-
Score 1 of 1
Question:
Work factor is defined as:
-
Response:
| the amount of effort/time required to maintain an established security plan once it has been implemented
|
| the amount of effort/time required by an administrator to establish a reasonable system security plan
|
| the amount of effort/time required by an attacker to overcome a protective measure
|
| the amount of effort/time required by an algorithm to fully encrypt or decrypt a message
|
-
Score 1 of 1
Question:
A WAN is
-
Response:
| a Wide Array Node
|
| the Westinghouse Address Naming convention
|
| one of the Wilson-Adder Need types
|
| a Working Authentication Name
|
| a Wide Area Network
|
-
Score 0 of 1
Question:
What OSI Layer includes data compression?
-
Response:
| Application
|
| Transport
|
| Network
|
| Datalink
|
| Presentation
|
-
Score 1 of 1
Question:
Motion detectors, video cameras, fences, locked doors, guards and dogs are all examples of
-
Response:
| Physical controls
|
| Administrative controls
|
| Technical controls
|
| Both Technical and Administrative controls
|
-
Score 1 of 1
Question:
Which of the following extinguishing methods is best for a computer or electrical fire?
-
Response:
| CO2
|
| Soda Acid
|
| ESD Blanket
|
| Water
|
-
Score 0 of 1
Question:
Which of the following is NOT a RAW authentication protocol?
-
Response:
| CHAP
|
| EAP
|
| PAP
|
| LDAP
|
-
Score 1 of 1
Question:
Which of the following is primarily focused on identifying violations and incidents?
-
Response:
| Detective
|
| Preventative
|
| Corrective
|
| Compensating
|
| Recovery
|
-
Score 1 of 1
Question:
Owner-set permissions are an example of:
-
Response:
| Clark-Wilson
|
| mandatory access control
|
| role-based access control
|
| Discretionary access control
|
-
Score 0 of 1
Question:
What is the primary difference between NIST and ISO ?
-
Response:
| NIST produces guidelines only available to federal agencies.
|
| ISO publications cover international standards and are therefore not applicable within the US
|
| NIST insures compliance only within the United States
|
Feedback:Actually, NIST is an informational resource and does not mandate compliance, they publish guidelines only - they are not a directive agency.
|
| NIST standards are free, ISO charges
|
-
Score 1 of 1
Question:
Falsely rejecting an authorized user is:
-
Response:
| FRR or Type I error
|
| CER or Type III error
|
| FAR or Type II error
|
| FRA or Type IV error
|
-
Score 0 of 1
Question:
What is the ideal humidity level for a data center?
-
Response:
| 30-50%
|
| 60-80%
|
| 20-40%
|
| 40-60%
|
-
Score 1 of 1
Question:
Bell-La Padula focuses primarily on:
-
Response:
| Availability
|
| Data Integrity
|
| Authentication
|
| Accessibility
|
| Confidentialty
|
-
Score 1 of 1
Question:
Which OSI layer includes the LLC and MAC sub-layers?
-
Response:
| Session
|
| Physical
|
| Data Link
|
| Network
|
| Transport
|
-
Score 1 of 1
Question:
How many keys does symmetric cryptography use for a single piece of data?
-
Response:
| Depends on the key size vs. data size
|
| 2
|
| 1
|
Feedback:One key only, Vasily. Symmetric keys are shared passwords/keys between the sender and recipient.
|
| 4
|
-
Score 1 of 1
Question:
Which access control includes job rotation?
-
Response:
| Physical
|
| Administrative
|
| Organizational
|
| Technical
|
-
Score 1 of 1
Question:
Which of the following have the best CER?
-
Response:
| Iris Scanning
|
| Hand scanning
|
| Finger scanning
|
| Badge Scanning
|
-
Score 0 of 1
Question:
Which classification of fuel type is wood given?
-
Response:
| C
|
| A
|
| B
|
| D
|
-
Score 5 of 5
Question:
Match the following examples to their definitions
-
Response:
Match | User answer | Feedback |
Unpatched servers
| Vulnerability
| | |
A virus that relies on unpatched code or OS levels
| Threat
| | |
The likelihood a threat will be realized, the frequency of natural disasters
| Risk
| | |
$1M dollars per day downtime
| Exposure
| | |
A proxy server
| Countermeasure
| | |
-
Score 1 of 1
Question:
Which of the following would be the least useful in attempting to crack a password?
-
Response:
| LophtCrack
|
| John the Ripper
|
| Packet sniffing
|
| brute force/dictionary attack
|
| MAC the Knife
|
-
Score 1 of 1
Question:
A LAN is
-
Response:
| a Local Authentication Node
|
| a Least Access Notification
|
| a Linear Applebaum Network diagram
|
| a Local Account Name
|
| a Local Area Network
|
-
Score 1 of 1
Question:
Which of the following is not a typical layer 1 topology?
-
Response:
| bus
|
| star
|
| 2 layer star
|
| mesh
|
| ring
|
-
Score 0 of 1
Question:
Biometric authentication is most often hampered by:
-
Response:
| Cost to implement
|
| Initial Registration
|
| Rings/Weight change
|
| User acceptance
|
-
Score 1 of 1
Question:
Which of the following is immediately above the Transport Layer in the OSI model:
-
Response:
| Session
|
| Datalink
|
| Network
|
| Presentation
|
-
Score 1 of 1
Question:
Which of the following is the lowest in the OSI model:
-
Response:
| Application
|
| Data Link
|
| Network
|
| Transport
|
| Session
|
-
Score 1 of 5
Question:
More key terms from Chapter 2
-
Response:
Match | User answer | Feedback |
Weakness or lack of a countermeasure
| Vulnerability
| | |
Entity that can exploit a vulnerability
| Threat
| | |
The danger of having a vulnerability exploited
| Threat agent
| | |
The probability of a threat being realized
| Risk
| | |
Presence of a vulnerability which exposes the organization
| Exposure
| | |
-
Score 7 of 7
Question:
Match the following key management definitions and functions
-
Response:
Match | User answer | Feedback |
Keys must be created randomly, securely, without sequencing or plaintext displays
| Generation
| | |
Keys must be distributed securely, preferably via asymmetric systems
| Distribution
| | |
Keys must be readily available, manually invoked and integrity checked
| Installation
| | |
Keys should be protected at rest and prevent unauthorized access
| Storage
| | |
Keys should be protected, maintained with integrity checks and safe from frequency analysis
| Change
| | |
Keys should follow the least-access priviliege model and align with appropriate safeguards and levels of classification
| Control
| | |
Keys must be rotated out, ensuring proper remediation/destruction of storage media and outdated keys
| Disposal
| | |
-
Score 1 of 1
Question:
Which access control includes job rotation?
-
Response:
| Technical
|
| Organizational
|
| Physical
|
| Administrative
|
-
Score 1 of 1
Question:
Data stored on an encrypted file system (EFS, TrueCrypt, etc.) does not need to be encrypted when being sent over the network?
-
Response:
User answer | |
False | Protecting data-at-rest does not extend to data-in-transit. Often, encrypted data-at-rest is decrypted once it is read from the media, therefore re-encryption is needed before the data is sent over the ire (or becomes data-in-tansit)
|
-
Score 1 of 1
Question:
Hashing is used to
-
Response:
| provide authenticity / authentication
|
| ensure confidentiality
|
| verify integrity
|
| verify integrity and ensure confidentiality
|
-
Score 1 of 1
Question:
What is encrypted data called?
-
Response:
| Message Digest
|
| Ciphertext
|
| Payload
|
| Data-in-transit
|
-
Score 1 of 1
Question:
What formula provides total keyspace size?
-
Response:
| w[i] = (w[i-3] xor w[i-8] xor w[i-14] xor w[i-16])
|
| (n*(n-1))/2
|
| SLE x ALE
|
| m^e mod n
|
-
Score 1 of 1
Question:
A SHA-256 system will always generate different hashes when given the same plaintext, no matter how many times it is invoked
-
Response:
User answer | |
False | A hash is a hash is a hash, it never changes the output. Hashes are used to prove integrity, usually by comparing current hashes (aka message digests) against previous ones (stored filesystems checksums, for example) to prove nothing has changed. Therefore, a hashing algorithm must produce one and only one output per plaintext input.
|
-
Score 1 of 1
Question:
Which encryption method is most likely to be used to maintain data confidentiality on a mobile computing device (and why?)
-
Response:
| IDEA
|
| One-way hashing
|
| EC
|
| Merkle-Hellman Knapsack
|
-
Score 0 of 1
Question:
Determining whether a subject can log into a system is an example of
-
Response:
| Authentication
|
| Accountability
|
| Authorization
|
-
Score 1 of 1
Question:
Account administration, policies and standards, asset classification and reviews of audit trails are all examples of
-
Response:
| Both technical and administrative controls
|
| Technical controls
|
| Physical controls
|
| Administrative controls
|
-
Score 1 of 1
Question:
Job rotation policies provide improved security for all of the following reasons except:
-
Response:
| Reduces opportunities for abuse
|
| Promotes Professional growth
|
| Increases visibility for high-potential employees
|
| Identifies / Eliminates single points of failure
|
-
Score 1 of 5
Question:
Matchup - Terms
-
Response:
Match | User answer | Feedback |
Converts internal port numbers to external port numbers
| PAT
| | |
Converts MAC addresses to IP
| RARP
| | |
Converts Domain Names to IP
| DNS
| | |
Converts internal IP to external IP
| NAT
| | |
Converts IP to MAC Address
| ARP
| | |
-
Score 0 of 1
Question:
Which of the following is primarily focused on reducing risk?
-
Response:
| Corrective
|
| Deterrent
|
| Preventative
|
| Detective
|
| Recovery
|
-
Score 1 of 1
Question:
Which of the following packet switched networks uses HDLC?
-
Response:
| SONET
|
| SMDS
|
| ATM
|
| MPLS
|
| Frame Relay
|
-
Score 1 of 1
Question:
The ORIGINAL sender of a message encrypted using asymmetric algorithms can reverse/backout the process using the initial public key
-
Response:
User answer | |
False | Although technically, the original sender has an unencrypted version to start with, he/she cannot decrypted the message without the private key (because of the nature of asymmetric algorithms)
|
-
Score 1 of 1
Question:
Which of the following is NOT an example of biometric identification?
-
Response:
| Ear shape/pattern
|
| Retinal imagery
|
| Hand shape/pattern
|
| Voice
|
-
Score 1 of 1
Question:
Which of the following is primarily focused on restoring systems and information?
-
Response:
| Compensating
|
| Preventative
|
| Detective
|
| Recovery
|
| Corrective
|
-
Score 0 of 1
Question:
Which access control includes audit trails?
-
Response:
| Administrative
|
| Physical
|
| Owner
|
| Technical
|
| Organizational
|
-
Score 0 of 1
Question:
Which classification of fuel type are electrical fires given?
-
Response:
| A
|
| C
|
| D
|
| B
|
-
Score 1 of 1
Question:
Which of the following is the strongest wireless encryption?
-
Response:
| E0
|
| WPA2
|
Feedback:WPA2 replaced WPA and WEP and relies on AES instead of RC4 (as do WEP and WPA)
|
| WEP
|
| WPA
|
-
Score 0 of 1
Question:
Which classification of fuel type is a computer given?
-
Response:
| C
|
| B
|
| A
|
| D
|
-
Score 1 of 1
Question:
All of the following are true about encryption EXCEPT:
-
Response:
| Encryption algorithms are constant from version to version
|
| Encryption keys are constant from version to version
|
| Longer keys usually result in more secure encryption
|
| Encryption is used to protect the confidentiality of the data
|
-
Score 0 of 1
Question:
Which of the following components of a computer are best suited to brute force attacks?
-
Response:
| CPU - Central Processing Unit
|
Feedback:As it turns out GPU's (with their dedicated hardware of multiple ALU's) provide substantially more throughput than a standalone ALU or even a multicore CPU so GPU's, given their comparative speed for encryption hacking, are the preferred hacking hardware.
|
| GPU - Graphical Processing Unit
|
| SCU - Security Control Unit
|
| ALU - Arithmetic Logic Unit
|
-
Score 3 of 3
Question:
Match the following terms to definitions
-
Response:
Match | User answer | Feedback |
Training, configuration management of documentation, risk management
| Administrative controls
| | |
Firewalls, IDS, encryption
| Technical controls
| | |
Lighting, Fencing, guard patrols
| Physical Controls
| | |
-
Score 0 of 1
Question:
Which classification of fuel type is grease given?
-
Response:
| D
|
| A
|
| C
|
| B
|
-
Score 0 of 1
Question:
Clark-Wilson focuses primarily on:
-
Response:
| Address Integrity
|
| Availability
|
| Confidentialty
|
| Accessibility
|
| Authentication
|
-
Score 2 of 6
Question:
Match the following terms and definitions
-
Response:
Match | User answer | Feedback |
Intended to discourage a potential attacker
| Deterrent
| | |
Intended to avoid an incident from happening
| Preventive
| | |
Fixes component or systems after an incident has occurred
| Recovery
| | |
Intended to bring the environment back to production levels
| Recovery
| | |
Identify an incidents activities
| Detective
| | |
Alternate measures of control
| Corrective
| | |
-
Score 5 of 5
Question:
Match the following cryptographic definitions to their terms
-
Response:
Match | User answer | Feedback |
Replacing one value for another using static or dynamic lookup tables
| Substitution
| | |
Swapping values around using static or dynamic lookup tables
| Transposition
| | |
Removing redundant or common letters/phrases from plaintext
| Compression
| | |
Adding redundant or common letters to plaintext to create a more complex encrypted message
| Expansion
| | |
Adding redundant or repeating letters to expand plaintext to create a more appropriately sized encrypted message
| Padding
| | |
-
Score 1 of 1
Question:
How many levels are there in the latest (June 2013) OSI model?
-
Response:
| 6
|
| 8
|
| 10
|
| 7
|
| 5
|
-
Score 1 of 1
Question:
VoIP uses which protocol for AV streaming
-
Response:
| TCP/IP
|
| H.264
|
| Vorbis
|
| SRTP
|
Feedback:Secure Real-time Transport Protocol
|
-
Score 1 of 1
Question:
Which access control includes cameras?
-
Response:
| Physical
|
| Organizational
|
| Visual
|
| Administrative
|
| Technical
|
-
Score 1 of 1
Question:
Which access control includes intrusion detection?
-
Response:
| Administrative
|
| Techincal
|
| Organizational
|
| Owner
|
| Physical
|
| Technical
|
-
Score 0 of 1
Question:
Which of the following is NOT an example of SSO?
-
Response:
| KryptoKnight
|
| LDAP
|
| SESAME
|
| KErberos
|
-
Score 0 of 1
Question:
Which of the following is a remote authentication system?
-
Response:
| OpenVPN
|
| TACACS
|
| KERBEROS
|
| SESAME
|
-
Score 1 of 1
Question:
Which of the following are the three components of the fire triangle?
-
Response:
| Heat/Fuel/Oxygen
|
| Heat/Combustion/Oxygen
|
| Fire/Combustion/Oxygen
|
| Fire/Fuel/Oxygen
|
-
Score 1 of 1
Question:
John's computer access changed with his reassignment to a new department. This is an example of:
-
Response:
| Need-to-Know control
|
| Mandatory access control
|
| Role-based access control
|
| Access List Control
|
| Owner set access control
|
-
Score 1 of 1
Question:
Encryption is related to Confidentiality, Hashing is related to
-
Response:
| Confidentiality
|
| Authenticity
|
| Integrity
|
| Availability
|
-
Score 0 of 1
Question:
Which of the following packet switched networks is best suited for fiber optic networks with sporadic traffic?
-
Response:
| SMDS
|
| SONET
|
| MPLS
|
| Frame Relay
|
| ATM
|
-
Score 1 of 1
Question:
Which access control includes training?
-
Response:
| Technical
|
| Administrative
|
| Organizational
|
| Physical
|
-
Score 1 of 1
Question:
Which access control includes asset classification?
-
Response:
| Physical
|
| Organizational
|
| Owner
|
| Administrative
|
| Technical
|
-
Score 0 of 5
Question:
Match the following cryptology tools and technologies
-
Response:
Match | User answer | Feedback |
One-time pads
| Electronic
| Still in use in some instances. Recall, one-time pads are the most secure approach
| |
Enigma machine
| Mechanical
| Electrical lights, mechanical crank/spinwheel
| |
AES, RSA Algorithms
| Quantum cryptography
| I know, you wanted to think "digital" but technically, electronic works as well
| |
Cipherdisks
| Mechanical
| Think ceasar's spin wheel here
| |
Single photon emissions
| Electro-mechanical
| used to provide secure key negotiation. After the test, go google "einstein spooky action" to see what will keep future CISSP's from sleeping at night
| |
-
Score 0 of 1
Question:
What OSI Layer includes data encryption?
-
Response:
| Application
|
| Transport
|
| Datalink
|
| Presentation
|
| Network
|
-
Score 1 of 1
Question:
Encryption, access control mechanisms, access control lists and remote access authentication protocols are all examples of
-
Response:
| Technical controls
|
| Both Technical and Administrative
|
| Administrative Controls
|
| Physical Controls
|
-
Score 1 of 1
Question:
Which access control includes motion detectors?
-
Response:
| Technical
|
| Administrative
|
| Authentication
|
| Organizational
|
| Physical
|
-
Score 1 of 1
Question:
Which classification of fuel type is paper given?
-
Response:
| C
|
| A
|
| D
|
| B
|
-
Score 1 of 1
Question:
Which of the folowing is best suited for short messages (one block in size)
-
Response:
| CBC
|
| ECB
|
Feedback:Actually, this is one of the few instances where ECB's disadvantages don't overcome its advantages
|
| CFB
|
| CCMP
|
-
Score 1 of 1
Question:
Asymmetric cryptography is more secure, faster and more scalable than symmetric encryption
-
Response:
User answer | |
False | Symmetric encryption can be 100 faster than asymmetric and are generally more available to organizations.
|
-
Score 1 of 1
Question:
Which of the following is primarily focused on identifying alternate solutions to achieve a task?
-
Response:
| Preventative
|
| Recovery
|
| Detective
|
| Corrective
|
| Compensating
|
-
Score 4 of 4
Question:
Match the following key terms
-
Response:
Match | User answer | Feedback |
Availability
| Reliable and timely access to data and resources
| | |
Confidentiality
| Necessary level of secrecy, unauthorized disclosure is prevented
| | |
Shoulder surfing
| Unauthorized viewing of information (screen peeking)
| | |
Social Engineering
| Tricking someone into giving sensitive information (to gain unauthorized access)
| | |
-
Score 0 of 1
Question:
"The strength of the cryptosystem is a function of the keys, not the algorithm" is also known as
-
Response:
| Kerckhoff's Principle
|
| Moore's Law
|
| Diffe-Hillman's Axiom
|
| Rijndael's Challenge
|
-
Score 0 of 1
Question:
Which classification of fuel type is gasoline given?
-
Response:
| B
|
| D
|
| C
|
| A
|
-
Score 5 of 5
Question:
Match the following control types to their purposes
-
Response:
Match | User answer | Feedback |
Reducing Risk
| Preventative
| | |
Correcting violations and incidents
| Detective
| Corrective controls also help improve existing preventative and detective controls
| |
Discouraging violations
| Deterrent
| | |
Providing alternate ways of accomplishing a task
| Compensating
| | |
Restoring systems and information
| Recovery
| | |
-
Score 1 of 1
Question:
Which of the following is immediately above the Data Link Layer in the OSI model:
-
Response:
| Presentation
|
| Session
|
| Datalink
|
| Network
|
| Transport
|
-
Score 1 of 1
Question:
Which access control includes locked doors?
-
Response:
| Organizational
|
| Technical
|
| Owner
|
| Physical
|
| Administrative
|
-
Score 1 of 1
Question:
Which of the following packet switched networks is best suited to support fully meshed VPNs?
-
Response:
| SMDS
|
| Frame Relay
|
| SONET
|
| MPLS
|
| ATM
|
-
Score 1 of 1
Question:
A cryptosystem's strength is primarily based on
-
Response:
| The closedness of the algorithm (how well-protected it is, how proprietary it is)
|
| The Security Parameter Index (SPI)
|
| The cryptographic key
|
| The openness of the algorithm (how widely available it is, how well-published it is)
|
-
Score 1 of 1
Question:
Which of the following is the lowest in the OSI model:
-
Response:
| Data Link
|
| Transport
|
| Session
|
| Physical
|
| Network
|
-
Score 1 of 1
Question:
Which access control requires sensitivity labels on all subjects and objects?
-
Response:
| Mandatory access control
|
| Role-based access control
|
| Manager set control
|
| Access List Control
|
| Discretionary access control
|
-
Score 1 of 1
Question:
Which of the following is the highest in the OSI model:
-
Response:
| Presentation
|
| Transport
|
| Data Link
|
| Physical
|
| Network
|
-
Score 1 of 1
Question:
Which access control protects the entire system?
-
Response:
| System Access Controls
|
| Operating System Controls/Policies
|
| Data Access Controls
|
| Access Control Lists
|
| Firewalls/IPS
|
-
Score 1 of 1
Question:
How many bits are in a SHA1 hash (or message digest)?
-
Response:
| 160
|
| 256
|
| 255
|
| 1024
|
-
Score 1 of 1
Question:
Which of the following uses fixed-size blocks of data as well as previous blocks of text for encryption
-
Response:
| CFB - Cipher Feed Back
|
| SBC - Sequential Block Coding
|
| CBC - Cipher Block Chaining
|
| ECB - Electronic Code Book
|
-
Score 1 of 1
Question:
In MAC the access policy is set by:
-
Response:
| the role
|
| the system
|
| the owner
|
| network ACL
|
| the GPO
|