Pastebin launched a little side project called VERYVIRAL.com, check it out ;-) Want more features on Pastebin? Sign Up, it's FREE!
Guest

Untitled

By: a guest on Dec 13th, 2010  |  syntax: None  |  size: 31.03 KB  |  views: 8,840  |  expires: Never
download  |  raw  |  embed  |  report abuse  |  print
Text below is selected. Please press Ctrl+C to copy to your clipboard. (⌘+C on Mac)
  1. __A__   1.      Regarding access control, a(n) ____ is a specific resource, such as a file or a hardware device.
  2. a.      object  c.      operation
  3. b.      subject d.      asset
  4.  
  5.  
  6. __B__   2.      Regarding access control, a(n) ____ is a user or a process functioning on behalf of the user who attempts to access an object.
  7. a.      object  c.      operation
  8. b.      subject d.      asset
  9.  
  10.  
  11. __C__   3.      Regarding access control, an example of a(n) ____ is when a user attempts to delete a file.
  12. a.      object  c.      operation
  13. b.      subject d.      asset
  14.  
  15.  
  16. __D__   4.      In the ____ model, the end user cannot implement, modify, or transfer any controls.
  17. a.      Discretionary Access Control (DAC)      c.      Rule Based Access Control (RBAC)
  18. b.      Role Based Access Control (RBAC)        d.      Mandatory Access Control (MAC)
  19.  
  20.  
  21. __B__   5.      With the ____ model a subject has total control over any objects that he or she owns, along with the programs that are associated with those objects.
  22. a.      RBAC    c.      RuBAC
  23. b.      DAC     d.      MAC
  24.  
  25.  
  26. __D__   6.      The ____ model is considered a more “real world” approach than the other models to structuring access control.
  27. a.      Discretionary Access Control (DAC)      c.      Mandatory Access Control (MAC)
  28. b.      Rule Based Access Control (RBAC)        d.      Role Based Access Control (RBAC)
  29.  
  30.  
  31. __C__   7.      The ____ model can dynamically assign roles to subjects based on a set of rules defined by a custodian.
  32. a.      Discretionary Access Control (DAC)      c.      Rule Based Access Control (RBAC)
  33. b.      Role Based Access Control (RBAC)        d.      Mandatory Access Control (MAC)
  34.  
  35.  
  36. __A__   8.      Known as ____, this practice requires that if the fraudulent application of a process could potentially result in a breach of security, then the process should be divided between two or more individuals.
  37. a.      separation of duties    c.      least privilege
  38. b.      job rotation    d.      implicit deny
  39.  
  40.  
  41. __D__   9.      The principle of ____ in access control means that each user should be given only the minimal amount of privileges necessary to perform his or her job function.
  42. a.      job rotation    c.      separation of duties
  43. b.      implicit deny   d.      least privilege
  44.  
  45.  
  46. __A__   10.     ____ in access control means that if a condition is not explicitly met, then it is to be rejected.
  47. a.      Implicit deny   c.      least privilege
  48. b.      Separation of duties    d.      job rotation
  49.  
  50.  
  51. __C__   11.     Generally a ____ is used to configure settings for systems that are not part of Active Directory.
  52. a.      Group Policy    c.      Local Group Policy
  53. b.      Group Policy Object     d.      Domain Group Policy
  54.  
  55.  
  56. __B__   12.     ____ accounts are user accounts that remain active after an employee has left an organization.
  57. a.      Ghost   c.      Phantom
  58. b.      Orphaned        d.      Floating
  59.  
  60.  
  61. __A__   13.     ____ is the process of setting a user’s account to expire.
  62. a.      Account expiration      c.      Account restriction
  63. b.      Time of day restriction d.      Login expiration
  64.  
  65.  
  66. __B__   14.     A ____ is a secret combination of letters and numbers that only the user knows.
  67. a.      badge   c.      RFID tag
  68. b.      password        d.      smartcard
  69.  
  70.  
  71. __C__   15.     A ____ attack begins with the attacker creating hashes of common dictionary words, and compares those hashed dictionary words against those in a stolen password file.
  72. a.      birthday        c.      dictionary
  73. b.      brute force     d.      rainbow table
  74.  
  75.  
  76. __D__   16.     ____ make password attacks easier by creating a large pregenerated data set of hashes from nearly every possible password combination.
  77. a.      Brute force attacks     c.      Birthday attacks
  78. b.      Dictionary attacks      d.      Rainbow tables
  79.  
  80.  
  81. __B__   17.     To address the security issues in the LM hash, Microsoft introduced the ____ hash.
  82. a.      VLM     c.      ELM
  83. b.      NTLM    d.      NETLM
  84.  
  85.  
  86. __D__   18.     A ____ lock, also known as the key-in-knob lock, is the easiest to use because it requires only a key for unlocking the door from the outside.
  87. a.      deadbolt        c.      tailgate
  88. b.      cipher  d.      preset
  89.  
  90.  
  91. __C__   19.     Known as a ____ lock, this lock extends a solid metal bar into the door frame for extra security.
  92. a.      tailgate        c.      deadbolt
  93. b.      preset  d.      cipher
  94.  
  95.  
  96. __A__   20.     ____ locks are combination locks that use buttons that must be pushed in the proper sequence to open the door.
  97. a.      Cipher  c.      Preset
  98. b.      Deadbolt        d.      Tailgate
  99.  
  100.  
  101. __D__   21.     A ____ is a security device that monitors and controls two interlocking doors to a small room (a vestibule) that separates a nonsecured area from a secured area.
  102. a.      CCTV    c.      cipher lock
  103. b.      tailgate sensor d.      mantrap
  104.  
  105.  
  106. __B__   22.     ____ is the presentation of credentials or identification, typically performed when logging on to a system.
  107. a.      Authentication  c.      Authorization
  108. b.      Identification  d.      Access
  109.  
  110.  
  111. __A__   23.     ____ is the verification of the credentials to ensure that they are genuine and not fabricated.
  112. a.      Authentication  c.      Authorization
  113. b.      Identification  d.      Access
  114.  
  115.  
  116. __C__   24.     ____ is granting permission for admittance.
  117. a.      Authentication  c.      Authorization
  118. b.      Identification  d.      Access
  119.  
  120.  
  121. __D__   25.     ____ is the right to use specific resources.
  122. a.      Authentication  c.      Authorization
  123. b.      Identification  d.      Access
  124.  
  125.  
  126. __A__   26.     There are several types of OTPs. The most common type is a ____ OTP.
  127. a.      time-synchronized       c.      token-based
  128. b.      challenge-based d.      biometric-based
  129.  
  130.  
  131. __D__   27.     A ____ fingerprint scanner requires the user to place the entire thumb or finger on a small oval window on the scanner.
  132. a.      cognitive       c.      physical
  133. b.      dynamic d.      static
  134.  
  135.  
  136. __C__   28.     A ____ fingerprint scanner has a small slit or opening. Instead of placing the entire finger on the scanner the finger is swiped across the opening.
  137. a.      static  c.      dynamic
  138. b.      cognitive       d.      physical
  139.  
  140.  
  141. __B__   29.     ____ time is the time it takes for a key to be pressed and then released.
  142. a.      Hit     c.      Flight
  143. b.      Dwell   d.      Type
  144.  
  145.  
  146. __D__   30.     ____, such as using an OTP (what a person has) and a password (what a person knows), enhances security, particularly if different types of authentication methods are used.
  147. a.      Standard biometrics     c.      Cognitive biometrics
  148. b.      Federated identity management   d.      Two-factor authentication
  149.  
  150.  
  151. __B__   31.     ____ requires that a user present three different types of authentication credentials.
  152. a.      Two-factor authentication       c.      Behavioral biometrics
  153. b.      Three-factor authentication     d.      Cognitive biometrics
  154.  
  155.  
  156. __C__   32.     ____ is a feature of Windows that is intended to provide users with control of their digital identities while helping them to manage privacy.
  157. a.      FMI     c.      Windows CardSpace
  158. b.      Windows Live ID d.      OpenID
  159.  
  160.  
  161. __A__   33.     ____ is a decentralized open source FIM that does not require specific software to be installed on the desktop.
  162. a.      OpenID  c.      .NET Passport
  163. b.      Windows CardSpace       d.      Windows Live ID
  164.  
  165.  
  166. __B__   34.     ____ is an authentication system developed by the Massachusetts Institute of Technology (MIT) and used to verify the identity of networked users.
  167. a.      RADIUS  c.      TACACS+
  168. b.      Kerberos        d.      LDAP
  169.  
  170.  
  171. __A__   35.     ____ is an industry standard protocol specification that forwards username and password information to a centralized server.
  172. a.      TACACS+ c.      RADIUS
  173. b.      LDAP    d.      Kerberos
  174.  
  175.  
  176. __C__   36.     The International Organization for Standardization (ISO) created a standard for directory services known as ____.
  177. a.      X.400i  c.      X.500
  178. b.      X.459   d.      X.589
  179.  
  180.  
  181. __D__   37.     The ____, sometimes called X.500 Lite, is a simpler subset of DAP.
  182. a.      Kerberos        c.      TACACS+
  183. b.      RADIUS  d.      LDAP
  184.  
  185.  
  186. __A__   38.     The management protocol of IEEE 802.1x that governs the interaction between the system, authenticator, and RADIUS server is known as the ____.
  187. a.      EAP     c.      X.500
  188. b.      LDAP    d.      TACACS+
  189.  
  190.  
  191. __D__   39.     ____ is a very basic authentication protocol that was used to authenticate a user to a remote access server or to an Internet service provider (ISP).
  192. a.      MS-CHAP c.      EAP-TLS
  193. b.      EAP-MD5 d.      PAP
  194.  
  195.  
  196. __C__   40.     ____ refers to any combination of hardware and software that enables access to remote users to a local internal network.
  197. a.      LDAP    c.      RAS
  198. b.      EAP     d.      VPN
  199.  
  200.  
  201. __B__   41.     A(n) ____ uses an unsecured public network, such as the Internet, as if it were a secure private network.
  202. a.      RAS     c.      EAP
  203. b.      VPN     d.      LDAP
  204.  
  205.  
  206. __D__   42.     A(n) ____ is the end of the tunnel between VPN devices.
  207. a.      concentrator    c.      VPN server
  208. b.      demux   d.      endpoint
  209.  
  210.  
  211. __B__   43.     In information security, a ____ is the likelihood that a threat agent will exploit a vulnerability.
  212. a.      hole    c.      risk
  213. b.      threat  d.      weakness
  214.  
  215.  
  216. __A__   44.     ____ generally denotes a potential negative impact to an asset.
  217. a.      Risk    c.      Weakness
  218. b.      Threat  d.      Vulnerability
  219.  
  220.  
  221. __B__   45.     The goal of ____ is to better understand who the attackers are, why they attack, and what types of attacks might occur.
  222. a.      risk modeling   c.      weakness modeling
  223. b.      threat modeling d.      vulnerability modeling
  224.  
  225.  
  226. __D__   46.     Known as ____, this in effect takes a snapshot of the security of the organization as it now stands.
  227. a.      risk identification     c.      threat identification
  228. b.      risk mitigation d.      vulnerability appraisal
  229.  
  230.  
  231. __A__   47.     The ____ is the expected monetary loss every time a risk occurs.
  232. a.      Single Loss Expectancy (SLE)    c.      Asset Value (AV)
  233. b.      Exposure Factor (EF)    d.      Annualized Loss Expectancy (ALE)
  234.  
  235.  
  236. __D__   48.     The ____ is the expected monetary loss that can be expected for an asset due to a risk over a one-year period.
  237. a.      Single Loss Expectancy (SLE)    c.      Asset Value (AV)
  238. b.      Exposure Factor (EF)    d.      Annualized Loss Expectancy (ALE)
  239.  
  240.  
  241. __B__   49.     In a ____, the risk is spread over all of the members of the pool.
  242. a.      retained risk   c.      joined risk
  243. b.      risk retention pool     d.      cooperative risk
  244.  
  245.  
  246. __C__   50.     Identifying vulnerabilities through a(n) ____ determines the current security weaknesses that could expose assets to threats.
  247. a.      asset identification    c.      vulnerability appraisal
  248. b.      threat identification   d.      risk mitigation
  249.  
  250.  
  251. __D__   51.     Most communication in TCP/IP involves the exchange of information between a program running on one device (known as a ____) and the same or a corresponding process running on another device.
  252. a.      port    c.      scanner
  253. b.      socket  d.      process
  254.  
  255.  
  256. __C__   52.     TCP/IP uses a numeric value as an identifier to applications and services on the systems. These are known as the ____.
  257. a.      process c.      port number
  258. b.      socket  d.      protocol
  259.  
  260.  
  261. __B__   53.     ____ are typically used to determine the state of a port to know what applications are running and could be exploited.
  262. a.      Network scanners        c.      Port testers
  263. b.      Port scanners   d.      Network testers
  264.  
  265.  
  266. __A__   54.     A(n) ____ port means that the application or service assigned to that port is listening.
  267. a.      open    c.      blocked
  268. b.      closed  d.      listening
  269.  
  270.  
  271. __C__   55.     A(n) ____ port indicates that no process is listening at this port.
  272. a.      listening       c.      closed
  273. b.      open    d.      blocked
  274.  
  275.  
  276. __A__   56.     A(n) ____ port means that the host system does not reply to any inquiries to this port number.
  277. a.      blocked c.      open
  278. b.      closed  d.      listening
  279.  
  280.  
  281. __B__   57.     ____ are software tools that can identify all the systems connected to a network.
  282. a.      Port scanners   c.      ICMP mappers
  283. b.      Network mappers d.      ICMP scanners
  284.  
  285.  
  286. __D__   58.     ____ provides support to IP in the form of ICMP messages that allow different types of communication to occur between IP devices.
  287. a.      SNMP    c.      HTTP
  288. b.      SMTP    d.      ICMP
  289.  
  290.  
  291. __A__   59.     The key feature of a protocol analyzer is that it places the computer’s network interface card (NIC) adapter into ____, meaning that NIC does not ignore packets intended for other systems and shows all network traffic.
  292. a.      promiscuous mode        c.      traffic mode
  293. b.      listening mode  d.      sniffing mode
  294.  
  295.  
  296. __D__   60.     ____ is a generic term that refers to a range of products that look for vulnerabilities in networks or systems.
  297. a.      Port scanner    c.      Ping
  298. b.      Network mapper  d.      Vulnerability scanner
  299.  
  300.  
  301. __B__   61.     ____ is a “common language” for the exchange of information regarding security vulnerabilities.
  302. a.      XML     c.      SQL
  303. b.      OVAL    d.      HTML
  304.  
  305.  
  306. __C__   62.     ____ programs use the file of hashed passwords and then attempts to break the hashed passwords offline.
  307. a.      ICMP scanner    c.      Password cracker
  308. b.      Port scanner    d.      Network mapper
  309.  
  310.  
  311. __D__   63.     ____ is a method of evaluating the security of a computer system or network by simulating a malicious attack instead of just scanning for vulnerabilities.
  312. a.      Vulnerability scanning  c.      Port scanning
  313. b.      Network mapping d.      Penetration testing
  314.  
  315.  
  316. __B__   64.     ____ is the process of assigning and revoking privileges to objects; that is, it covers the procedures of managing object authorizations.
  317. a.      Privilege assignment    c.      Privilege auditing
  318. b.      Privilege management    d.      Privilege configuration
  319.  
  320.  
  321. __C__   65.     The ____ is typically defined as the person responsible for the information, who determines the level of security needed for the data, and delegates security duties as required.
  322. a.      guardian        c.      owner
  323. b.      manager d.      custodian
  324.  
  325.  
  326. __A__   66.     The ____ is the individual to whom day-to-day actions have been assigned by the owner and who periodically reviews security settings and maintains records of access by end users.
  327. a.      custodian       c.      manager
  328. b.      guardian        d.      owner
  329.  
  330.  
  331. __D__   67.     The Windows file and folder ____ permission allows files or folders to be opened as read-only and to be copied.
  332. a.      Write   c.      Modify
  333. b.      Read and Execute        d.      Read
  334.  
  335.  
  336. __C__   68.     The Windows file and folder ____ permission allows the creation of files and folders, and allows data to be added to or removed from files.
  337. a.      Modify  c.      Write
  338. b.      Read and Execute        d.      Read
  339.  
  340.  
  341. __D__   69.     The Microsoft ____ infrastructure is a mechanism to centrally configure and secure a common set of computer and user configurations and security settings to Windows servers, desktops, and users in an AD.
  342. a.      Security Template       c.      Auditing
  343. b.      Baseline        d.      Group Policy
  344.  
  345.  
  346. __A__   70.     ____ is part of the pre-trial phase of a lawsuit in which each party through the law of civil procedure can request documents and other evidence from other parties or can compel the production of evidence by using a subpoena.
  347. a.      Discovery       c.      Interview
  348. b.      Interrogation   d.      Retention
  349.  
  350.  
  351. __B__   71.     ILM strategies are typically recorded in ____ policies.
  352. a.      user security   c.      data confidentiality
  353. b.      storage and retention   d.      group
  354.  
  355.  
  356. __D__   72.     ____ assigns a level of business importance, availability, sensitivity, security and regulation requirements to data.
  357. a.      Usage auditing  c.      Usage classification
  358. b.      Security auditing       d.      Data classification
  359.  
  360.  
  361. __B__   73.     ____ means permissions given to a higher level “parent” will also be inherited by a lower level “child.”
  362. a.      Delegation      c.      Transition
  363. b.      Inheritance     d.      Classification
  364.  
  365.  
  366. __A__   74.     ____ is the process for generating, transmitting, storing, analyzing, and disposing of computer security log data.
  367. a.      Log management  c.      Event management
  368. b.      Log auditing    d.      Event auditing
  369.  
  370.  
  371. __C__   75.     ____ servers are intermediate hosts through which Web sites are accessed.
  372. a.      NIDS    c.      Proxy
  373. b.      Authentication  d.      HIPS
  374.  
  375.  
  376. __B__   76.     ____ logs can be used to determine whether new IP addresses are attempting to probe the network and if stronger firewall rules are necessary to block them.
  377. a.      Proxy servers   c.      Authentication servers
  378. b.      Firewall        d.      DNS
  379.  
  380.  
  381. __C__   77.     A(n) ____ is an occurrence within a software system that is communicated to users or other programs outside the operating system.
  382. a.      thread  c.      event
  383. b.      entry   d.      call
  384.  
  385.  
  386. __A__   78.     ____ are operational actions that are performed by the operating system, such as shutting down the system or starting a service.
  387. a.      System events   c.      System functions
  388. b.      System calls    d.      System processes
  389.  
  390.  
  391. __D__   79.     Logs based on ____ are the second common type of security-related operating system logs.
  392. a.      event records   c.      event logs
  393. b.      system events   d.      audit records
  394.  
  395.  
  396. __C__   80.     ____ refers to a methodology for making changes and keeping track of those changes, often manually.
  397. a.      Event auditing  c.      Change management
  398. b.      Event management        d.      Log management
  399.  
  400.  
  401. __D__   81.     ____ monitoring is designed for detecting statistical anomalies.
  402. a.      Signature-based c.      Time-based
  403. b.      Behavior-based  d.      Anomaly-based
  404.  
  405.  
  406. __A__   82.     ____ monitoring compares activities against a predefined signature.
  407. a.      Signature-based c.      Behavior-based
  408. b.      Anomaly-based   d.      Time-based
  409.  
  410.  
  411. __B__   83.     A ____ baseline is a reference set of data established to create the “norm” of performance for a system or systems.
  412. a.      configuration   c.      system
  413. b.      performance     d.      monitoring
  414.  
  415.  
  416. __D__   84.     A ____ monitor is typically a low-level system program that uses a notification engine designed to monitor and track down hidden activity on a desktop system, server, or even personal digital assistant (PDA) or cell phone.
  417. a.      performance     c.      behavior
  418. b.      baseline        d.      system
  419.  
  420.  
  421. __A__   85.     Changing the original text to a secret message using cryptography is known as ____.
  422. a.      encryption      c.      ciphertext
  423. b.      decryption      d.      cleartext
  424.  
  425.  
  426. __D__   86.     Data that is in an unencrypted form is called ____ data.
  427. a.      plaintext       c.      hidetext
  428. b.      caesartext      d.      cleartext
  429.  
  430.  
  431. __C__   87.     ____, also called a one-way hash, is a process for creating a unique “signature” for a set of data.
  432. a.      Digital signing c.      Hashing
  433. b.      Decrypting      d.      Encrypting
  434.  
  435.  
  436. __B__   88.     ____ is a relatively recent cryptographic hash function that has received international recognition and adoption by standards organizations.
  437. a.      MD5     c.      SHA-1
  438. b.      Whirlpool       d.      MD2
  439.  
  440.  
  441. __D__   89.     Symmetric encryption is also called ____ key cryptography.
  442. a.      open    c.      public
  443. b.      close   d.      private
  444.  
  445.  
  446. __B__   90.     The simplest type of stream cipher is a ____ cipher. It simply substitutes one letter or character for another.
  447. a.      transposition   c.      permutation
  448. b.      substitution    d.      homoalphabetic
  449.  
  450.  
  451. __C__   91.     A ____ substitution cipher maps a single plaintext character to multiple ciphertext characters.
  452. a.      polyalphabetic  c.      homoalphabetic
  453. b.      monoalphabetic  d.      random
  454.  
  455.  
  456. __A__   92.     A ____ cipher rearranges letters without changing them.
  457. a.      transposition   c.      substitution
  458. b.      monoalphabetic  d.      homoalphabetic
  459.  
  460.  
  461. __B__   93.     A ____ cipher manipulates an entire block of plaintext at one time.
  462. a.      substitution    c.      stream
  463. b.      block   d.      transposition
  464.  
  465.  
  466. __A__   94.     ____ was approved by the NIST in late 2000 as a replacement for DES.
  467. a.      AES     c.      Twofish
  468. b.      3DES    d.      Blowfish
  469.  
  470.  
  471. __C__   95.     ____ is a block cipher that processes blocks of 64 bits.
  472. a.      SHA-1   c.      RC2
  473. b.      RC4     d.      MD5
  474.  
  475.  
  476. __D__   96.     The ____ algorithm dates back to the early 1990s and is used in European nations.
  477. a.      Blowfish        c.      RC4
  478. b.      Twofish d.      IDEA
  479.  
  480.  
  481. __A__   97.     ____ encryption uses two keys instead of one. These keys are mathematically related and are known as the public key and the private key.
  482. a.      Asymmetric      c.      Private
  483. b.      Symmetric       d.      Open
  484.  
  485.  
  486. __D__   98.     The asymmetric algorithm ____ was published in 1977 and patented by MIT in 1983.
  487. a.      AES     c.      SHA
  488. b.      Diffie-Hellman  d.      RSA
  489.  
  490.  
  491. __C__   99.     The strength of the ____ algorithm is that it allows two users to share a secret key securely over a public network.
  492. a.      DES     c.      Diffie-Hellman
  493. b.      RSA     d.      AES
  494.  
  495.  
  496. __B__   100.    A similar program known as ____ is a PGP open-source product.
  497. a.      FreePGP c.      PGPx
  498. b.      GPG     d.      PGPnix
  499.  
  500.  
  501. __D__   101.    Microsoft’s ____ is a cryptography system for Windows operating systems that use the Windows NTFS file system.
  502. a.      GPG     c.      PGP
  503. b.      AES     d.      EFS
  504.  
  505.  
  506. __B__   102.    Cryptography can also be applied to entire disks. This is known as ____ encryption.
  507. a.      symmetric       c.      file system
  508. b.      whole disk      d.      EFS
  509.  
  510.  
  511. __C__   103.    To protect data stored on a hard drive, Microsoft Windows Vista includes ____ drive encryption.
  512. a.      IDEA    c.      BitLocker
  513. b.      TPM     d.      AES
  514.  
  515.  
  516. __A__   104.    ____ is a hardware-enabled data encryption feature.
  517. a.      BitLocker       c.      AES
  518. b.      EFS     d.      DES
  519.  
  520.  
  521. __B__   105.    ____ is essentially a chip on the motherboard of the computer that provides cryptographic services.
  522. a.      EFS     c.      BitLocker
  523. b.      TPM     d.      AES
  524.  
  525.  
  526. __C__   106.    Some organizations set up a subordinate entity, called a ____, to handle some CA tasks such as processing certificate requests and authenticating users.
  527. a.      Remote Authority (RA)   c.      Registration Authority (RA)
  528. b.      Delegation Authority (DA)       d.      Handle Authority (HA)
  529.  
  530.  
  531. __D__   107.    ____ digital certificates are issued by a CA or RA directly to individuals.
  532. a.      Server  c.      Single-sided
  533. b.      Software publisher      d.      Personal
  534.  
  535.  
  536. __B__   108.    ____ digital certificates are often issued from a Web server to a client, although they can be distributed by any type of server, such as a mail server.
  537. a.      Software publisher      c.      Personal
  538. b.      Server  d.      Organizational
  539.  
  540.  
  541. __A__   109.    When Bob sends one digital certificate to Alice along with his message, that is known as a ____ certificate.
  542. a.      single-sided    c.      dual-sided
  543. b.      software publisher      d.      server
  544.  
  545.  
  546. __D__   110.    In one type of trust model, ____ trust, a relationship exists between two individuals because one person knows the other person.
  547. a.      indirect        c.      discrete
  548. b.      third party     d.      direct
  549.  
  550.  
  551. __A__   111.    A(n) ____ trust refers to a situation in which two individuals trust each other because each trusts a third party.
  552. a.      third party     c.      indirect
  553. b.      direct  d.      discrete
  554.  
  555.  
  556. __B__   112.    The ____ trust model assigns a single hierarchy with one master CA called the root.
  557. a.      web of  c.      direct
  558. b.      hierarchical    d.      third party
  559.  
  560.  
  561. __C__   113.    The ____ trust model has multiple CAs that sign digital certificates.
  562. a.      direct  c.      distributed
  563. b.      web of  d.      hierarchical
  564.  
  565.  
  566. __A__   114.    The ____ trust model is the basis for digital certificates issued by Internet users.
  567. a.      distributed     c.      direct
  568. b.      hierarchical    d.      web of
  569.  
  570.  
  571. __C__   115.    With the ____ trust model, there is one CA that acts as a “facilitator” to interconnect all other CAs.
  572. a.      web of  c.      bridge
  573. b.      distributed     d.      hierarchical
  574.  
  575.  
  576. __B__   116.    The ____ provides recommended baseline security requirements for the use and operation of CA, RA, and other PKI components.
  577. a.      certificate practice statement  c.      baseline policy
  578. b.      certificate policy      d.      CA policy
  579.  
  580.  
  581. __D__   117.    A ____ describes in detail how the CA uses and manages certificates.
  582. a.      CA policy       c.      baseline policy
  583. b.      certificate policy      d.      certificate practice statement
  584.  
  585.  
  586. __C__   118.    ____ refers to a situation in which keys are managed by a third party, such as a trusted CA.
  587. a.      Expiration      c.      Key escrow
  588. b.      Renewal d.      Revocation
  589.  
  590.  
  591. __D__   119.    ____ is used to connect to an FTP server, much in the same way that HTTP links to a Web server.
  592. a.      SSH     c.      SSL
  593. b.      PKCS    d.      FTP
  594.  
  595.  
  596. __B__   120.    ____ is a protocol that guarantees privacy and data integrity between applications communicating over the Internet.
  597. a.      FTP     c.      HTTP
  598. b.      TLS     d.      CRL
  599.  
  600.  
  601. __A__   121.    The TLS ____ Protocol allows authentication between the server and the client and the negotiation of an encryption algorithm and cryptographic keys before any actual data is transmitted.
  602. a.      Handshake       c.      Transport
  603. b.      Record  d.      Packing
  604.  
  605.  
  606. __D__   122.    The TLS ____ Protocol is used to encapsulate higher-level protocols.
  607. a.      Packing c.      Transport
  608. b.      Handshake       d.      Record
  609.  
  610.  
  611. __A__   123.    ____ is actually a suite of three utilities—slogin, scp, and ssh—that are secure versions of the unsecure UNIX counterpart utilities rlogin, rcp, and rsh.
  612. a.      SSH     c.      SSL
  613. b.      TLS     d.      SFTP
  614.  
  615.  
  616. __B__   124.    ____ is the most widely deployed tunneling protocol.
  617. a.      SSL     c.      TLS
  618. b.      PPTP    d.      NAS
  619.  
  620.  
  621. __C__   125.    One variation of PPP that is used by broadband Internet providers with DSL or cable modem connections is ____.
  622. a.      TLS     c.      PPPoE
  623. b.      LCP     d.      PPTP
  624.  
  625.  
  626. __C__   126.    One of the most common e-mail transport protocols is ____.
  627. a.      S/MIME  c.      TLS
  628. b.      SSL     d.      IPsec
  629.  
  630.  
  631. __A__   127.    A Class ____ fire includes common combustibles.
  632. a.      A       c.      C
  633. b.      B       d.      D
  634.  
  635.  
  636. __B__   128.    ____ systems spray the fire area with pressurized water.
  637. a.      Dry chemical    c.      Chemical agent
  638. b.      Water sprinkler d.      Clean agent
  639.  
  640.  
  641. __D__   129.    ____ systems disperse a fine, dry powder over the fire.
  642. a.      Clean agent     c.      Water sprinkler
  643. b.      Clean chemical  d.      Dry chemical
  644.  
  645.  
  646. __C__   130.    ____ fire suppression systems do not harm people, documents, or electrical equipment in the room.
  647. a.      Water sprinkler c.      Clean agent
  648. b.      Clean sprinkler d.      Dry chemical
  649.  
  650.  
  651. __B__   131.    In a(n) ____ server cluster, a standby server exists only to take over for another server in the event of its failure.
  652. a.      network c.      redundant
  653. b.      asymmetric      d.      symmetric
  654.  
  655.  
  656. __C__   132.    In a(n) ____ server cluster, every server in the cluster performs useful work. If one server fails, the remaining servers continue to perform their normal work as well as that of the failed server.
  657. a.      asymmetric      c.      symmetric
  658. b.      redundant       d.      network
  659.  
  660.  
  661. __D__   133.    A system of hard drives based on redundancy can be achieved through using a technology known as ____, which uses multiple hard disk drives for increased reliability and performance.
  662. a.      MTBF    c.      ESD
  663. b.      VPN     d.      RAID
  664.  
  665.  
  666. __A__   134.    ____ partitions the storage space of each hard drive into smaller sections, which can be as small as 512 bytes or as large as several megabytes.
  667. a.      Striping        c.      Duplexing
  668. b.      Mirroring       d.      Segmenting
  669.  
  670.  
  671. __C__   135.    Disk ____ involves connecting multiple drives in the server to the same disk controller card.
  672. a.      segmenting      c.      mirroring
  673. b.      stripping       d.      duplexing
  674.  
  675.  
  676. __A__   136.    Instead of having a single disk controller card that is attached to all hard drives, disk ____ has separate cards for each disk.
  677. a.      duplexing       c.      mirroring
  678. b.      segmenting      d.      stripping
  679.  
  680.  
  681. __D__   137.    RAID Level 5 distributes ____ data (a type of error checking) across all drives instead of using a separate drive to hold the parity error checking information.
  682. a.      mirroring       c.      segmenting
  683. b.      stripping       d.      parity
  684.  
  685.  
  686. __B__   138.    A(n) ____ UPS is always running off its battery while the main power runs the battery charger.
  687. a.      battery c.      off-line
  688. b.      on-line d.      mirroring
  689.  
  690.  
  691. __A__   139.    A ____ site is generally run by a commercial disaster recovery service that allows a business to continue computer and network operations to maintain business continuity.
  692. a.      hot     c.      cold
  693. b.      warm    d.      cool
  694.  
  695.  
  696. __B__   140.    A ____ site provides office space but the customer must provide and install all the equipment needed to continue operations.
  697. a.      cool    c.      warm
  698. b.      cold    d.      hot
  699.  
  700.  
  701. __D__   141.    A ____ site has all of the equipment installed but does not have active Internet or telecommunications facilities, and does not have current backups of data.
  702. a.      cold    c.      cool
  703. b.      hot     d.      warm
  704.  
  705.  
  706. __C__   142.    Backup software can internally designate which files have already been backed up by setting a(n) ____ in the properties of the file.
  707. a.      archive sector  c.      archive bit
  708. b.      backup bit      d.      backup sector
  709.  
  710.  
  711. __A__   143.    The ____ is defined as the maximum length of time that an organization can tolerate between backups.
  712. a.      RPO     c.      D2D
  713. b.      RTO     d.      D2D2T
  714.  
  715.  
  716. __C__   144.    The ____ is simply the length of time it will take to recover the data that has been backed up.
  717. a.      D2D2T   c.      RTO
  718. b.      RPO     d.      D2D
  719.  
  720.  
  721. __D__   145.    An alternative to using magnetic tape is to back up to magnetic disk, such as a large hard drive or RAID configuration. This is known as ____.
  722. a.      RTO     c.      D2D2T
  723. b.      RPO     d.      D2D
  724.  
  725.  
  726. __B__   146.    A solution that combines the best of magnetic tape and magnetic disk is ____. This technology uses the magnetic disk as a temporary storage area.
  727. a.      D2D     c.      RTO
  728. b.      D2D2T   d.      RPO
  729.  
  730.  
  731. __C__   147.    ____ is the application of science to questions that are of interest to the legal profession.
  732. a.      Chain of custody        c.      Forensics
  733. b.      RTO     d.      RPO
  734.  
  735.  
  736. __D__   148.    At its core, a(n) ____ policy is a document that outlines the protections that should be enacted to ensure that the organization’s assets face minimal risks.
  737. a.      safety  c.      change management
  738. b.      acceptable use  d.      security
  739.  
  740.  
  741. __C__   149.    A ____ is a collection of requirements specific to the system or procedure that must be met by everyone.
  742. a.      recommendation  c.      standard
  743. b.      guideline       d.      policy
  744.  
  745.  
  746. __A__   150.    A ____ is a collection of suggestions that should be implemented.
  747. a.      guideline       c.      policy
  748. b.      recommendation  d.      standard
  749.  
  750.  
  751. __B__   151.    A ____ is a document that outlines specific requirements or rules that must be met.
  752. a.      standard        c.      guideline
  753. b.      policy  d.      recommendation
  754.  
  755.  
  756. __C__   152.    ____ determines the items that have a positive economic value and may include data, hardware, personnel, physical assets, and software.
  757. a.      Risk assessment c.      Asset identification
  758. b.      Threat identification   d.      Vulnerability appraisal
  759.  
  760.  
  761. __B__   153.    ____ takes a snapshot of the security of the organization as it now stands.
  762. a.      Risk mitigation c.      Risk assessment
  763. b.      Vulnerability appraisal d.      Threat identification
  764.  
  765.  
  766. __A__   154.    ____ involves determining the damage that would result from an attack and the likelihood that the vulnerability is a risk to the organization.
  767. a.      Risk assessment c.      Vulnerability appraisal
  768. b.      Risk mitigation d.      Asset identification
  769.  
  770.  
  771. __D__   155.    A(n) ____ policy establishes guidelines for effectively reducing the threat of computer viruses on the organization’s network and computers.
  772. a.      acceptable encryption   c.      automated forwarded e-mail
  773. b.      dial-in access  d.      anti-virus
  774.  
  775.  
  776. __B__   156.    A(n) ____ policy outlines the requirements and provides the authority for an information security team to conduct audits and risk assessments, investigate incidents, to ensure conformance to security policies, or to monitor user activity.
  777. a.      database credentials coding     c.      automatically forwarded e-mail
  778. b.      audit vulnerability scanning    d.      analog line
  779.  
  780.  
  781. __D__   157.    A(n) ____ policy defines requirements for storing and retrieving database usernames and passwords.
  782. a.      analog line     c.      e-mail retention
  783. b.      dial-in access  d.      database credentials coding
  784.  
  785.  
  786. __A__   158.    A(n) ____ policy helps employees determine what information sent or received by e-mail should be retained and for how long.
  787. a.      e-mail retention        c.      router security
  788. b.      extranet        d.      information sensitivity
  789.  
  790.  
  791. __C__   159.    A(n) ____ policy establishes requirements for Remote Access IPSec or L2TP Virtual Private Network (VPN) connections to the organization’s network.
  792. a.      extranet        c.      VPN security
  793. b.      server security d.      demilitarized zone security
  794.  
  795.  
  796. __D__   160.    Many organizations have a ____ policy that outlines how the organization uses personal information it collects.
  797. a.      security-related human resource c.      disposal and destruction
  798. b.      password management and complexity      d.      personally identifiable information
  799.  
  800.  
  801. __C__   161.    Most organizations have a ____ policy that addresses the disposal of resources that are considered confidential.
  802. a.      security-related human resource c.      disposal and destruction
  803. b.      password management and complexity      d.      personally identifiable information
  804.  
  805.  
  806. __A__   162.    A ____ policy is designed to produce a standardized framework for classifying information assets.
  807. a.      classification of information   c.      service level agreement
  808. b.      change management       d.      disposal and destruction
  809.  
  810.  
  811. __B__   163.    ____ refers to a methodology for making changes and keeping track of those changes, often manually.
  812. a.      Classification of information   c.      Destruction and disposal
  813. b.      Change management       d.      Service level agreement
  814.  
  815.  
  816. __C__   164.    ____ are a person’s fundamental beliefs and principles used to define what is good, right, and just.
  817. a.      Norms   c.      Values
  818. b.      Morals  d.      Ethics
  819.  
  820.  
  821. __B__   165.    ____ are values that are attributed to a system of beliefs that help the individual distinguish right from wrong.
  822. a.      Ethics  c.      Codes
  823. b.      Morals  d.      Norms
  824.  
  825.  
  826. __A__   166.    ____ can be defined as the study of what a group of people understand to be good and right behavior and how people make those judgments.
  827. a.      Ethics  c.      Values
  828. b.      Codes   d.      Morals
  829.  
  830.  
  831. __D__   167.    ____ relies on tricking and deceiving someone to provide secure information.
  832. a.      Worm    c.      Trojan horse
  833. b.      Virus   d.      Social engineering
  834.  
  835.  
  836. __B__   168.    One of the most common forms of social engineering is ____, or sending an e-mail or displaying a Web announcement that falsely claims to be from a legitimate enterprise in an attempt to trick the user into surrendering private information.
  837. a.      dumpster diving c.      computer hoax
  838. b.      phishing        d.      pharming