Suppose A (n) __________________________ is issued by senior management, and defines an
organizations security goals.
A. Records-retention procedure
B. Acceptable-use policy
C. Organizational security policy
D. Security policy mission statement
E. Service level agreement?
Explain Which of these metrics measure how a biometric device performs, when attempting to
authenticate subjects? (Choose THREE.)
A. False Rejection Rate
B. User Acceptance Rate
C. Crossover Error Rate
D. False Acceptance Rate
E. Enrollment Failure Rate?
A(n) _______________ is an abstract machine, which mediates all access subjects have to
B. Reference monitor
C. State machine
_________ is a smaller, enhanced version of the X.500 protocol. It is used to provide directory-
service information. (Choose the BEST answer.)
A. Lightweight Directory Access Protocol
B. X.400 Directory Access Protocol
C. Access control list
D. Lightweight Host Configuration Protocol
E. Role-based access control?
Explain Which types of security solutions should a home user deploy? (Choose TWO.)
A. Managed Security Gateway
B. Access control lists on a router
C. Personal firewall
D. Network intrusion-detection system
E. Anti-virus software?
____________________ is the state of being correct, or the degree of certainty a person or
process can have, that the data in an information asset is correct.
Maintenance of the Business Continuity Plan (BCP) must be integrated with an organizations
Embedding symbols in images or common items, such as pictures or quilts, is an example of
B. Transposition cipher
C. Key exchange
____________________ educate(s) security administrators and end users about organizations
A. Security-awareness training
B. Information Security (INFOSEC) briefings
C. Acceptable-use policies
D. Continuing education
E. Nondisclosure agreements?
Operating-system fingerprinting uses all of the following, EXCEPT ________, to identify a target
A. Sequence Verifier
B. Initial sequence number
C. Address spoofing
D. Time to Live
E. IP ID field?
Explain Which encryption algorithm has the highest bit strength?
E. Triple DES?
Explain Which type of Business Continuity Plan (BCP) test involves shutting down a primary site, bringing
an alternate site on-line, and moving all operations to the alternate site?
B. Full interruption
D. Structured walkthrough
A(n) _______________ is an unintended communication path that can be used to violate a
system security policy.
A. Covert channel
B. Integrity axiom
C. Simple rule violation
D. Inferred fact?
A _______ attack uses multiple systems to launch a coordinated attack.
A. Distributed denial-of-service
D. FTP Bounce
Virtual corporations typically use a(n) _______ for maintaining centralized information assets.
A. Off-line repository
B. Floppy disk
C. Data warehouse
D. CD-ROM burner
Which of the following is an example of a simple, physical-access control?
B. Access control list
C. Background check
Which of the following is NOT an auditing function that should be performed regularly?
A. Reviewing IDS alerts
B. Reviewing performance logs
C. Reviewing IDS logs
D. Reviewing audit logs
E. Reviewing system logs?
_______ can mimic the symptoms of a denial-of-service attack, and the resulting loss in
productivity can be no less devastating to an organization.
A. ICMP traffic
B. Peak traffic
C. Fragmented packets
D. Insufficient bandwidth
E. Burst traffic?
Explain How do virtual corporations maintain confidentiality?
C. Data hashes
D. Redundant servers
E. Security by obscurity?
Organizations _______ risk, when they convince another entity to assume the risk for them.
Explain What type of document contains information on alternative business locations, IT resources, and
A. End-user license agreement
B. Nondisclosure agreement
C. Acceptable use policy
D. Security policy
E. Business continuity plan?
A(n) _______ is the first step for determining which technical information assets should be
A. Network diagram
B. Business Impact Analysis
C. Office floor plan
E. Intrusion detection system?
Explain Which of the following is the BEST method for managing users in an enterprise?
A. Enter user data in a spreadsheet.
B. Implement centralized access control.
C. Deploy Kerberos.
D. Place them in a centralized Lightweight Directory Access Protocol.
E. Use a Domain Name System.
Explain Which of the following should be included in an enterprise Business Continuity Plan (BCP)?
A. Accidental or intentional data deletion
B. Severe weather disasters
C. Employee terminations
D. Employee administrative leave
E. Minor power outages
Explain Which principle of secure design states that a security mechanisms methods must be testable?
A. Separation of privilege
B. Least common mechanism
C. Complete mediation
D. Open design
E. Economy of mechanism
_______ intrusion-detection systems learn the behavior of a machine or network, and create a
A. Behavioral analysis
B. Statistical anomaly
D. Pattern matching
(n) ________________ is a one-way mathematical function that maps variable values into
smaller values of a fixed length.
A. Symmetric key
C. Back door
D. Hash function
Explain Which of the following tests provides testing teams some information about hosts or networks?
A. Partial-knowledge test
B. Full-knowledge test
C. Zero-knowledge test
A new U.S. Federal Information Processing Standard specifies a cryptographic algorithm. This
algorithm is used by U.S. government organizations to protect sensitive, but unclassified,
information. What is the name of this Standard?
A. Triple DES
Explain Which of the following are enterprise administrative controls? (Choose TWO.)
A. Network access control
B. Facility access control
C. Password authentication
D. Background checks
E. Employee handbooks
_______ is a method of tricking users into revealing passwords, or other sensitive information.
A. Dumpster diving
B. Means testing
C. Social engineering
Explain Who should have physical access to network-connectivity devices and corporate servers?
A. Customers and clients
B. Accounting, information-technology, and auditing staff
C. Managers and C-level executives
D. Only appropriate information-technology personnel
A(n) ______________________________ is a quantitative review of risks, to determine how an
organization will continue to function, in the event a risk is realized.
A. Monitored risk process
B. Disaster-recovery plan
C. Business impact analysis
D. Full interruption test
E. Information security audit
Explain Which of the following can be stored on a workstation? (Choose TWO.)
A. Payroll information
B. Data objects used by many employees
D. Interoffice memo
E. Customer correspondence
Explain Which type of Business Continuity Plan (BCP) test involves practicing aspects of the BCP,
without actually interrupting operations or bringing an alternate site on-line?
A. Structured walkthrough
D. Full interruption