Cybersecurity Concepts and Practices, Exams of Database Management Systems (DBMS)

Download Cybersecurity Concepts and Practices and more Exams Database Management Systems (DBMS) in PDF only on Docsity! SSCP Test Questions with correct answers B Correct Answer-DES - Data Encryption standard has a 128 bit key and is very difficult to break. A. True B. False B Correct Answer-What is the main difference between computer abuse and computer crime? A. Amount of damage B. Intentions of the perpetrator C. Method of compromise D. Abuse = company insider; crime = company outsider C Correct Answer-A standardized list of the most common security weaknesses and exploits is the __________. A. SANS Top 10 B. CSI/FBI Computer Crime Study C. CVE - Common Vulnerabilities and Exposures D. CERT Top 10 C Correct Answer-A salami attack refers to what type of activity? A. Embedding or hiding data inside of a legitimate communication - a picture, etc. B. Hijacking a session and stealing passwords C. Committing computer crimes in such small doses that they almost go unnoticed D. Setting a program to attack a website at11:59 am on New Year's Eve D Correct Answer-Multi-partite viruses perform which functions? A. Infect multiple partitions B. Infect multiple boot sectors C. Infect numerous workstations D. Combine both boot and file virus behavior B Correct Answer-What security principle is based on the division of job responsibilities - designed to prevent fraud? A. Mandatory Access Control B. Separation of Duties C. Information Systems Auditing D. Concept of Least Privilege A Correct Answer-________ is the authoritative entity which lists port assignments A. IANA B. ISSA C. Network Solutions D. Register.com C. Accessibility D. Accountability E. Forensics A,B,C Correct Answer-There are 5 classes of IP addresses available, but only 3 classes are in common use today, identify the three: (Choose three) A. Class A: 1-126 B. Class B: 128-191 C. Class C: 192-223 D. Class D: 224-255 E. Class E: 0.0.0.0 - 127.0.0.1 B Correct Answer-The ultimate goal of a computer forensics specialist is to ___________________. A. Testify in court as an expert witness B. Preserve electronic evidence and protect it from any alteration C. Protect the company's reputation D. Investigate the computer crime A Correct Answer-One method that can reduce exposure to malicious code is to run applications as generic accounts with little or no privileges. A. True B. False Risk assessment Correct Answer-______________ is a major component of an overall risk management program. Cryptanalysis Correct Answer-An attempt to break an encryption algorithm is called _____________. C Correct Answer-The act of intercepting the first message in a public key exchange and substituting a bogus key for the original key is an example of which style of attack? A. Spoofing B. Hijacking C. Man In The Middle D. Social Engineering E. Distributed Denial of Service (DDoS) Cramming Correct Answer-If Big Texas telephone company suddenly started billing you for caller ID and call forwarding without your permission, this practice is referred to as __________________. Disable Correct Answer-When an employee leaves the company, their network access account should be __________? 90 Correct Answer-Passwords should be changed every ________ days at a minimum. 90 days is the recommended minimum, but some resources will tell you that 30-60 days is ideal. C Correct Answer-IKE - Internet Key Exchange is often used in conjunction with what security standard? A. SSL B. OPSEC C. IPSEC D. Kerberos E. All of the above A Correct Answer-Wiretapping is an example of a passive network attack? A. True B. False A,C,E Correct Answer-What are some of the major differences of Qualitative vs. Quantitative methods of performing risk analysis? (Choose all that apply) A. Quantitative analysis uses numeric values B. Qualitative analysis uses numeric values C. Quantitative analysis is more time consuming D. Qualitative analysis is more time consuming E. Quantitative analysis is based on Annualized Loss Expectancy (ALE) formulas F. Qualitative analysis is based on Annualized Loss Expectancy (ALE) formulas A Correct Answer-EDI (Electronic Data Interchange) differs from e-Commerce in that ___________________. A. EDI involves only computer to computer transactions B. E-Commerce involves only computer to computer transactions C. EDI allows companies to take credit cards directly to consumers via the web D. None of the items listed accurately reflect the differences between EDI and e- Commerce Macro Correct Answer-A type of virus that resides in a Word or Excel document is called a ___________ virus? C Correct Answer-Vulnerability x Threat = RISK is an example of the _______________. A. Disaster Recovery Equation B. Threat Assessment C. Risk Equation D. Calculation of Annual Loss Expectancy B Correct Answer-Only law enforcement personnel are qualified to do computer forensic investigations. A. True B. False A,B,C Correct Answer-Countermeasures have three main objectives, what are they? (Choose all that apply) A. Prevent B. Recover C. Detect D. Trace E. Retaliate ISO Correct Answer-___________________ is responsible for creating security policies and for communicating those policies to system users. D Correct Answer-An intrusion detection system is an example of what type of countermeasure? A. Preventative B. Corrective C. Subjective D. Detective E. Postulative A Correct Answer-So far, no one has been able to crack the IDEA algorithm with Brute Force. A. True B. False Confidentiality Correct Answer-______________ relates to the concept of protecting data from unauthorized users. B Correct Answer-Which auditing practice relates to the controlling of hardware, software, firmware, and documentation to insure it has not been improperly modified? A. System Control B. Configuration Control C. Consequence Assessment D. Certification / Accreditation A Correct Answer-MD5 is a ___________ algorithm A. One way hash B. 3DES C. 192 bit D. PKI A,B Correct Answer-Which of the following is an example of One-Time Password technology? (Choose all that apply) A. S/Key B. OPIE C. LC3 D. MD5 C. IT personnel to determine access rights D. Security Officers to determine access rights E. Security Officers to delegate authority to other users Data Hiding Correct Answer-Intentionally embedding secret data into a picture or some form of media is known as Steganographyor data ___________. F Correct Answer-From a security standpoint, the product development life cycle consists of which of the following? A. Code Review B. Certification C. Accreditation D. Functional Design Review E. System Test Review F. All of the items listed B Correct Answer-Only key members of the staff need to be educated in disaster recovery procedures. A. True B. False B Correct Answer-A virus is considered to be "in the ______ " if it has been reported as replicating and causing harm to computers. A. Zoo B. Wild C. Cage D. Jungle E. Fire A Correct Answer-____________ is used in mission critical systems and applications to lock down information based on sensitivity levels (Confidential, Top Secret, etc.. A. MAC - Mandatory Access Control B. DAC - Discretionary Access Control C. SAC - Strategic Access Control D. LAC - Limited Access Control E Correct Answer-___________________ viruses change the code order of the strain each time they replicate to another machine. A. Malicious B. Zenomorphic C. Worm D. Super E. Polymorphic D Correct Answer-Which major vendor adopted TACACS into its product line as a form of AAA architecture? A. Microsoft B. Dell C. Sun D. Cisco E. All of the above A,B,C Correct Answer-Name three types of firewalls __________, _______________, and _________________ (Choose three) A. Packet Filtering B. Application Proxy C. Stateful Inspection D. Microsoft Proxy E. SonicWall F. Raptor Firewall D Correct Answer-This free (for personal use) program is used to encrypt and decrypt emails. A. SHA-1 B. MD5 C. DES unauthorized access to network systems. A. Sniffing B. Eavesdropping C. Social Engineering D. Shoulder Surfing E. None of the items are correct B Correct Answer-Diffie Hellman, RSA, and ___________ are all examples of Public Key cryptography? A. SSL - Secure Sockets Layer B. DSS - Digital Signature Standard C. Blowfish D. AES - Advanced Encryption Standard B Correct Answer-___________, generally considered "need to know" access is given based on permissions granted to the user. A. MAC - Mandatory Access Control B. DAC - Discretionary Access Control C. SAC - Strategic Access Control D. LAC - Limited Access Control B C D Correct Answer-What are the main goals of an information security program? (Choose all that apply) A. Complete Security B. Confidentiality C. Availability D. Integrity of data E. Ease of Use B Correct Answer-The ability to adjust access control to the exact amount of permission necessary is called ______________. A. Detection B. Granularity C. Separation of Duties D. Concept of Least Privilege C Correct Answer-Which one of these formulas is used in Quantitative risk analysis? A. SLO - Single Loss Occurrence B. ARE - Annual Rate of Exposure C. SLE - Single Loss Expectancy D. ALO - Annual Loss Occurrence Answer: C A Correct Answer-Integrity = ______________ A. Data being delivered from the source to the intended receiver without being altered B. Protection of data from unauthorized users C. Data being kept correct and current D. Ability to access data when requested E. All answers are correct A Correct Answer-A true network security audit does include an audit for modems? A. True B. False A B Correct Answer-What is the main difference between a logic bomb and a stealth virus? (Choose all that apply) A. Stealth viruses supply AV engines with false information to avoid detection B. Stealth viruses live in memory while logic bombs are written to disk C. Stealth viruses "wake up" at a pre-specified time in the code, then execute payload D. Logic Bombs supply AV engines with false information to avoid detection D Correct Answer-What is the minimum recommended length of a security policy? A. True B. False C Correct Answer-If you the text listed below at the beginning or end of an email message, what would it be anindication of? mQGiBDfJY1ERBADd1lBX8WlbSHj2uDt6YbMVl4Da3O1yG0exQnEwU3sKQ ARzspNB zB2BF+ngFiy1+RSfDjfbpwz6vLHo6zQZkT2vKOfDu1e4/LqiuOLpd/6rOrmH/ Mvk A. A virus B. A worm C. A PGP Signed message D. A software error A Correct Answer-Although they are accused of being one in the same, hackers and crackers are two distinctly different groups with different goals pertaining to computers. A. True B. False A C D Correct Answer-Select three ways to deal with risk. A. Acceptance B. Avoid / Eliminate C. Transfer D. Mitigate E. Deny C Correct Answer-Digital Certificates use which protocol? A. X.400 B. X.500 C. X.509 D. X.511 E. X.525 F. None of the above B Correct Answer-A. L2TP B. LDAP C. L2F D. PPTP encrypting, depcrypting Correct Answer-Public keys are used for ___________ messages and private keys are used for __________ messages. B Correct Answer-In a Public Key Infrastructure (PKI), what is the role of a directory server? A. To issue certificates to users B. To make user certificates available to others C. Authorizes CA servers to issue certificates to users D. Is the root authority for thePKI D Correct Answer-RSA has all of the following characteristics except? A. Can produce a digital signature B. Relies on large prime number factoring C. Uses third party key distribution centers D. Is based on a symmetric algorithm C Correct Answer-What distinguishes a hacker / cracker from a phreak? A. Hackers and crackers specifically target telephone networks B. Phreaks specifically target data networks C. Phreaks specifically target telephone networks D. Phreaks cause harm, hackers and crackers do not C Correct Answer-Identifying specific attempts to penetrate systems is the function of the _______________. A. Firewall B. Router C. Intrusion Detection System D. Vulnerability Scanner E. CERT - Computer Emergency Response Team B. 3DES C. RSA D. 3RSA E. Blowfish F. All of the above A B C Correct Answer-Which of the following are NT Audit events? (Choose all that apply) A. Logon and Logoff B. Use of User Rights C. Security Policy Change D. Registry Tracking E. All of choices are correct D Correct Answer-The most secure method for storing backup tapes is? A. In a locked desk drawer B. In the same building, but on a different floor C. In a cool dry climate D. Off site in a climate controlled area E. In a fire proof safe inside the data center (for faster retrieval) F. None of the above Sniffer Correct Answer-__________ is a tool used by network administrators to capture packets from a network. C Correct Answer-The IDEA algorithm (used in PGP) is _______ bits long. A. 56 B. 158 C. 128 D. 168 E Correct Answer-Which organization(s) are responsible for the timely distribution of information security intelligence data? A. CERT B. SANS C. CERIAS D. COAST E. All of the organizations listed E Correct Answer-A password audit consists of checking for ____________? A. Minimum password length B. Password aging C. Password Strength D. Blank Passwords E. All of the items listed Authentication, Authorization Correct Answer-Accounting, __________, and ____________ are the AAAs of information security. D Correct Answer-What term describes the amount of risk that remains after the countermeasures have been deployed and the vulnerabilities classified? A. Terminal risk B. Infinite risk C. Imminent risk D. Residual risk B Correct Answer-Risk assessment deals with constant monitoring? A. True B. False E Correct Answer-Countermeasures address security concerns in which of the following categories? A. Physical B. Operations C. Computer D. Communication E. Information F. All of the listed categories B. Fingerprints C. Face Recognition D. Voice Recognition E. All of the above F. None of the above C Correct Answer-Smart cards are a secure alternative to which weak security mechanism? A. Biometrics B. Public Key Encryption C. Passwords D. Tokens D Correct Answer-What type of software can be used to prevent, detect (and possibly correct) malicious activities on a system? A. Personal Firewall B. IDS - host based C. Antivirus D. All methods listed C Correct Answer-Information security policies are a ___________________. A. Necessary evil B. Waste of time C. Business enabler D. Inconvenience for the end user E. All of the answers are correct B Correct Answer-Macintosh computers are not at risk for receiving viruses. A. True B. False Hoaxes Correct Answer-Unlike like viruses and worm, __________ are bogus messages that spread via email forwarding. D Correct Answer-There are 6 types of security control practices. ___________ controls are management policies, procedures, and guidelines that usually effect the entire system. These types of controls deal with system auditing and usability. A. Preventive B. Detective C. Corrective D. Directive E. Recovery F. Combination host based, network based Correct Answer-Name two types of Intrusion Detection Systems ________ and ________. A Correct Answer-Today, privacy violations are almost as serious as security violations? A. True B. False D Correct Answer-_________ is a protocol developed by Visa and MasterCard to protect electronic transactions. A. SSL B. SHA-1 C. HMAC D. SET E. ETP F Correct Answer-Which of the following are Unix / Linux based security tools? A. Tiger B. TCP Wrappers C. TripWire D. LogCheck E. SATAN F. All of the tools listed can work on theUnix platforms B Correct Answer-Layer 4 of the OSI model corresponds to which layer of the DoD model?