Quiz
Section 2 - Test
Fragen in diesem Quiz (96)
1The combination of the probability of an event and its consequence (ISO/IEC 73). ___ is/are mitigated through
the use of controls or safeguards.- ARisk
- BThreat
- CAsset
- DVulnerability
2Anything that is capable of acting against an asset in a manner that can result in harm.
- ARisk
- BThreat
- CAsset
- DVulnerability
3Something of either tangible or intangible value that is worth protecting, including people, information,
infrastructure, finances and reputation- ARisk
- BThreat
- CAsset
- DVulnerability
4A weakness in the design, implementation, operation or internal control of a process that could
expose the system to adverse threats from threat events.- ARisk
- BThreat
- CAsset
- DVulnerability
5The risk level or exposure without taking into account the actions that management has taken or
might take- AInherent Risk
- BResidual Risk
6Which breadcrumb is correct when framing an approach to risk management?
- AThreat Source initiates > Threat Events exploits > Vulnerability causing > Adverse Impact producing > Organization Risk
- BThreat Source initiates > Vulnerability causing > Threat Events exploits > Adverse Impact producing > Organization Risk
- CThreat Events exploits >Threat Source initiates > Vulnerability causing > Adverse Impact producing > Organization Risk
- DThreat Events exploits > Vulnerability causing > Threat Source initiates > Adverse Impact producing > Organization Risk
7Approach to developing risk scenarios is based on describing risk events that are specific to
cybersecurity-related situations, typically hypothetical situations envisioned by the people performing the job
functions in specific processes.- ATop-down Approach
- BBottom-up Approach
8Approach to scenario development is based on understanding business goals and how a risk event
could affect the achievement of those goals. Under this model, the risk practitioner looks for the outcome of events
that may hamper business goals identified by senior management.- ATop-down Approach
- BBottom-up Approach
9The ___ approach is suited to general risk management of the company, because it looks at both IT- and non-
IT-related events. A benefit of this approach is that because it is more general, it is easier to achieve management
buy-in even if management usually is not interested in IT. The ___ approach also deals with the goals that
senior managers have already identified as important to them.- ATop-down Approach
- BBottom-down Approach
10The ____ approach can be a good way to identify scenarios that are highly dependent on the specific
technical workings of a process or system, which may not be apparent to anyone who is not intimately involved
with that work but could have substantial consequences for the organization.- ATop-down Approach
- BBottom-down Approach
11___ is used to calculate the risk that an organization faces based on the number of events that may occur within a given time period.
- AThreat
- BImpact
- CLikelihood
- DVulnerabilty
12Failure to detect a ___ may be the result of its absence, or it may be a false negative arising from configurations of a tool or improper performance of a manual review.
- AVulnerability
- BThreat
- CRisk
- DImpact
13Given the combination of unknown ___ and unknown ___, it is difficult of the cybersecurity professional to provide a comprehensive estimate of the likelihood of a successful attack.
- AThreat, Vulnerability
- BAsset, Threat
- CVulnerability, Asset
- DThreat, Risk
14Vulnerability assessments and penetration test provide the cybersecurity practitioner with valuable information on which to partially estimate the ___ .
- AVulnerabilities
- BRisks
- CThreats
- DLikelihood
15When using ___ rankings, the most important state is to rigorously define the meaning of each category and use definitions consistently throughout the assessment process.
- AQuantitative
- BQualitative
16For each identified threat, the ___ of harm expected to result should also be determined.
- ARisk
- BVulnerability
- CImpact
- DLikelihood
17Select all that apply: A number of methodologies are available to measure risk. Different industries and professions have adopted various tactics based upon the following criteria:
- ARisk tolerance
- BSize and scope of the environment in the question
- CAmount of data available
- DRisk appetite
- EThreat events
- FThreat impacts
18It is particularly important to understand an organization's ___ when considering how to measure risk.
- ARisk management plan
- BRisk appetite
- CRisk tolerance
- DRisk assessment
19There are three different approaches to implementing cybersecurity. Which three are they below
- AAd hoc
- BCompliance-based
- CRisk-based
- DThreat-based
- EImpact-based
- FLikelihood-based
20An ___ approach simply implements security with no particular rationale or criteria. ___
implementations may be driven by vendor marketing, or they may reflect insufficient subject matter expertise,
knowledge or training when designing and implementing safeguards.- AAd hoc
- BCompliance-based
- CRisk-based
- DThreat-based
21Also known as standards-based security, this approach relies on regulations or standards to
determine security implementations. Controls are implemented regardless of their applicability or necessity, which
often leads to a “checklist” attitude toward security- AAd hoc
- BCompliance-based
- CRisk-based
- DThreat-based
22___ security relies on identifying the unique risk a particular organization faces and designing
and implementing security controls to address that risk above and beyond the entity’s risk tolerance and business
needs. The ___ approach is usually scenario-based.- AAd hoc
- BCompliance-based
- CRisk-based
- DThreat-based
23The ___ approach is usually scenario-based.
- AAd hoc
- BCompliance-based
- CRisk-based
- DThreat-based
24___ have been known to breach security boundaries and perform malicious acts to gain a
competitive advantage.- ACybercriminals
- BCorporations
- COnline social hackers
- DScript kiddies
25Motivated by the desire for profit, these individuals are involved in fraudulent financial transactions
- ACybercriminals
- BCyberwarriors
- CCorporations
- DHacktivists
26Characterized by their willingness to use violence to achieve their goals, ___ frequently target critical infrastructures and government groups.
- ACyberterrorists
- BCybercriminals
- CCyberwarriors
- DNation states
27Often likened to hacktivists, ___ , also referred to as cyberfighters, are nationally
motivated citizens who may act on behalf of a political party or against another political party that threatens them.- ACyberwarriors
- BCyberterrorists
- CCybercriminals
- DScript kiddies
28Although they typically have fairly low-tech methods and tools, dissatisfied current or former
___ represent a clear cybersecurity risk. All of these attacks are adversarial, but some are not related to
APT cyberattacks.- AEmployees
- BNation states
- COnline social hackers
- DScript kiddies
29Although they often act independently, politically motivated hackers may target specific individuals
or organizations to achieve various ideological ends.- ACyberterrorists
- BHacktivists
- CCyberwarriors
- DCybercriminals
30___ often target government and private entities with a high level of sophistication to
obtain intelligence or carry out other destructive activities.- ANation states
- BOnline social hackers
- CHacktivists
- DEmployees
31Skilled in social engineering, these attackers are frequently involved in cyberbullying,
identity theft and collection of other confidential information or credentials.- AScript kiddies
- BOnline social hackers
- CHacktivists
- DEmployees
32___ are individuals who are learning to hack; they may work alone or with others and
are primarily involved in code injections and distributed denial-of-service (DDoS) attacks.- AOnline social hackers
- BEmployees
- CScript kiddies
- DCybercriminals
33The actual occurrence of a threat, or an activity by a threat agent (or adversary) against an asset.
- AExploit
- BAttack Vector
- CAttack
- DAttack Mechanism
34From an attacker’s point of view, the asset is a target, and the path or route used to gain access to the target (asset) is known as an
- AExploit
- BAttack Vector
- CAttack
- DAttack Mechanism
35There are two types of attack vectors: ingress and egress. Which one is known as data exfiltration?
- AIngress
- BEgress
36Which attack vector focuses on intrusion and hacking into systems?
- AIngress
- BEgress
37Employees that steal data from systems and networks is an example of which attack vector?
- AIngress
- BEgress
38The attacker must defeat any controls in place and/or use an ___ to take advantage of a vulnerability.
- AExploit
- BAttack Vector
- CAttack
- DAttack Mechanism
39The method used to deliver the exploit.
- ATarget
- BAttack Vector
- CAttack
- DAttack Mechanism
40An example of this can be a crafted malicious pdf, crafted by the attacker and delivered by email.
- AExploit
- BAttack Vector
- CAttack
- DAttack Mechanism
41Which order is correct for the attributes of an attack?
- AAttack Vector, Exploit, Vulnerability, Payload, Target (Asset)
- BAttack Vector, Exploit, Payload, Vulnerability, Target (Asset)
- CAttack Vector, Vulnerability, Payload, Exploit, Target (Asset)
- DAttack Vector, Vulnerability, Exploit, Payload, Target (Asset)
42Usually the result of an error, malfunction or mishap of some sort.
- AAdversarial Threat Event
- BNonadversarial Threat Event
43 Made by a human threat agent
- AAdversarial Threat Event
- BNonadversarial Threat Event
44 The adversary gathers information using a variety of techniques, passive or active.
- APerform reconnaissance
- BCreate attack tools
- CDeliver malicious capabilities
- DExploit and compromise
- EConduct an attack
- FAchieve results
- GMaintain a presence or set of capabilities
- HCoordinate a campaign
45The adversary crafts the tools needed to carry out a future attack.
- APerform reconnaissance
- BCreate attack tools
- CDeliver malicious capabilities
- DExploit and compromise
- EConduct an attack
- FAchieve results
- GMaintain a presence or set of capabilities
- HCoordinate a campaign
46 The adversary inserts or installs whatever is needed to carry out the attack.
- APerform reconnaissance
- BCreate attack tools
- CDeliver malicious capabilities
- DExploit and compromise
- EConduct an attack
- FAchieve results
- GMaintain a presence or set of capabilities
- HCoordinate a campaign
47The adversary takes advantage of information and systems in order to compromise
them.- APerform reconnaissance
- BCreate attack tools
- CDeliver malicious capabilities
- DExploit and compromise
- EConduct an attack
- FAchieve results
- GMaintain a presence or set of capabilities
- HCoordinate a campaign
48 The adversary coordinates attack tools or performs activities that interfere with
organizational functions.- APerform reconnaissance
- BCreate attack tools
- CDeliver malicious capabilities
- DExploit and compromise
- EConduct an attack
- FAchieve results
- GMaintain a presence or set of capabilities
- HCoordinate a campaign
49 The adversary causes an adverse impact.
- APerform reconnaissance
- BCreate attack tools
- CDeliver malicious capabilities
- DExploit and compromise
- EConduct an attack
- FAchieve results
- GMaintain a presence or set of capabilities
- HCoordinate a campaign
50The adversary continues to exploit and compromise the system
- APerform reconnaissance
- BCreate attack tools
- CDeliver malicious capabilities
- DExploit and compromise
- EConduct an attack
- FAchieve results
- GMaintain a presence or set of capabilities
- HCoordinate a campaign
51 The adversary coordinates a campaign against the organization.
- APerform reconnaissance
- BCreate attack tools
- CDeliver malicious capabilities
- DExploit and compromise
- EConduct an attack
- FAchieve results
- GMaintain a presence or set of capabilities
- HCoordinate a campaign
52What is the correct order of the Threat Process?
- APerform reconnaissance, Create attack tools, Exploit and compromise, Deliver malicious capabilities, Conduct an attack, Achieve results, Maintain a presence or set of capabilities, Coordinate a campaign
- BPerform reconnaissance, Create attack tools, Deliver malicious capabilities, Exploit and compromise, Conduct an attack, Achieve results, Maintain a presence or set of capabilities, Coordinate a campaign
- CPerform reconnaissance, Deliver malicious capabilities, Create attack tools, Exploit and compromise, Conduct an attack, Achieve results, Maintain a presence or set of capabilities, Coordinate a campaign
- DPerform reconnaissance, Deliver malicious capabilities, Create attack tools, Exploit and compromise, Conduct an attack, Maintain a presence or set of capabilities, Achieve results, Coordinate a campaign
53Perform reconnaissance: The adversary gathers information using a variety of techniques, passive or active. Passive may include:
- Ai. Sniffing network traffic
ii. Using open source discovery of organizational information (news groups; company postings on IT design
and IT architecture)
iii. Google hacking - Bi. Scanning the network perimeter
ii. Social engineering (fake phone calls, low-level phishing)
- Ai. Sniffing network traffic
54The following are examples of which attack process?
a. Sniffing network traffic
b. Using open source discovery of organizational information (news groups; company postings on IT design and IT architecture)
c. Google hacking
d. Scanning the network perimeter
e. Social engineering (fake phone calls, low-level phishing)- APerform reconnaissance
- BCreate attack tools
- CDeliver malicious capabilities
- DExploit and compromise
55The following are examples of which attack process?
a. Phishing or spear phishing attacks
b. Crafting counterfeit websites or certificates
c. Creating and operating false organizations and placing them in to the supply chain to inject malicious components- APerform reconnaissance
- BCreate attack tools
- CDeliver malicious capabilities
- DExploit and compromise
56The following are examples of which attack process?
a. Introducing malware into organizational information systems
b. Placing subverted individuals into privileged positions within the organization
c. Installing sniffers or scanning devices on targeted networks and systems
d. Inserting tampered hardware or critical components into organizational systems or supply chains- APerform reconnaissance
- BCreate attack tools
- CDeliver malicious capabilities
- DExploit and compromise
57The following are examples of which attack process?
a. Split tunneling or gaining physical access to organizational facilities
b. Exfiltrating data or sensitive information
c. Exploiting multitenancy (i.e., multiple customers on shared resources) in a public cloud environment (e.g.,
attacking open public access points; application program interfaces [APIs])
d. Launching zero-day exploits- APerform reconnaissance
- BCreate attack tools
- CDeliver malicious capabilities
- DExploit and compromise
58The following are examples of which attack process?
a. Communication interception or wireless jamming attacks
b. Denial-of-service (DoS) or distributed DDoS attacks
c. Remote interference with or physical attacks on organizational facilities or infrastructures
d. Session-hijacking or man-in-the-middle attacks- AConduct an attack
- BAchieve results
- CMaintain a presence or set of capabilities
- DCoordinate a campaign
59The following are examples of which attack process?
a. Obtaining unauthorized access to systems and/or sensitive information
b. Degrading organizational services or capabilities
c. Creating, corrupting or deleting critical data
d. Modifying the control flow of information system (e.g., industrial control system, supervisory control and
data acquisition (SCADA) systems)- AConduct an attack
- BAchieve results
- CMaintain a presence or set of capabilities
- DCoordinate a campaign
60The following are examples of which attack process?
a. Obfuscating adversary actions or interfering with intrusion detection systems (IDSs)
b. Adapting cyberattacks in response to organizational security measures- AConduct an attack
- BAchieve results
- CMaintain a presence or set of capabilities
- DCoordinate a campaign
61The following are examples of which attack process?
a. Multi-staged attacks
b. Internal and external attacks
c. Widespread and adaptive attacks- AConduct an attack
- BAchieve results
- CMaintain a presence or set of capabilities
- DCoordinate a campaign
62Which of the following is NOT a Nonadversarial Threat Event?
- AMishandling of critical or sensitive information by authorized users
- BIncorrect privilege settings
- CFire, flood, hurricane, windstorm or earthquake at primary or backup facilities
- DIntroduction of vulnerabilities into software products
- EViruses, Network Worms, Botnets
- FPervasive disk errors or other problems caused by aging equipment
63Software designed to gain access to targeted computer systems, steal information or disrupt computer operations.
- ADoS Attack
- BMalware
- CSocial Engineering
- DPhishing
64A piece of code that can replicate itself and spread from one computer to another. It requires intervention or execution to replicate and/or cause damage.
- ASpyware
- BAdware
- CVirus
- DNetwork Worm
65A variant of the computer virus, which is essentially a piece of self-replicating code designed to spread itself across computer networks. It does not require intervention or execution to replicate.
- AVirus
- BNetwork Worm
- CTrojan Horse
- DBotnet
66A piece of malware that gains access to a targeted system by hiding within a genuine application
- AVirus
- BNetwork Worm
- CTrojan Horse
- DBotnet
67Derived from “robot network,” a large, automated and distributed network of previously compromised computers that can be simultaneously controlled to launch large-scale attacks such as DoS.
- AVirus
- BNetwork Worm
- CTrojan Horse
- DBotnet
68A class of malware that gathers information about a person or organization without the knowledge of
that person or organization.- ASpyware
- BAdware
- CRansomware
- DKeylogger
- ERootkit
69Also called “hostage code,” a class of extortive malware that locks or encrypts data or functions and demands a payment to unlock them. Several types are available for every operating system
- ASpyware
- BAdware
- CRansomware
- DKeylogger
- ERootkit
70A class of malware that secretly records user keystrokes and, in some cases, screen content.
- ASpyware
- BAdware
- CRansomware
- DKeylogger
- ERootkit
71A class of malware that hides the existence of other malware by modifying the underlying operating system.
- ASpyware
- BAdware
- CRansomware
- DKeylogger
- ERootkit
72Complex and coordinated attacks directed at a specific entity or
organization. They require a substantial amount of research and time, often taking months or even years to fully execute.- AAdvanced persistent threats (APTs)
- BDoS Attack
- CBrute force attack
- DCross-site scripting (XSS)
73A means of regaining access to a compromised system by installing software or configuring existing software to enable remote access under attacker-defined conditions.
- AAdvanced persistent threats (APTs)
- BBackdoor
- CBrute force attack
- DMan-in-the-middle attack
74An attack made by trying all possible combinations of passwords or encryption keys until the correct one is found.
- ABuffer overflow
- BAdvanced persistent threats (APTs)
- CBackdoor
- DBrute force attack
75Occurs when a program or process tries to store more data in a buffer (temporary data storage area) than it was intended to hold.
- ACross-site scripting (XSS)
- BMan-in-the-middle attack
- CBuffer overflow
- DBackdoor
76A type of injection in which malicious scripts are injected into otherwise benign and
trusted websites.- AStructure Query Language (SQL) injection
- BCross-site scripting (XSS)
- CDoS attack
- DAdvanced persistent threats (APTs)
77An assault on a service from a single source that floods it with so many requests that it becomes overwhelmed and is either stopped completely or operates at a significantly reduced rate.
- AMan-in-the-middle attack
- BCross-site scripting (XSS)
- CStructure Query Language (SQL) injection
- DDoS attack
78Any attempt to exploit social vulnerabilities to gain access to information and/or systems.
- ASpear phishing
- BSocial engineering
- CPhishing
- DSpoofing
79A type of email attack that attempts to convince a user that the originator is genuine, but with the intention of obtaining information for use in social engineering.
- APhishing
- BSpoofing
- CSpear phishing
- DSocial engineering
80An attack where social engineering techniques are used to masquerade as a trusted party to obtain important information such as passwords from the victim.
- APhishing
- BSocial engineering
- CSpear phishing
- DSpoofing
81Faking the sending address of a transmission in order to gain illegal entry into a secure system.
- ASpoofing
- BPhishing
- CSocial engineering
- DSpear phishing
82An attack that consists of insertion or ‘injection’ of a SQL query via the input data from the client to the application.
- AZero-day exploit
- BStructure Query Language (SQL) injection
- CCross-site scripting (XSS)
- DBuffer overflow
83A vulnerability that is exploited before the software creator/vendor is even aware of its existence.
- ABackdoor
- BAdvanced persistent threats (APTs)—
- CDoS attack
- DZero-day exploit
84There are several attributes of good policies that should be considered: (select all that apply below)
- ASecurity policies should be an articulation of a well-defined information security strategy that captures the intent, expectations and direction of management.
- BPolicies must be update/maintained on a frequent basis.
- CPolicies must be clear and easily understood by all affected parties.
- DPolicies should be short and concise, written in plain language.
85Most organizations should create security policies ___ developing a security strategy.
- ABefore
- BAfter
86Communicate required and prohibited activities and behaviors.
- AProcedures
- BPolicies
- CStandards
- DGuidelines
87Interpret policies in specific situations.
- AGuidelines
- BPolicies
- CStandards
- DProcedures
88Provide details on how to comply with policies and standards.
- AProcedures
- BGuidelines
- CStandards
- DPolicies
89Provide general advice on issues such as “what to do in particular circumstances.” These are not requirements to be met but are strongly recommended.
- APolicies
- BStandards
- CProcedures
- DGuidelines
90Which COBIT 5 information security policy set do the following items belong to:
– Data classification and ownership
– System classification and ownership
– Resource utilization and prioritization
– Asset life cycle management
– Asset protection- ARisk Management
- BCompliance
- CCommunication and Operations
- DAsset Management
91Which COBIT 5 information security policy set do the following items belong to:
– At-work acceptable use and behavior, including privacy, Internet/email, mobile devices, BYOD, etc.
– Offsite acceptable use and behavior, including social media, blogs- ACommunication and Operations
- BCompliance
- CAcquisition/Development/Maintenance
- DRules of Behavior
92Which COBIT 5 information security policy set do the following items belong to:
– Information security within the life cycle, requirements definition and procurement/acquisition processes
– Secure coding practices
– Integration of information security with change and configuration management- AAcquisition/Development/Maintenance
- BRisk Management
- CRules of Behavior
- DCommunication and Operations
93Which COBIT 5 information security policy set do the following items belong to:
Contract management- ARisk Management
- BVendor Management
- CAsset Management
- DBusiness Continuity and Disaster Recovery
94Which COBIT 5 information security policy set do the following items belong to:
– IT information security architecture and application design
– Service level agreements- ACompliance
- BRules of Behavior
- CCommunication and Operations
- DAcquisition/Development/Maintenance
95Which COBIT 5 information security policy set do the following items belong to:
– IT information security ___ assessment process
– Development of metrics
– Assessment repositories- ACompliance
- BAsset Management
- CRisk Management
- DBusiness Continuity and Disaster Recovery
96Which COBIT 5 information security policy set do the following items belong to:
– Organizational risk management plan
– Information risk profile- AAsset Management
- BCommunication and Operations
- CAcquisition/Development/Maintenance
- DRisk Management
Informationen
- Beschreibung
- 1 Security X Quiz am Section 2 - Test, erstellt von J Garner am 05/08/2018.
- Autor
- J Garner
- Sprache
- English
- Aufrufe
- 56
- Schlagwörter
- Bewertung
- Noch keine Bewertungen Bewerte dieses Quiz