Unlock document.
This document is partially blurred.
Unlock all pages and 1 million more documents.
Get Access
A ______ is a word, name, symbol, or device that is used in trade with goods to indicate
the source of the goods and to distinguish them from the goods of others.
A. copyright
B. patent
C. trademark
D. all of the above
_________ is the granting of a right or permission to a system entity to access a system
resource.
A. Authorization
B. Authentication
C. Control
D. Monitoring
A(n) __________ is a resource to which access is controlled.
A. object
B. owner
C. world
D. subject
__________ are used to send large volumes of unwanted e-mail.
A. Rootkits
B. Spammer programs
C. Downloaders
D. Auto-rooter
The assurance that data received are exactly as sent by an authorized entity is
__________.
A. authentication
B. access control
C. data confidentiality
D. data integrity
In order to accelerate the introduction of strong security into WLANs the Wi-Fi
Alliance promulgated ________, a set of security mechanisms that eliminates most
802.11 security issues, as a Wi-Fi standard.
A. WPA
B. WEP
C. RSN
D. MAC
A benefit of IPsec is __________.
A. that it is below the transport layer and transparent to applications
B. there is no need to revoke keying material when users leave the organization
C. it can provide security for individual users if needed
D. all of the above
_________ audit trails are generally used to monitor and optimize system performance.
A. User-level
B. Physical-level
C. System-level
D. All of the above
________ is a process where authentication and permission will be passed on from one
system to another, usually across multiple enterprises, reducing the number of
authentications needed by the user.
A. Integration
B. Registration
C. Synchronization
D. Federation
A _________ configuration involves stand-alone firewall devices plus host-based
firewalls working together under a central administrative control.
A. packet filtering firewall
B. distributed firewall
C. personal firewall
D. stateful inspection firewall
The _________ attack is designed to circumvent filtering rules that depend on TCP
header information.
A. tiny fragment
B. address spoofing
C. source routing
D. bastion host
Although the _________ attack is a serious threat, there are simple countermeasures
that can be used such as constant time calcs, random delays or blinding computations.
A. timing
B. chosen ciphertext
C. mathematical
D. none of the above
A __________ strategy is one in which the system periodically runs its own password
cracker to find guessable passwords.
A. user education
B. reactive password checking
C. proactive password checking
D. computer-generated password
To counter threats to remote user authentication, systems generally rely on some form
of ___________ protocol.
A. eavesdropping
B. challenge-response
C. Trojan horse
D. denial-of-service
________ ensures that a user may make multiple uses of resources or services without
others being able to link these uses together.
A. Anonymity
B. Pseudonymity
C. Unobservability
D. Unlinkability
Assurance is the process of examining a computer product or system with respect to
certain criteria.
There are _____ modes of operation defined by NIST that are intended to cover
virtually all the possible applications of encryption for which a block cipher could be
used.
A. three
B. five
C. seven
D. nine
The ______ is responsible for transferring the message from the MHS to the MS.
A. MDA
B. MS
C. MUA
D. MSA
Once the system is appropriately built, secured, and deployed, the process of
maintaining security is ________.
A. complete
B. no longer a concern
C. continuous
D. sporadic
Inserting a new row at a lower level without modifying the existing row at the higher
level is known as ________ .
A. polyinstantiation
B. ds-property
C. trust
D. MAC
A system used to interconnect a set of basic service sets and LANs to create an
extended service set is a _________.
A. distribution system
B. coordination function
C. MAC data unit
D. wireless access system
In both direct flooding attacks and ______ the use of spoofed source addresses results
in response packets being scattered across the Internet and thus detectable.
A. SYN spoofing attacks
B. indirect flooding attacks
C. ICMP attacks
D. system address spoofing
________ security protects computer-based data from software-based and
communication-based threats.
A. Infrastructure
B. Premises
C. Physical
D. Logical
The advantages of the _________ approach are that it doesn"t require the expenditure
of additional resources in conducting a more formal risk assessment and that the same
measures can be replicated over a range of systems.
A. combined
B. informal
C. baseline
D. detailed
__________ applications is a control that limits the programs that can execute on the
system to just those in an explicit list.
A. Virtualizing
B. White listing
C. Logging
D. Patching
__________ aim to prevent or detect buffer overflows by instrumenting programs when
they are compiled.
A. Compile-time defenses
B. Shellcodes
C. Run-time defenses
D. All of the above
__________ can prevent buffer overflow attacks, typically of global data,
which attempt to overwrite adjacent regions in the processes address space, such as the
global offset table.
A. MMUs
B. Guard pages
C. Heaps
D. All of the above
__________ is a block cipher in which the plaintext and ciphertext are integers between
0 and n-1 for some n.
A. DSS
B. RSA
C. SHA
D. AES
The _________ defines the transport protocol.
A. destination IP address
B. source IP address
C. interface
D. IP protocol field
_________ is a form of overflow attack.
A. Heap overflows
B. Return to system call
C. Replacement stack frame
D. All of the above
The ______ is an optional key that may be present on any PIV card, does not require
PIN entry, and whose purpose is to authenticate the card and therefore its possessor.
A. VIS
B. BIO
C. CHUID
D. CAK
_________ involves the collection of data relating to the behavior of legitimate users
over a period of time.
A. Profile based detection
B. Signature detection
C. Threshold detection
D. Anomaly detection
Maintenance of security controls, security compliance checking, change and
configuration management, and incident handling are all included in the follow-up
stage of the _________ process.
A. management
B. security awareness and training
C. maintenance
D. all of the above
The principal threats to wireless transmission are disruption, _____________, and
altering or inserting messages.
A host generated random number is often called a __________.
Snort can perform intrusion prevention but not intrusion detection.
Kerberos does not support interrealm authentication.
An important element in many computer security services and applications is the use of
cryptographic algorithms.
Management controls refer to issues that management needs to address.
Unix and Linux systems use a ________ which restricts the server's view of the file
system to just a specified portion.
The aim of the _________ process is to provide management with the information
necessary for them to make reasonable decisions on where available resources will be
deployed.
Employee behavior is not a critical concern in ensuring the security of computer
systems.
A _________ is a hardware device that sits between servers and storage systems and
encrypts all data going from the server to the storage system and decrypts data going in
the opposite direction.
Software security is closely related to software quality and reliability.
Physical access or environmental controls are only relevant to areas housing the
relevant equipment.
Both policy and ________ approaches are needed to protect privacy when both
government and nongovernment organization seek to learn as much as possible about
individuals.
________ lists the following security objective with respect to current employees: "to
ensure that employees, contractors, and third-party users are aware of information
security threats and concerns and their responsibilities and liabilities with regard to
information security and are equipped to support organizational security policy in the
course of their normal work and to reduce the risk of human error".
It is not critical that an organization's IT security policy have full approval or buy-in by
senior management.
