Comp 337 - Exam Prep

Front

What key concept below best describes only providing the permissions necessary to perform a role? Options: Ephemeral accounts, Mandatory access control, Best practice, Least privilege

Back

Least privilege

Front

A person's name, age, location, or job title are all examples of what?

Back

Attributes

Front

What is the term for the process where code is tested, validated, and immediately put into production after being checked into a code repository? Options: Agile development, A security nightmare, Continuous integration, Continuous delivery

Back

Continuous delivery

Front

Which team member acts as a primary conduit to senior management on an IR team? Options: Communications and public relations, Management, Information security, Technical expert

Back

Management

Front

A PIN is an example of what type of factor?

Back

Something you know

Front

What term best describes Kolin's work as a penetration tester conducting a test against a health-care system? Options: Unknown attacker, Semi-authorized attacker, Authorized attacker, Unauthorized attacker

Back

Authorized attacker

Front

Colin would like to implement a security control in his accounting department that is specifically designed to detect cases of fraud that are able to occur despite the presence of other security controls. Which one of the following controls is best suited to meet Colin's need? Options: Dual control, Separation of duties, Mandatory vacations, Least privilege

Back

Mandatory vacations

Front

Which of the following human vectors is primarily associated with nation-state actors? Password spraying, Business email compromise, Misinformation campaigns, Watering hole attacks

Back

Misinformation campaigns

Front

What compliance obligation applies to merchants and service providers who work with credit card information? Options: PCI DSS, FERPA, HIPPA, SOX

Back

PCI DSS

Front

Which statement best captures the difference between security training and awareness programs?

Back

Security training requires time to learn new material, whereas awareness efforts use techniques like posters and emails to remind employees of security lessons.