behavior.
User can be authenticated based on unique physical attributes.
User can be authenticated by what he knows.
A biometric system's accuracy is determined by its crossover error rate (CER).

Erklärung

Frage 108 von 113

1

Which of the following biometric devices offers the LOWEST CER?

Wähle eine der folgenden:

Keystroke dynamics
Voice verification
Iris scan
Fingerprint

Erklärung

Frage 109 von 113

1

Which of the following is the weakest authentication mechanism?

Wähle eine der folgenden:

Passphrases
Passwords
One-time passwords
Token devices

Erklärung

Frage 110 von 113

1

Which of the following statements pertaining to access control is false?

Wähle eine der folgenden:

Users should only access data on a need-to-know basis.
If access is not explicitly denied, it should be implicitly allowed.
Access rights should be granted based on the level of trust a company has on a subject.
Roles can be an efficient way to assign rights to a type of user who performs certain tasks.

Erklärung

Frage 111 von 113

1

Which of the following is not part of the Kerberos authentication protocol?

Wähle eine der folgenden:

Symmetric key cryptography
Authentication service (AS)
Principals
Public Key

Erklärung

Frage 112 von 113

1

	Erstellt von Alexandre Pinheiro vor fast 8 Jahre

Exam Practice Questions

Final Exam 2015+

Frage 1 von 113

Which of the following can be defined as the process of rerunning a portion of the test scenario or test plan to ensure that changes or corrections have not introduced new errors?

Wähle eine der folgenden:

Erklärung

Frage 2 von 113

At which layer of the OSI model do sniffers operate?

Wähle eine der folgenden:

Erklärung

Frage 3 von 113

When two or more separate entities (usually persons) operating in concert to protect sensitive functions or information must combine their knowledge to gain access to an asset, this is known as?

Wähle eine der folgenden:

Erklärung

Frage 4 von 113

What is the name for a substitution cipher that shifts the alphabet by 13 places?

Wähle eine der folgenden:

Erklärung

Frage 5 von 113

Your organization creates software applications that are sold to the public. Recently, management has become concerned about software piracy. Which organization deals with the prevention of this crime?

Wähle eine der folgenden:

Erklärung

Frage 6 von 113

A potential problem related to the physical installation of the Iris Scanner in regards to the usage of the iris pattern within a biometric system is:

Wähle eine der folgenden:

Erklärung

Frage 7 von 113

In Mandatory Access Control, sensitivity labels attached to object contain what information?

Wähle eine der folgenden:

Erklärung

Frage 8 von 113

Which of the following is true about Kerberos?

Wähle eine der folgenden:

Erklärung

Frage 9 von 113

Which of the following is needed for System Accountability?

Wähle eine der folgenden:

Erklärung

Frage 10 von 113

What is Kerberos?

Wähle eine der folgenden:

Erklärung

Frage 11 von 113

Kerberos depends upon what encryption method?

Wähle eine der folgenden:

Erklärung

Frage 12 von 113

A confidential number used as an authentication factor to verify a user's identity is called a:

Wähle eine der folgenden:

Erklärung

Frage 13 von 113

Individual accountability does not include which of the following?

Wähle eine der folgenden:

Erklärung

Frage 14 von 113

Which of the following exemplifies proper separation of duties?

Wähle eine der folgenden:

Erklärung

Frage 15 von 113

An access control policy for a bank teller is an example of the implementation of which of the following?

Wähle eine der folgenden:

Erklärung

Frage 16 von 113

Which one of the following authentication mechanisms creates a problem for mobile users?

Wähle eine der folgenden:

Erklärung

Frage 17 von 113

Organizations should consider which of the following first before allowing external access to their LANs via the Internet?

Wähle eine der folgenden:

Erklärung

Frage 18 von 113

Kerberos can prevent which one of the following attacks?

Wähle eine der folgenden:

Erklärung

Frage 19 von 113

In discretionary access environments, which of the following entities is authorized to grant information access to other people?

Wähle eine der folgenden:

Erklärung

Frage 20 von 113

What is the main concern with single sign-on?

There are parallels between the trust models in Kerberos and Public Key Infrastructure (PKI).
When we compare them side by side, Kerberos tickets correspond most closely to which of the following?

In biometric identification systems, at the beginning, it was soon apparent that truly positive identification could only be based on physical attributes of a person.

This raised the necessity of answering 2 questions: