Quiz
Computer and Network Security
Erstelle ein kostenloses Konto, um dieses Quiz zu beenden
Speichere deinen Fortschritt und sieh dir dein Endergebnis an.
oder mit deiner E-Mail registrieren
Schon ein Konto? Anmelden
Fragen in diesem Quiz (200)
1Within the realm of IT security, which of the following combinations
best defines risk?- AThreat coupled with a breach
- BThreat coupled with a vulnerability
- CVulnerability coupled with an attack
- DThreat coupled with a breach of security
2When determining the value of an intangible asset which is be BEST
approach?- ADetermine the physical storage costs and multiply by the expected life
of the company - BWith the assistance of a finance of accounting professional determine
how much profit the asset has returned - CReview the depreciation of the intangible asset over the past three
years. - DUse the historical acquisition or development cost of the intangible
asset
- ADetermine the physical storage costs and multiply by the expected life
3Qualitative risk assessment is earmarked by which of the following?
- AEase of implementation and it can be completed by personnel with a
limited understanding of the risk assessment process - BCan be completed by personnel with a limited understanding of the risk
assessment process and uses detailed metrics used for calculation of
risk - CDetailed metrics used for calculation of risk and ease of
implementation - DCan be completed by personnel with a limited understanding of the risk
assessment process and detailed metrics used for the calculation of risk
- AEase of implementation and it can be completed by personnel with a
4Single loss expectancy (SLE) is calculated by using:
- AAsset value and annualized rate of occurrence (ARO)
- BAsset value, local annual frequency estimate (LAFE), and standard
annual frequency estimate (SAFE) - CAsset value and exposure factor
- DLocal annual frequency estimate and annualized rate of occurrence
5Consideration for which type of risk assessment to perform includes
all of the following:- ACulture of the organization, likelihood of exposure and budget
- BBudget, capabilities of resources and likelihood of exposure
- CCapabilities of resources, likelihood of exposure and budget
- DCulture of the organization, budget, capabilities and resources
6Security awareness training includes:
- ALegislated security compliance objectives
- BSecurity roles and responsibilities for staff
- CThe high-level outcome of vulnerability assessments
- DSpecialized curriculum assignments, coursework and an accredited
institution
7What is the minimum and customary practice of responsible
protection of assets that affects a community or societal norm?- ADue diligence
- BRisk mitigation
- CAsset protection
- DDue care
8Effective security management:
- AAchieves security at the lowest cost
- BReduces risk to an acceptable level
- CPrioritizes security for new products
- DInstalls patches in a timely manner
9Availability makes information accessible by protecting from:
- ADenial of services, fires, floods, hurricanes, and unauthorized
transactions - BFires, floods, hurricanes, unauthorized transactions and unreadable
backup tapes - CUnauthorized transactions, fires, floods, hurricanes and unreadable
backup tapes - DDenial of services, fires, floods, and hurricanes and unreadable backup
tapes
- ADenial of services, fires, floods, hurricanes, and unauthorized
10Which phrase best defines a business continuity/disaster recovery
plan?- AA set of plans for preventing a disaster.
- BAn approved set of preparations and sufficient procedures for
responding to a disaster. - CA set of preparations and procedures for responding to a disaster
without management approval. - DThe adequate preparations and procedures for the continuation of all
organization functions.
11Which of the following steps should be performed first in a business
impact analysis (BIA)?- AIdentify all business units within an organization
- BEvaluate the impact of disruptive events
- CEstimate the Recovery Time Objectives (RTO)
- DEvaluate the criticality of business functions
12Tactical security plans are BEST used to:
- AEstablish high-level security policies
- BEnable enterprise/entity-wide security management
- CReduce downtime
- DDeploy new security technology
13Who is accountable for implementing information security?
- AEveryone
- BSenior management
- CSecurity officer
- DData owners
14Security is likely to be most expensive when addressed in which
phase?- ADesign
- BRapid prototyping
- CTesting
- DImplementation
15Information systems auditors help the organization:
- AMitigate compliance issues
- BEstablish an effective control environment
- CIdentify control gaps
- DAddress information technology for financial statements
16The Facilitated Risk Analysis Process (FRAP)
- Amakes a base assumption that a broad risk assessment is the most
efficient way to determine risk in a system, business segment,
application or process. - Bmakes a base assumption that a narrow risk assessment is the most
efficient way to determine risk in a system, business segment,
application or process. - Cmakes a base assumption that a narrow risk assessment is the least
efficient way to determine risk in a system, business segment,
application or process. - Dmakes a base assumption that a broad risk assessment is the least
efficient way to determine risk in a system, business segment,
application or process.
- Amakes a base assumption that a broad risk assessment is the most
17Setting clear security roles has the following benefits:
- AEstablishes personal accountability, reduces cross-training
requirements and reduces departmental turf battles - BEnables continuous improvement, reduces cross-training requirements
and reduces departmental turf battles - CEstablishes personal accountability, establishes continuous
improvement and reduces turf battles - DReduces departmental turf battles, Reduces cross-training
requirements and establishes personal accountability
- AEstablishes personal accountability, reduces cross-training
18Well-written security program policies are BEST reviewed:
- AAt least annually or at pre-determined organization changes
- BAfter major project implementations
- CWhen applications or operating systems are updated
- DWhen procedures need to be modified
19An organization will conduct a risk assessment to evaluate
- Athreats to its assets, vulnerabilities not present in the environment, the
likelihood that a threat will be realized by taking advantage of an
exposure, the impact that the exposure being realized will have on the
organization, the residual risk - Bthreats to its assets, vulnerabilities present in the environment, the
likelihood that a threat will be realized by taking advantage of an
exposure, the impact that the exposure being realized will have on
another organization, the residual risk - Cthreats to its assets, vulnerabilities present in the environment, the
likelihood that a threat will be realized by taking advantage of an
exposure, the impact that the exposure being realized will have on the
organization, the residual risk - Dthreats to its assets, vulnerabilities present in the environment, the
likelihood that a threat will be realized by taking advantage of an
exposure, the impact that the exposure being realized will have on the
organization, the total risk
- Athreats to its assets, vulnerabilities not present in the environment, the
20A security policy which will remain relevant and meaningful over time
includes the following:- ADirective words such as shall, must, or will, technical specifications and
is short in length - BDefined policy development process, short in length and contains
directive words such as shall, must or will - CShort in length, technical specifications and contains directive words
such as shall, must or will - DDirective words such as shall, must, or will, defined policy development
process and is short in length
- ADirective words such as shall, must, or will, technical specifications and
21The ability of one person in the finance department to add vendors to
the vendor database and subsequently pay the vendor violates which
concept?- AA well-formed transaction
- BSeparation of duties
- CLeast privilege
- DData sensitivity level
22Collusion is best mitigated by:
- AJob rotation
- BData classification
- CDefining job sensitivity level
- DLeast privilege
23Data access decisions are best made by:
- AUser managers
- BData owners
- CSenior management
- DApplication developer
24Which of the following statements BEST describes the extent to which
an organization should address business continuity or disaster
recovery planning?- AContinuity planning is a significant organizational issue and should
include all parts or functions of the company. - BContinuity planning is a significant technology issue and the recovery of
technology should be its primary focus. - CContinuity planning is required only where there is complexity in voice
and data communications. - DContinuity planning is a significant management issue and should
include the primary functions specified by management.
- AContinuity planning is a significant organizational issue and should
25Business impact analysis is performed to BEST identify:
- AThe impacts of a threat to the organization operations.
- BThe exposures to loss to the organization.
- CThe impacts of a risk on the organization.
- DThe cost efficient way to eliminate threats.
26During the risk analysis phase of the planning, which of the following
actions could BEST manage threats or mitigate the effects of an
event?- AModifying the exercise scenario.
- BDeveloping recovery procedures.
- CIncreasing reliance on key individuals
- DImplementing procedural controls.
27The BEST reason to implement additional controls or safeguards is to:
- Adeter or remove the risk.
- Bidentify and eliminate the threat.
- Creduce the impact of the threat.
- Didentify the risk and the threat.
28Which of the following statements BEST describes organization impact
analysis?- ARisk analysis and organization impact analysis are two different terms
describing the same project effort. - BA organization impact analysis calculates the probability of disruptions
to the organization. - CA organization impact analysis is critical to development of a business
continuity plan. - DA organization impact analysis establishes the effect of disruptions on
the organization.
- ARisk analysis and organization impact analysis are two different terms
29The term “disaster recovery” refers to the recovery of:
- Aorganization operations.
- Btechnology environment.
- Cmanufacturing environment.
- Dpersonnel environments.
30Which of the following terms BEST describes the effort to determine
the consequences of disruptions that could result from a disaster?- ABusiness impact analysis.
- BRisk analysis.
- CRisk assessment.
- DProject problem definition
31The elements of risk are as follows:
- ANatural disasters and manmade disasters
- BThreats, assets and mitigating controls
- CRisk and business impact analysis
- Dbusiness impact analysis and mitigating controls
32Which of the following methods is not acceptable for exercising the
business continuity plan?- ATable-top exercise.
- BCall exercise.
- CSimulated exercise.
- DHalting a production application or function.
33Which of the following is the primary desired result of any wellplanned
business continuity exercise?- AIdentifies plan strengths and weaknesses.
- BSatisfies management requirements.
- CComplies with auditor’s requirements.
- DMaintains shareholder confidence
34A business continuity plan is best updated and maintained:
- AAnnually or when requested by auditors.
- BOnly when new versions of software are deployed.
- COnly when new hardware is deployed.
- DDuring the configuration and change management process.
35Which of the following is MOST important for successful business
continuity?- ASenior leadership support.
- BStrong technical support staff.
- CExtensive wide area network infrastructure.
- DAn integrated incident response team.
36A service’s recovery point objective is zero. Which approach BEST
ensures the requirement is met?- ARAID 6 with a hot site alternative.
- BRAID 0 with a warm site alternative
- CRAID 0 with a cold site alternative
- DRAID 6 with a reciprocal agreement.
37The (ISC)2 code of ethics resolves conflicts between canons by:
- Athere can never be conflicts between canons.
- Bworking through adjudication.
- Cthe order of the canons.
- Dvetting all canon conflicts through the board of directors.
38In the event of a security incident, one of the primary objectives of the
operations staff is to ensure that- Athe attackers are detected and stopped.
- Bthere is minimal disruption to the organization’s mission.
- Cappropriate documentation about the event is maintained as chain of
evidence. - Dthe affected systems are immediately shut off to limit to the impact.
39Good data management practices include:
- AData quality procedures at all stages of the data management process,
verification and validation of accuracy of the data, adherence to agreed
upon data management practices, ongoing data audit to monitor the
use and assess effectiveness of management practices and the
integrity of existing data. - BData quality procedures at some stages of the data management
process, verification and validation of accuracy of the data, adherence
to agreed upon data management practices, ongoing data audit to
monitor the use and assess effectiveness of management practices and
the integrity of existing data. - CData quality procedures at all stages of the data management process,
verification and validation of accuracy of the data, adherence to
discussed data management practices, ongoing data audit to monitor
the use and assess effectiveness of management practices and the
integrity of existing data. - DData quality procedures at all stages of the data management process,
verification and validation of accuracy of the data, adherence to agreed
upon data management practices, intermittent data audit to monitor
the use and assess effectiveness of management practices and the
integrity of existing data.
- AData quality procedures at all stages of the data management process,
40Issues to be considered by the security practitioner when establishing
a data policy include:- ACost, Due Care and Due Diligence, Privacy, Liability, Sensitivity,
Existing Law & Policy Requirements, Policy and Process - BCost, Ownership and Custodianship, Privacy, Liability, Sensitivity,
Future Law & Policy Requirements, Policy and Process - CCost, Ownership and Custodianship, Privacy, Liability, Sensitivity,
Existing Law & Policy Requirements, Policy and Procedure - DCost, Ownership and Custodianship, Privacy, Liability, Sensitivity,
Existing Law & Policy Requirements, Policy and Process
- ACost, Due Care and Due Diligence, Privacy, Liability, Sensitivity,
41The information owner typically has the following responsibilities:
- ADetermine the impact the information has on the mission of the
organization, understand the replacement cost of the information,
determine who in the organization or outside of it has a need for the
information and under what circumstances the information should be
released, know when the information is inaccurate or no longer needed
and should be archived. - BDetermine the impact the information has on the mission of the
organization, understand the replacement cost of the information,
determine who in the organization or outside of it has a need for the
information and under what circumstances the information should be
released, know when the information is inaccurate or no longer needed
and should be destroyed. - CDetermine the impact the information has on the policies of the
organization, understand the replacement cost of the information,
determine who in the organization or outside of it has a need for the
information and under what circumstances the information should not
be released, know when the information is inaccurate or no longer
needed and should be destroyed. - DDetermine the impact the information has on the mission of the
organization, understand the creation cost of the information,
determine who in the organization or outside of it has a need for the
information and under what circumstances the information should be
released, know when the information is inaccurate or no longer needed
and should be destroyed.
- ADetermine the impact the information has on the mission of the
42QA/QC mechanisms are designed to prevent data contamination,
which occurs when a process or event introduces either of which two
fundamental types of errors into a dataset: (Choose TWO)- AErrors of commission
- BErrors of insertion
- CErrors of omission
- DErrors of creation
43Some typical responsibilities of a data custodian may include: (Choose
ALL that apply)- AAdherence to appropriate and relevant data policy and data ownership
guidelines. - BEnsuring accessibility to appropriate users, maintaining appropriate
levels of dataset security. - CFundamental dataset maintenance, including but not limited to data
storage and archiving. - DAssurance of quality and validation of any additions to a dataset,
including periodic audits to assure ongoing data integrity.
- AAdherence to appropriate and relevant data policy and data ownership
44The objectives of data documentation are to: (Choose ALL that apply)
- AEnsure the longevity of data and their re-use for multiple purposes
- BEnsure that data users understand the content context and limitations
of datasets - CFacilitate the confidentiality of datasets
- DFacilitate the interoperability of datasets and data exchange
45Benefits of data standards include:
- Amore efficient data management, decreased data sharing, higher
quality data, improved data consistency, increased data integration,
better understanding of data, improved documentation of information
resources - Bmore efficient data management, increased data sharing, higher
quality data, improved data consistency, increased data integration,
better understanding of data, improved documentation of information
resources - Cmore efficient data management, increased data sharing, medium
quality data, improved data consistency, decreased data integration,
better understanding of data, improved documentation of information
resources - Dmore efficient data management, increased data sharing, highest
quality data, improved data consistency, increased data integration,
better understanding of data, improved documentation of information
metadata
- Amore efficient data management, decreased data sharing, higher
46When classifying data, the security practitioner needs to determine
the following aspects of the policy: (Choose ALL that apply)- Awho has access to the data
- Bwhat methods should be used to dispose of the data
- Chow the data is secured
- Dwhether the data needs to be encrypted
47The major benefit of information classification is to
- Amap out the computing ecosystem
- Bidentify the threats and vulnerabilities
- Cdetermine the software baseline
- Didentify the appropriate level of protection needs
48When sensitive information is no longer critical but still within scope
of a record retention policy, that information is BEST- ADestroyed
- BRe-categorized
- CDegaussed
- DReleased
49What are the FOUR phases of the equipment lifecycle?
- ADefining requirements, acquiring and implementing, operations and
maintenance, disposal and decommission - BAcquiring requirements, defining and implementing, operations and
maintenance, disposal and decommission - CDefining requirements, acquiring and maintaining, implementing and
operating, disposal and decommission - DDefining requirements, acquiring and implementing, operations and
decommission, maintenance and disposal
- ADefining requirements, acquiring and implementing, operations and
50Which of the following BEST determines the employment suitability of
an individual?- AJob rank or title
- BPartnership with the security team
- CRole
- DBackground investigation
51The best way to ensure that there is no data remanence of sensitive
information that was once stored on a DVD-R media is by- ADeletion
- BDegaussing
- CDestruction
- DOverwriting
52Which of the following processes is concerned with not only
identifying the root cause but also addressing the underlying issue?- AIncident management
- BProblem management
- CChange management
- DConfiguration management
53Before applying a software update to production systems, it is MOST
important that- AFull disclosure information about the threat that the patch addresses is
available - BThe patching process is documented
- CThe production systems are backed up
- DAn independent third party attests the validity of the patch
- AFull disclosure information about the threat that the patch addresses is
54A holistic lifecycle for developing security architecture that begins
with assessing business requirements and subsequently creating a
‘chain of traceability’ through phases of strategy, concept, design,
implementation and metrics is characteristic of which of the following
frameworks?- AZachman
- BSABSA
- CISO 27000
- DTOGAF
55While an Enterprise Security Architecture (ESA) can be applied in
many different ways, it is focused on a few key goals. Identify the
proper listing of the goals for the ESA:- AIt represents a simple, long term view of control, it provides a unified
vision for common security controls, it leverages existing technology
investments, it provides a fixed approach to current and future threats
and also the needs of peripheral functions - BIt represents a simple, long term view of control, it provides a unified
vision for common security controls, it leverages new technology
investments, it provides a flexible approach to current and future
threats and also the needs of core functions - CIt represents a complex, short term view of control, it provides a
unified vision for common security controls, it leverages existing
technology investments, it provides a flexible approach to current and
future threats and also the needs of core functions - DIt represents a simple, long term view of control, it provides a unified
vision for common security controls, it leverages existing technology
investments, it provides a flexible approach to current and future
threats and also the needs of core functions
- AIt represents a simple, long term view of control, it provides a unified
56Which of the following can BEST be used to capture detailed security
requirements?- AThreat modeling, covert channels, and data classification
- BData classification, risk assessments, and covert channels
- CRisk assessments, covert channels, and threat modeling
- DThreat modeling, data classification, and risk assessments
57Which of the following security standards is internationally
recognized as the standards for sound security practices and is
focused on the standardization and certification of an organization’s
Information Security Management System (ISMS)?- AISO 15408
- BISO 27001
- CISO 9001
- DISO 9146
58Which of the following describes the rules that need to be
implemented to ensure that the security requirements are met?- ASecurity kernel
- BSecurity policy
- CSecurity model
- DSecurity reference monitor
59A two-dimensional grouping of individual subjects into groups or roles
and granting access to groups to objects is an example of which of the
following types of models?- AMultilevel lattice
- BState machine
- CNon-interference
- DMatrix-based
60Which of the following models ensures that a subject with clearance
level of ‘Secret’ has the ability to write only to objects classified as
‘Secret’ or ‘Top Secret’ but is prevented from writing information
classified as ‘Public’?- ABiba-Integrity
- BClark–Wilson
- CBrewer–Nash
- DBell–LaPadula
61Which of the following is unique to the Biba Integrity Model?
- ASimple property
- B* (star) property
- CInvocation property
- DStrong * property
62Which of the following models is BEST considered in a shared datahosting
environment so that the data of one customer is not disclosed
to a competitor or other customers sharing that hosted environment?- ABrewer–Nash
- BClark–Wilson
- CBell–LaPadula
- DLipner
63Which of the following security models is primarily concerned with
how the subjects and objects are created and how subjects are
assigned rights or privileges?- ABell–LaPadula
- BBiba-Integrity
- CChinese Wall
- DGraham–Denning
64Which of the following ISO standards provides the evaluation criteria
that can be used to evaluate security requirements of different
products with different functions?- A15408
- B27000
- C9100
- D27002
65In the Common Criteria, the common set of functional and assurance
requirements for a category of vendor products deployed in a
particular type of environment are known as- AProtection Profiles
- BSecurity Target
- CTrusted Computing Base
- DRing Protection
66Which of the following evaluation assurance level that is formally
verified, designed and tested is expected for high risk situation?- AEAL 1
- BEAL 3
- CEAL 5
- DEAL 7
67Formal acceptance of an evaluated system by management is known
as- ACertification
- BAccreditation
- CValidation
- DVerification
68Which stage of the Capability Maturity Model (CMM) is characterized
by having organizational processes that are proactive?- AInitial
- BManaged
- CDefined
- DOptimizing
69Which of the following BEST provides a method of quantifying risks
associated with information technology when validating the abilities
of new security controls and countermeasures to address the
identified risks?- AThreat/risk assessment
- BPenetration testing
- CVulnerability assessment
- DData classification
70The TCSEC identifies two types of covert channels, what are they?
(Choose TWO)- AStorage
- BBoundary
- CTiming
- DMonitoring
71Which of the following is the main reason for security concerns in
mobile computing devices?- AThe 3G/4G protocols are inherently insecure
- BLower processing power
- CHackers are targeting mobile devices
- DThe lack of anti-virus software.
72In decentralized environments device drivers that enable the OS to
control and communicate with hardware need to be securely
designed, developed and deployed because they are- Atypically installed by end-users and granted access to the supervisor
state - Btypically installed by administrators and granted access to user mode
state - Ctypically installed by software without human interaction.
- Dintegrated as part of the operating system.
- Atypically installed by end-users and granted access to the supervisor
73A system administrator grants rights to a group of individuals called
“Accounting” instead of granting rights to each individual. This is an
example of which of the following security mechanisms?- ALayering
- BData hiding
- CCryptographic protections
- DAbstraction
74Asymmetric key cryptography is used for the following:
- AEncryption of data, Access Control, Steganography
- BSteganography, Access control, Nonrepudiation
- CNonrepudiation, Steganography, Encryption of Data
- DEncryption of Data, Nonrepudiation, Access Control
75Which of the following supports asymmetric key cryptography?
- ADiffie–Hellman
- BRijndael
- CBlowfish
- DSHA-256
76What is an important disadvantage of using a public key algorithm
compared to a symmetric algorithm?- AA symmetric algorithm provides better access control.
- BA symmetric algorithm is a faster process.
- CA symmetric algorithm provides nonrepudiation of delivery.
- DA symmetric algorithm is more difficult to implement.
77When a user needs to provide message integrity, what option is BEST?
- ASend a digital signature of the message to the recipient
- BEncrypt the message with a symmetric algorithm and send it
- CEncrypt the message with a private key so the recipient can decrypt
with the corresponding public key - DCreate a checksum, append it to the message, encrypt the message,
and then send to recipient
78A Certificate Authority (CA) provides which benefits to a user?
- AProtection of public keys of all users
- BHistory of symmetric keys
- CProof of nonrepudiation of origin
- DValidation that a public key is associated with a particular user
79What is the output length of a RIPEMD-160 hash?
- A160 bits
- B150 bits
- C128 bits
- D104 bits
80ANSI X9.17 is concerned primarily with
- AProtection and secrecy of keys
- BFinancial records and retention of encrypted data
- CFormalizing a key hierarchy
- DThe lifespan of key-encrypting keys (KKMs)
81When a certificate is revoked, what is the proper procedure?
- ASetting new key expiry dates
- BUpdating the certificate revocation list
- CRemoval of the private key from all directories
- DNotification to all employees of revoked keys
82Which is true about link encryption?
- ALink encryption is advised for high-risk environments, provides better
traffic flow confidentiality, and encrypts routing information. - BLink encryption is often used for Frame Relay or satellite links, is
advised for high-risk environments and provides better traffic flow
confidentiality. - CLink encryption encrypts routing information, is often used for Frame
Relay or satellite links, and provides traffic flow confidentiality. - DLink encryption provides better traffic flow confidentiality, is advised for
high-risk environments and provides better traffic flow confidentiality.
- ALink encryption is advised for high-risk environments, provides better
83NIST identifies three service models that represent different types of
cloud services available, what are they?- ASoftware as a Service (SaaS), Infrastructure as a Service (IaaS) and
Platform as a Service (PaaS) - BSecurity as a Service (SaaS), Infrastructure as a Service (IaaS) and
Platform as a Service (PaaS) - CSoftware as a Service (SaaS), Integrity as a Service (IaaS) and
Platform as a Service (PaaS) - DSoftware as a Service (SaaS), Infrastructure as a Service (IaaS) and
Process as a Service (PaaS)
- ASoftware as a Service (SaaS), Infrastructure as a Service (IaaS) and
84The process used in most block ciphers to increase their strength is
- ADiffusion
- BConfusion
- CStep function
- DSP-network
85Which of the following BEST describes fundamental methods of
encrypting data:- ASubstitution and transposition
- B3DES and PGP
- CSymmetric and asymmetric
- DDES and AES
86Cryptography supports all of the core principles of information
security except- AAvailability
- BConfidentiality
- CIntegrity
- DAuthenticity
87A way to defeat frequency analysis as a method to determine the key
is to use- ASubstitution ciphers
- BTransposition ciphers
- CPolyalphabetic ciphers
- DInversion ciphers
88The running key cipher is based on
- AModular arithmetic
- BXOR mathematics
- CFactoring
- DExponentiation
89The only cipher system said to be unbreakable by brute force is
- AAES
- BDES
- COne-time pad
- DTriple DES
90The main types of implementation attacks include: (Choose ALL that apply)
- AFault analysis
- BKnown plaintext
- CProbing
- DLinear
91Which is the BEST choice for implementing encryption on a smart card?
- ABlowfish
- BElliptic Curve Cryptography
- CTwoFish
- DQuantum Cryptography
92An e-mail with a document attachment from a known individual is
received with a digital signature. The e-mail client is unable to
validate the signature. What is the BEST course of action?- AOpen the attachment to determine if the signature is valid.
- BDetermine why the signature can’t be validated prior to opening the
attachment. - CDelete the e-mail
- DForward the e-mail to another address with a new signature.
93The vast majority of Virtual Private Networks use
- ASSL/TLS and IPSec.
- BEl Gamal and DES.
- C3DES and Blowfish
- DTwoFish and IDEA.
94In the OSI reference model, on which layer can Ethernet (IEEE 802.3)
be described?- ALayer 1—Physical layer
- BLayer 2—Data-link layer
- CLayer 3—Network Layer
- DLayer 4—Transport Layer
95A customer wants to keep cost to a minimum and has only ordered a
single static IP address from the ISP. Which of the following must be
configured on the router to allow for all the computers to share the
same public IP address?- AVLANs
- BPoE
- CPAT
- DVPN
96Users are reporting that some Internet websites are not accessible
anymore. Which of the following will allow the network administrator
to quickly isolate the remote router that is causing the network
communication issue, so that the problem can be reported to the
appropriate responsible party?- APing
- BProtocol analyzer
- CTracert
- DDig
97Ann installs a new Wireless Access Point (WAP) and users are able to
connect to it. However, once connected, users cannot access the
Internet. Which of the following is the MOST likely cause of the
problem?- AThe signal strength has been degraded and latency is increasing hop
count. - BAn incorrect subnet mask has been entered in the WAP configuration.
- CThe signal strength has been degraded and packets are being lost.
- DUsers have specified the wrong encryption type and packets are being
rejected.
- AThe signal strength has been degraded and latency is increasing hop
98What is the optimal placement for network-based intrusion detection
systems (NIDS)?- AOn the network perimeter, to alert the network administrator of all
suspicious traffic - BOn network segments with business-critical systems (e.g., demilitarized
zones (DMZs) and on certain intranet segments) - CAt the network operations center (NOC)
- DAt an external service provider
- AOn the network perimeter, to alert the network administrator of all
99Which of the following end-point devices would MOST likely be
considered part of a converged IP network?- Afile server, IP phone, security camera
- BIP phone, thermostat, cypher lock
- Csecurity camera, cypher lock, IP phone
- Dthermostat, file server, cypher lock
100Network upgrades have been completed and the WINS server was
shutdown. It was decided that NetBIOS network traffic will no longer
be permitted. Which of the following will accomplish this objective?- AContent filtering
- BPort filtering
- CMAC filtering
- DIP filtering
101Which of the following devices should be part of a network’s
perimeter defense?- AA boundary router, A firewall, A proxy Server
- BA firewall, A proxy server, A host based intrusion detection system
(HIDS) - CA proxy server, A host based intrusion detection system (HIDS), A
firewall - DA host based intrusion detection system (HIDS), A firewall, A boundary
router
102Which of the following is a principal security risk of wireless LANs?
- ALack of physical access control
- BDemonstrably insecure standards
- CImplementation weaknesses
- DWar driving
103Which of the following is a path vector routing protocol?
- ARIP
- BEIGRP
- COSPF/IS-IS
- DBGP
104It can be said that IPSec
- Aprovides mechanisms for authentication and encryption.
- Bprovides mechanisms for nonrepudiation.
- Cwill only be deployed with IPv6.
- Donly authenticates clients against a server.
105A Security Event Management (SEM) service performs the following
function:- AGathers firewall logs for archiving
- BAggregates logs from security devices and application servers looking
for suspicious activity - CReviews access controls logs on servers and physical entry points to
match user system authorization with physical access permissions - DCoordination software for security conferences and seminars.
106Which of the following is the principal weakness of DNS (Domain
Name System)?- ALack of authentication of servers, and thereby authenticity of records
- BIts latency, which enables insertion of records between the time when
a record has expired and when it is refreshed - CThe fact that it is a simple, distributed, hierarchical database instead of
a singular, relational one, thereby giving rise to the possibility of
inconsistencies going undetected for a certain amount of time - DThe fact that addresses in e-mail can be spoofed without checking their
validity in DNS, caused by the fact that DNS addresses are not digitally
signed
107Which of the following statements about open e-mail relays is
incorrect?- AAn open e-mail relay is a server that forwards e-mail from domains
other than the ones it serves. - BOpen e-mail relays are a principal tool for distribution of spam.
- CUsing a blacklist of open e-mail relays provides a secure way for an email
administrator to identify open mail relays and filter spam. - DAn open e-mail relay is widely considered a sign of bad system
administration.
- AAn open e-mail relay is a server that forwards e-mail from domains
108A botnet can be characterized as
- AAn network used solely for internal communications
- BAn automatic security alerting tool for corporate networks
- CA group of dispersed, compromised machines controlled remotely for
illicit reasons. - DA type of virus
109During a disaster recovery test, several billing representatives need to
be temporarily setup to take payments from customers. It has been
determined that this will need to occur over a wireless network, with
security being enforced where possible. Which of the following
configurations should be used in this scenario?- AWPA2, SSID enabled, and 802.11n.
- BWEP, SSID enabled, and 802.11b.
- CWEP, SSID disabled, and 802.11g.
- DWPA2, SSID disabled, and 802.11a.
110Which xDSL flavor delivers both downstream and upstream speeds of
1.544 Mbps over two copper twisted pairs?- AHDSL
- BSDSL
- CADSL
- DVDSL
111A new installation requires a network in a heavy manufacturing area
with substantial amounts of electromagnetic radiation and power
fluctuations. Which media is best suited for this environment if little
traffic degradation is tolerated?- ACoax cable
- BWireless
- CShielded twisted pair
- DFiber
112Multi-layer protocols such as Modbus used in industrial control
systems- Aoften have their own encryption and security like IPv6
- Bare used in modern routers as a routing interface control
- CAre often insecure by their very nature as they were not designed to
natively operate over today’s IP networks - DHave largely been retired and replaced with newer protocols such as
IPv6 and NetBIOS
113Frame Relay and X.25 networks are part of which of the following?
- ACircuit-switched services
- BCell-switched services
- CPacket-switched services
- DDedicated digital services
114Authentication is
- Athe assertion of a unique identity for a person or system.
- Bthe process of verifying the identity of the user.
- Cthe process of defining the specific resources a user needs and
determining the type of access to those resources the user may have. - Dthe assertion by management that the user should be given access to a
system.
115Which best describes access controls?
- AAccess controls are a collection of technical controls that permit access
to authorized users, systems, and applications. - BAccess controls help protect against threats and vulnerabilities by
reducing exposure to unauthorized activities and providing access to
information and systems to only those who have been approved. - CAccess control is the employment of encryption solutions to protect
authentication information during log-on. - DAccess controls help protect against vulnerabilities by controlling
unauthorized access to systems and information by employees,
partners, and customers.
- AAccess controls are a collection of technical controls that permit access
116_____ requires that a user or process be granted access to only those
resources necessary to perform assigned functions.- ADiscretionary access control
- BSeparation of duties
- CLeast privilege
- DRotation of duties
117What are the seven main categories of access control?
- ADetective, corrective, monitoring, logging, recovery, classification, and
directive - BDirective, deterrent, preventative, detective, corrective, compensating,
and recovery - CAuthorization, identification, factor, corrective, privilege, detective, and
directive - DIdentification, authentication, authorization, detective, corrective,
recovery, and directive
- ADetective, corrective, monitoring, logging, recovery, classification, and
118What are the three types of access control?
- AAdministrative, physical, and technical
- BIdentification, authentication, and authorization
- CMandatory, discretionary, and least privilege
- DAccess, management, and monitoring
119What are types of failures in biometric identification systems? (Choose
ALL that apply)- AFalse reject
- BFalse positive
- CFalse accept
- DFalse negative
120What best describes two-factor authentication?
- AA hard token and a smart card
- BA user name and a PIN
- CA password and a PIN
- DA PIN and a hard token
121A potential vulnerability of the Kerberos authentication server is
- ASingle point of failure
- BAsymmetric key compromise
- CUse of dynamic passwords
- DLimited lifetimes for authentication credentials
122In mandatory access control the system controls access and the
owner determines- AValidation
- BNeed to know
- CConsensus
- DVerification
123Which is the least significant issue when considering biometrics?
- AResistance to counterfeiting
- BTechnology type
- CUser acceptance
- DReliability and accuracy
124Which is a fundamental disadvantage of biometrics?
- ARevoking credentials
- BEncryption
- CCommunications
- DPlacement
125Role-based access control
- AIs unique to mandatory access control
- BIs independent of owner input
- CIs based on user job functions
- DCan be compromised by inheritance
126Identity management is
- AAnother name for access controls
- BA set of technologies and processes intended to offer greater efficiency
in the management of a diverse user and technical environment - CA set of technologies and processes focused on the provisioning and
decommissioning of user credentials - DA set of technologies and processes used to establish trust
relationships with disparate systems
127A disadvantage of single sign-on is
- AConsistent time-out enforcement across platforms
- BA compromised password exposes all authorized resources
- CUse of multiple passwords to remember
- DPassword change control
128Which of the following is incorrect when considering privilege
management?- APrivileges associated with each system, service, or application, and the
defined roles within the organization to which they are needed, should
be identified and clearly documented. - BPrivileges should be managed based on least privilege. Only rights
required to perform a job should be provided to a user, group, or role. - CAn authorization process and a record of all privileges allocated should
be maintained. Privileges should not be granted until the authorization
process is complete and validated. - DAny privileges that are needed for intermittent job functions should be
assigned to multiple user accounts, as opposed to those for normal
system activity related to the job function.
- APrivileges associated with each system, service, or application, and the
129The Identity and Access Provisioning Lifecycle is made up of which
phases? (Choose ALL that apply)- AReview
- BDeveloping
- CProvisioning
- DRevocation
130When reviewing user entitlement the security professional must be
MOST aware of- AIdentity management and disaster recovery capability
- BBusiness or organizational processes and access aggregation
- CThe organizational tenure of the user requesting entitlement
- DAutomated processes which grant users access to resources
131A guard dog patrolling the perimeter of a data center is what type of a
control?- ARecovery
- BAdministrative
- CLogical
- DPhysical
132Real User Monitoring (RUM) is an approach to Web monitoring that?
- AAims to capture and analyze select transactions of every user of a
website or application. - BAims to capture and analyze every transaction of every user of a
website or application. - CAims to capture and analyze every transaction of select users of a
website or application. - DAims to capture and analyze select transactions of select users of a
website or application.
- AAims to capture and analyze select transactions of every user of a
133Synthetic performance monitoring, sometimes called proactive
monitoring, involves?- AHaving external agents run scripted transactions against a web
application. - BHaving internal agents run scripted transactions against a web
application. - CHaving external agents run batch jobs against a web application.
- DHaving internal agents run batch jobs against a web application.
- AHaving external agents run scripted transactions against a web
134Most security vulnerabilities are caused by one? (Choose ALL that apply)
- ABad programming patterns
- BMisconfiguration of security infrastructures
- CFunctional bugs in security infrastructures
- DDesign flaws in the documented processes
135When selecting a security testing method or tool, the security
practitioner needs to consider many different things, such as:- ACulture of the organization and likelihood of exposure
- BLocal annual frequency estimate (LAFE), and standard annual
frequency estimate (SAFE) - CSecurity roles and responsibilities for staff
- DAttack surface and supported technologies
136In the development stages where an application is not yet sufficiently
mature enough to be able to be placed into a test environment, which
of the following techniques are applicable: (Choose ALL that apply)- AStatic Source Code Analysis and Manual Code Review
- BDynamic Source Code Analysis and Automatic Code Review
- CStatic Binary Code Analysis and Manual Binary Review
- DDynamic Binary Code Analysis and Static Binary Review
137Software testing tenets include: (Choose Two)
- ATesters and coders use the same tools
- BThere is independence from coding
- CThe expected test outcome is unknown
- DA successful test is one that finds an error
138Common structural coverage metrics include: (Choose ALL that apply)
- AStatement Coverage
- BPath Coverage
- CAsset Coverage
- DDynamic Coverage
139What are the two main testing strategies in software testing?
- APositive and Dynamic
- BStatic and Negative
- CKnown and Recursive
- DNegative and Positive
140What is the reason that an Information Security Continuous
Monitoring (ISCM) program is established?- ATo monitor information in accordance with dynamic metrics, utilizing
information readily available in part through implemented security
controls - BTo collect information in accordance with pre-established metrics,
utilizing information readily available in part through implemented
security controls - CTo collect information in accordance with pre-established metrics,
utilizing information readily available in part through planned security
controls - DTo analyze information in accordance with test metrics, utilizing
information readily available in part through implemented security
controls
- ATo monitor information in accordance with dynamic metrics, utilizing
141The process for developing an ISCM strategy and implementing an
ISCM program is?- ADefine, analyze, implement, establish, respond, review and update
- BAnalyze, implement, define, establish, respond, review and update
- CDefine, establish, implement, analyze, respond, review and update
- DImplement, define, establish, analyze, respond, review and update
142The NIST document that discusses the Information Security
Continuous Monitoring (ISCM) program is?- ANIST SP 800-121
- BNIST SP 800-65
- CNIST SP 800-53
- DNIST SP 800-137
143A Service Organization Control (SOC) Report commonly covers a
- A6 month period
- B12 month period
- C18 month period
- D9 month period
144Assuming a working IDS is in place, which of the following groups is
BEST capable of stealing sensitive information due to the absence of
system auditing?- AMalicious software (malware)
- BHacker or cracker
- CDisgruntled employee
- DAuditors
145Which of the following provides controlled and un-intercepted
interfaces into privileged user functions?- ARing protection
- BAnti-malware
- CMaintenance hooks
- DTrusted paths
146The doors of a data center spring open in the event of a fire. This is an
example of- AFail-safe
- BFail-secure
- CFail-proof
- DFail-closed
147Which of the following ensures constant redundancy and faulttolerance?
- ACold spare
- BWarm spare
- CHot spare
- DArchives
148If speed is preferred over resilience, which of the following RAID
configuration is the most suited?- ARAID 0
- BRAID 1
- CRAID 5
- DRAID 10
149Updating records in multiple locations or copying an entire database
on to a remote location as a means to ensure the appropriate levels of
fault-tolerance and redundancy is known as- AData mirroring
- BShadowing
- CBackup
- DArchiving
150When the backup window is not long enough to backup all of the data
and the restoration of backup must be as fast as possible. Which of
the following type of high-availability backup strategy is BEST?- AFull
- BIncremental
- CDifferential
- DIncrease the backup window so a full backup can be performed
151At a restricted facility, visitors are requested to provide identification
and verified against a pre-approved list by the guard at the front gate
before being let in. This is an example of checking for- ALeast privilege
- BSeparation of duties
- CFail-safe
- DPsychological acceptability
152When sensitive information is no longer critical but still within scope
of a record retention policy, that information is BEST- ADestroyed
- BRe-categorized
- CDegaussed
- DReleased
153Which of the following BEST determines access and suitability of an
individual?- AJob rank or title
- BPartnership with the security team
- CRole
- DBackground investigation
154Which of the following can help with ensuring that only the needed
logs are collected for monitoring?- AClipping level
- BAggregation
- CXML Parsing
- DInference
155The main difference between a Security Event Information
Management (SEIM) system and a log management system is that
SEIM systems are useful for log collection, collation and analysis- AIn real time
- BFor historical purposes
- CFor admissibility in court
- DIn discerning patterns
156The best way to ensure that there is no data remanence of sensitive
information that was once stored on a DVD-R media is by- ADeletion
- BDegaussing
- CDestruction
- DOverwriting
157Which of the following processes is concerned with not only
identifying the root cause but also addressing the underlying issue?- AIncident management
- BProblem management
- CChange management
- DConfiguration management
158Before applying a software update to production systems, it is MOST
important that- AFull disclosure information about the threat that the patch addresses is
available - BThe patching process is documented
- CThe production systems are backed up
- DAn independent third party attests the validity of the patch
- AFull disclosure information about the threat that the patch addresses is
159Computer forensics is the marriage of computer science, information
technology, and engineering with- ALaw
- BInformation systems
- CAnalytical thought
- DThe scientific method
160What principal allows an investigator to identify aspects of the person
responsible for a crime when, whenever committing a crime, the
perpetrator leaves traces while stealing assets?- AMeyer’s principal of legal impunity
- BCriminalistic principals
- CIOCE/Group of 8 Nations principals for computer forensics
- DLocard’s principle of exchange
161Which of the following is part of the five rules of evidence?
- ABe authentic, be redundant and be admissible.
- BBe complete, be authentic and be admissible.
- CBe complete, be redundant and be authentic.
- DBe redundant, be admissible and be complete
162What is not mentioned as a phase of an incident response?
- ADocumentation
- BProsecution
- CContainment
- DInvestigation
163Which BEST emphasizes the abstract concepts of law and is influenced
by the writings of legal scholars and academics.- ACriminal law
- BCivil law
- CReligious law
- DAdministrative law
164Which of the following are computer forensics guidelines?
- AIOCE, MOM and SWGDE.
- BMOM, SWGDE and IOCE.
- CIOCE, SWGDE and ACPO.
- DACPO, MOM and IOCE.
165Triage encompasses which of the following incident response subphases?
- ACollection, transport, testimony
- BTraceback, feedback, loopback
- CDetection, identification, notification
- DConfidentiality, integrity, availability
166The integrity of a forensic bit stream image is determined by:
- AComparing hash totals to the original source
- BKeeping good notes
- CTaking pictures
- DEncrypted keys
167When dealing with digital evidence, the crime scene:
- AMust never be altered
- BMust be completely reproducible in a court of law
- CMust exist in only one country
- DMust have the least amount of contamination that is possible
168When outsourcing IT systems
- Aall regulatory and compliance requirements must be passed on to the
provider. - Bthe outsourcing organization is free from compliance obligations.
- Cthe outsourced IT systems are free from compliance obligations.
- Dthe provider is free from compliance obligations.
- Aall regulatory and compliance requirements must be passed on to the
169When dealing with digital evidence, the chain of custody:
- AMust never be altered
- BMust be completely reproducible in a court of law
- CMust exist in only one country
- DMust follow a formal documented process
170To ensure proper forensics action when needed, an incident response
program must:- Aavoid conflicts of interest by ensuring organization legal council is not
part of the process. - Broutinely create forensic images of all desktops and servers.
- Conly promote closed incidents to law enforcement.
- Dtreat every incident as though it may be a crime.
- Aavoid conflicts of interest by ensuring organization legal council is not
171A hard drive is recovered from a submerged vehicle. The drive is
needed for a court case. What is the best approach to pull information
off the drive?- AWait for the drive to dry and then install it in a desktop and attempt to
retrieve the information via normal operating system commands. - BPlace the drive in a forensic oven to dry it and then use a degausser to
remove any residual humidity prior to installing the drive in a laptop
and using the OS to pull off information. - CWhile the drive is still wet use a forensic bit to bit copy program to
ensure the drive is preserved in its “native” state. - DContact a professional data recovery organization, explain the situation
and request they pull a forensic image.
- AWait for the drive to dry and then install it in a desktop and attempt to
172To successfully complete a vulnerability assessment, it is critical that
protection systems are well understood through:- AThreat definition, target identification and facility characterization
- BThreat definition, conflict control and facility characterization
- CRisk assessment, threat identification and incident review
- DThreat identification, vulnerability appraisal and access review
173The strategy of forming layers of protection around an asset or facility
is known as:- ASecured Perimeter
- BDefense-in-Depth
- CReinforced Barrier Deterrent
- DReasonable Asset Protection
174The key to a successful physical protection system is the integration
of:- Apeople, procedures, and equipment
- Btechnology, risk assessment, and human interaction
- Cprotecting, offsetting, and transferring risk
- Ddetection, deterrence, and response
175For safety considerations in perimeter areas such as parking lots or
garages what is the advised lighting?- A3 fc
- B5 fc
- C7 fc
- D10 fc
176What would be the most appropriate interior sensor used for a
building that has windows along the ground floor?- Ainfrared glass-break sensor
- Bultrasonic glass-break sensors
- Cacoustic/shock glass-break sensors
- Dvolumetric sensors
177Which of the following BEST describe three separate functions of CCTV?
- Asurveillance, deterrence, and evidentiary archives
- Bintrusion detection, detainment and response
- Coptical scanning, infrared beaming and lighting
- Dmonitoring, white balancing and inspection
178What is the BEST means of protecting the physical devices associated
with the alarm system?- ATamper protection
- BTarget hardening
- CSecurity design
- DUL 2050
179The key objective of application security is to ensure
- Athat the software is hacker proof
- Bthe confidentiality, integrity and availability of data
- Caccountability of software and user activity
- Dprevent data theft
180For an application security program to be effective within an
organization, it is critical to- Aidentify regulatory and compliance requirements.
- Beducate the software development organization the impact of insecure
programming. - Cdevelop the security policy that can be enforced.
- Dproperly test all the software that is developed by your organization for
security vulnerabilities.
181Which of the following architectures states: “There is no inherent
difference between data and programming representations in
computer memory” which can lead to injection attacks, characterized
by executing data as instructions.- AVon Neumann
- BLinus’ Law
- CClark and Wilson
- DBell LaPadula
182An important characteristic of bytecode is that it
- Ahas increased secure inherently due to sandboxing
- Bmanages memory operations automatically
- Cis more difficult to reverse engineer
- Dis faster than interpreted languages
183Two cooperating processes that simultaneously compete for a shared
resource, in such a way that they violate the system’s security policy,
is commonly known as- ACovert channel
- BDenial of Service
- COvert channel
- DObject reuse
184An organization has a website with a guest book feature, where
visitors to the web site can input their names and comments about the
organization. Each time the guest book web page loads, a message
box is prompted with the message ‘You have been P0wnd’ followed by
redirection to a different website. Analysis reveals that the no input
validation or output encoding is being performed in the web
application. This is the basis for the following type of attack?- ADenial of Service
- BCross-site Scripting (XSS)
- CMalicious File Execution
- DInjection Flaws
185The art of influencing people to divulge sensitive information about
themselves or their organization by either coercion or masquerading
as a valid entity is known as- ADumpster diving
- BShoulder surfing
- CPhishing
- DSocial engineering
186An organization’s server audit logs indicate that an employee that was
terminated in the morning was still able to access certain sensitive
resources on his system, on the internal network, that afternoon. The
logs indicate that the employee had logged on successfully before he
was terminated but there is no record of him logging off before he
was terminated. This is an example of this type of attack?- ATime of Check/Time of Use (TOC/TOU)
- BLogic Bomb
- CRemote-Access Trojans (RATS)
- DPhishing
187The most effective defense against a buffer overflow attack is
- Adisallow dynamic construction of queries
- Bbounds checking
- Cencode the output
- Dforced garbage collection
188It is extremely important that as one follows a software development
project, security activities are performed- Abefore release to production, so that the project is not delayed
- Bif a vulnerability is detected in your software
- Cin each stage of the life cycle
- Dwhen management mandates it
189Software Acquisition (SwA) can be organized around the major
phases of a generic acquisition process. The major phases are:- APlanning, contracting, monitoring and acceptance, follow on
- BContracting, planning, monitoring and acceptance, follow on
- CPlanning, contracting, monitoring and certification, follow on
- DPlanning, contracting, monitoring and accreditation, follow on
190Who can ensure and enforce the separation of duties by ensuring that
programmers don’t have access to production code?- AOperations personnel
- BSoftware librarian
- CManagement
- DQuality assurance personnel
191Technical evaluation of assurance to ensure that security
requirements have been met is known as?- AAccreditation
- BCertification
- CValidation
- DVerification
192Defect prevention rather than defect removal is characteristic of
which of the following software development methodology?- AComputer Aided Software Engineering (CASE)
- BSpiral
- CWaterfall
- DCleanroom
193A security protection mechanism in which untrusted code, which is
not signed, is restricted from accessing system resources is known as?- ASandboxing
- BNon-repudiation
- CSeparation of Duties
- DObfuscation
194A program that does not reproduce itself but pretends to be
performing a legitimate action, while acting performing malicious
operations in the background is the characteristic of which of the
following?- AWorms
- BTrapdoor
- CVirus
- DTrojan
195A plot to take insignificant pennies from a user’s bank account and
move them to the attacker’s bank account is an example of- ASocial Engineering
- BSalami Scam
- CPranks
- DHoaxes
196Role-based access control to protect confidentiality of data in
databases can be achieved by which of the following?- AViews
- BEncryption
- CHashing
- DMasking
197The two most dangerous types of attacks against databases
containing disparate non-sensitive information are- AInjection and scripting
- BSession hijacking and cookie poisoning
- CAggregation and inference
- DBypassing authentication and insecure cryptography
198A property that ensures only valid or legal transactions that do not
violate any user-defined integrity constraints in DBMS technologies is
known as?- AAtomicity
- BConsistency
- CIsolation
- DDurability
199Expert systems are comprised of a knowledge base comprising
modeled human experience and which of the following?- AInference engine
- BStatistical models
- CNeural networks
- DRoles
200The best defense against session hijacking and man-in-the-middle
(MITM) attacks is to use the following in the development of your
software?- AUnique and random identification
- BUse prepared statements and procedures
- CDatabase views
- DEncryption
Informationen
- Beschreibung
- Undergrad Computer Science Quiz am Computer and Network Security, erstellt von Cody Mahaffey am 03/05/2017.
- Autor
- Cody Mahaffey
- Sprache
- English
- Aufrufe
- 37
- Schlagwörter
- Bewertung
- Noch keine Bewertungen Bewerte dieses Quiz