Quiz
Quix5 - D2 - 50Q
Questions in this quiz (50)
1Charles has been asked to downgrade the media used for storage of
private data for his organization. What process should Charles follow?- AA. Degauss the drives, and then relabel them with a lower
classification level. - BB. Pulverize the drives, and then reclassify them based on the data
they contain. - CC. Follow the organization’s purging process, and then downgrade
and replace labels. - DD. Relabel the media, and then follow the organization’s purging
process to ensure that the media matches the label.
- AA. Degauss the drives, and then relabel them with a lower
2Which of the following tasks are not performed by a system owner per
NIST SP 800-18?- AA. Develops a system security plan
- BB. Establishes rules for appropriate use and protection of data
- CC. Identifies and implements security controls
- DD. Ensures that system users receive appropriate security training
3NIST SP 800-60 provides a process shown in the following diagram to
assess information systems. What process does this diagram show?
- AA. Selecting a standard and implementing it
- BB. Categorizing and selecting controls
- CC. Baselining and selecting controls
- DD. Categorizing and sanitizing
4Which letters on this diagram are locations where you might find data
at rest?
- AA. A, B, and C
- BB. C and E
- CC. A and E
- DD. B, D, and F
5What would be the best way to secure data at points B, D, and F?
- AA. AES-256
- BB. SSL
- CC. TLS
- DD. 3DES
6What is the best way to secure files that are sent from workstation A
via the internet service (C) to remote server E?- AA. Use AES at rest at point A, and use TLS in transit via B and D
- BB. Encrypt the data files and send them.
- CC. Use 3DES and TLS to provide double security.
- DD. Use full disk encryption at A and E, and use SSL at B and D.
7Susan needs to provide a set of minimum security requirements for
email. What steps should she recommend for her organization to
ensure that the email remains secure?- AA. All email should be encrypted.
- BB. All email should be encrypted and labeled.
- CC. Sensitive email should be encrypted and labeled.
- DD. Only highly sensitive email should be encrypted.
8What term describes the process of reviewing baseline security
controls and selecting only the controls that are appropriate for the IT
system you are trying to protect?- AA. Standard creation
- BB. CIS benchmarking
- CC. Baselining
- DD. Scoping
9What data role does a system that is used to process data have?
- AA. Mission owner
- BB. Data owner
- CC. Data processor
- DD. Custodian
10Which one of the following is not considered PII under U.S. federal
government regulations?- AA. Name
- BB. Social security number
- CC. Student ID number
- DD. ZIP code
11What type of health information is the Health Insurance Portability
and Accountability Act required to protect?- AA. PII
- BB. PHI
- CC. SHI
- DD. HPHI
12What encryption algorithm would provide strong protection for data
stored on a USB thumb drive?- AA. TLS
- BB. SHA1
- CC. AES
- DD. DES
13Lauren’s multinational company wants to ensure compliance with the
EU GDPR. Which principle of the GDPR states that the individual
should have the right to receive personal information concerning
himself or herself and share it with another data controller?- AA. Onward transfer
- BB. Data integrity
- CC. Enforcement
- DD. Data portability
14What is the best method to sanitize a solid-state drive (SSD)?
- AA. Clearing
- BB. Zero fill
- CC. Disintegration
- DD. Degaussing
15As shown in the following security lifecycle diagram (loosely based
on the NIST reference architecture), NIST uses a five-step process
for risk management.
What data role will own responsibility for step 1, the categorization of
information systems; to whom will they delegate step 2; and what data
role will be responsible for step 3?
- AA. Data owners, system owners, custodians
- BB. Data processors, custodians, users
- CC. Business owners, administrators, custodians
- DD. System owners, business owners, administrators
16As shown in the following security lifecycle diagram (loosely based
on the NIST reference architecture), NIST uses a five-step process
for risk management.
If the systems that are being assessed all handle credit card
information (and no other sensitive data), at what step would the PCI
DSS first play an important role?- AA. Step 1
- BB. Step 2
- CC. Step 3
- DD. Step 4
17What data security role is primarily responsible for step 5?
- AA. Data owners
- BB. Data processors
- CC. Custodians
- DD. Users
18Susan’s organization performs a zero fill on hard drives before they are
sent to a third-party organization to be shredded. What issue is her
organization attempting to avoid?- AA. Data remanence while at the third-party site
- BB. Mishandling of drives by the third party
- CC. Classification mistakes
- DD. Data permanence
19Embedded data used to help identify the owner of a file is an example
of what type of label?- AA. Copyright notice
- BB. DLP
- CC. Digital watermark
- DD. Steganography
20Retaining and maintaining information for as long as it is needed is
known as what?- AA. Data storage policy
- BB. Data storage
- CC. Asset maintenance
- DD. Record retention
21Which of the following activities is not a consideration during data
classification?- AA. Who can access the data
- BB. What the impact would be if the data was lost or breached
- CC. How much the data cost to create
- DD. What protection regulations may be required for the data
22What type of encryption is typically used for data at rest?
- AA. Asymmetric encryption
- BB. Symmetric encryption
- CC. DES
- DD. OTP
23Fred is preparing to send backup tapes offsite to a secure third-party
storage facility. What steps should Fred take before sending the tapes
to that facility?- AA. Ensure that the tapes are handled the same way the original media
would be handled based on their classification. - BB. Increase the classification level of the tapes because they are
leaving the possession of the company. - CC. Purge the tapes to ensure that classified data is not lost.
- DD. Decrypt the tapes in case they are lost in transit.
- AA. Ensure that the tapes are handled the same way the original media
24Which of the following does not describe data in motion?
- AA. Data on a backup tape that is being shipped to a storage facility
- BB. Data in a TCP packet
- CC. Data in an e-commerce transaction
- DD. Data in files being copied between locations
25A new law is passed that would result in significant financial harm to
your company if the data that it covers was stolen or inadvertently
released. What should your organization do about this?- AA. Select a new security baseline.
- BB. Relabel the data.
- CC. Encrypt all of the data at rest and in transit.
- DD. Review its data classifications and classify the data appropriately.
26Ed has been asked to send data that his organization classifies as
confidential and proprietary via email. What encryption technology
would be appropriate to ensure that the contents of the files attached
to the email remain confidential as they traverse the internet?- AA. SSL
- BB. TLS
- CC. PGP
- DD. VPN
27Which mapping correctly matches data classifications between
nongovernment and government classification schemes?- AA. Top Secret – Confidential/Proprietary
Secret – Private
Confidential – Sensitive - BB. Secret – Business confidential
Classified – Proprietary
Confidential – Business internal - CC. Top Secret – Business sensitive
Secret – Business internal
Confidential – Business proprietary - DD. Secret – Proprietary
Classified – Private
Unclassified – Public
- AA. Top Secret – Confidential/Proprietary
28Angela is an information security architect at a bank and has been
assigned to ensure that transactions are secure as they traverse the
network. She recommends that all transactions use TLS. What threat
is she most likely attempting to stop, and what method is she using to
protect against it?- AA. Man-in-the-middle, VPN
- BB. Packet injection, encryption
- CC. Sniffing, encryption
- DD. Sniffing, TEMPEST
29Control Objectives for Information and Related Technology (COBIT)
is a framework for information technology (IT) management and
governance. Which data management role is most likely to select and
apply COBIT to balance the need for security controls against business
requirements?- AA. Business owners
- BB. Data processors
- CC. Data owners
- DD. Data stewards
30What term is used to describe a starting point for a minimum security
standard?- AA. Outline
- BB. Baseline
- CC. Policy
- DD. Configuration guide
31When media is labeled based on the classification of the data it
contains, what rule is typically applied regarding labels?- AA. The data is labeled based on its integrity requirements.
- BB. The media is labeled based on the highest classification level of the
data it contains. - CC. The media is labeled with all levels of classification of the data it
contains. - DD. The media is labeled with the lowest level of classification of the
data it contains.
32Which one of the following administrative processes assists
organizations in assigning appropriate levels of security control to
sensitive information?- AA. Information classification
- BB. Remanence
- CC. Transmitting data
- DD. Clearing
33How can a data retention policy help to reduce liabilities?
- AA. By ensuring that unneeded data isn’t retained
- BB. By ensuring that incriminating data is destroyed
- CC. By ensuring that data is securely wiped so it cannot be restored for
legal discovery - DD. By reducing the cost of data storage required by law
34Staff in an information technology (IT) department who are delegated
responsibility for day-to-day tasks hold what data role?- AA. Business owner
- BB. User
- CC. Data processor
- DD. Custodian
35Susan works for an American company that conducts business with
customers in the European Union. What is she likely to have to do if
she is responsible for handling PII from those customers?- AA. Encrypt the data at all times.
- BB. Label and classify the data according to HIPAA.
- CC. Conduct yearly assessments to the PCI DSS standard.
- DD. Comply with a standard such as the US-EU Privacy Shield.
36Ben has been tasked with identifying security controls for systems
covered by his organization’s information classification system. Why
might Ben choose to use a security baseline?- AA. It applies in all circumstances, allowing consistent security
controls. - BB. They are approved by industry standards bodies, preventing
liability. - CC. They provide a good starting point that can be tailored to
organizational needs. - DD. They ensure that systems are always in a secure state.
- AA. It applies in all circumstances, allowing consistent security
37What term is used to describe overwriting media to allow for its reuse
in an environment operating at the same sensitivity level?- AA. Clearing
- BB. Erasing
- CC. Purging
- DD. Sanitization
38What issue is common to spare sectors and bad sectors on hard drives
as well as overprovisioned space on modern SSDs?- AA. They can be used to hide data.
- BB. They can only be degaussed.
- CC. They are not addressable, resulting in data remanence.
- DD. They may not be cleared, resulting in data remanence.
39What term describes data that remains after attempts have been made
to remove the data?- AA. Residual bytes
- BB. Data remanence
- CC. Slack space
- DD. Zero fill
40Your organization regularly handles three types of data:
information that it shares with customers, information that it uses
internally to conduct business, and trade secret information that
offers the organization significant competitive advantages.
Information shared with customers is used and stored on web
servers, while both the internal business data and the trade secret
information are stored on internal file servers and employee
workstations.
What civilian data classifications best fit this data?- AA. Unclassified, confidential, top secret
- BB. Public, sensitive, private
- CC. Public, sensitive, proprietary
- DD. Public, confidential, private
41Your organization regularly handles three types of data:
information that it shares with customers, information that it uses
internally to conduct business, and trade secret information that
offers the organization significant competitive advantages.
Information shared with customers is used and stored on web
servers, while both the internal business data and the trade secret
information are stored on internal file servers and employee
workstations.
What technique could you use to mark your trade secret information
in case it was released or stolen and you need to identify it?- AA. Classification
- BB. Symmetric encryption
- CC. Watermarks
- DD. Metadata
42Your organization regularly handles three types of data:
information that it shares with customers, information that it uses
internally to conduct business, and trade secret information that
offers the organization significant competitive advantages.
Information shared with customers is used and stored on web
servers, while both the internal business data and the trade secret
information are stored on internal file servers and employee
workstations.
What type of encryption should you use on the file servers for the
proprietary data, and how might you secure the data when it is in
motion?- AA. TLS at rest and AES in motion
- BB. AES at rest and TLS in motion
- CC. VPN at rest and TLS in motion
- DD. DES at rest and AES in motion
43What does labeling data allow a DLP system to do?
- AA. The DLP system can detect labels and apply appropriate
protections. - BB. The DLP system can adjust labels based on changes in the
classification scheme. - CC. The DLP system can notify the firewall that traffic should be
allowed through. - DD. The DLP system can delete unlabeled data.
- AA. The DLP system can detect labels and apply appropriate
44Why is it cost effective to purchase high-quality media to contain
sensitive data?- AA. Expensive media is less likely to fail.
- BB. The value of the data often far exceeds the cost of the media.
- CC. Expensive media is easier to encrypt.
- DD. More expensive media typically improves data integrity.
45Chris is responsible for workstations throughout his company and
knows that some of the company’s workstations are used to handle
proprietary information. Which option best describes what should
happen at the end of their lifecycle for workstations he is responsible
for?- AA. Erasing
- BB. Clearing
- CC. Sanitization
- DD. Destruction
46What scenario describes data at rest?
- AA. Data in an IPSec tunnel
- BB. Data in an e-commerce transaction
- CC. Data stored on a hard drive
- DD. Data stored in RAM
47If you are selecting a security standard for a Windows 10 system that
processes credit cards, what security standard is your best choice?- AA. Microsoft’s Windows 10 security baseline
- BB. The CIS Windows 10 baseline
- CC. PCI DSS
- DD. The NSA Windows 10 baseline
48The CIS benchmarks are an example of what practice?
- AA. Conducting a risk assessment
- BB. Implementing data labeling
- CC. Proper system ownership
- DD. Using security baselines
49How should you determine what controls from the baseline a given
system or software package should receive?- AA. Consult the custodians of the data.
- BB. Select based on the data classification of the data it stores or
handles. - CC. Apply the same controls to all systems.
- DD. Consult the business owner of the process the system or data
supports.
50What problem with FTP and Telnet makes using SFTP and SSH better
alternatives?- AA. FTP and Telnet aren’t installed on many systems.
- BB. FTP and Telnet do not encrypt data.
- CC. FTP and Telnet have known bugs and are no longer maintained.
- DD. FTP and Telnet are difficult to use, making SFTP and SSH the
preferred solution.
Information
- Description
- Good Luck!
- Author
- Requiemdust Sheena
- Language
- English
- Views
- 39
- Tags
- Rating
- 5.0 out of 5 · 1 rating Rate this quiz