Quiz
Final Exam 2015+
This quiz has a time limit, so it opens in the usual player.
Questions in this quiz (113)
1Which of the following can be defined as the process of rerunning a portion of the test scenario or test plan to ensure that changes or corrections have not introduced new errors?
- AUnit testing
- BParallel testing
- CRegression testing
- DPilot testing
2At which layer of the OSI model do sniffers operate?
- ALayer 2 - Data Link Layer
- BLayer 1 - Hardware layer
- CLayer 3 - Networking Layer
- DLayer 7 - Application layer
3When two or more separate entities (usually persons) operating in concert to protect sensitive functions or information must combine their knowledge to gain access to an asset, this is known as?
- ASegragation of duties
- BSeparation of duties
- CNeed to know
- DDual Control
4What is the name for a substitution cipher that shifts the alphabet by 13 places?
- ATransposition cipher
- BCaesar cipher
- CPolyalphabetic cipher
- DROT13 cipher
5Your organization creates software applications that are sold to the public. Recently, management has become concerned about software piracy. Which organization deals with the prevention of this crime?
- ACIA
- BDoD
- CSPA
- DNCSC
6A potential problem related to the physical installation of the Iris Scanner in regards to the usage of the iris pattern within a biometric system is:
- AConcern that the laser beam may cause eye damage.
- BThe iris pattern changes as a person grows older.
- CThere is a relatively high rate of false accepts.
- DThe optical unit must be positioned so that the sun does not shine into the aperture.
7In Mandatory Access Control, sensitivity labels attached to object contain what information?
- AThe item's classification
- BThe item's classification and category set
- CThe item's category
- DThe items's need to know
8Which of the following is true about Kerberos?
- AIt utilizes public key cryptography.
- BIt encrypts data after a ticket is granted, but passwords are exchanged in plain text.
- CIt depends upon symmetric ciphers.
- DIt is a second party authentication system.
9Which of the following is needed for System Accountability?
- AAudit mechanisms.
- BDocumented design as laid out in the Common Criteria.
- CAuthorization.
- DFormal verification of system design.
10What is Kerberos?
- AA three-headed dog from the Egyptian mythology.
- BA trusted third-party authentication protocol.
- CA security model.
- DA remote authentication dial in user server.
11Kerberos depends upon what encryption method?
- APublic Key cryptography.
- BSecret Key cryptography.
- CEl Gamal cryptography.
- DBlowfish cryptography.
12A confidential number used as an authentication factor to verify a user's identity is called a:
- APIN
- BUser ID
- CPassword
- DChallenge
13Individual accountability does not include which of the following?
- Aunique identifiers
- Bpolicies & procedures
- Caccess rules
- Daudit trails
14Which of the following exemplifies proper separation of duties?
- AOperators are not permitted modify the system time.
- BProgrammers are permitted to use the system console.
- CConsole operators are permitted to mount tapes and disks.
- DTape operators are permitted to use the system console.
15An access control policy for a bank teller is an example of the implementation of which of the following?
- ARule-based policy
- BIdentity-based policy
- CUser-based policy
- DRole-based policy
16Which one of the following authentication mechanisms creates a problem for mobile users?
- AMechanisms based on IP addresses
- BMechanism with reusable passwords
- COne-time password mechanism.
- DChallenge response mechanism.
17Organizations should consider which of the following first before allowing external access to their LANs via the Internet?
- APlan for implementing workstation locking mechanisms.
- BPlan for protecting the modem pool.
- CPlan for providing the user with his account usage information.
- DPlan for considering proper authentication options.
18Kerberos can prevent which one of the following attacks?
- ATunneling attack.
- BPlayback (replay) attack.
- CDestructive attack.
- DProcess attack.
19In discretionary access environments, which of the following entities is authorized to grant information access to other people?
- AManager
- BGroup Leader
- CSecurity Manager
- DData Owner
20What is the main concern with single sign-on?
- AMaximum unauthorized access would be possible if a password is disclosed.
- BThe security administrator's workload would increase.
- CThe users' password would be too hard to remember.
- DUser access rights would be increased.
21Who developed one of the first mathematical models of a multilevel-security computer system?
- ADiffie and Hellman.
- BClark and Wilson.
- CBell and LaPadula.
- DGasser and Lipner.
22Which of the following attacks could capture network user passwords?
- AData diddling
- BSniffing
- CIP Spoofing
- DSmurfing
23Which of the following would constitute the best example of a password to use for access to a system by a network administrator?
- Aholiday
- BChristmas12
- CJenny
- DGyN19Za!
24What physical characteristic does a retinal scan biometric device measure?
- AThe amount of light reaching the retina
- BThe amount of light reflected by the retina
- CThe pattern of light receptors at the back of the eye
- DThe pattern of blood vessels at the back of the eye
25The Computer Security Policy Model the Orange Book is based on is which of the following?
- ABell-LaPadula
- BData Encryption Standard
- CKerberos
- DTempest
26The end result of implementing the principle of least privilege means which of the following?
- AUsers would get access to only the info for which they have a need to know
- BUsers can access all systems.
- CUsers get new privileges added when they change positions.
- DAuthorization creep.
27Which of the following is the most reliable authentication method for remote access?
- AVariable callback system
- BSynchronous token
- CFixed callback system
- DCombination of callback and caller ID
28Which of the following is true of two-factor authentication?
- AIt uses the RSA public-key signature based on integers with large prime factors.
- BIt requires two measurements of hand geometry.
- CIt does not use single sign-on technology.
- DIt relies on two independent proofs of identity.
29The primary service provided by Kerberos is which of the following?
- Anon-repudiation
- Bconfidentiality
- Cauthentication
- Dauthorization
30There are parallels between the trust models in Kerberos and Public Key Infrastructure (PKI).
When we compare them side by side, Kerberos tickets correspond most closely to which of the following?- Apublic keys
- Bprivate keys
- Cpublic-key certificates
- Dprivate-key certificates
31In which of the following security models is the subject's clearance compared to the object's classification such that specific rules can be applied to control how the subject-to-object interactions take place?
- ABell-LaPadula model
- BBiba model
- CAccess Matrix model
- DTake-Grant model
32Which of the following was developed to address some of the weaknesses in Kerberos and uses public key cryptography for the distribution of secret keys and provides additional access control support?
- ASESAME
- BRADIUS
- CKryptoKnight
- DTACACS+
33Single Sign-on (SSO) is characterized by which of the following advantages?
- AConvenience
- BConvenience and centralized administration
- CConvenience and centralized data administration
- DConvenience and centralized network administration
34What is the primary role of smartcards in a PKI?
- ATransparent renewal of user keys
- BEasy distribution of the certificates between the users
- CFast hardware encryption of the raw data
- DTamper resistant, mobile storage and application of private keys of the users
35What kind of certificate is used to validate a user identity?
- APublic key certificate
- BAttribute certificate
- CRoot certificate
- DCode signing certificate
36The following is not a security characteristic we need to consider while choosing a biometric identification systems:
- Adata acquisition process
- Bcost
- Cenrollment process
- Dspeed and user interface
37In biometric identification systems, at the beginning, it was soon apparent that truly positive identification could only be based on physical attributes of a person.
This raised the necessity of answering 2 questions:- Awhat was the sex of a person and his age
- Bwhat part of body to be used and how to accomplish identification that is viable
- Cwhat was the age of a person and his income level
- Dwhat was the tone of the voice of a person and his habits
38In biometric identification systems, the parts of the body conveniently available for identification are:
- Aneck and mouth
- Bhands, face, and eyes
- Cfeet and hair
- Dvoice and neck
39Controlling access to information systems and associated networks is necessary for the preservation of their:
- AAuthenticity, confidentiality and availability
- BConfidentiality, integrity, and availability.
- Cintegrity and availability.
- Dauthenticity, confidentiality, integrity and availability.
40To control access by a subject (an active entity such as individual or process) to an object (a passive entity such as a file) involves setting up:
- AAccess Rules
- BAccess Matrix
- CIdentification controls
- DAccess terminal
41Rule-Based Access Control (RuBAC) access is determined by rules.
Such rules would fit within what category of access control?- ADiscretionary Access Control (DAC)
- BMandatory Access control (MAC)
- CNon-Discretionary Access Control (NDAC)
- DLattice-based Access control
42The type of discretionary access control (DAC) that is based on an individual's identity is also called:
- AIdentity-based Access control
- BRule-based Access control
- CNon-Discretionary Access Control
- DLattice-based Access control
43Which access control type has a central authority that determine to what objects the subjects have access to and it is based on role or on the organizational security policy?
- AMandatory Access Control
- BDiscretionary Access Control
- CNon-Discretionary Access Control
- DRule-based Access control
44Which of the following control pairings include: organizational policies and procedures, pre- employment background checks, strict hiring practices, employment agreements, employee termination procedures, vacation scheduling, labeling of sensitive materials, increased supervision, security awareness training, behavior awareness, and sign-up procedures to obtain access to information systems and networks?
- APreventive/Administrative Pairing
- BPreventive/Technical Pairing
- CPreventive/Physical Pairing
- DDetective/Administrative Pairing
45Technical controls such as encryption and access control can be built into the operating system, be software applications, or can be supplemental hardware/software units.
Such controls, also known as logical controls, represent which pairing?- APreventive/Administrative Pairing
- BPreventive/Technical Pairing
- CPreventive/Physical Pairing
- DDetective/Technical Pairing
46What is called the use of technologies such as fingerprint, retina, and iris scans to authenticate the individuals requesting access to resources?
- AMicrometrics
- BMacrometrics
- CBiometrics
- DMicroBiometrics
47What is called the access protection system that limits connections by calling back the number of a previously authorized location?
- ASendback systems
- BCallback forward systems
- CCallback systems
- DSendback forward systems
48What are called user interfaces that limit the functions that can be selected by a user?
- AConstrained user interfaces
- BLimited user interfaces
- CMini user interfaces
- DUnlimited user interfaces
49Controls such as job rotation, the sharing of responsibilities, and reviews of audit records are associated with:
- APreventive/physical
- BDetective/technical
- CDetective/physical
- DDetective/administrative
50The control measures that are intended to reveal the violations of security policy using software and hardware are associated with:
- APreventive/physical
- BDetective/technical
- CDetective/physical
- DDetective/administrative
51The controls that usually require a human to evaluate the input from sensors or cameras to determine if a real threat exists are associated with:
- APreventive/physical
- BDetective/technical
- CDetective/physical
- DDetective/administrative
52External consistency ensures that the data stored in the database is:
- Ain-consistent with the real world.
- Bremains consistant when sent from one system to another.
- Cconsistent with the logical world.
- Dconsistent with the real world.
53A central authority determines what subjects can have access to certain objects based on the organizational security policy is called:
- AMandatory Access Control
- BDiscretionary Access Control
- CNon-Discretionary Access Control
- DRule-based Access control
54What is called the act of a user professing an identity to a system, usually in the form of a log-on ID?
- AAuthentication
- BIdentification
- CAuthorization
- DConfidentiality
55Which one of the following factors is not one on which Authentication is based?
- AType 1 Something you know, such as a PIN or password
- BType 2 Something you have, such as an ATM card or smart card
- CType 3 Something you are (based upon one or more intrinsic physical or behavioral traits), such as a fingerprint or retina scan
- DType 4 Something you are, such as a system administrator or security administrator
56A central authority determines what subjects can have access to certain objects based on the organizational security policy is called:
- AMandatory Access Control
- BDiscretionary Access Control
- CNon-Discretionary Access Control
- DRule-based Access control
57What is called the act of a user professing an identity to a system, usually in the form of a log-on ID?
- AAuthentication
- BIdentification
- CAuthorization
- DConfidentiality
58What is called the verification that the user's claimed identity is valid and is usually implemented through a user password at log-on time?
- AAuthentication
- BIdentification
- CIntegrity
- DConfidentiality
59Which one of the following factors is not one on which Authentication is based?
- AType 1 Something you know, such as a PIN or password
- BType 2 Something you have, such as an ATM card or smart card
- CType 3 Something you are (based upon one or more intrinsic physical or behavioral traits), such as a fingerprint or retina scan
- DType 4 Something you are, such as a system administrator or security administrator
60The act of requiring two of the three factors to be used in the authentication process refers to:
- ATwo-Factor Authentication
- BOne-Factor Authentication
- CBi-Factor Authentication
- DDouble Authentication
61Which type of password provides maximum security because a new password is required for each new log-on?
- AOne-time or dynamic password
- BCongnitive password
- CStatic password
- DPassphrase
62What is called a password that is the same for each log-on session?
- A"one-time password"
- B"two-time password"
- Cstatic password
- Ddynamic password
63What is called a sequence of characters that is usually longer than the allotted number for a password?
- Apassphrase
- Bcognitive phrase
- Canticipated phrase
- DReal phrase
64Which best describes a tool (i.e. keyfob, calculator, memory card or smart card) used to supply dynamic passwords?
- ATickets
- BTokens
- CToken passing networks
- DCoupons
65Which of the following would be true about Static password tokens?
- AThe owner identity is authenticated by the token
- BThe owner will never be authenticated by the token.
- CThe owner will authenticate himself to the system
- DThe token does not authenticates the token owner but the system
66In Synchronous dynamic password tokens:
- AThe token generates a new password value at fixed time intervals (this password could be based on the time of day encrypted with a secret key).
- BThe token generates a new non-unique password value at fixed time intervals (this password could be based on the time of day encrypted with a secret key).
- CThe unique password is not entered into a system or workstation along with an owner's PIN.
- DThe authentication entity in a system or workstation knows an owner's secret key and PIN, and the entity verifies that the entered password is invalid and that it was entered during the invalid time window
67In biometrics, "one-to-many" search against database of stored biometric images is done in:
- AAuthentication
- BIdentification
- CIdentities
- DIdentity-based access control
68Which of the following is true of biometrics?
- AIt is used for identification in physical controls and it is not used in logical controls
- BIt is used for authentication in physical controls and for identification in logical controls
- CIt is used for identification in physical controls and for authentication in logical controls.
- DBiometrics has not role in logical controls.
69What is called the percentage of valid subjects that are falsely rejected by a Biometric Authentication system?
- AFalse Rejection Rate (FRR) or Type I Error
- BFalse Acceptance Rate (FAR) or Type II Error
- CCrossover Error Rate (CER)
- DTrue Rejection Rate (TRR) or Type III Error
70What is called the percentage of invalid subjects that are falsely accepted by a Biometric authentication system?
- AFalse Rejection Rate (FRR) or Type I Error
- BFalse Acceptance Rate (FAR) or Type II Error
- CCrossover Error Rate (CER)
- DTrue Acceptance Rate (TAR) or Type III Error
71What is called the percentage at which the False Rejection Rate equals the False Acceptance Rate?
- AFalse Rejection Rate (FRR) or Type I Error
- BFalse Acceptance Rate (FAR) or Type II Error
- CCrossover Error Rate (CER)
- DFailure to enroll rate (FTE or FER)
72Considerations of privacy, invasiveness, and psychological and physical comfort when using the system are important elements for which of the following?
- AAccountability of biometrics systems
- BAcceptability of biometrics systems
- CAvailability of biometrics systems
- DAdaptability of biometrics systems
73Which of the following offers advantages such as the ability to use stronger passwords, easier password administration, one set of credential, and faster resource access?
- ASmart cards
- BSingle Sign-On (SSO)
- CSymmetric Ciphers
- DPublic Key Infrastructure (PKI)
74Which of the following describes the major disadvantage of many Single Sign-On (SSO) implementations?
- AOnce an individual obtains access to the system through the initial log-on, they have access to all resources within the environment that the account has access to.
- BThe initial logon process is cumbersome to discourage potential intruders.
- COnce a user obtains access to the system through the initial log-on, they only need to logon to some applications.
- DOnce a user obtains access to the system through the initial log-on, he has to logout from all other systems
75Which of the following is implemented through scripts or smart agents that replays the users multiple log-ins against authentication servers to verify a user's identity which permit access to system services?
- ASingle Sign-On
- BDynamic Sign-On
- CSmart cards
- DKerberos
76Which of the following is not true of the Kerberos protocol?
- AOnly a single login is required per session.
- BThe initial authentication steps are done using public key algorithm
- CThe KDC is aware of all systems in the network and is trusted by all of them
- DIt performs mutual authentication
77The authenticator within Kerberos provides a requested service to the client after validating which of the following?
- Atimestamp
- Bclient public key
- Cclient private key
- Dserver public key
78Which of the following is addressed by Kerberos?
- AConfidentiality and Integrity
- BAuthentication and Availability
- CValidation and Integrity
- DAuditability and Integrity
79Kerberos is vulnerable to replay in which of the following circumstances?
- AWhen a private key is compromised within an allotted time window
- BWhen a public key is compromised within an allotted time window.
- CWhen a ticket is compromised within an allotted time window.
- DWhen the KSD is compromised within an allotted time window.
80Like the Kerberos protocol, SESAME is also subject to which of the following?
- Atimeslot replay
- Bpassword guessing
- Csymmetric key guessing
- Dasymmetric key guessing
81RADIUS incorporates which of the following services?
- AAuthentication server and PIN codes.
- BAuthentication of clients and static passwords generation.
- CAuthentication of clients and dynamic passwords generation.
- DAuthentication server as well as support for Static and Dynamic passwords.
82Which of the following protects a password from eavesdroppers and supports the encryption of communication?
- AChallenge Handshake Authentication Protocol (CHAP)
- BChallenge Handshake Identification Protocol (CHIP)
- CChallenge Handshake Encryption Protocol (CHEP)
- DChallenge Handshake Substitution Protocol (CHSP)
83Which of the following represents the columns of the table in a relational database?
- Aattributes
- Brelation
- Crecord retention
- Drecords or tuples
84A database view is the results of which of the following operations?
- AJoin and Select.
- BJoin, Insert, and Project
- CJoin, Project, and Create.
- DJoin, Project, and Select.
85Which of the following is used to create and modify the structure of your tables and other objects in the database?
- ASQL Data Definition Language (DDL)
- BSQL Data Manipulation Language (DML)
- CSQL Data Relational Language (DRL)
- DSQL Data Identification Language (DIL)
86Which of the following is used to monitor network traffic or to monitor host audit logs in real time to determine violations of system security policy that have taken place?
- AIntrusion Detection System
- BCompliance Validation System
- CIntrusion Management System (IMS)
- DCompliance Monitoring System
87Which of the following monitors network traffic in real time?
- Anetwork-based IDS
- Bhost-based IDS
- Capplication-based IDS
- Dfirewall-based IDS
88A host-based IDS is resident on which of the following?
- AOn each of the critical hosts
- Bdecentralized hosts
- Ccentral hosts
- Dbastion hosts
89Which of the following usually provides reliable, real-time information without consuming network or host resources?
- Anetwork-based IDS
- Bhost-based IDS
- Capplication-based IDS
- Dfirewall-based IDS
90The fact that a network-based IDS reviews packets payload and headers enable which of the following?
- ADetection of denial of service
- BDetection of all viruses
- CDetection of data corruption
- DDetection of all password guessing attacks
91Which of the following reviews system and event logs to detect attacks on the host and determine if the attack was successful?
- Ahost-based IDS
- Bfirewall-based IDS
- Cbastion-based IDS
- Dserver-based IDS
92What would be considered the biggest drawback of Host-based Intrusion Detection systems
(HIDS)?- AIt can be very invasive to the host operating system
- BMonitors all processes and activities on the host system only
- CVirtually eliminates limits associated with encryption
- DThey have an increased level of visibility and control compared to NIDS
93Attributes that characterize an attack are stored for reference using which of the following
Intrusion Detection System (IDS)?- Asignature-based IDS
- Bstatistical anomaly-based IDS
- Cevent-based IDS
- Dinferent-based IDS
94Which of the following is an issue with signature-based intrusion detection systems?
- AOnly previously identified attack signatures are detected.
- BSignature databases must be augmented with inferential elements.
- CIt runs only on the windows operating system
- DHackers can circumvent signature evaluations.
95Which of the following is an IDS that acquires data and defines a "normal" usage profile for the network or host?
- AStatistical Anomaly-Based ID
- BSignature-Based ID
- Cdynamical anomaly-based ID
- Dinferential anomaly-based ID
96Which of the following is most relevant to determining the maximum effective cost of access control?
- Athe value of information that is protected
- Bmanagement's perceptions regarding data importance
- Cbudget planning related to base versus incremental spending
- Dthe cost to replace lost data
97Which of the following is not a factor related to Access Control?
- Aintegrity
- Bauthenticity
- Cconfidentiality
- Davailability
98Which of the following is most appropriate to notify an external user that session monitoring is being conducted?
- ALogon Banners
- BWall poster
- CEmployee Handbook
- DWritten agreement
99Which of the following pairings uses technology to enforce access control policies?
- APreventive/Administrative
- BPreventive/Technical
- CPreventive/Physical
- DDetective/Administrative
100In the course of responding to and handling an incident, you work on determining the root cause of the incident. In which step are you in?
- ARecovery
- BContainment
- CTriage
- DAnalysis and tracking
101Access control is the collection of mechanisms that permits managers of a system to exercise a directing or restraining influence over the behavior, use, and content of a system.
It does not permit management to:- Aspecify what users can do
- Bspecify which resources they can access
- Cspecify how to restrain hackers
- Dspecify what operations they can perform on a system
102Access Control techniques do not include which of the following choices?
- ARelevant Access Controls
- BDiscretionary Access Control
- CMandatory Access Control
- DLattice Based Access Control
103Which of the following statements relating to the Bell-LaPadula security model is false (assuming the Strong Star property is not being used)?
- AA subject is not allowed to read up
- BThe *- property restriction can be escaped by temporarily downgrading a high level subject.
- CA subject is not allowed to read down
- DIt is restricted to confidentiality
104When a biometric system is used, which error type deals with the possibility of granting access to impostors who should be rejected?
- AType I error
- BType II error
- CType III error
- DCrossover error
105Which of the following is the FIRST step in protecting data's confidentiality?
- AInstall a firewall
- BImplement encryption
- CIdentify which information is sensitive
- DReview all user access rights
106Which of the following best ensures accountability of users for the actions taken within a system or domain?
- AIdentification
- BAuthentication
- CAuthorization
- DCredentials
107Which of the following statements pertaining to biometrics is false?
- AUser can be authenticated based on behavior.
- BUser can be authenticated based on unique physical attributes.
- CUser can be authenticated by what he knows.
- DA biometric system's accuracy is determined by its crossover error rate (CER).
108Which of the following biometric devices offers the LOWEST CER?
- AKeystroke dynamics
- BVoice verification
- CIris scan
- DFingerprint
109Which of the following is the weakest authentication mechanism?
- APassphrases
- BPasswords
- COne-time passwords
- DToken devices
110Which of the following statements pertaining to access control is false?
- AUsers should only access data on a need-to-know basis.
- BIf access is not explicitly denied, it should be implicitly allowed.
- CAccess rights should be granted based on the level of trust a company has on a subject.
- DRoles can be an efficient way to assign rights to a type of user who performs certain tasks.
111Which of the following is not part of the Kerberos authentication protocol?
- ASymmetric key cryptography
- BAuthentication service (AS)
- CPrincipals
- DPublic Key
112Which access control model enables the owner of the resource to specify what subjects can access specific resources based on their identity?
- ADiscretionary Access Control
- BMandatory Access Control
- CSensitive Access Control
- DRole-based Access Control
113Which of the following access control models is based on sensitivity labels?
- ADiscretionary access contro
- BMandatory access control
- CRule-based access control
- DRole-based access control
Information
- Description
- Exam Practice Questions
- Author
- Alexandre Pinheiro
- Language
- English
- Views
- 753
- Tags
- Rating
- 5.0 out of 5 · 2 ratings Rate this quiz