Final Exam 2015+

Pregunta 1 de 113

1

Which of the following can be defined as the process of rerunning a portion of the test scenario or test plan to ensure that changes or corrections have not introduced new errors?

Selecciona una de las siguientes respuestas posibles:

Unit testing
Parallel testing
Regression testing
Pilot testing

Explicación

Pregunta 2 de 113

1

At which layer of the OSI model do sniffers operate?

Selecciona una de las siguientes respuestas posibles:

Layer 2 - Data Link Layer
Layer 1 - Hardware layer
Layer 3 - Networking Layer
Layer 7 - Application layer

Explicación

Pregunta 3 de 113

1

When two or more separate entities (usually persons) operating in concert to protect sensitive functions or information must combine their knowledge to gain access to an asset, this is known as?

Selecciona una de las siguientes respuestas posibles:

Segragation of duties
Separation of duties
Need to know
Dual Control

Explicación

Pregunta 4 de 113

1

What is the name for a substitution cipher that shifts the alphabet by 13 places?

Selecciona una de las siguientes respuestas posibles:

Transposition cipher
Caesar cipher
Polyalphabetic cipher
ROT13 cipher

Explicación

Pregunta 5 de 113

1

Your organization creates software applications that are sold to the public. Recently, management has become concerned about software piracy. Which organization deals with the prevention of this crime?

Selecciona una de las siguientes respuestas posibles:

CIA
DoD
SPA
NCSC

Explicación

Pregunta 6 de 113

1

A potential problem related to the physical installation of the Iris Scanner in regards to the usage of the iris pattern within a biometric system is:

Selecciona una de las siguientes respuestas posibles:

Concern that the laser beam may cause eye damage.
The iris pattern changes as a person grows older.
There is a relatively high rate of false accepts.
The optical unit must be positioned so that the sun does not shine into the aperture.

Explicación

Pregunta 7 de 113

1

In Mandatory Access Control, sensitivity labels attached to object contain what information?

Selecciona una de las siguientes respuestas posibles:

The item's classification
The item's classification and category set
The item's category
The items's need to know

Explicación

Pregunta 8 de 113

1

Which of the following is true about Kerberos?

Selecciona una de las siguientes respuestas posibles:

It utilizes public key cryptography.
It encrypts data after a ticket is granted, but passwords are exchanged in plain text.
It depends upon symmetric ciphers.
It is a second party authentication system.

Explicación

Pregunta 9 de 113

1

Which of the following is needed for System Accountability?

Selecciona una de las siguientes respuestas posibles:

Audit mechanisms.
Documented design as laid out in the Common Criteria.
Authorization.
Formal verification of system design.

Explicación

Pregunta 10 de 113

1

What is Kerberos?

Selecciona una de las siguientes respuestas posibles:

A three-headed dog from the Egyptian mythology.
A trusted third-party authentication protocol.
A security model.
A remote authentication dial in user server.

Explicación

Pregunta 11 de 113

1

Kerberos depends upon what encryption method?

Selecciona una de las siguientes respuestas posibles:

Public Key cryptography.
Secret Key cryptography.
El Gamal cryptography.
Blowfish cryptography.

Explicación

Pregunta 12 de 113

1

A confidential number used as an authentication factor to verify a user's identity is called a:

Selecciona una de las siguientes respuestas posibles:

PIN
User ID
Password
Challenge

Explicación

Pregunta 13 de 113

1

Individual accountability does not include which of the following?

Selecciona una de las siguientes respuestas posibles:

unique identifiers
policies & procedures
access rules
audit trails

Explicación

Pregunta 14 de 113

1

Which of the following exemplifies proper separation of duties?

Selecciona una de las siguientes respuestas posibles:

Operators are not permitted modify the system time.
Programmers are permitted to use the system console.
Console operators are permitted to mount tapes and disks.
Tape operators are permitted to use the system console.

Explicación

Pregunta 15 de 113

1

An access control policy for a bank teller is an example of the implementation of which of the following?

Selecciona una de las siguientes respuestas posibles:

Rule-based policy
Identity-based policy
User-based policy
Role-based policy

Explicación

Pregunta 16 de 113

1

Which one of the following authentication mechanisms creates a problem for mobile users?

Selecciona una de las siguientes respuestas posibles:

Mechanisms based on IP addresses
Mechanism with reusable passwords
One-time password mechanism.
Challenge response mechanism.

Explicación

Pregunta 17 de 113

1

Organizations should consider which of the following first before allowing external access to their LANs via the Internet?

Selecciona una de las siguientes respuestas posibles:

Plan for implementing workstation locking mechanisms.
Plan for protecting the modem pool.
Plan for providing the user with his account usage information.
Plan for considering proper authentication options.

Explicación

Pregunta 18 de 113

1

Kerberos can prevent which one of the following attacks?

Selecciona una de las siguientes respuestas posibles:

Tunneling attack.
Playback (replay) attack.
Destructive attack.
Process attack.

Explicación

Pregunta 19 de 113

1

In discretionary access environments, which of the following entities is authorized to grant information access to other people?

Selecciona una de las siguientes respuestas posibles:

Manager
Group Leader
Security Manager
Data Owner

Explicación

Pregunta 20 de 113

1

What is the main concern with single sign-on?

Selecciona una de las siguientes respuestas posibles:

Maximum unauthorized access would be possible if a password is disclosed.
The security administrator's workload would increase.
The users' password would be too hard to remember.
User access rights would be increased.

Explicación

Pregunta 21 de 113

1

Who developed one of the first mathematical models of a multilevel-security computer system?

Selecciona una de las siguientes respuestas posibles:

Diffie and Hellman.
Clark and Wilson.
Bell and LaPadula.
Gasser and Lipner.

Explicación

Pregunta 22 de 113

1

Which of the following attacks could capture network user passwords?

Selecciona una de las siguientes respuestas posibles:

Data diddling
Sniffing
IP Spoofing
Smurfing

Explicación

Pregunta 23 de 113

1

Which of the following would constitute the best example of a password to use for access to a system by a network administrator?

Selecciona una de las siguientes respuestas posibles:

holiday
Christmas12
Jenny
GyN19Za!

Explicación

Pregunta 24 de 113

1

What physical characteristic does a retinal scan biometric device measure?

Selecciona una de las siguientes respuestas posibles:

The amount of light reaching the retina
The amount of light reflected by the retina
The pattern of light receptors at the back of the eye
The pattern of blood vessels at the back of the eye

Explicación

Pregunta 25 de 113

1

The Computer Security Policy Model the Orange Book is based on is which of the following?

Selecciona una de las siguientes respuestas posibles:

Bell-LaPadula
Data Encryption Standard
Kerberos
Tempest

Explicación

Pregunta 26 de 113

1

The end result of implementing the principle of least privilege means which of the following?

Selecciona una de las siguientes respuestas posibles:

Users would get access to only the info for which they have a need to know
Users can access all systems.
Users get new privileges added when they change positions.
Authorization creep.

Explicación

Pregunta 27 de 113

1

Which of the following is the most reliable authentication method for remote access?

Selecciona una de las siguientes respuestas posibles:

Variable callback system
Synchronous token
Fixed callback system
Combination of callback and caller ID

Explicación

Pregunta 28 de 113

1

Which of the following is true of two-factor authentication?

Selecciona una de las siguientes respuestas posibles:

It uses the RSA public-key signature based on integers with large prime factors.
It requires two measurements of hand geometry.
It does not use single sign-on technology.
It relies on two independent proofs of identity.

Explicación

Pregunta 29 de 113

1

The primary service provided by Kerberos is which of the following?

Selecciona una de las siguientes respuestas posibles:

non-repudiation
confidentiality
authentication
authorization

Explicación

Pregunta 30 de 113

1

There are parallels between the trust models in Kerberos and Public Key Infrastructure (PKI).
When we compare them side by side, Kerberos tickets correspond most closely to which of the following?

Selecciona una de las siguientes respuestas posibles:

public keys
private keys
public-key certificates
private-key certificates

Explicación

Pregunta 31 de 113

1

In which of the following security models is the subject's clearance compared to the object's classification such that specific rules can be applied to control how the subject-to-object interactions take place?

Selecciona una de las siguientes respuestas posibles:

Bell-LaPadula model
Biba model
Access Matrix model
Take-Grant model

Explicación

Pregunta 32 de 113

1

Which of the following was developed to address some of the weaknesses in Kerberos and uses public key cryptography for the distribution of secret keys and provides additional access control support?

Selecciona una de las siguientes respuestas posibles:

SESAME
RADIUS
KryptoKnight
TACACS+

Explicación

Pregunta 33 de 113

1

Single Sign-on (SSO) is characterized by which of the following advantages?

Selecciona una de las siguientes respuestas posibles:

Convenience
Convenience and centralized administration
Convenience and centralized data administration
Convenience and centralized network administration

Explicación

Pregunta 34 de 113

1

What is the primary role of smartcards in a PKI?

Selecciona una de las siguientes respuestas posibles:

Transparent renewal of user keys
Easy distribution of the certificates between the users
Fast hardware encryption of the raw data
Tamper resistant, mobile storage and application of private keys of the users

Explicación

Pregunta 35 de 113

1

What kind of certificate is used to validate a user identity?

Selecciona una de las siguientes respuestas posibles:

Public key certificate
Attribute certificate
Root certificate
Code signing certificate

Explicación

Pregunta 36 de 113

1

The following is not a security characteristic we need to consider while choosing a biometric identification systems:

Selecciona una de las siguientes respuestas posibles:

data acquisition process
cost
enrollment process
speed and user interface

Explicación

Pregunta 37 de 113

1

In biometric identification systems, at the beginning, it was soon apparent that truly positive identification could only be based on physical attributes of a person.

This raised the necessity of answering 2 questions:

Selecciona una de las siguientes respuestas posibles:

what was the sex of a person and his age
what part of body to be used and how to accomplish identification that is viable
what was the age of a person and his income level
what was the tone of the voice of a person and his habits

Explicación

Pregunta 38 de 113

1

In biometric identification systems, the parts of the body conveniently available for identification are:

Selecciona una de las siguientes respuestas posibles:

neck and mouth
hands, face, and eyes
feet and hair
voice and neck

Explicación

Pregunta 39 de 113

1

Controlling access to information systems and associated networks is necessary for the preservation of their:

Selecciona una de las siguientes respuestas posibles:

Authenticity, confidentiality and availability
Confidentiality, integrity, and availability.
integrity and availability.
authenticity, confidentiality, integrity and availability.

Explicación

Pregunta 40 de 113

1

To control access by a subject (an active entity such as individual or process) to an object (a passive entity such as a file) involves setting up:

Selecciona una de las siguientes respuestas posibles:

Access Rules
Access Matrix
Identification controls
Access terminal

Explicación

Pregunta 41 de 113

1

Rule-Based Access Control (RuBAC) access is determined by rules.
Such rules would fit within what category of access control?

Selecciona una de las siguientes respuestas posibles:

Discretionary Access Control (DAC)
Mandatory Access control (MAC)
Non-Discretionary Access Control (NDAC)
Lattice-based Access control

Explicación

Pregunta 42 de 113

1

The type of discretionary access control (DAC) that is based on an individual's identity is also called:

Selecciona una de las siguientes respuestas posibles:

Identity-based Access control
Rule-based Access control
Non-Discretionary Access Control
Lattice-based Access control

Explicación

Pregunta 43 de 113

1

Which access control type has a central authority that determine to what objects the subjects have access to and it is based on role or on the organizational security policy?

Selecciona una de las siguientes respuestas posibles:

Mandatory Access Control
Discretionary Access Control
Non-Discretionary Access Control
Rule-based Access control

Explicación

Pregunta 44 de 113

1

Which of the following control pairings include: organizational policies and procedures, pre- employment background checks, strict hiring practices, employment agreements, employee termination procedures, vacation scheduling, labeling of sensitive materials, increased supervision, security awareness training, behavior awareness, and sign-up procedures to obtain access to information systems and networks?

Selecciona una de las siguientes respuestas posibles:

Preventive/Administrative Pairing
Preventive/Technical Pairing
Preventive/Physical Pairing
Detective/Administrative Pairing

Explicación

Pregunta 45 de 113

1

Technical controls such as encryption and access control can be built into the operating system, be software applications, or can be supplemental hardware/software units.
Such controls, also known as logical controls, represent which pairing?

Selecciona una de las siguientes respuestas posibles:

Preventive/Administrative Pairing
Preventive/Technical Pairing
Preventive/Physical Pairing
Detective/Technical Pairing

Explicación

Pregunta 46 de 113

1

What is called the use of technologies such as fingerprint, retina, and iris scans to authenticate the individuals requesting access to resources?

Selecciona una de las siguientes respuestas posibles:

Micrometrics
Macrometrics
Biometrics
MicroBiometrics

Explicación

Pregunta 47 de 113

1

What is called the access protection system that limits connections by calling back the number of a previously authorized location?

Selecciona una de las siguientes respuestas posibles:

Sendback systems
Callback forward systems
Callback systems
Sendback forward systems

Explicación

Pregunta 48 de 113

1

What are called user interfaces that limit the functions that can be selected by a user?

Selecciona una de las siguientes respuestas posibles:

Constrained user interfaces
Limited user interfaces
Mini user interfaces
Unlimited user interfaces

Explicación

Pregunta 49 de 113

1

Controls such as job rotation, the sharing of responsibilities, and reviews of audit records are associated with:

Selecciona una de las siguientes respuestas posibles:

Preventive/physical
Detective/technical
Detective/physical
Detective/administrative

Explicación

Pregunta 50 de 113

1

The control measures that are intended to reveal the violations of security policy using software and hardware are associated with:

Selecciona una de las siguientes respuestas posibles:

Preventive/physical
Detective/technical
Detective/physical
Detective/administrative

Explicación

Pregunta 51 de 113

1

The controls that usually require a human to evaluate the input from sensors or cameras to determine if a real threat exists are associated with:

Selecciona una de las siguientes respuestas posibles:

Preventive/physical
Detective/technical
Detective/physical
Detective/administrative

Explicación

Pregunta 52 de 113

1

External consistency ensures that the data stored in the database is:

Selecciona una de las siguientes respuestas posibles:

in-consistent with the real world.
remains consistant when sent from one system to another.
consistent with the logical world.
consistent with the real world.

Explicación

Pregunta 53 de 113

1

A central authority determines what subjects can have access to certain objects based on the organizational security policy is called:

Selecciona una de las siguientes respuestas posibles:

Mandatory Access Control
Discretionary Access Control
Non-Discretionary Access Control
Rule-based Access control

Explicación

Pregunta 54 de 113

1

What is called the act of a user professing an identity to a system, usually in the form of a log-on ID?

Selecciona una de las siguientes respuestas posibles:

Authentication
Identification
Authorization
Confidentiality

Explicación

Pregunta 55 de 113

1

Which one of the following factors is not one on which Authentication is based?

Selecciona una de las siguientes respuestas posibles:

Type 1 Something you know, such as a PIN or password
Type 2 Something you have, such as an ATM card or smart card
Type 3 Something you are (based upon one or more intrinsic physical or behavioral traits), such as a fingerprint or retina scan
Type 4 Something you are, such as a system administrator or security administrator

Explicación

Pregunta 56 de 113

1

A central authority determines what subjects can have access to certain objects based on the organizational security policy is called:

Selecciona una de las siguientes respuestas posibles:

Mandatory Access Control
Discretionary Access Control
Non-Discretionary Access Control
Rule-based Access control

Explicación

Pregunta 57 de 113

1

What is called the act of a user professing an identity to a system, usually in the form of a log-on ID?

Selecciona una de las siguientes respuestas posibles:

Authentication
Identification
Authorization
Confidentiality

Explicación

Pregunta 58 de 113

1

What is called the verification that the user's claimed identity is valid and is usually implemented through a user password at log-on time?

Selecciona una de las siguientes respuestas posibles:

Authentication
Identification
Integrity
Confidentiality

Explicación

Pregunta 59 de 113

1

Which one of the following factors is not one on which Authentication is based?

Selecciona una de las siguientes respuestas posibles:

Type 1 Something you know, such as a PIN or password
Type 2 Something you have, such as an ATM card or smart card
Type 3 Something you are (based upon one or more intrinsic physical or behavioral traits), such as a fingerprint or retina scan
Type 4 Something you are, such as a system administrator or security administrator

Explicación

Pregunta 60 de 113

1

The act of requiring two of the three factors to be used in the authentication process refers to:

Selecciona una de las siguientes respuestas posibles:

Two-Factor Authentication
One-Factor Authentication
Bi-Factor Authentication
Double Authentication

Explicación

Pregunta 61 de 113

1

Which type of password provides maximum security because a new password is required for each new log-on?

Selecciona una de las siguientes respuestas posibles:

One-time or dynamic password
Congnitive password
Static password
Passphrase

Explicación

Pregunta 62 de 113

1

What is called a password that is the same for each log-on session?

Selecciona una de las siguientes respuestas posibles:

"one-time password"
"two-time password"
static password
dynamic password

Explicación

Pregunta 63 de 113

1

What is called a sequence of characters that is usually longer than the allotted number for a password?

Selecciona una de las siguientes respuestas posibles:

passphrase
cognitive phrase
anticipated phrase
Real phrase

Explicación

Pregunta 64 de 113

1

Which best describes a tool (i.e. keyfob, calculator, memory card or smart card) used to supply dynamic passwords?

Selecciona una de las siguientes respuestas posibles:

Tickets
Tokens
Token passing networks
Coupons

Explicación

Pregunta 65 de 113

1

Which of the following would be true about Static password tokens?

Selecciona una de las siguientes respuestas posibles:

The owner identity is authenticated by the token
The owner will never be authenticated by the token.
The owner will authenticate himself to the system
The token does not authenticates the token owner but the system

Explicación

Pregunta 66 de 113

1

In Synchronous dynamic password tokens:

Selecciona una de las siguientes respuestas posibles:

The token generates a new password value at fixed time intervals (this password could be based on the time of day encrypted with a secret key).
The token generates a new non-unique password value at fixed time intervals (this password could be based on the time of day encrypted with a secret key).
The unique password is not entered into a system or workstation along with an owner's PIN.
The authentication entity in a system or workstation knows an owner's secret key and PIN, and the entity verifies that the entered password is invalid and that it was entered during the invalid time window

Explicación

Pregunta 67 de 113

1

In biometrics, "one-to-many" search against database of stored biometric images is done in:

Selecciona una de las siguientes respuestas posibles:

Authentication
Identification
Identities
Identity-based access control

Explicación

Pregunta 68 de 113

1

Which of the following is true of biometrics?

Selecciona una de las siguientes respuestas posibles:

It is used for identification in physical controls and it is not used in logical controls
It is used for authentication in physical controls and for identification in logical controls
It is used for identification in physical controls and for authentication in logical controls.
Biometrics has not role in logical controls.

Explicación

Pregunta 69 de 113

1

What is called the percentage of valid subjects that are falsely rejected by a Biometric Authentication system?

Selecciona una de las siguientes respuestas posibles:

False Rejection Rate (FRR) or Type I Error
False Acceptance Rate (FAR) or Type II Error
Crossover Error Rate (CER)
True Rejection Rate (TRR) or Type III Error

Explicación

Pregunta 70 de 113

1

What is called the percentage of invalid subjects that are falsely accepted by a Biometric authentication system?

Selecciona una de las siguientes respuestas posibles:

False Rejection Rate (FRR) or Type I Error
False Acceptance Rate (FAR) or Type II Error
Crossover Error Rate (CER)
True Acceptance Rate (TAR) or Type III Error

Explicación

Pregunta 71 de 113

1

What is called the percentage at which the False Rejection Rate equals the False Acceptance Rate?

Selecciona una de las siguientes respuestas posibles:

False Rejection Rate (FRR) or Type I Error
False Acceptance Rate (FAR) or Type II Error
Crossover Error Rate (CER)
Failure to enroll rate (FTE or FER)

Explicación

Pregunta 72 de 113

1

Considerations of privacy, invasiveness, and psychological and physical comfort when using the system are important elements for which of the following?

Selecciona una de las siguientes respuestas posibles:

Accountability of biometrics systems
Acceptability of biometrics systems
Availability of biometrics systems
Adaptability of biometrics systems

Explicación

Pregunta 73 de 113

1

Which of the following offers advantages such as the ability to use stronger passwords, easier password administration, one set of credential, and faster resource access?

Selecciona una de las siguientes respuestas posibles:

Smart cards
Single Sign-On (SSO)
Symmetric Ciphers
Public Key Infrastructure (PKI)

Explicación

Pregunta 74 de 113

1

Which of the following describes the major disadvantage of many Single Sign-On (SSO) implementations?

Selecciona una de las siguientes respuestas posibles:

Once an individual obtains access to the system through the initial log-on, they have access to all resources within the environment that the account has access to.
The initial logon process is cumbersome to discourage potential intruders.
Once a user obtains access to the system through the initial log-on, they only need to logon to some applications.
Once a user obtains access to the system through the initial log-on, he has to logout from all other systems

Explicación

Pregunta 75 de 113

1

Which of the following is implemented through scripts or smart agents that replays the users multiple log-ins against authentication servers to verify a user's identity which permit access to system services?

Selecciona una de las siguientes respuestas posibles:

Single Sign-On
Dynamic Sign-On
Smart cards
Kerberos

Explicación

Pregunta 76 de 113

1

Which of the following is not true of the Kerberos protocol?

Selecciona una de las siguientes respuestas posibles:

Only a single login is required per session.
The initial authentication steps are done using public key algorithm
The KDC is aware of all systems in the network and is trusted by all of them
It performs mutual authentication

Explicación

Pregunta 77 de 113

1

The authenticator within Kerberos provides a requested service to the client after validating which of the following?

Selecciona una de las siguientes respuestas posibles:

timestamp
client public key
client private key
server public key

Explicación

Pregunta 78 de 113

1

Which of the following is addressed by Kerberos?

Selecciona una de las siguientes respuestas posibles:

Confidentiality and Integrity
Authentication and Availability
Validation and Integrity
Auditability and Integrity

Explicación

Pregunta 79 de 113

1

Kerberos is vulnerable to replay in which of the following circumstances?

Selecciona una de las siguientes respuestas posibles:

When a private key is compromised within an allotted time window
When a public key is compromised within an allotted time window.
When a ticket is compromised within an allotted time window.
When the KSD is compromised within an allotted time window.

Explicación

Pregunta 80 de 113

1

Like the Kerberos protocol, SESAME is also subject to which of the following?

Selecciona una de las siguientes respuestas posibles:

timeslot replay
password guessing
symmetric key guessing
asymmetric key guessing

Explicación

Pregunta 81 de 113

1

RADIUS incorporates which of the following services?

Selecciona una de las siguientes respuestas posibles:

Authentication server and PIN codes.
Authentication of clients and static passwords generation.
Authentication of clients and dynamic passwords generation.
Authentication server as well as support for Static and Dynamic passwords.

Explicación

Pregunta 82 de 113

1

Which of the following protects a password from eavesdroppers and supports the encryption of communication?

Selecciona una de las siguientes respuestas posibles:

Challenge Handshake Authentication Protocol (CHAP)
Challenge Handshake Identification Protocol (CHIP)
Challenge Handshake Encryption Protocol (CHEP)
Challenge Handshake Substitution Protocol (CHSP)

Explicación

Pregunta 83 de 113

1

Which of the following represents the columns of the table in a relational database?

Selecciona una de las siguientes respuestas posibles:

attributes
relation
record retention
records or tuples

Explicación

Pregunta 84 de 113

1

A database view is the results of which of the following operations?

Selecciona una de las siguientes respuestas posibles:

Join and Select.
Join, Insert, and Project
Join, Project, and Create.
Join, Project, and Select.

Explicación

Pregunta 85 de 113

1

Which of the following is used to create and modify the structure of your tables and other objects in the database?

Selecciona una de las siguientes respuestas posibles:

SQL Data Definition Language (DDL)
SQL Data Manipulation Language (DML)
SQL Data Relational Language (DRL)
SQL Data Identification Language (DIL)

Explicación

Pregunta 86 de 113

1

Which of the following is used to monitor network traffic or to monitor host audit logs in real time to determine violations of system security policy that have taken place?

Selecciona una de las siguientes respuestas posibles:

Intrusion Detection System
Compliance Validation System
Intrusion Management System (IMS)
Compliance Monitoring System

Explicación

Pregunta 87 de 113

1

Which of the following monitors network traffic in real time?

Selecciona una de las siguientes respuestas posibles:

network-based IDS
host-based IDS
application-based IDS
firewall-based IDS

Explicación

Pregunta 88 de 113

1

A host-based IDS is resident on which of the following?

Selecciona una de las siguientes respuestas posibles:

On each of the critical hosts
decentralized hosts
central hosts
bastion hosts

Explicación

Pregunta 89 de 113

1

Which of the following usually provides reliable, real-time information without consuming network or host resources?

Selecciona una de las siguientes respuestas posibles:

network-based IDS
host-based IDS
application-based IDS
firewall-based IDS

Explicación

Pregunta 90 de 113

1

The fact that a network-based IDS reviews packets payload and headers enable which of the following?

Selecciona una de las siguientes respuestas posibles:

Detection of denial of service
Detection of all viruses
Detection of data corruption
Detection of all password guessing attacks

Explicación

Pregunta 91 de 113

1

Which of the following reviews system and event logs to detect attacks on the host and determine if the attack was successful?

Selecciona una de las siguientes respuestas posibles:

host-based IDS
firewall-based IDS
bastion-based IDS
server-based IDS

Explicación

Pregunta 92 de 113

1

What would be considered the biggest drawback of Host-based Intrusion Detection systems
(HIDS)?

Selecciona una de las siguientes respuestas posibles:

It can be very invasive to the host operating system
Monitors all processes and activities on the host system only
Virtually eliminates limits associated with encryption
They have an increased level of visibility and control compared to NIDS

Explicación

Pregunta 93 de 113

1

Attributes that characterize an attack are stored for reference using which of the following
Intrusion Detection System (IDS)?

Selecciona una de las siguientes respuestas posibles:

signature-based IDS
statistical anomaly-based IDS
event-based IDS
inferent-based IDS

Explicación

Pregunta 94 de 113

1

Which of the following is an issue with signature-based intrusion detection systems?

Selecciona una de las siguientes respuestas posibles:

Only previously identified attack signatures are detected.
Signature databases must be augmented with inferential elements.
It runs only on the windows operating system
Hackers can circumvent signature evaluations.

Explicación

Pregunta 95 de 113

1

Which of the following is an IDS that acquires data and defines a "normal" usage profile for the network or host?

Selecciona una de las siguientes respuestas posibles:

Statistical Anomaly-Based ID
Signature-Based ID
dynamical anomaly-based ID
inferential anomaly-based ID

Explicación

Pregunta 96 de 113

1

Which of the following is most relevant to determining the maximum effective cost of access control?

Selecciona una de las siguientes respuestas posibles:

the value of information that is protected
management's perceptions regarding data importance
budget planning related to base versus incremental spending
the cost to replace lost data

Explicación

Pregunta 97 de 113

1

Which of the following is not a factor related to Access Control?

Selecciona una de las siguientes respuestas posibles:

integrity
authenticity
confidentiality
availability

Explicación

Pregunta 98 de 113

1

Which of the following is most appropriate to notify an external user that session monitoring is being conducted?

Selecciona una de las siguientes respuestas posibles:

Logon Banners
Wall poster
Employee Handbook
Written agreement

Explicación

Pregunta 99 de 113

1

Which of the following pairings uses technology to enforce access control policies?

Selecciona una de las siguientes respuestas posibles:

Preventive/Administrative
Preventive/Technical
Preventive/Physical
Detective/Administrative

Explicación

Pregunta 100 de 113

1

In the course of responding to and handling an incident, you work on determining the root cause of the incident. In which step are you in?

Selecciona una de las siguientes respuestas posibles:

Recovery
Containment
Triage
Analysis and tracking

Explicación

Pregunta 101 de 113

1

Access control is the collection of mechanisms that permits managers of a system to exercise a directing or restraining influence over the behavior, use, and content of a system.
It does not permit management to:

Selecciona una de las siguientes respuestas posibles:

specify what users can do
specify which resources they can access
specify how to restrain hackers
specify what operations they can perform on a system

Explicación

Pregunta 102 de 113

1

Access Control techniques do not include which of the following choices?

Selecciona una de las siguientes respuestas posibles:

Relevant Access Controls
Discretionary Access Control
Mandatory Access Control
Lattice Based Access Control

Explicación

Pregunta 103 de 113

1

Which of the following statements relating to the Bell-LaPadula security model is false (assuming the Strong Star property is not being used)?

Selecciona una de las siguientes respuestas posibles:

A subject is not allowed to read up
The *- property restriction can be escaped by temporarily downgrading a high level subject.
A subject is not allowed to read down
It is restricted to confidentiality

Explicación

Pregunta 104 de 113

1

When a biometric system is used, which error type deals with the possibility of granting access to impostors who should be rejected?

Selecciona una de las siguientes respuestas posibles:

Type I error
Type II error
Type III error
Crossover error

Explicación

Pregunta 105 de 113

1

Which of the following is the FIRST step in protecting data's confidentiality?

Selecciona una de las siguientes respuestas posibles:

Install a firewall
Implement encryption
Identify which information is sensitive
Review all user access rights

Explicación

Pregunta 106 de 113

1

Which of the following best ensures accountability of users for the actions taken within a system or domain?

Selecciona una de las siguientes respuestas posibles:

Identification
Authentication
Authorization
Credentials

Explicación

Pregunta 107 de 113

1

Which of the following statements pertaining to biometrics is false?

Selecciona una de las siguientes respuestas posibles:

User can be authenticated based on behavior.
User can be authenticated based on unique physical attributes.
User can be authenticated by what he knows.
A biometric system's accuracy is determined by its crossover error rate (CER).

Explicación

Pregunta 108 de 113

1

Which of the following biometric devices offers the LOWEST CER?

Selecciona una de las siguientes respuestas posibles:

Keystroke dynamics
Voice verification
Iris scan
Fingerprint

Explicación

Pregunta 109 de 113

1

Which of the following is the weakest authentication mechanism?

Selecciona una de las siguientes respuestas posibles:

Passphrases
Passwords
One-time passwords
Token devices

Explicación

Pregunta 110 de 113

1

Which of the following statements pertaining to access control is false?

Selecciona una de las siguientes respuestas posibles:

Users should only access data on a need-to-know basis.
If access is not explicitly denied, it should be implicitly allowed.
Access rights should be granted based on the level of trust a company has on a subject.
Roles can be an efficient way to assign rights to a type of user who performs certain tasks.

Explicación

Pregunta 111 de 113

1

Which of the following is not part of the Kerberos authentication protocol?

Selecciona una de las siguientes respuestas posibles:

Symmetric key cryptography
Authentication service (AS)
Principals
Public Key

Explicación

Pregunta 112 de 113

1

	Creado por Alexandre Pinheiro hace casi 8 años

Exam Practice Questions

Final Exam 2015+

Pregunta 1 de 113

Which of the following can be defined as the process of rerunning a portion of the test scenario or test plan to ensure that changes or corrections have not introduced new errors?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 2 de 113

At which layer of the OSI model do sniffers operate?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 3 de 113

When two or more separate entities (usually persons) operating in concert to protect sensitive functions or information must combine their knowledge to gain access to an asset, this is known as?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 4 de 113

What is the name for a substitution cipher that shifts the alphabet by 13 places?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 5 de 113

Your organization creates software applications that are sold to the public. Recently, management has become concerned about software piracy. Which organization deals with the prevention of this crime?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 6 de 113

A potential problem related to the physical installation of the Iris Scanner in regards to the usage of the iris pattern within a biometric system is:

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 7 de 113

In Mandatory Access Control, sensitivity labels attached to object contain what information?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 8 de 113

Which of the following is true about Kerberos?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 9 de 113

Which of the following is needed for System Accountability?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 10 de 113

What is Kerberos?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 11 de 113

Kerberos depends upon what encryption method?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 12 de 113

A confidential number used as an authentication factor to verify a user's identity is called a:

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 13 de 113

Individual accountability does not include which of the following?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 14 de 113

Which of the following exemplifies proper separation of duties?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 15 de 113

An access control policy for a bank teller is an example of the implementation of which of the following?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 16 de 113

Which one of the following authentication mechanisms creates a problem for mobile users?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 17 de 113

Organizations should consider which of the following first before allowing external access to their LANs via the Internet?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 18 de 113

Kerberos can prevent which one of the following attacks?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 19 de 113

In discretionary access environments, which of the following entities is authorized to grant information access to other people?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 20 de 113

What is the main concern with single sign-on?

There are parallels between the trust models in Kerberos and Public Key Infrastructure (PKI).
When we compare them side by side, Kerberos tickets correspond most closely to which of the following?

In biometric identification systems, at the beginning, it was soon apparent that truly positive identification could only be based on physical attributes of a person.

This raised the necessity of answering 2 questions: