|
What term is directly related to customer privacy considerations?
|
|
a.
|
Information classification
|
|
|
b.
|
Data handling policies
|
|
|
c.
|
Clean desk policies
|
|
|
d.
|
Personally identifiable information
|
|
What is a requirement when implementing PKI if data loss is unacceptable?
|
|
a.
|
Certificate revocation list
|
|
|
b.
|
Non-repudiation
|
|
|
c.
|
Key escrow
|
|
|
d.
|
Web of trust
|
|
|
A distributed denial of service attack can best be described as:
|
|
a.
|
Invalid characters being entered into a field in a database application
|
|
|
b.
|
Multiple attackers attempting to gain elevated privileges on a target system
|
|
|
c.
|
User attempting to input random or invalid data into fields within a web browser application
|
|
|
d.
|
Multiple computers attacking a single target in an organized attempt to deplete its resources
|
|
Kerberos and LDAP are commonly used for which of the following?
|
|
a.
|
To store usernames and passwords for Federated Identity
|
|
|
b.
|
To sign SSL wildcard certificates for subdomains
|
|
|
c.
|
To utilize single sign-on capabilities
|
|
|
d.
|
To perform queries on a directory service
|
|
|
Which of the following is an authentication service that uses UDP as a transport medium?
|
|
a.
|
LDAP
|
|
|
b.
|
TACACS+
|
|
|
c.
|
RADIUS
|
|
|
d.
|
Kerberos
|
|
Which of the following is another name for a symmetric key used to exchange a shared secret to begin communication securely?
|
|
a.
|
Private key
|
|
|
b.
|
Public key
|
|
|
c.
|
Session key
|
|
|
d.
|
Digital signature
|
|
|
Which of the following is a security risk regarding the use of public P2P as a method of collaboration?
|
|
a.
|
Limiting the amount of necessary space for data storage
|
|
|
b.
|
Monitoring data changes induces a higher cost
|
|
|
c.
|
Data integrity is susceptible to being compromised
|
|
|
d.
|
Users are not responsible for data usage tracking
|
|
Mandatory vacation is a security control which can be used to uncover which of the following?
|
|
a.
|
Fraud committed by a system administrator
|
|
|
b.
|
Software vulnerabilities in vendor code
|
|
|
c.
|
The need for additional security staff
|
|
|
d.
|
Poor password security among users
|
|
|
The following are encryption types except:
|
|
a.
|
File and folder
|
|
|
b.
|
RADIUS
|
|
|
c.
|
Full disk
|
|
|
d.
|
SMIME
|
|
You are walking into your building when you are asked by another employee to let you into the building because they lost their badge. What does this describe?
|
|
a.
|
Whaling
|
|
|
b.
|
Impersonation
|
|
|
c.
|
Tailgating
|
|
|
d.
|
Shoulder surfing
|
|
|
Public key certificates and keys that are compromised or were issued fraudulently are listed on which of the following?
|
|
a.
|
PKI
|
|
|
b.
|
ACL
|
|
|
c.
|
CA
|
|
|
d.
|
CRL
|
|
You have implemented an array of four servers to accomplish one specific task. This is best known as what?
|
|
a.
|
RAID
|
|
|
b.
|
Clustering
|
|
|
c.
|
Virtualization
|
|
|
d.
|
Load balancing
|
|
|
What type of malware types may require user interaction, does not hide itself, and is commonly identified by marketing pop-up based on browsing habits?
|
|
a.
|
Adware
|
|
|
b.
|
Virus
|
|
|
c.
|
Rootkit
|
|
|
d.
|
Botnet
|
|
Fundamental information security principles include confidentiality, availability, and which of the following?
|
|
a.
|
The ability to secure data against unauthorized disclosure to external sources
|
|
|
b.
|
The capacity of a system to resist unauthorized changes to stored information
|
|
|
c.
|
The characteristic of a system to provide uninterrupted service to authorized users
|
|
|
d.
|
The confidence with which a system can attest to the identity of a user
|
|
|
Which of the following types of trust models is used by PKI?
|
|
a.
|
Transitive
|
|
|
b.
|
Decentralized
|
|
|
c.
|
Open source
|
|
|
d.
|
Centralized
|
|
As an administrator you wish to hide the network addresses of internal network when connecting to the internet. What is the most effective way to mask the network address the users would be passing the traffic through is?
|
|
a.
|
NIPS
|
|
|
b.
|
NAT
|
|
|
c.
|
Stateful firewell
|
|
|
d.
|
Packet-filtering firewall
|
|
|
Of the following, what risk concept requires an organization to determine the number of failures per year?
|
|
a.
|
MTBF
|
|
|
b.
|
SLE
|
|
|
c.
|
Quantitative analysis
|
|
|
d.
|
ALE
|
|
As a security administrator, you want to replace your RADIUS authentication with a more secure protocol that can use EAP. Which is the best fit for your project?
|
|
a.
|
Diameter
|
|
|
b.
|
CHAP
|
|
|
c.
|
Kerberos
|
|
|
d.
|
SAML
|
|
|
Which of the following types of logs could provide clues that someone has been attempting to compromise the SQL server database?
|
|
a.
|
SQL_LOG
|
|
|
b.
|
Event
|
|
|
c.
|
Security
|
|
|
d.
|
Access
|
|
What device monitors network traffic in a passive manner?
|
|
a.
|
Firewall
|
|
|
b.
|
IDS
|
|
|
c.
|
Web browser
|
|
|
d.
|
Sniffer
|
|
|
Without validation, a user's input and application becomes vulnerable to all of the following except:
|
|
a.
|
Spear phishing
|
|
|
b.
|
Buffer overflow
|
|
|
c.
|
Command injection
|
|
|
d.
|
SQL injection
|
|
Of the following, which will provide the strongest encryption?
|
|
a.
|
RSA with a 1024-bit key
|
|
|
b.
|
AES with a 256-bit key
|
|
|
c.
|
DES with a 56-bit key
|
|
|
d.
|
Random one-time pad
|
|
|
Which of the following offerings typically allows the customer to apply operation system patches?
|
|
a.
|
Cloud based storage
|
|
|
b.
|
Infrastructure as a service
|
|
|
c.
|
Software as a service
|
|
|
d.
|
Public clouds
|
|
Which of the following must a security administrator implement to isolate public facing servers from both the corporate network and the internet?
|
|
a.
|
IPSec
|
|
|
b.
|
NAC
|
|
|
c.
|
NAT
|
|
|
d.
|
DMZ
|
|
|
When you are verifying file integrity on a remote system that is bandwidth limited, which of the following tool combinations provides the strongest confidence?
|
|
a.
|
MD5 and SHA-1
|
|
|
b.
|
MD5 and 3DES
|
|
|
c.
|
SHA-256 and RSA
|
|
|
d.
|
SHA-256 and AES
|
|
|
mrsx_bri
IS211FINALEXAM.docx
0
