CIS 333 Week 11 Final Exam Set 2 NEW

02 Jun CIS 333 Week 11 Final Exam Set 2 NEW

 

Question 1  ____________ is the amount of time it takes to recover and make a system, application, and data available for use after an outage.                           

Question 2  The requirement to keep information private or secret is the definition of __________.   

Question 3 The _________ Domain connects remote users to the organization’s IT infrastructure.

Question 4   A ___________ gives priorities to the functions an organization needs to keep going.

Question 5  ___________ is the process of transforming data from cleartext into ciphertext.    

Question 6  Today, people working in cyberspace must deal with new and constantly evolving ________.                            

Question 7  The director of IT security is generally in charge of ensuring that the ____________ conforms to policy.                        

Question 8  A ________ is a collection of computers connected to one another or to a common connection medium.

Question 9 The goal and objective of a __________ is to provide a consistent definition for how an organization should handle and secure different types of data.           

Question 10  Which of the following is the definition of ciphertext?     

Question 11  What term is used to describe streamlining processes with automation or simplified steps?

Question 12  Audio conferencing is a software-based, real-time audio conference solution for ________ callers.                                   

Question 13  What is meant by digital subscriber line (DSL)?               

Question 14  Medical practices and hospitals realized early on that ________ provide(s) the ability to provide access to the necessary information without having to invest in many computers and network infrastructure.                      

Question 15 What term is used to describe communication that doesn’t happen in real time but rather consists of messages (voice or e-mail) that are stored on a server and downloaded to endpoint devices?

Question 16  E-commerce systems and applications demand strict C-I-A ________.       

Question 17  If VoIP traffic needs to traverse through a WAN with congestion, you need ___________.          

Question 18  What name is given to a high-speed broadband networking technology that uses a 53-byte cell to support real-time voice, video, or data communications?

Question 19 What is meant by application convergence?                       

Question 20  Network devices can implement ___________ to better support VoIP and SIP IP packets and reduce dropped calls and delays.              

Question 21  What is meant by firewall?   

Question 22 When an attacker discovers a __________, he or she can use it to bypass existing security controls such as passwords, encryption, and so on.           

Question 23  ________ is a type of attack in which the attacker takes control of a session between two machines and masquerades as one of them.        

Question 24  A _________ has a hostile intent, possesses sophisticated skills, and may be interested in financial gain. They represent the greatest threat to networks and information resources.                                         

Question 25  A software program that collects information about Internet usage and uses it to present targeted advertisements to users is the definition of ________.    

Question 26  Another type of attacker is called a ________. This is a person with little or no skill who simply follows directions or uses a “cookbook” approach to carrying out a cyberattack without understanding the meaning of the steps he or she is performing.     

Question 27  An attempt to exploit a vulnerability of a computer or network component is the definition of ________.          

Question 28  What name is given to any event that results in a violation of any of the C-I-A security tenets?                       

Question 29  What is meant by rootkit?                

Question 30  What is meant by promiscuous mode?                  

Question 31 __________ is rapidly becoming an increasingly important aspect of enterprise computing.       

Question 32 ________ is the difference between the security controls you have in place and the controls you need to have in place in order to address all vulnerabilities.     

Question 33  Which of the following is the definition of business drivers?                  

Question 34  When you accept a __________, you take no further steps to resolve.                                           

Question 35  The first step in risk analysis is to determine what and where the organization’s _________ are located.                                  

Question 36  Your _________ plan shows that you have examined risks to your organization and have developed plans to address each risk.      

Question 37  What name is given to any risk that exists but has a defined response?                                               

Question 38  The goal of ____________ is to quantify possible outcomes of risks, determine probabilities of outcomes, identify high-impact risks, and develop plans based on risks.

Question 39  Any organization that is serious about security will view ___________ as an ongoing process.                          

Question 40  A ___________ will help identify not only which functions are critical, but also how quickly essential business functions must return to full operation following a major interruption.                                      

Question 41  The Bell-La Padula access control model focuses primarily on ________.

Question 42 Which of the following adequately defines continuous authentication? 

Question 43  ________ is an authorization method in which access to resources is decided by the user’s formal status.

Question 44  What name is given to an access control method that bases access control approvals on the jobs the user is assigned?   

Question 45  An organization’s facilities manager might give you a security card programmed with your employee ID number, also known as a ________.

Question 46  ________ is an authentication credential that is generally longer and more complex than a password.

Question 47  What is meant by multi-tenancy?                            

Question 48  What is meant by physically constrained user interface?            

Question 49  How is decentralized access control defined?                   

Question 50  A method of restricting resource access to specific periods of time is called ________.                          

Question 51 When an information security breach occurs in your organization, a __________ helps determine what happened to the system and when.                                      

Question 52  What is meant by certification?                               

Question 53  What term is used to describe a benchmark used to make sure that a system provides a minimum level of security across multiple applications and across different products?        

Question 54  What term is used to describe a set of step-by-step actions to be performed to accomplish a security requirement, process, or objective?

Question 55  What or who is the individual or team responsible for performing the security test and evaluation for the system and for preparing the report for the AO on the risk of operating the system?

Question 56  The ___________ team’s responsibilities include handling events that affect your computers and networks and ultimately can respond rapidly and effectively to any event.                 

Question 57  The process of managing the baseline settings of a system device is called ________.                

Question 58  Which of the following is the definition of guideline?                                                       

Question 59  Enacting changes in response to reported problems is called ________.                                                                          

Question 60  Which of the following is the definition of system owner?                      

Question 61  SOC 2 and SOC 3 reports both address primarily ________-related controls.

Question 62  Security audits help ensure that your rules and __________ are up to date, documented, and subject to change control procedures.                                          

Question 63  One of the best ways to avoid wasting your organization’s resources is to ensure that you follow the ________ review cycle.                              

Question 64  What is meant by gray-box testing?            

Question 65  The ___________ framework defines the scope and contents of three levels of audit reports.                           

Question 66  The primary difference between SOC 2 and SOC 3 reports is ________.               

Question 67 _________ was developed for organizations such as insurance and medical claims processors, telecommunication service providers, managed services providers, and credit card transaction processing companies.    

Question 68  As your organization evolves and as threats mature, it is important to make sure your __________ still meet(s) the risks you face today.                                

Question 69  ________ gives you the opportunity to review your risk-management program and to confirm that the program has correctly identified and reduced (or otherwise addressed) the risks to your organization.

Question 70  Audits also often look at the current configuration of a system as a snapshot in time to verify that it complies with ________.                                   

Question 71  The ________ identifies staff reaction and response times as well as inefficiencies or previously unidentified vulnerabilities. All members of the staff involved in operations or procedures participate in the test.    

Question 72  Forensics and incident response are examples of ___________ controls.                          

Question 73  A _________ determines the extent of the impact that a particular incident would have on business operations over time.                  

Question 74  A(n) ________ is a measurable occurrence that has an impact on the business.                          

Question 75 ___________ is the likelihood that a particular threat exposes a vulnerability that could damage your organization.               

Question 76  An attacker or event that might exploit a vulnerability is a(n) ____________.        

Question 77 ________ attempts to describe risk in financial terms and put a dollar value on all the elements of a risk.

Question 78  A(n) ________ is an intent and method to exploit a vulnerability.  

Question 79  ___________ refers to the amount of harm a threat can cause by exploiting a vulnerability.

Question 80  A control involved in the process of developing and ensuring compliance with policy and procedures is the definition of ________.     

Question 81  Without any knowledge of the key, an attacker with access to an encrypted message and the decryption cipher could try every possible key to decode the message. This is referred to as ________.       

Question 82 What name is given to random characters that you can combine with an actual input key to create the encryption key?                         

Question 83  _______________ is another symmetric algorithm that organizations currently use. It is a 64-bit block cipher that has a variable key length from 32 to 448 bits. It is much faster than DES or IDEA and is a strong algorithm that has been included in more than 150 products, as well as v2.5.47 of the Linux kernel. Its author, Bruce Schneier, placed it in the public domain.         

Question 84  Cryptography accomplishes four security goals: confidentiality, integrity, authentication, and ________________.                                  

Question 85  ________ is the act of unscrambling ciphertext into plaintext.

Question 86  What name is given to an encryption cipher that is a product cipher with a 56-bit key consisting of 16 iterations of substitution and transformation?

Question 87  What name is given to an encryption cipher that uniquely maps any letter to any other letter?                       

Question 88  The most scrutinized cipher in history is the ________.       

Question 89  A ________ is an encryption key used to encrypt other keys before transmitting them.             

Question 90  What is meant by checksum?                                   

Question 91  Which of the following is the definition of packet-filtering firewall?      

Question 92  A _____________ contains rules that define the types of traffic that can come and go through a network.

Question 93  What name is given to a protocol to implement a VPN connection between two computers?

Question 94  Which OSI Reference Model layer must translate the binary ones and zeros of computer language into the language of the transport medium?    

Question 95 Which OSI Reference Model layer is responsible for transmitting information on computers connected to the same local area network (LAN)?

Question 96  What term is used to describe the current encryption standard for wireless networks?

Question 97  ________ allows the computer to get its configuration information from the network instead of the network administrator providing the configuration information to the computer. It provides a computer with an IP address, subnet mask, and other essential communication information, simplifying the network administrator’s job.

Question 98  Which OSI Reference Model layer uses Media Access Control (MAC) addresses? Device manufacturers assign each hardware device a unique MAC address.                          

Question 99  A method to restrict access to a network based on identity or other rules is the definition of ________.                      

Question 100  A method to restrict access to a network based on identity or other rules is the definition of ________.                      

Question 101  In a __________, the attacker uses IP spoofing to send a large number of packets requesting connections to the victim computer. These appear to be legitimate but in fact reference a client system that is unable to respond.           

Question 102  Whether software or hardware based, a ____________ captures keystrokes, or user entries, and then forwards that information to the attacker.                                      

Question 103  Which of the following is the definition of logic bomb? 

Question 104  Unrecognized new processes running, startup messages indicating that new software has been (or is being) installed (registry updating), unresponsiveness of applications to normal commands, and unusual redirection of normal Web requests to unknown sites are all telltale symptoms of a ________.       

Question 105  Which of the following is the definition of botnet?         

Question 106  The purpose of the ________ is to “make the Internet work better.” It focuses on the engineering aspects of Internet communication and attempts to avoid policy and business questions. It is an open organization, and it has no membership requirements.                

Question 107  Today, _________ standards address a wide variety of topics, including power generation, power transmission and distribution, commercial and consumer electrical appliances, semiconductors, electromagnetics, batteries, solar energy, and telecommunications. The organization was also instrumental in the development of standards for electrical measurements, including the gauss, hertz, and weber.                               

Question 108  The ________ provides oversight for architecture for Internet protocols and procedures, processes used to create standards, editorial and publication procedures for RFCs, and confirmation of IETF chair and technical area directors. It also provides much of the high-level management and validation of the processes of conducting IETF business.    

Question 109  The _____________ is the preeminent organization for developing and publishing international standards for technologies related to electrical and electronic devices and processes.                                             

Question 110  ________ is a document produced by the IETF that contains standards as well as other specifications or descriptive contents.      

Question 111  An educational program that is generally associated with a college or university that provides formal courses that do not lead to degrees is the definition of ________.                        

Question 112  The standard bachelor’s degree is a __________ program.                       

Question 113  ________ refers to an educational institution that has successfully undergone evaluation by an external body to determine whether the institution meets applicable standards.                                                       

Question 114  The purpose of ________ is to provide formal training courses that lead to a certificate or professional certification and not a degree.

Question 115  The four main areas in NIST SP 800-50 are awareness, training, education, and __________________.                   

Question 116  Which is the highest level of Check Point certification for network security?             

Question 117   Which is Cisco’s highest level of certification?   

Question 118  The four main credentials of the ________ are Systems Security Certified Practitioner (SSCP®), Certified Information Systems Security Professional (CISSP®), Certified Authorization Professional (CAP®), and Certified Secure Software Lifecycle Professional (CSSLP®).                      

Question 119  The ____________ concentration from (ISC)2 is the road map for incorporating security into projects, applications, business processes, and all information systems.                                 

Question 120  CompTIA’s Security+ certification provides ________.                              

Question 121   The regulating agency for the Family Educational Rights and Privacy Act is the ________.

Question 122  The ________________ ,enacted as part of the American Recovery and Reinvestment Act of 2009, was designed to promote the widespread adoption and standardization of health information technology.                       

Question 123  Information regulated under the Gramm-Leach-Bliley Act is ________.              

Question 124  The regulating agency for the Sarbanes-Oxley Act is the ________.         

Question 125  Tier C violations under the HITECH Act are ________.