Quiz
Security + Practice
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (75)
1Which of the following BEST describes both change and incident management?
- AIncident management is not a valid term in IT, however change management is
- BChange management is not a valid term in IT, however incident management is
- CIncident management and change management are interchangeable terms meaning the same thing
- DIncident management is for unexpected consequences, change management is for planned work
2Which of the following account policy controls requires a user to enter a 15 character alpha-numerical password?
- ADisablement
- BLength
- CExpiration
- DPassword complexity
3Which of the following information types would be considered personally identifiable information?
- AFirst name and home address
- BSocial security number
- CDate of birth
- DFull name, date of birth and address
4Which of the following is the benefit of single file versus full disk encryption?
- AEncryption is preserved in full disk encryption when a file is copied from one media to another
- BEncryption is preserved in single file encryption when a file is copied from one media to another
- CSingle file encryption provides better security when decrypting single files than full disk encryption when properly implemented and used
- DFull disk encryption provides better security when decrypting single files than single file encryption when properly implemented and used
5Which of the following is another name for a CAC?
- AToken
- BRFID
- CMAC
- DPIV
6Which of the following systems offers Trusted OS capabilities by default?
- AWindows Vista
- BWindows 7
- CSE Linux
- DBacktrack
7Which of the following describes a common operational problem when using patch management software that results in a false sense of security?
- AConflicts with vulnerability scans impede patch effectiveness
- BDistributed updates may fail to apply or may not be active until a reboot
- CVendor patches are released too frequently consuming excessive network bandwidth
- DIt is resource intensive to test all patches
8Which of the following is BEST identified as an attacker who has or is about to use a Logic bomb?
- AGrey hat
- BMalicious insider
- CWhite hat
- DBlack box
9Which of the following is the BEST choice in regards to training staff members on dealing with PII?
- APII requires public access but must be flagged as confidential
- BPII data breaches are always the result of negligent staff and punishable by law
- CPII must be handled properly in order to minimize security breaches and mishandling
- DPII must be stored in an encrypted fashion and only printed on shared printers
10Which of the following processes are used to avoid employee exhaustion and implement a system of checks and balances?
- AJob rotation
- BIncident response
- CLeast privilege
- DOn-going security
11When designing secure LDAP compliant applications, null passwords should NOT be allowed because:
- Anull password can be changed by all users on a network
- Ba null password is a successful anonymous bind
- Cnull passwords can only be changed by the administrator
- DLDAP passwords are one-way encrypted
12A security administrator visits a remote data center dressed as a delivery person. Which of the following is MOST likely being conducted?
- ASocial engineering
- BRemote access
- CVulnerability scan
- DTrojan horse
13Mobile devices used in the enterprise should be administered using:
- Aencrypted networks and system logging
- Bfull disk encryption and central password management
- Cvendor provided software update systems
- Dcentrally managed update services and access controls
14The Chief Information Officer (CIO) wants to implement widespread network and hardware changes within the organization. The CIO has adopted an aggressive deployment schedule and does not want to bother with documentation, because it will slow down the deployment. Which of the following are the risks associated with not documenting the changes?
- AUndocumented networks might not be protected and can be used to support insider attacks
- BDocumenting a network hinders production because it is time consuming and ties up critical resources
- CDocumented networks provide a visual representation of the network for an attacker to exploit
- DUndocumented networks ensure the confidentiality and secrecy of the network topology
15Which of the following could mitigate shoulder surfing?
- APrivacy screens
- BHashing
- CMan traps
- DScreen locks
16Which of the following passwords is the MOST complex?
- A5@rAru99
- BCarL8241g
- Cj1l!1b5
- Dl@ur0
17Which of the following is being utilized when the BIOS and operating system’s responsibility is platform integrity?
- ASSL
- BUSB encryption
- CData loss prevention
- DTPM
18Which of the following BEST describes a Buffer Overflow attack that allows access to a remote system?
- AThe attacker attempts to have the receiving server run a payload using programming commonly found on web servers
- BThe attacker overwhelms a system or application, causing it to crash and bring the server down to cause an outage
- CThe attacker attempts to have the receiving server pass information to a back-end database from which it can compromise the stored information
- DThe attacker overwhelms a system or application, causing it to crash, and then redirects the memory address to read from a location holding the payload
19A company fails to monitor and maintain the HVAC system in the datacenter. Which of the following is the MOST likely to affect availability of systems?
- AEmployee productivity in a hot datacenter
- BPremature failure of components
- CDecreased number of systems in the datacenter
- DIncreased utility costs
20Which of the following protocols is defined in RFC 1157 as utilizing UDP ports 161 and 162?
- ASNMP
- BIPSec
- CSSL
- DTLS
21Which of the following is LEAST likely to have a legitimate business purpose?
- AMetasploit
- BVulnerability scanner
- CSteganography
- DPort scanner
22Which of the following does full disk encryption on a laptop computer NOT protect against?
- AConfidentiality of the data
- BKey loggers
- CTheft of the data
- DDisclosure of the data
23Which of the following passwords exemplifies the STRONGEST complexity?
- APassw0rd
- BP@ssw0rd
- CPasswrd
- Dpasswordpassword
24Which following port ranges would give a technician the MOST comprehensive port scan of a server?
- A1024-15000
- B0-99999
- C0-65535
- D0-1024
25Which of the following attacks steals contacts from a mobile device?
- ABluesnarfing
- BSmurf attack
- CSession hijacking
- DBluejacking
26Which of the following attacks sends unwanted messages to a mobile device?
- ASession hijacking
- BSmurf attack
- CBluejacking
- DBluesnarfing
27A smurf attack relies on which protocol to perform a Denial of Service?
- ADNS
- BSNMP
- CSMTP
- DICMP
28Which of the following allows for multiple operating systems to run on a single piece of hardware?
- AVirtualization
- BPort security
- CRemote access
- DDMZ
29A user name is an example of which of the following?
- AIdentification
- BAuthentication
- CAuthorization
- DAccess
30The CRL contains a list of:
- Aprivate keys
- Bpublic keys
- Croot certificates
- Dvalid certificates
31Which of the following fall into the category of physical security measures? (Select all that apply)
- AHoneypot
- BMantrap
- CVulnerability scanner
- DHardware lock
32Software that performs unwanted and harmful actions in disguise of a legitimate and useful program is also referred to as:
- AAdware
- BLogic bomb
- CSpyware
- DTrojan horse
33The term Trusted OS refers to an operating system:
- AAdmitted to a network through NAC
- BThat has been authenticated on the network
- CImplementing patch management
- DWith enhanced security features
34Which of the following would be fastest in validating a digital certificate?
- AIPX
- BOCSP
- COSPF
- DCRL
35HTTPS runs on TCP port:
- A80
- B137
- C143
- D443
36Paper shredder would help in preventing what kind of threats? (Select all that apply)
- ATailgating
- BDumpster diving
- CSocial engineering
- DZero-day attack
37Penetration test with the prior knowledge on how the system that is to be tested works is also known as:
- ABlack box
- BWhite box
- CSandbox
- DWhite hat
38What type of protocols ensure the privacy of a VPN connection?
- AOSPF
- BTunneling
- CTelnet
- DIPv6
39Zero-day attack exploits:
- AVulnerability that is present in already released software but unknown to the software developer
- BPatched software coding errors
- CWell known vulnerabilities
- DNew accounts
40An authentication subsystem that enables a user to access multiple, connected system components (such as separate hosts on a network) after a single login at only one of the components is also referred to as:
- ASSO
- BSSL
- CWAP
- DTLS
41What is tailgating?
- AGaining unauthorized access to restricted areas by following another person
- BLooking over someone's shoulder in order to get information
- CManipulating a user into disclosing confidential information
- DScanning for unsecured wireless networks while driving in a car
42Which of the following are symmetric-key algorithms? (Select all that apply)
- ADiffie-Hellman
- B3DES
- CDES
- DRSA
- EAES
43TCP port 22 is used by default by: (Select all that apply)
- ASFTP
- BSCP
- CFTP
- DSSH
- ESMTP
44A maximum acceptable period of time within which a system must be restored after failure is also known as:
- ARecovery Time Objective (RTO)
- BMaximum Tolerable Period of Disruption (MTPOD)
- CMeantime Between Failures (MTBF)
- DMeantime To Restore (MTTR)
45Which of the following authentication protocols offer(s) countermeasures against replay attacks? (Select all that apply)
- AKerberos
- BPAP
- CCHAP
- DNTP
46A policy outlining ways of collecting and managing personal data is also known as:
- AData loss prevention
- BAcceptable use policy
- CAudit policy
- DPrivacy policy
47Which of the following solutions is used for controlling temperature and humidity?
- AEMI shielding
- BHVAC
- CUART
- DFaraday cage
48Sticky note with a password kept on sight in the user's cubicle would be a violation of which of the following policies?
- AUser account policy
- BClean desk policy
- CData labeling policy
- DPassword complexity
49TCP port 23 is used by:
- ATFTP
- BTelnet
- CSMTP
- DSSH
50A chronological record outlining persons in possession of an evidence is also referred to as:
- AInformation classification
- BEvidence timeline
- CData handling chain
- DChain of custody
51Which of the following acronyms refers to any type of information pertaining to an individual that can be used to uniquely identify that individual?
- AID
- BPII
- CPassword
- DPIN
52Which of the following terms refers to a rogue access point?
- ATrojan horse
- BBackdoor
- CEvil twin
- DWorm
53A group of computers running malicious software under control of a hacker is also referred to as:
- AEthernet
- BIntranet
- CBotnet
- DSubnet
54Which IPsec mode provides whole packet encryption?
- AHost-to-host
- BPayload
- CTransport
- DTunnel
55Security measures that can be applied to mobile devices include: (Select all that apply)
- ALoad balancing
- BRemote sanitation
- CEncryption and passwords
- DVoice encryption
- EQuality of Service (QoS)
56Which of the following is the BEST approach to perform risk mitigation of user access control rights?
- AConduct surveys and rank the results.
- BPerform routine user permission reviews.
- CImplement periodic vulnerability scanning.
- DDisable user accounts that have not been used within the last two weeks.
57Which of the following devices is BEST suited for servers that need to store private keys?
- AHardware security module
- BHardened network firewall
- CSolid state disk drive
- DHardened host firewall
58All of the following are valid cryptographic hash functions EXCEPT:
- ARIPEMD.
- BRC4.
- CSHA-512.
- DMD4.
59In regards to secure coding practices, why is input validation important?
- AIt mitigates buffer overflow attacks.
- BIt makes the code more readable.
- CIt provides an application configuration baseline.
- DIt meets gray box testing standards.
60Which of the following would be used when a higher level of security is desired for encryption key storage?
- ATACACS+
- BL2TP
- CLDAP
- DTPM
61A security administrator needs to determine which system a particular user is trying to login to at
various times of the day. Which of the following log types would the administrator check?- AFirewall
- BApplication
- CIDS
- DSecurity
62Which of the following MUST be updated immediately when an employee is terminated to prevent unauthorized access?
- ARegistration
- BCA
- CCRL
- DRecovery agent
63Employee badges are encoded with a private encryption key and specific personal information. The encoding is then used to provide access to the network. Which of the following describes this access control type?
- ASmartcard
- BToken
- CDiscretionary access control
- DMandatory access control
64Which of the following devices would MOST likely have a DMZ interface?
- AFirewall
- BSwitch
- CLoad balancer
- DProxy
65Which of the following application security testing techniques is implemented when an automated system generates random input data?
- AFuzzing
- BXSRF
- CHardening
- DInput validation
66Which of the following can be used by a security administrator to successfully recover a user’s forgotten password on a password protected file?
- ACognitive password
- BPassword sniffing
- CBrute force
- DSocial engineering
67A security administrator wants to check user password complexity. Which of the following is the
BEST tool to use?- APassword history
- BPassword logging
- CPassword cracker
- DPassword hashing
68Certificates are used for: (Select TWO).
- AClient authentication.
- BWEP encryption.
- CAccess control lists.
- DCode signing.
- EPassword hashing.
69Which of the following is a hardware based encryption device?
- AEFS
- BTrueCrypt
- CTPM
- DSLE
70Which of the following BEST describes a protective countermeasure for SQL injection?
- AEliminating cross-site scripting vulnerabilities
- BInstalling an IDS to monitor network traffic
- CValidating user input in web applications
- DPlacing a firewall between the Internet and database servers
71Which of the following MOST interferes with network-based detection techniques?
- AMime-encoding
- BSSL
- CFTP
- DAnonymous email accounts
72A certificate authority takes which of the following actions in PKI?
- ASigns and verifies all infrastructure messages
- BIssues and signs all private keys
- CPublishes key escrow lists to CRLs
- DIssues and signs all root certificates
73Use of a smart card to authenticate remote servers remains MOST susceptible to which of the
following attacks?- AMalicious code on the local system
- BShoulder surfing
- CBrute force certificate cracking
- DDistributed dictionary attacks
74Separation of duties is often implemented between developers and administrators in order to separate which of the following?
- AMore experienced employees from less experienced employees
- BChanges to program code and the ability to deploy to production
- CUpper level management users from standard development employees
- DThe network access layer from the application access layer
75A security administrator needs to update the OS on all the switches in the company. Which of the following MUST be done before any actual switch configuration is performed?
- AThe request needs to be sent to the incident management team.
- BThe request needs to be approved through the incident management process.
- CThe request needs to be approved through the change management process.
- DThe request needs to be sent to the change management team.
Information
- Description
- Quiz on Security + Practice, created by Elise Berg on 10/07/2014.
- Author
- Elise Berg
- Language
- English
- Views
- 264
- Tags
- Rating
- 4.0 out of 5 · 1 rating Rate this quiz