Quiz
CIT 370 Unit 1
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (153)
1Which of the following is NOT a characteristic of Advanced Persistent Threat (APT)?
- Acan span several years
- Btargets sensitive proprietary information
- Cis only used by hactivists against foreign enemies
- Duses advanced tools and techniques
2Which of these is NOT a basic security protection for information that cryptography can provide?
- Aintegrity
- Bconfidentiality
- Crisk loss
- Dauthenticity
3An entity that issues digital certificates is a _____.
- ACertificate Signatory (CS)
- BDigital Signer (DS)
- CCertificate Authority (CA)
- DSignature Authority (SA)
4A UPS can perform each of the following EXCEPT _____.
- Aprevent any new users from logging on
- Bdisconnect users and shut down the server
- Cnotify all users that they must finish their work immediately and log off
- Dprevent certain applications from launching that will consume too much power
5Internet Control Message Protocol (ICMP) is used by each of these attacks EXCEPT _____.
- Aping of death
- BICMP redirect attack
- Csmurf DoS attack
- DICMP poisoning
6Why is a rogue AP a security vulnerability?
- AIt allows an attacker to bypass many of the network security configurations.
- BIt requires the use of vulnerable wireless probes on all mobile devices.
- CIt uses the weaker IEEE 802.15.ax protocol.
- DIt conflicts with other network firewalls and can cause them to become disabled.
7_____ is defined as the obligations that are imposed on owners and operators of assets to exercise reasonable care of the assets and take necessary precautions to protect them.
- ADue diligence
- BDue care
- CDue obligations
- DDue process
8Which statement regarding vulnerability appraisal is NOT true?
- AEach vulnerability should be cataloged.
- BEvery asset must be viewed in light of each threat.
- CEach threat could reveal multiple vulnerabilities.
- DVulnerability appraisal is always the easiest and quickest step.
9Tablet computers are designed for _____.
- Aprocessing capabilities
- Bhardware upgrades
- Cwireless connection speed
- Dease of use
10How does a virtual LAN (VLAN) allow devices to be grouped?
- Abased on subnets
- Bonly around core switches
- Cdirectly to hubs
- Dlogically
11What should you do to completely remove a rootkit from a computer?
- AErase and reinstall all files in the WINDOWS folder.
- BExpand the Master Boot Record.
- CReformat the hard drive and reinstall the operating system.
- DFlash the ROM BIOS.
12A RADIUS authentication server requires that the _____ be authenticated first.
- Asupplicant
- Bauthenticator
- Cauthentication server
- Duser
13The residential lock most often used for keeping out intruders is the _____.
- Akeyed entry lock
- Bpassage lock
- Cprivacy lock
- Dencrypted key lock
14A TOTP token code is valid _____.
- Afor up to 24 hours
- Buntil an event occurs
- Conly while the user presses SEND
- Dfor as long as it appears on the device
15An attacker who manipulates the maximum size of an integer type would be performing what kind of attack?
- Abuffer overflow
- Bheap size
- Creal number
- Dinteger overflow
16_____ ensures that only authorized parties can view the information.
- AConfidentiality
- BAvailability
- CAuthorization
- DIntegrity
17What is a very simple way to limit your attack surface?
- APerform operations through the command prompt.
- BDisconnect a device from the internet
- CInstall Flash Player
- DSet all of your services to automatically start up
18A user's supervisor directed him to update a file. When the user opened the file on a shared drive he was denied access to the file. The user was denied access because of which security protection?
- AAuthentication
- BConfidentiality
- CAccounting
- DAuthorization
19Which phrase describes the term “security” in a general sense?
- Aprotection from only direct actions
- Busing reverse attack vectors (RAV) for protection
- Conly available on hardened computers and systems
- Dthe necessary steps to protect a person or property from harm
20Which of the following was used to describe attackers who would break into a computer system without the owner’s permission and publicly disclose the vulnerability?
- Awhite hat hackers
- Bblack hat hackers
- Cblue hat hackers
- Dgray hat hackers
21An organization wants to upgrade their phone system and determines that the best solution would be to purchase a hosted VOIP phone system. This is an example of which practice?
- ARisk Transference
- BRisk Deterrence
- CRisk Mitigation
- DRisk Avoidance
22What tool would most likely be used by a script kiddie?
- Asuper computer
- Bexploit kit
- Cthreat agent
- Dpacket analyzer
23Traditionally, why would a white hat hacker penetrate a network security flaw?
- ATo instil fear in the organization
- BTo gain educational knowledge of the system's weaknesses
- CTo support their political agenda
- DTo obtain information for malicious exploitation
24The ________ is primarily responsible for assessing, managing, and implementing security.
- Asecurity administrator
- Bsecurity manager
- Csecurity technician
- Dchief information security officer (CISO)
25Each of the following is a goal of information security EXCEPT .
- Aavoid legal consequences
- Bfoil cyberterrorism
- Cprevent data theft
- Dlimit access control
26How can an attacker use a hoax?
- ABy sending out a hoax, an attacker can convince a user to read his email more often.
- BA hoax could convince a user that a bad Trojan is circulating and that he should change his security settings.
- CA user who receives multiple hoaxes could contact his supervisor for help.
- DHoaxes are not used by attackers today.
27A SYN flood attack targets a vulnerability of which of the following?
- AThe ICMP protocol
- BA SYN+ACK packet from the server
- CTCP/IP stack
- DThree-way handshake
28What type of attack intercepts legitimate communication and forges a fictitious response to the sender?
- ASIDS
- Binterceptor
- Cman-in-the-middle
- DSQL intrusion
29What is a session token?
- AXML code used in an XML injection attack
- Ba random string assigned by a web server
- Canother name for a third-party cookie
- Da unique identifier that includes the user’s email address
30Which of these is not an HTTP header attack?
- AAccept-Language
- BReferer
- CResponse splitting
- DContent-length
31Why do zero-day attacks remain a serious threat to organizations?
- AFirewalls cannot filter them
- BThey are untraceable
- CUpdated anti-virus software can't detect them by comparing virus signatures
- DThey utilize HTTPS vulnerabilities
32Which of these could NOT be defined as a logic bomb?
- AErase all data if John Smith’s name is removed from the list of employees.
- BReformat the hard drive three months after Susan Jones left the company.
- CSend spam email to all users in the company on Tuesday.
- DIf the company’s stock price drops below $10, then credit Jeff Brown with 10 additional years of retirement credit.
33A user who installs a program that prints out coupons but in the background silently collects her passwords has installed a _____.
- Avirus
- Bworm
- CTrojan
- Dlogic bomb
34Which type of malicious traffic is very hard to filter since it uses graphics to bypass text filters?
- ASpim
- BSpear phishing
- CImage Spam
- DSpam
35What would be considered best practice in regards to malware circulation prevention?
- AOnly open attachments if they aren't executables
- BTurn off Wi-Fi of infected laptop
- CScan your PC for viruses several times a day
- DScan USB devices with anti-virus if you suspect infection
36What would be considered an example of pharming?
- AThe CEO of the company has been sent multiple urgent emails requesting information
- BYour host file on your PC has been modified
- CA user is sent an attachment in an email from an unknown sender
- DA user receives a phone call informing them of unusual charges on their credit card
37Which of these items retrieved through dumpster diving would NOT provide useful information?
- Acalendars
- Bmemos
- Corganizational charts
- Dbooks
38Which of these is NOT a reason why securing server-side web applications is difficult?
- AAlthough traditional network security devices can block traditional network attacks, they cannot always block web application attacks.
- BThe processors on clients are smaller than on web servers and thus they are easier to defend.
- CMany web application attacks exploit previously unknown vulnerabilities.
- DBy design dynamic server-side web applications accept user input that can contain malicious code.
39A watering hole attack is directed against _____.
- Awealthy individuals
- Battackers who send spam
- Call users of a large corporation
- Dusers who access a common website
40A student is able to modify their grades without detection. This could be accomplished through what means?
- ASpyware
- BRansomware
- CTracking software
- DA keylogger
41How would an attacker lock a user's PC by encrypting the entire hard drive and all attached storage devices?
- AWith a rootkit
- BBy using ransomware
- CWith a worm
- DBy using Windows encrypted file system
42Java, Adobe Flash, and Adobe Acrobat Reader are all examples of what?
- APlug-ins
- BActive X applications
- CExtensions
- DAdd-ons
43A DoS attack can use which protocol to conduct an attack?
- AARP
- BTCP
- CICMP
- DDHCP
44If an attacker modifies a referrer field to portray that request came from a legitimate site this is known as what?
- ABuffer overflow attack
- BSession hijacking
- CInteger overflow attack
- DHeader manipulation
45A lock that extends a solid metal bar into the door frame for extra security is the _____.
- Atriple bar lock
- Bdeadman’s lock
- Cfull bar lock
- Ddeadbolt lock
46Which of the following is NOT an advantage to utilizing wrapper functions?
- AThey write error-checking methods
- BThey secure static environments
- CThey provide error-correction of the existing code
- DThey allow programmers to concentrate on the essential purpose of the code module
47Why would an administrator use the hardening technique of kernel pruning?
- AIt is harder for an attacker to physically tamper with the hardware
- BA default system kernel doesn't have security features built in
- CIt removes the ability of the attacker to change the operating system files
- DBy removing services that aren't needed, you can limit the attack surface of a system
48Which of the following correctly describes the importance of eliminating marks that classify a master key?
- AIt is imperative to follow ideal key management procedures
- BThe attacker will not be able to duplicate the key
- CIt allows for easier tracking of keys within an organization
- DAn attacker will know which type of door locks the key opens
49Which of the following is NOT an activity phase control?
- Acompensating control
- Bdetective control
- Cresource control
- Ddeterrent control
50A typical configuration baseline would include each of the following EXCEPT _____.
- Achanging any default settings that are insecure
- Beliminating any unnecessary software
- Cenabling operating system security features
- Dperforming a security risk assessment
51Seismic sensors are used for which of the following?
- ADeterrent controls
- BBarriers
- CPassive infrared light sensors
- DMotion detection
52Which of the following is NOT an advantage to an automated patch update service?
- AAdministrators can approve or decline updates for client systems, force updates to install by a specific date, and obtain reports on what updates each computer needs.
- BDownloading patches from a local server instead of using the vendor’s online update service can save bandwidth and time because each computer does not have to connect to an external server.
- CUsers can disable or circumvent updates just as they can if their computer is configured to use the vendor’s online update service.
- DSpecific types of updates that the organization does not test, such as hotfixes, can be automatically installed whenever they become available.
53_____ allows for a single configuration to be set and then deployed to many or all users.
- AActive Directory
- BGroup Policy
- CSnap-In Replication (SIR)
- DCommand Configuration
54How is a hotfix different from other operating system fixes?
- AA hotfix is an umbrella of security patches
- BA hotfix is considered preventative maintenance
- CA hotfix can relate to a specific customer
- DA hotfix fixes a feature as opposed to a security risk
55"Plaintext" is a term that is best described as what?
- AData in an unencrypted form
- BAn algorithm
- CText that has no formatting applied
- DData that has been encrypted
56How does SHA-1 differ from the MD4 algorithm?
- AMD4 can process 64 bits at a time
- BGenerally, SHA is considered a more secure hash than MD
- CMD4 creates a digest length of 128 bit whereas SHA-1's digest length is 160 bits
- DFlaws have not yet been discovered in the MD4 algorithm
57Why would a security administrator use perfect forward secrecy instead of other key exchange solutions?
- AIt utilizes elliptic curve cryptography which is less common
- BIt uses a temporary key that is only used once before being discarded
- CIf compromised it can only expose the content of a single message
- DIt generates random private keys that vary between sessions
58Which of these is NOT a basic security protection for information that cryptography can provide?
- Arisk loss
- Bintegrity
- Cconfidentiality
- Dauthenticity
59Which of the following key exchanges uses the same keys each time?
- ADiffie-Hellman Ephemeral (DHE)
- BDiffie-Hellman (DH)
- CDiffie-Hellman-RSA (DHRSA)
- DElliptic Curve Diffie-Hellman (ECDH)
60Elliptic Curve Diffie–Hellman (ECDH) is an example of _____.
- Ain-band key exchange
- Bout-of-band key exchange
- CSHA-1 key management
- DAES key certification
61Which of these has an onboard key generator and key storage facility, as well as accelerated symmetric and asymmetric encryption, and can back up sensitive material in encrypted form?
- ATrusted Platform Module (TPM)
- Bself-encrypting hard disk drives (HDDs)
- Cencrypted hardware-based USB devices
- DHardware Security Module (HSM)
62Public key systems that generate random public keys that are different for each session are called _____.
- APublic Key Exchange (PKE)
- BElliptic Curve Diffie-Hellman (ECDH)
- CDiffie-Hellman (DH)
- Dperfect forward secrecy
63What type of system is blowfish designed to run efficiently on?
- ALinux systems
- BDevices with full disk encryption
- C32-bit systems
- DSmaller devices and appliances
64What is the disadvantage of RSA compared to most symmetrical algorithms?
- AThere is no disadvantage of asymmetrical algorithms
- BRSA is slower in software but not in hardware
- CRSA is complicated and slower than other algorithms
- DRSA doesn't provide nonrepudiation like symmetrical algorithms
65All of the following can be broken mathematically EXCEPT _____.
- AAES
- B3DES
- CSHA
- DOTP
66What is data called that is to be encrypted by inputting it into an cryptographic algorithm?
- Aplaintext
- Bcleartext
- Copentext
- Dciphertext
67Which of the following would disallow virus circulation?
- AOligomorphic malware
- BUse of an .MSC file
- CUse of a screen saver file
- DAttempts from a virus to spread to a Macintosh computer from a Windows PC
68Which statement about data loss prevention (DLP) is NOT true?
- AIt can only protect data while it is on the user’s personal computer.
- BIt can scan data on a DVD.
- CIt can read inside compressed files.
- DA policy violation can generate a report or block the data.
69Browser plug-ins _____.
- Aonly function on web servers
- Bcan be embedded inside a webpage but add-ons cannot
- Chave additional functionality to the entire browser
- Dhave been replaced by browser extensions
70How does vishing differ from phishing?
- AVishing involves impersonating through spam
- BVishing requires its own website to effect users
- CVishing involves manipulating a user through a phone call
- DVishing is associated with targeting senior executives within an organization
71Why would a database administrator use NoSQL over a SQL relational database?
- ANoSQL does not have security vulnerabilities
- BNoSQL does not need to be patched
- CNoSQL uses client-side validation
- DNoSQL is simpler by design and has a smaller attack surface
72Why is a zone transfer DNS poisoning generally more worthwhile for an attacker than altering a host table?
- AA zone transfer will affect many DNS servers as opposed to just a single host
- BHost tables are no longer used by clients
- CHost tables are only used on the local subnet and not on the internet
- DA zone transfer can tamper with information related to DHCP as well as DNS
73Which action cannot be performed through a successful SQL injection attack?
- Areformat the web application server’s hard drive
- Bdisplay a list of customer telephone numbers
- Cdiscover the names of different fields in a table
- Derase a database table
74A security manager's duty should involve which of the following?
- AFinding solutions for problems diagnosed by a technician
- BProviding technical support for problematic software and hardware
- CPinpointing user's needs and discovering solutions for issues
- DSurveying existing security systems and their infrastructure
75Which is the first step in securing an operating system?
- ADevelop the security policy.
- BImplement patch management.
- CConfigure operating system security and settings.
- DPerform host software baselining.
76Which of the following is an attempt to influence a user by coercion?
- Aauthority
- Bsocial proof
- Cintimidation
- Dfamiliarity
77If a website accepts user input and doesn't validate the input, this website may be susceptible to which of the following?
- ACross-Site scripting
- BDNS poisoning
- CCommand injection
- DDirectory traversal
78Which type of attack can compromise a system just by a user viewing a web page?
- AA zero-pixel IFrame
- BMan-in-the-middle attack
- CHTTP header manipulation
- DInteger overflow attack
79Which of the following is NOT a reason why it is difficult to defend against today's attackers?
- Aincreased speed of attacks
- Bsimplicity of attack tools
- Cgreater sophistication of defense tools
- Ddelays in security updating
80Why can brokers command such a high price for what they sell?
- ABrokers are licensed professionals
- BThe attack targets are always wealthy corporations
- CThe vulnerability was previously unknown and is unlikely to be patched quickly
- DBrokers work in teams and all the members must be compensated
81Each of the following is a successive layer in which information security is achieved EXCEPT _________.
- Aproducts
- Bpurposes
- Cprocedures
- Dpeople
82What is a person or element that has the power to carry out a threat?
- Athreat agent
- Bexploiter
- Crisk agent
- Dvulnerability
83________ ensures that individuals are who they claim to be.
- ADemonstration
- BAccounting
- CAuthentication
- DCertification
84What is the difference between a hactivist and a cyberterrorist?
- AA hactivist is motivated by ideology while a cyberterrorist is not.
- BCyberterrorists always work in groups while hactivists work alone.
- CThe aim of a hactivist is not to incite panic like cyberterrorists.
- DCyberterrorists are better funded than hactivists.
85Fuzzing inputs random data into a program to accomplish which of the following?
- AOutput encoding
- BTrap errors in the application code
- CCross-site request forgery
- DInput validation
86How is a hash algorithm limited in functionality?
- AData of different character quantities can't produce a fixed hash length
- BIt can only be applied to a stream cipher
- CIt can only provide confidentiality
- DIt cannot be decrypted
87Proving that a user sent an email message is known as _____.
- Arepudiation
- Bintegrity
- Cnon-repudiation
- Davailability
88Which of the following is NOT a characteristic of an alarmed carrier PDS?
- Aperiodic visual inspections
- Bcontinuous monitoring
- Ccarrier can be hidden below a floor
- Deliminates the need to seal connections
89Why is a homoalphabetic substitution considered a stream cipher?
- AIt has the ability to make use of block cipher or stream cipher
- BIt encrypts multiple plaintext character into a single hexadecimal character
- CIt substitutes multiple characters at once, but the character length is not fixed
- DIt encrypts one plaintext character at a time
90What is an advantage to an alarmed carrier PDS over a hardened carrier PDS?
- AAn alarm carrier PDS utilizes deterrent controls
- BAn alarmed carrier PDS requires that you permanently seal all segments with special sealants
- CAn alarmed carrier PDS can sense vibrations with optical fibers
- DA hardened carrier PDS allows easier access to the cabling
91What are attackers called who belong to a network of identity thieves and financial fraudsters?
- Acybercriminals
- Bscript kiddies
- Chackers
- Dbrokers
92Which statement regarding a keylogger is NOT true?
- AHardware keyloggers are installed between the keyboard connector and computer keyboard USB port.
- BSoftware keyloggers are easy to detect.
- CKeyloggers can be used to capture passwords, credit card numbers, or personal information.
- DSoftware keyloggers can be designed to send captured information automatically back to the attacker through the Internet.
93What is a benefit of having an automated patch update service instead of configuring clients to install updates independently?
- AAn automated patch update service can allow an administrator to test the patch within their environment before causing a network-wide problem
- BAutomated patch update service can apply the patch to all clients at the same exact time
- CThere is no benefit because this simply causes a delay in applying a security patch to fix a vulnerability
- DAn automated patch update service requires less administrative effort and maintenance
94The Hashed Message Authentication Code (HMAC) _____.
- Aencrypts only the key
- Bencrypts the key and the message
- Cencrypts only the message
- Dencrypts the DHE key only
95Which statement about a mantrap is true?
- AIt is illegal in the U.S.
- BIt monitors and controls two interlocking doors to a room.
- CIt is a special keyed lock.
- DIt requires the use of a cipher lock.
96Why is it important to know the exact URL of a website you are entering confidential information into?
- ATo evade TCP/IP hijacking
- BTo not be a victim of a hoax
- CTo avoid typo squatting
- DTo not be compromised by image spam
97An attacker who has obtained a confidential USB flash drive from an administrator's desk through social engineering has accomplished which of the following?
- AHas avoided risk deterrence to carry out data theft
- BUsed a threat agent to steal information
- CHas utilized risk avoidance to be undetected
- DExploited a vulnerability through a threat vector
98Why is vertical privilege escalation generally simpler than horizontal privilege escalation?
- AVertical privilege escalation uses access rights that are already in place
- BVertical privilege escalation only gives an attacker modify permission whereas horizontal privilege escalation gives full control
- CVertical privilege escalation only requires access to one account as opposed to more than one
- DHorizontal privilege escalation requires social engineering to execute
99Which of these is NOT an action that a virus can take?
- Atransport itself through the network to another device
- Bcause a computer to crash
- Cerase files from a hard drive
- Dreformat the hard disk drive
100DNS poisoning _____.
- Afloods a DNS server with requests until it can no longer respond
- Bis rarely found today due to the use of host tables
- Csubstitutes DNS addresses so that the computer is automatically redirected to another device
- Dis the same as ARP poisoning
101OTPs were originally used by whom?
- ASecurity guards
- BResistance groups and operation teams during World War II
- COperating system developers
- DVideo game developers
102Why do cyberterrorists target power plants, air traffic control centers, and water systems?
- AThese targets have notoriously weak security and are easy to penetrate.
- BThey can cause significant disruption by destroying only a few targets.
- CThese targets are government-regulated and any successful attack would be considered a major victory.
- DThe targets are privately owned and cannot afford high levels of security.
103Which of the following encryption algorithms has not been successfully attacked?
- AMD2
- B3DES
- CAES
- DSHA-0
104An organization that purchased security products from different vendors is demonstrating which security principle?
- Aobscurity
- Bdiversity
- Climiting
- Dlayering
105Why does RC4 consume more processing power than RC5?
- ARC4 performs 20 rounds on each block
- BRC5 processes blocks of 64 bit opposed to RC4 which processes blocks of 128 bit
- CRC4 can have a key length from 23 to 448 bits
- DRC4 is a stream cipher and RC5 is a block cipher
106Which of the following is NOT a motion detection method?
- Aradio frequency
- Bmoisture
- Cmagnetism
- Dinfrared
107How is diversity related to layering in network security?
- AIf you don't use diverse layers of defense one technique can compromise multiple layers
- BDiversity limits an attacker's ability of successfully attacking a system
- CDiversity can protect data without layering
- DLayers of security are diverse by nature
108A replay attack _____.
- Ais considered to be a type of DoS attack
- Bmakes a copy of the transmission for use at a later time
- Ccan be prevented by patching the web browser
- Dreplays the attack over and over to flood the server
109If Bob wants to send a secure message to Alice using an asymmetric cryptographic algorithm, which key does he use to encrypt the message?
- AAlice’s private key
- BAlice’s public key
- CBob’s public key
- DBob’s private key
110Which act requires enterprises to guard protected health information and implement policies and procedures to safeguard it?
- AHospital Protection and Insurance Association Agreement (HPIAA)
- BSarbanes-Oxley Act (Sarbox)
- CGramm-Leach-Bliley Act (GLBA)
- DHealth Insurance Portability and Accountability Act (HIPAA)
111What is the first step in the Cyber Kill Chain?
- Aweaponization
- Bexploitation
- Cactions on objectives
- Dreconnaissance
112Each of the following can be classified as an "insider" EXCEPT ________.
- Abusiness partners
- Bcontractors
- Cstockholders
- Demployees
113What is an objective of state-sponsored attackers?
- Ato right a perceived wrong
- Bto spy on citizens
- Cto sell vulnerabilities to the highest bidder
- Dfortune instead of fame
114An example of ________ is not revealing the type of computer, operating system, software, and network connection a computer uses.
- Alayering
- Bdiversity
- Cobscurity
- Dlimiting
115A(n) requires a user to transport it from one computer to another.
- Aworm
- Brootkit
- Cvirus
- Dadware
116Which malware locks up a user's computer and then displays a message that purports to come from a law enforcement agency?
- Avirus
- Bransomware
- Cworm
- DTrojan
117What is it called when a user makes a typing error when entering a URL that takes him to an imposter website?
- AURL variance
- Btypo squatting
- Cspell scraping
- Dwork hijacking
118Which os these is a general term used for describing software that gathers information without the user's consent?
- Aadware
- Bspyware
- Cscrapeware
- Dpullware
119The preferred method today of bot herders for command and control of zombies is ________.
- AInter Relay Chat (IRC)
- Bbotnets
- CHypertext Transport Protocol (HTTP)
- Dspam
120__________ sends phishing messages only to wealthy individuals.
- ASpeak phishing
- BTarget phishing
- CMicroing
- DWhaling
121What is unsolicited instant messaging called?
- Aspim
- Bspam
- Cvishing
- DSMS phishing
122Michelle pretends to be the help desk manager and calls Steve to trick him into giving her his password. What social engineering attack has Michelle performed?
- Aaliasing
- Bimpersonation
- Cluring
- Dduplicity
123___________ is following an authorized person through a secure door.
- ATagging
- BBackpacking
- CTailgating
- DCaboosing
124Each of these is a reason why adware is scorned EXCEPT _______________.
- Ait displays the attacker's programming skills
- Bit can interfere with a user's productivity
- Cit displays objectionable content
- Dit can cause a computer to crash or slow down
125What is the term used for an attacker who controls multiple zombies in a bonnet?
- Azombie shepherd
- Brogue IRC
- Cbot herder
- Dcyber-robot
126What is another name for a locally shared object?
- AFlash cookie
- Bsession cookie
- CRAM cookie
- Dsecure cookie
127What kind of attack is performed by an attacker who takes advantage of the inadvertent and unauthorized access built through three succeeding systems that all trust one another?
- Aprivilege rights
- Bheap spray
- Ctransitive
- Dvertical escalation
128Which statement is correct regarding why traditional network security devices cannot be used to block web application attacks?
- ATraditional network security devices ignore the content of HTTP traffic, which is the vehicle of web application attacks.
- BWeb application attacks use web browsers that cannot be controlled on a local computer.
- Cnetwork security devices cannot prevent attacks from web resources
- DThe complex nature of TCP/IP allows for too many ping sweeps to be blocked.
129What do attackers use buffer overflows to do?
- Aerase buffer overflow signature files
- Bcorrupt the kernel so the computer cannot reboot
- Cpoint to another area in data memory that contains the attacker's malware code
- Dplace a virus into the kernel
130What is unique about a cross-site scripting (XSS) attack compared to other injection attacks?
- ASQL code is used in an XSS attack
- BXSS requires the use of a browser
- CXSS does not attack the web application server to steal or corrupt its information
- DXSS attacks are rarely used anymore compared to other injection attacks
131What is a cookie that was not created by the website being viewed called?
- Afirst-party cookie
- Bsecond-party cookie
- Cthird-party cookie
- Dfourth-party cookie
132What is the basis of an SQL injection attack?
- Ato have the SQL server attack client web browsers
- Bto inject SQL statements through unfiltered user input
- Cto expose SQL code that it can be examined
- Dto link SQL servers into a botnet
133Which markup language is designed to carry data?
- AICMP
- BHTTP
- CHTML
- DXML
134Which type of attack involves an attacker accessing files in directories other than the root directory?
- ASQL injection
- Bcommand injection
- CXML injection
- Ddirectory traversal
135Which type of attack modifies the fields that contain the different characteristics of the data that is being transmitted?
- AXML Manipulation
- BHTML packet
- CSQL injection
- DHTTP header
136Which of these is NOT a DoS attack?
- ASYN flood
- Bping flood
- Csmurf
- Dpush flood
137What type of controls are the processes for developing and ensuring that policies and producers are carried out?
- Atechnical controls
- Bactive controls
- Cadministrative controls
- Dpolicy controls
138Which os the following is NOT designed to prevent individuals from entering sensitive areas but instead is intended to direct traffic flow?
- Abarricade
- Bfencing
- Croller barrier
- Dtype V controls
139Which of the following cannot be used along the fencing as a security perimeter?
- Avapor barrier
- Brotating spikes
- Croller barrier
- Danticlimb paint
140Which of the following is NOT a Microsoft Windows setting that can be configured through a security template?
- AAccount Policies
- BUser Rights
- CKeyboard Mapping
- DSystem Services
141A _______________ addresses a specific customer situation and often may not be distributed outside that customer's organization.
- Arollup
- Bservice pack
- Cpatch
- Dhotfix
142Which of these is NOT a state of data that DLP examines?
- Adata in-use
- Bdata in-process
- Cdata in-transit
- Ddata at-rest
143Which of these is a list of approved email senders?
- Ablacklist
- Bwhitelist
- Cgreylist
- Dgreenlist
144How does heuristic detection detect a virus?
- AA virtualized environment is created and the code is executed in it.
- BA string of bytes from the virus is compared against the suspected file.
- CThe bytes of a virus are place din different "piles" and then used to create a profile.
- DThe virus signature file is placed in a suspended chamber before streaming to the CPU.
145The Hashed Message Authentication Code (HMAC) ____________.
- Aencrypts only the key
- Bencrypts the key and the message
- Cencrypts only the message
- Dencrypts the DHE key only
146Elliptic Curve Diffie Hellman (ECDH) is an example of ________.
- Ain-band key exchange
- Bout-of-band key exchange
- CSHA-1 key management
- DAED key certification
147Public key systems that generate random public keys that are different for each session are called ___________.
- APublic Key Exchange (PKE)
- BElliptic Curve Diffie-Hellman (ECDH)
- CDiffie-Hellman (DH)
- Dperfect forward secrecy
148The areas of a file in which steganography can hide data include all of the following EXCEPT ________.
- Ain data that is used to describe the content or structure of the actual data
- Bin the directory structure of the file system
- Cint he file header fields that describe the file
- Din areas that contain the content data itself
149Which of these is NOT a characteristic of a secure ahh algorithm
- ACollisions should be rare
- BThe results of a hash function should not be reversed
- CThe hash should always be the same fixed size
- DA message cannot be produced from a predefined hash
150A(n) ______ is not decrypted but is only used for comparison purposes
- Astream
- Bdigest
- Calgorithm
- Dkey
151Which protection is provided by hashing?
- Aauthenticity
- Bconfidentiality
- Cintegrity
- Davailability
152Which asymmetric cryptographic algorithm is the most secure?
- ASHA-2
- BBTC-2
- CRSA
- DME-14
153Which asymmetric encryption algorithm uses prime numbers?
- AEFS
- Bquantum computing
- CECC
- DRSA
Information
- Description
- Quiz on CIT 370 Unit 1, created by sta13001 on 20/07/2015.
- Author
- sta13001
- Language
- English
- Views
- 6
- Rating
- No ratings yet Rate this quiz