GoConqr has a new look! Let us know what you think.

Sign up free

Flashcards

Review Questions Chapter 1

Ernesto Hata Portuguese 20 cards

Cards in this deck (20)

  1. 11. ​Which of the following contains the primary goals and objectives of security? A. A network’s border perimeter B. The CIA Triad C. A stand-alone system D. The internet1- B. The CIA Triad
    The goals and
    objectives of security
    are confidentiality,
    integrity, and
    availability,
    commonly
    referred to
    as the CIA Triad.
  2. 22. Vulnerabilities and risks are evaluated based on their threats against which of the following? A. One or more of the CIA Triad principles B. Data usefulness C. Due care D. Extent of liability2- A. One or more of the
    CIA Triad principles.
    Vulnerabilities and
    risks are evaluated based on their
    threats against
    one or more
    of the CIA Triad principles.
  3. 33. Which of the following is a principle of the CIA Triad that means authorized subjects are granted timely and uninterrupted access to objects? A. Identification B. Availability C. Encryption D. Layering3- B. Availability
    Availability means that authorized subjects are granted timely and uninterrupted access to objects.
  4. 44. Which of the following is not considered a violation of confidentiality? A. Stealing passwords B. Eavesdropping escutas C.Hardware destruction D. Social engineering4- C.Hardware destruction
    is a violation of availability
    and possibly integrity.
    Violations of
    confidentiality include capturing network
    traffic, stealing password files, social engineering,
    port scanning, shoulder surfing, eavesdropping,
    and sniffing.
  5. 55.Which of the following is not true? A. Violations of confidentiality include human error. B. Violations of confidentiality include management oversight. C. Violations of confidentiality are limited to direct intentional attacks. D. Violations of confidentiality can occur when a transmission is not properly encrypted.5- C. Violations of confidentiality are
    limited to direct intentional attacks.
    *Violations of confidentiality
    are not limited to direct intentional attacks. Many instances of unauthorized disclosure of sensitive or confidential information are due to human error, oversight, or ineptitude.
  6. 66. STRIDE is often used in relation to assessing threats against applications or operating systems. Which of the following is not an element of STRIDE? A. Spoofing B. Elevation of privilege C. Repudiation D. Disclosure6- D. Disclosure
    Disclosure is not an element of STRIDE. The elements of STRIDE are spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.
  7. 77. If a security mechanism offers availability, then it offers a high level of assurance that authorized subjects can ________________ the data, objects, and resources. A. Control A. Audit C. Access D. Repudiate7- C. Access
    Accessibility of data,
    objects, and resources
    is the goal of availability.
    If a security mechanism offers availability, then it is highly likely that the data, objects, and resources are accessible to authorized subjects.
  8. 88. _______________ refers to keeping information confidential that personally identifiable or that might cause harm, embarrassment, or disgrace to someone if revealed. A. Seclusion B. Concealment C. Privacy D. Criticality8- C. Privacy
    refers to keeping information
    confidential that is personally
    identifiable or that might
    cause harm, embarrassment,
    or disgrace to someone if revealed. Seclusion is to store
    something in an out-of-the-way location. Concealment is
    the act of hiding or preventing
    disclosure. The level to which information is mission critical
    is its measure of criticality.
  9. 99- All but which of the following items requires awareness ciência for all individuals affected? A. Restricting personal email B . Recording phone conversations C. Gathering information about surfing habits D. The backup mechanism used to retain email messages9- D. The backup mechanism used to retain email messages
    Users should be aware that email messages are retained, but the backup mechanism used to perform this operation does not need to be disclosed to them.
  10. 1010. What element of data categorization management can override all other forms of access control? A. Classification B. Physical access C. Custodian responsibilities D. Taking ownership10-D.Ownership grants an entity full capabilities and privileges over the object they own. The ability to take ownership is often granted to the most powerful accounts in an operating system because it can be used to overstep any access control limitations otherwise implemented.
  11. 1111. What ensures that the subject of an activity or event cannot deny that the event occurred? A. CIA Triad B. Abstraction C. Nonrepudiation D. Hash totals11- C. Nonrepudiation ensures that the subject of an activity or event cannot deny that the event occurred.
  12. 1212. Which of the following is the most important and distinctive concept in relation to layered security? A. Multiple B. Series C. Parallel D. Filter12- B. Layering is the deployment of multiple security mechanisms in a series. When security restrictions are performed in a series, they are performed one after the other in a linear fashion. Therefore, a single failure of a security control does not render the entire solution ineffective.
  13. 1313. Which of the following is not considered an example of data hiding? A.Preventing an authorized reader of an object from deleting that object B. Keeping a database from being accessed by unauthorized visitors C. Restricting a subject at a lower classification level from accessing data at a higher classification level D. Preventing an application from accessing hardware directly13- A. Preventing an authorized
    reader of an object from deleting that object is just an example of access control, not data hiding. If you can read an object,
    it is not hidden from you.
  14. 1414. What is the primary goal of change management? A. Maintaining documentation B. Keeping users informed of changes C. Allowing rollback of failed changes D. Preventing security compromises14- ​D. The prevention of security compromises
    is the primary goal of change management.
  15. 1515. What the primary objective of data classification schemes? A.To control access to objects for authorized subjects B. To formalize and stratify the process of securing data based on assigned labels of importance and sensitivity C. To establish a transaction trail for auditing accountability D. To manipulate access controls to provide for the most efficient means to grant or restrict functionality15- B. The primary objective of data classification schemes is to formalize and stratify the process of securing data based on assigned labels of importance and sensitivity.
  16. 1616. Which of the following is typically not a characteristic considered when classifying data? A. Value B.Size of object C. Useful lifetime D. National security implications16- B. Size is not a
    criterion for establishing data classification. When classifying an object, you should take value, lifetime, and security implications into consideration.
  17. 1717. What are the two common data classification schemes? A. Military and private sector B. Personal and government C. Private sector and unrestricted sector D. Classified and unclassified17- A. Military (or government) and private sector (or commercial business) are the two common data classification schemes.
  18. 1818. Which of the following is the lowest military data classification for classified data? A.Sensitive B. Secret C. Proprietary D. Private18-B.Of the options listed, secret is the lowest classified military data classification. Keep in mind that items labeled as confidential, secret, and top secret are collectively known as classified, and confidential is below secret in the list.
  19. 1919. ​Which commercial business/private sector data classification is used to control information about individuals within an organization? A. Confidential B. Private C. Sensitive D. Proprietary19- B. The commercial business/private sector data classification of private is used to protect information about individuals.
  20. 2020. Data classifications are used to focus security controls over all but which of the following? A. Storage B. Processing C. Layering D. Transfer20- C. Layering is a core aspect of security mechanisms, but
    it is not a focus
    of data classifications.

Information

Description
Flashcards on Review Questions Chapter 1, created by Ernesto Hata on 30/08/2018.
Created by
Ernesto Hata
Views
0
Rating

More on Security Principles and the CIA Triad

Feedback

What is it about?

What do you think of the new look?

How do you like it?