Final Exam 2015+

Questão 1 de 113

1

Which of the following can be defined as the process of rerunning a portion of the test scenario or test plan to ensure that changes or corrections have not introduced new errors?

Selecione uma das seguintes:

Unit testing
Parallel testing
Regression testing
Pilot testing

Explicação

Questão 2 de 113

1

At which layer of the OSI model do sniffers operate?

Selecione uma das seguintes:

Layer 2 - Data Link Layer
Layer 1 - Hardware layer
Layer 3 - Networking Layer
Layer 7 - Application layer

Explicação

Questão 3 de 113

1

When two or more separate entities (usually persons) operating in concert to protect sensitive functions or information must combine their knowledge to gain access to an asset, this is known as?

Selecione uma das seguintes:

Segragation of duties
Separation of duties
Need to know
Dual Control

Explicação

Questão 4 de 113

1

What is the name for a substitution cipher that shifts the alphabet by 13 places?

Selecione uma das seguintes:

Transposition cipher
Caesar cipher
Polyalphabetic cipher
ROT13 cipher

Explicação

Questão 5 de 113

1

Your organization creates software applications that are sold to the public. Recently, management has become concerned about software piracy. Which organization deals with the prevention of this crime?

Selecione uma das seguintes:

CIA
DoD
SPA
NCSC

Explicação

Questão 6 de 113

1

A potential problem related to the physical installation of the Iris Scanner in regards to the usage of the iris pattern within a biometric system is:

Selecione uma das seguintes:

Concern that the laser beam may cause eye damage.
The iris pattern changes as a person grows older.
There is a relatively high rate of false accepts.
The optical unit must be positioned so that the sun does not shine into the aperture.

Explicação

Questão 7 de 113

1

In Mandatory Access Control, sensitivity labels attached to object contain what information?

Selecione uma das seguintes:

The item's classification
The item's classification and category set
The item's category
The items's need to know

Explicação

Questão 8 de 113

1

Which of the following is true about Kerberos?

Selecione uma das seguintes:

It utilizes public key cryptography.
It encrypts data after a ticket is granted, but passwords are exchanged in plain text.
It depends upon symmetric ciphers.
It is a second party authentication system.

Explicação

Questão 9 de 113

1

Which of the following is needed for System Accountability?

Selecione uma das seguintes:

Audit mechanisms.
Documented design as laid out in the Common Criteria.
Authorization.
Formal verification of system design.

Explicação

Questão 10 de 113

1

What is Kerberos?

Selecione uma das seguintes:

A three-headed dog from the Egyptian mythology.
A trusted third-party authentication protocol.
A security model.
A remote authentication dial in user server.

Explicação

Questão 11 de 113

1

Kerberos depends upon what encryption method?

Selecione uma das seguintes:

Public Key cryptography.
Secret Key cryptography.
El Gamal cryptography.
Blowfish cryptography.

Explicação

Questão 12 de 113

1

A confidential number used as an authentication factor to verify a user's identity is called a:

Selecione uma das seguintes:

PIN
User ID
Password
Challenge

Explicação

Questão 13 de 113

1

Individual accountability does not include which of the following?

Selecione uma das seguintes:

unique identifiers
policies & procedures
access rules
audit trails

Explicação

Questão 14 de 113

1

Which of the following exemplifies proper separation of duties?

Selecione uma das seguintes:

Operators are not permitted modify the system time.
Programmers are permitted to use the system console.
Console operators are permitted to mount tapes and disks.
Tape operators are permitted to use the system console.

Explicação

Questão 15 de 113

1

An access control policy for a bank teller is an example of the implementation of which of the following?

Selecione uma das seguintes:

Rule-based policy
Identity-based policy
User-based policy
Role-based policy

Explicação

Questão 16 de 113

1

Which one of the following authentication mechanisms creates a problem for mobile users?

Selecione uma das seguintes:

Mechanisms based on IP addresses
Mechanism with reusable passwords
One-time password mechanism.
Challenge response mechanism.

Explicação

Questão 17 de 113

1

Organizations should consider which of the following first before allowing external access to their LANs via the Internet?

Selecione uma das seguintes:

Plan for implementing workstation locking mechanisms.
Plan for protecting the modem pool.
Plan for providing the user with his account usage information.
Plan for considering proper authentication options.

Explicação

Questão 18 de 113

1

Kerberos can prevent which one of the following attacks?

Selecione uma das seguintes:

Tunneling attack.
Playback (replay) attack.
Destructive attack.
Process attack.

Explicação

Questão 19 de 113

1

In discretionary access environments, which of the following entities is authorized to grant information access to other people?

Selecione uma das seguintes:

Manager
Group Leader
Security Manager
Data Owner

Explicação

Questão 20 de 113

1

What is the main concern with single sign-on?

Selecione uma das seguintes:

Maximum unauthorized access would be possible if a password is disclosed.
The security administrator's workload would increase.
The users' password would be too hard to remember.
User access rights would be increased.

Explicação

Questão 21 de 113

1

Who developed one of the first mathematical models of a multilevel-security computer system?

Selecione uma das seguintes:

Diffie and Hellman.
Clark and Wilson.
Bell and LaPadula.
Gasser and Lipner.

Explicação

Questão 22 de 113

1

Which of the following attacks could capture network user passwords?

Selecione uma das seguintes:

Data diddling
Sniffing
IP Spoofing
Smurfing

Explicação

Questão 23 de 113

1

Which of the following would constitute the best example of a password to use for access to a system by a network administrator?

Selecione uma das seguintes:

holiday
Christmas12
Jenny
GyN19Za!

Explicação

Questão 24 de 113

1

What physical characteristic does a retinal scan biometric device measure?

Selecione uma das seguintes:

The amount of light reaching the retina
The amount of light reflected by the retina
The pattern of light receptors at the back of the eye
The pattern of blood vessels at the back of the eye

Explicação

Questão 25 de 113

1

The Computer Security Policy Model the Orange Book is based on is which of the following?

Selecione uma das seguintes:

Bell-LaPadula
Data Encryption Standard
Kerberos
Tempest

Explicação

Questão 26 de 113

1

The end result of implementing the principle of least privilege means which of the following?

Selecione uma das seguintes:

Users would get access to only the info for which they have a need to know
Users can access all systems.
Users get new privileges added when they change positions.
Authorization creep.

Explicação

Questão 27 de 113

1

Which of the following is the most reliable authentication method for remote access?

Selecione uma das seguintes:

Variable callback system
Synchronous token
Fixed callback system
Combination of callback and caller ID

Explicação

Questão 28 de 113

1

Which of the following is true of two-factor authentication?

Selecione uma das seguintes:

It uses the RSA public-key signature based on integers with large prime factors.
It requires two measurements of hand geometry.
It does not use single sign-on technology.
It relies on two independent proofs of identity.

Explicação

Questão 29 de 113

1

The primary service provided by Kerberos is which of the following?

Selecione uma das seguintes:

non-repudiation
confidentiality
authentication
authorization

Explicação

Questão 30 de 113

1

There are parallels between the trust models in Kerberos and Public Key Infrastructure (PKI).
When we compare them side by side, Kerberos tickets correspond most closely to which of the following?

Selecione uma das seguintes:

public keys
private keys
public-key certificates
private-key certificates

Explicação

Questão 31 de 113

1

In which of the following security models is the subject's clearance compared to the object's classification such that specific rules can be applied to control how the subject-to-object interactions take place?

Selecione uma das seguintes:

Bell-LaPadula model
Biba model
Access Matrix model
Take-Grant model

Explicação

Questão 32 de 113

1

Which of the following was developed to address some of the weaknesses in Kerberos and uses public key cryptography for the distribution of secret keys and provides additional access control support?

Selecione uma das seguintes:

SESAME
RADIUS
KryptoKnight
TACACS+

Explicação

Questão 33 de 113

1

Single Sign-on (SSO) is characterized by which of the following advantages?

Selecione uma das seguintes:

Convenience
Convenience and centralized administration
Convenience and centralized data administration
Convenience and centralized network administration

Explicação

Questão 34 de 113

1

What is the primary role of smartcards in a PKI?

Selecione uma das seguintes:

Transparent renewal of user keys
Easy distribution of the certificates between the users
Fast hardware encryption of the raw data
Tamper resistant, mobile storage and application of private keys of the users

Explicação

Questão 35 de 113

1

What kind of certificate is used to validate a user identity?

Selecione uma das seguintes:

Public key certificate
Attribute certificate
Root certificate
Code signing certificate

Explicação

Questão 36 de 113

1

The following is not a security characteristic we need to consider while choosing a biometric identification systems:

Selecione uma das seguintes:

data acquisition process
cost
enrollment process
speed and user interface

Explicação

Questão 37 de 113

1

In biometric identification systems, at the beginning, it was soon apparent that truly positive identification could only be based on physical attributes of a person.

This raised the necessity of answering 2 questions:

Selecione uma das seguintes:

what was the sex of a person and his age
what part of body to be used and how to accomplish identification that is viable
what was the age of a person and his income level
what was the tone of the voice of a person and his habits

Explicação

Questão 38 de 113

1

In biometric identification systems, the parts of the body conveniently available for identification are:

Selecione uma das seguintes:

neck and mouth
hands, face, and eyes
feet and hair
voice and neck

Explicação

Questão 39 de 113

1

Controlling access to information systems and associated networks is necessary for the preservation of their:

Selecione uma das seguintes:

Authenticity, confidentiality and availability
Confidentiality, integrity, and availability.
integrity and availability.
authenticity, confidentiality, integrity and availability.

Explicação

Questão 40 de 113

1

To control access by a subject (an active entity such as individual or process) to an object (a passive entity such as a file) involves setting up:

Selecione uma das seguintes:

Access Rules
Access Matrix
Identification controls
Access terminal

Explicação

Questão 41 de 113

1

Rule-Based Access Control (RuBAC) access is determined by rules.
Such rules would fit within what category of access control?

Selecione uma das seguintes:

Discretionary Access Control (DAC)
Mandatory Access control (MAC)
Non-Discretionary Access Control (NDAC)
Lattice-based Access control

Explicação

Questão 42 de 113

1

The type of discretionary access control (DAC) that is based on an individual's identity is also called:

Selecione uma das seguintes:

Identity-based Access control
Rule-based Access control
Non-Discretionary Access Control
Lattice-based Access control

Explicação

Questão 43 de 113

1

Which access control type has a central authority that determine to what objects the subjects have access to and it is based on role or on the organizational security policy?

Selecione uma das seguintes:

Mandatory Access Control
Discretionary Access Control
Non-Discretionary Access Control
Rule-based Access control

Explicação

Questão 44 de 113

1

Which of the following control pairings include: organizational policies and procedures, pre- employment background checks, strict hiring practices, employment agreements, employee termination procedures, vacation scheduling, labeling of sensitive materials, increased supervision, security awareness training, behavior awareness, and sign-up procedures to obtain access to information systems and networks?

Selecione uma das seguintes:

Preventive/Administrative Pairing
Preventive/Technical Pairing
Preventive/Physical Pairing
Detective/Administrative Pairing

Explicação

Questão 45 de 113

1

Technical controls such as encryption and access control can be built into the operating system, be software applications, or can be supplemental hardware/software units.
Such controls, also known as logical controls, represent which pairing?

Selecione uma das seguintes:

Preventive/Administrative Pairing
Preventive/Technical Pairing
Preventive/Physical Pairing
Detective/Technical Pairing

Explicação

Questão 46 de 113

1

What is called the use of technologies such as fingerprint, retina, and iris scans to authenticate the individuals requesting access to resources?

Selecione uma das seguintes:

Micrometrics
Macrometrics
Biometrics
MicroBiometrics

Explicação

Questão 47 de 113

1

What is called the access protection system that limits connections by calling back the number of a previously authorized location?

Selecione uma das seguintes:

Sendback systems
Callback forward systems
Callback systems
Sendback forward systems

Explicação

Questão 48 de 113

1

What are called user interfaces that limit the functions that can be selected by a user?

Selecione uma das seguintes:

Constrained user interfaces
Limited user interfaces
Mini user interfaces
Unlimited user interfaces

Explicação

Questão 49 de 113

1

Controls such as job rotation, the sharing of responsibilities, and reviews of audit records are associated with:

Selecione uma das seguintes:

Preventive/physical
Detective/technical
Detective/physical
Detective/administrative

Explicação

Questão 50 de 113

1

The control measures that are intended to reveal the violations of security policy using software and hardware are associated with:

Selecione uma das seguintes:

Preventive/physical
Detective/technical
Detective/physical
Detective/administrative

Explicação

Questão 51 de 113

1

The controls that usually require a human to evaluate the input from sensors or cameras to determine if a real threat exists are associated with:

Selecione uma das seguintes:

Preventive/physical
Detective/technical
Detective/physical
Detective/administrative

Explicação

Questão 52 de 113

1

External consistency ensures that the data stored in the database is:

Selecione uma das seguintes:

in-consistent with the real world.
remains consistant when sent from one system to another.
consistent with the logical world.
consistent with the real world.

Explicação

Questão 53 de 113

1

A central authority determines what subjects can have access to certain objects based on the organizational security policy is called:

Selecione uma das seguintes:

Mandatory Access Control
Discretionary Access Control
Non-Discretionary Access Control
Rule-based Access control

Explicação

Questão 54 de 113

1

What is called the act of a user professing an identity to a system, usually in the form of a log-on ID?

Selecione uma das seguintes:

Authentication
Identification
Authorization
Confidentiality

Explicação

Questão 55 de 113

1

Which one of the following factors is not one on which Authentication is based?

Selecione uma das seguintes:

Type 1 Something you know, such as a PIN or password
Type 2 Something you have, such as an ATM card or smart card
Type 3 Something you are (based upon one or more intrinsic physical or behavioral traits), such as a fingerprint or retina scan
Type 4 Something you are, such as a system administrator or security administrator

Explicação

Questão 56 de 113

1

A central authority determines what subjects can have access to certain objects based on the organizational security policy is called:

Selecione uma das seguintes:

Mandatory Access Control
Discretionary Access Control
Non-Discretionary Access Control
Rule-based Access control

Explicação

Questão 57 de 113

1

What is called the act of a user professing an identity to a system, usually in the form of a log-on ID?

Selecione uma das seguintes:

Authentication
Identification
Authorization
Confidentiality

Explicação

Questão 58 de 113

1

What is called the verification that the user's claimed identity is valid and is usually implemented through a user password at log-on time?

Selecione uma das seguintes:

Authentication
Identification
Integrity
Confidentiality

Explicação

Questão 59 de 113

1

Which one of the following factors is not one on which Authentication is based?

Selecione uma das seguintes:

Type 1 Something you know, such as a PIN or password
Type 2 Something you have, such as an ATM card or smart card
Type 3 Something you are (based upon one or more intrinsic physical or behavioral traits), such as a fingerprint or retina scan
Type 4 Something you are, such as a system administrator or security administrator

Explicação

Questão 60 de 113

1

The act of requiring two of the three factors to be used in the authentication process refers to:

Selecione uma das seguintes:

Two-Factor Authentication
One-Factor Authentication
Bi-Factor Authentication
Double Authentication

Explicação

Questão 61 de 113

1

Which type of password provides maximum security because a new password is required for each new log-on?

Selecione uma das seguintes:

One-time or dynamic password
Congnitive password
Static password
Passphrase

Explicação

Questão 62 de 113

1

What is called a password that is the same for each log-on session?

Selecione uma das seguintes:

"one-time password"
"two-time password"
static password
dynamic password

Explicação

Questão 63 de 113

1

What is called a sequence of characters that is usually longer than the allotted number for a password?

Selecione uma das seguintes:

passphrase
cognitive phrase
anticipated phrase
Real phrase

Explicação

Questão 64 de 113

1

Which best describes a tool (i.e. keyfob, calculator, memory card or smart card) used to supply dynamic passwords?

Selecione uma das seguintes:

Tickets
Tokens
Token passing networks
Coupons

Explicação

Questão 65 de 113

1

Which of the following would be true about Static password tokens?

Selecione uma das seguintes:

The owner identity is authenticated by the token
The owner will never be authenticated by the token.
The owner will authenticate himself to the system
The token does not authenticates the token owner but the system

Explicação

Questão 66 de 113

1

In Synchronous dynamic password tokens:

Selecione uma das seguintes:

The token generates a new password value at fixed time intervals (this password could be based on the time of day encrypted with a secret key).
The token generates a new non-unique password value at fixed time intervals (this password could be based on the time of day encrypted with a secret key).
The unique password is not entered into a system or workstation along with an owner's PIN.
The authentication entity in a system or workstation knows an owner's secret key and PIN, and the entity verifies that the entered password is invalid and that it was entered during the invalid time window

Explicação

Questão 67 de 113

1

In biometrics, "one-to-many" search against database of stored biometric images is done in:

Selecione uma das seguintes:

Authentication
Identification
Identities
Identity-based access control

Explicação

Questão 68 de 113

1

Which of the following is true of biometrics?

Selecione uma das seguintes:

It is used for identification in physical controls and it is not used in logical controls
It is used for authentication in physical controls and for identification in logical controls
It is used for identification in physical controls and for authentication in logical controls.
Biometrics has not role in logical controls.

Explicação

Questão 69 de 113

1

What is called the percentage of valid subjects that are falsely rejected by a Biometric Authentication system?

Selecione uma das seguintes:

False Rejection Rate (FRR) or Type I Error
False Acceptance Rate (FAR) or Type II Error
Crossover Error Rate (CER)
True Rejection Rate (TRR) or Type III Error

Explicação

Questão 70 de 113

1

What is called the percentage of invalid subjects that are falsely accepted by a Biometric authentication system?

Selecione uma das seguintes:

False Rejection Rate (FRR) or Type I Error
False Acceptance Rate (FAR) or Type II Error
Crossover Error Rate (CER)
True Acceptance Rate (TAR) or Type III Error

Explicação

Questão 71 de 113

1

What is called the percentage at which the False Rejection Rate equals the False Acceptance Rate?

Selecione uma das seguintes:

False Rejection Rate (FRR) or Type I Error
False Acceptance Rate (FAR) or Type II Error
Crossover Error Rate (CER)
Failure to enroll rate (FTE or FER)

Explicação

Questão 72 de 113

1

Considerations of privacy, invasiveness, and psychological and physical comfort when using the system are important elements for which of the following?

Selecione uma das seguintes:

Accountability of biometrics systems
Acceptability of biometrics systems
Availability of biometrics systems
Adaptability of biometrics systems

Explicação

Questão 73 de 113

1

Which of the following offers advantages such as the ability to use stronger passwords, easier password administration, one set of credential, and faster resource access?

Selecione uma das seguintes:

Smart cards
Single Sign-On (SSO)
Symmetric Ciphers
Public Key Infrastructure (PKI)

Explicação

Questão 74 de 113

1

Which of the following describes the major disadvantage of many Single Sign-On (SSO) implementations?

Selecione uma das seguintes:

Once an individual obtains access to the system through the initial log-on, they have access to all resources within the environment that the account has access to.
The initial logon process is cumbersome to discourage potential intruders.
Once a user obtains access to the system through the initial log-on, they only need to logon to some applications.
Once a user obtains access to the system through the initial log-on, he has to logout from all other systems

Explicação

Questão 75 de 113

1

Which of the following is implemented through scripts or smart agents that replays the users multiple log-ins against authentication servers to verify a user's identity which permit access to system services?

Selecione uma das seguintes:

Single Sign-On
Dynamic Sign-On
Smart cards
Kerberos

Explicação

Questão 76 de 113

1

Which of the following is not true of the Kerberos protocol?

Selecione uma das seguintes:

Only a single login is required per session.
The initial authentication steps are done using public key algorithm
The KDC is aware of all systems in the network and is trusted by all of them
It performs mutual authentication

Explicação

Questão 77 de 113

1

The authenticator within Kerberos provides a requested service to the client after validating which of the following?

Selecione uma das seguintes:

timestamp
client public key
client private key
server public key

Explicação

Questão 78 de 113

1

Which of the following is addressed by Kerberos?

Selecione uma das seguintes:

Confidentiality and Integrity
Authentication and Availability
Validation and Integrity
Auditability and Integrity

Explicação

Questão 79 de 113

1

Kerberos is vulnerable to replay in which of the following circumstances?

Selecione uma das seguintes:

When a private key is compromised within an allotted time window
When a public key is compromised within an allotted time window.
When a ticket is compromised within an allotted time window.
When the KSD is compromised within an allotted time window.

Explicação

Questão 80 de 113

1

Like the Kerberos protocol, SESAME is also subject to which of the following?

Selecione uma das seguintes:

timeslot replay
password guessing
symmetric key guessing
asymmetric key guessing

Explicação

Questão 81 de 113

1

RADIUS incorporates which of the following services?

Selecione uma das seguintes:

Authentication server and PIN codes.
Authentication of clients and static passwords generation.
Authentication of clients and dynamic passwords generation.
Authentication server as well as support for Static and Dynamic passwords.

Explicação

Questão 82 de 113

1

Which of the following protects a password from eavesdroppers and supports the encryption of communication?

Selecione uma das seguintes:

Challenge Handshake Authentication Protocol (CHAP)
Challenge Handshake Identification Protocol (CHIP)
Challenge Handshake Encryption Protocol (CHEP)
Challenge Handshake Substitution Protocol (CHSP)

Explicação

Questão 83 de 113

1

Which of the following represents the columns of the table in a relational database?

Selecione uma das seguintes:

attributes
relation
record retention
records or tuples

Explicação

Questão 84 de 113

1

A database view is the results of which of the following operations?

Selecione uma das seguintes:

Join and Select.
Join, Insert, and Project
Join, Project, and Create.
Join, Project, and Select.

Explicação

Questão 85 de 113

1

Which of the following is used to create and modify the structure of your tables and other objects in the database?

Selecione uma das seguintes:

SQL Data Definition Language (DDL)
SQL Data Manipulation Language (DML)
SQL Data Relational Language (DRL)
SQL Data Identification Language (DIL)

Explicação

Questão 86 de 113

1

Which of the following is used to monitor network traffic or to monitor host audit logs in real time to determine violations of system security policy that have taken place?

Selecione uma das seguintes:

Intrusion Detection System
Compliance Validation System
Intrusion Management System (IMS)
Compliance Monitoring System

Explicação

Questão 87 de 113

1

Which of the following monitors network traffic in real time?

Selecione uma das seguintes:

network-based IDS
host-based IDS
application-based IDS
firewall-based IDS

Explicação

Questão 88 de 113

1

A host-based IDS is resident on which of the following?

Selecione uma das seguintes:

On each of the critical hosts
decentralized hosts
central hosts
bastion hosts

Explicação

Questão 89 de 113

1

Which of the following usually provides reliable, real-time information without consuming network or host resources?

Selecione uma das seguintes:

network-based IDS
host-based IDS
application-based IDS
firewall-based IDS

Explicação

Questão 90 de 113

1

The fact that a network-based IDS reviews packets payload and headers enable which of the following?

Selecione uma das seguintes:

Detection of denial of service
Detection of all viruses
Detection of data corruption
Detection of all password guessing attacks

Explicação

Questão 91 de 113

1

Which of the following reviews system and event logs to detect attacks on the host and determine if the attack was successful?

Selecione uma das seguintes:

host-based IDS
firewall-based IDS
bastion-based IDS
server-based IDS

Explicação

Questão 92 de 113

1

What would be considered the biggest drawback of Host-based Intrusion Detection systems
(HIDS)?

Selecione uma das seguintes:

It can be very invasive to the host operating system
Monitors all processes and activities on the host system only
Virtually eliminates limits associated with encryption
They have an increased level of visibility and control compared to NIDS

Explicação

Questão 93 de 113

1

Attributes that characterize an attack are stored for reference using which of the following
Intrusion Detection System (IDS)?

Selecione uma das seguintes:

signature-based IDS
statistical anomaly-based IDS
event-based IDS
inferent-based IDS

Explicação

Questão 94 de 113

1

Which of the following is an issue with signature-based intrusion detection systems?

Selecione uma das seguintes:

Only previously identified attack signatures are detected.
Signature databases must be augmented with inferential elements.
It runs only on the windows operating system
Hackers can circumvent signature evaluations.

Explicação

Questão 95 de 113

1

Which of the following is an IDS that acquires data and defines a "normal" usage profile for the network or host?

Selecione uma das seguintes:

Statistical Anomaly-Based ID
Signature-Based ID
dynamical anomaly-based ID
inferential anomaly-based ID

Explicação

Questão 96 de 113

1

Which of the following is most relevant to determining the maximum effective cost of access control?

Selecione uma das seguintes:

the value of information that is protected
management's perceptions regarding data importance
budget planning related to base versus incremental spending
the cost to replace lost data

Explicação

Questão 97 de 113

1

Which of the following is not a factor related to Access Control?

Selecione uma das seguintes:

integrity
authenticity
confidentiality
availability

Explicação

Questão 98 de 113

1

Which of the following is most appropriate to notify an external user that session monitoring is being conducted?

Selecione uma das seguintes:

Logon Banners
Wall poster
Employee Handbook
Written agreement

Explicação

Questão 99 de 113

1

Which of the following pairings uses technology to enforce access control policies?

Selecione uma das seguintes:

Preventive/Administrative
Preventive/Technical
Preventive/Physical
Detective/Administrative

Explicação

Questão 100 de 113

1

In the course of responding to and handling an incident, you work on determining the root cause of the incident. In which step are you in?

Selecione uma das seguintes:

Recovery
Containment
Triage
Analysis and tracking

Explicação

Questão 101 de 113

1

Access control is the collection of mechanisms that permits managers of a system to exercise a directing or restraining influence over the behavior, use, and content of a system.
It does not permit management to:

Selecione uma das seguintes:

specify what users can do
specify which resources they can access
specify how to restrain hackers
specify what operations they can perform on a system

Explicação

Questão 102 de 113

1

Access Control techniques do not include which of the following choices?

Selecione uma das seguintes:

Relevant Access Controls
Discretionary Access Control
Mandatory Access Control
Lattice Based Access Control

Explicação

Questão 103 de 113

1

Which of the following statements relating to the Bell-LaPadula security model is false (assuming the Strong Star property is not being used)?

Selecione uma das seguintes:

A subject is not allowed to read up
The *- property restriction can be escaped by temporarily downgrading a high level subject.
A subject is not allowed to read down
It is restricted to confidentiality

Explicação

Questão 104 de 113

1

When a biometric system is used, which error type deals with the possibility of granting access to impostors who should be rejected?

Selecione uma das seguintes:

Type I error
Type II error
Type III error
Crossover error

Explicação

Questão 105 de 113

1

Which of the following is the FIRST step in protecting data's confidentiality?

Selecione uma das seguintes:

Install a firewall
Implement encryption
Identify which information is sensitive
Review all user access rights

Explicação

Questão 106 de 113

1

Which of the following best ensures accountability of users for the actions taken within a system or domain?

Selecione uma das seguintes:

Identification
Authentication
Authorization
Credentials

Explicação

Questão 107 de 113

1

Which of the following statements pertaining to biometrics is false?

Selecione uma das seguintes:

User can be authenticated based on behavior.
User can be authenticated based on unique physical attributes.
User can be authenticated by what he knows.
A biometric system's accuracy is determined by its crossover error rate (CER).

Explicação

Questão 108 de 113

1

Which of the following biometric devices offers the LOWEST CER?

Selecione uma das seguintes:

Keystroke dynamics
Voice verification
Iris scan
Fingerprint

Explicação

Questão 109 de 113

1

Which of the following is the weakest authentication mechanism?

Selecione uma das seguintes:

Passphrases
Passwords
One-time passwords
Token devices

Explicação

Questão 110 de 113

1

Which of the following statements pertaining to access control is false?

Selecione uma das seguintes:

Users should only access data on a need-to-know basis.
If access is not explicitly denied, it should be implicitly allowed.
Access rights should be granted based on the level of trust a company has on a subject.
Roles can be an efficient way to assign rights to a type of user who performs certain tasks.

Explicação

Questão 111 de 113

1

Which of the following is not part of the Kerberos authentication protocol?

Selecione uma das seguintes:

Symmetric key cryptography
Authentication service (AS)
Principals
Public Key

Explicação

Questão 112 de 113

1

	Criado por Alexandre Pinheiro quase 8 anos atrás

Exam Practice Questions

Final Exam 2015+

Questão 1 de 113

Which of the following can be defined as the process of rerunning a portion of the test scenario or test plan to ensure that changes or corrections have not introduced new errors?

Selecione uma das seguintes:

Explicação

Questão 2 de 113

At which layer of the OSI model do sniffers operate?

Selecione uma das seguintes:

Explicação

Questão 3 de 113

When two or more separate entities (usually persons) operating in concert to protect sensitive functions or information must combine their knowledge to gain access to an asset, this is known as?

Selecione uma das seguintes:

Explicação

Questão 4 de 113

What is the name for a substitution cipher that shifts the alphabet by 13 places?

Selecione uma das seguintes:

Explicação

Questão 5 de 113

Your organization creates software applications that are sold to the public. Recently, management has become concerned about software piracy. Which organization deals with the prevention of this crime?

Selecione uma das seguintes:

Explicação

Questão 6 de 113

A potential problem related to the physical installation of the Iris Scanner in regards to the usage of the iris pattern within a biometric system is:

Selecione uma das seguintes:

Explicação

Questão 7 de 113

In Mandatory Access Control, sensitivity labels attached to object contain what information?

Selecione uma das seguintes:

Explicação

Questão 8 de 113

Which of the following is true about Kerberos?

Selecione uma das seguintes:

Explicação

Questão 9 de 113

Which of the following is needed for System Accountability?

Selecione uma das seguintes:

Explicação

Questão 10 de 113

What is Kerberos?

Selecione uma das seguintes:

Explicação

Questão 11 de 113

Kerberos depends upon what encryption method?

Selecione uma das seguintes:

Explicação

Questão 12 de 113

A confidential number used as an authentication factor to verify a user's identity is called a:

Selecione uma das seguintes:

Explicação

Questão 13 de 113

Individual accountability does not include which of the following?

Selecione uma das seguintes:

Explicação

Questão 14 de 113

Which of the following exemplifies proper separation of duties?

Selecione uma das seguintes:

Explicação

Questão 15 de 113

An access control policy for a bank teller is an example of the implementation of which of the following?

Selecione uma das seguintes:

Explicação

Questão 16 de 113

Which one of the following authentication mechanisms creates a problem for mobile users?

Selecione uma das seguintes:

Explicação

Questão 17 de 113

Organizations should consider which of the following first before allowing external access to their LANs via the Internet?

Selecione uma das seguintes:

Explicação

Questão 18 de 113

Kerberos can prevent which one of the following attacks?

Selecione uma das seguintes:

Explicação

Questão 19 de 113

In discretionary access environments, which of the following entities is authorized to grant information access to other people?

Selecione uma das seguintes:

Explicação

Questão 20 de 113

What is the main concern with single sign-on?

There are parallels between the trust models in Kerberos and Public Key Infrastructure (PKI).
When we compare them side by side, Kerberos tickets correspond most closely to which of the following?

In biometric identification systems, at the beginning, it was soon apparent that truly positive identification could only be based on physical attributes of a person.

This raised the necessity of answering 2 questions: