Chapter 6 Network Security and Risk Analysis Quiz

A user is asked to perform a risk analysis of a company. The user asks for the company asset database that contains a list of all equipment.The user uses this information as part of a risk analysis. Which type of risk analysis could be performed?

• exposure factor

• hardware

• quantitative

• qualitative

A user is evaluating the network infrastructure of a company. The user noted many redundant systems and devices in place, but no overall evaluation of the network. In a report, the user emphasized the methods and configurations needed as a whole to make the network fault tolerant. What is the type of design the user is stressing?

• comprehensive

• spanning tree

• resilient

• availability

A user has completed a six month project to identify all data locations and catalog the location. The next step is to classify the data and produce some criteria on data sensitivity. Which two steps can the user take to classify the data? (Choose two.)

• Identify sensitivity of the data.

• Determine how often data is backed up.

• Determine the user of the data.

• Treat all the data the same.

• Establish the owner of the data.

A user needs to add redundancy to the routers in a company. What are the three options the user can use? (Choose three.)

• IPFIX

• STP

• VRRP

• HSRP

• GLBP

A user is asked to evaluate the data center to improve availability for customers. The user notices that there is only one ISP connection, some of the equipment is out of warranty, there are no spare parts, and no one was monitoring the UPS which was tripped twice in one month. Which three deficiencies in high availability has the user identified? (Choose three.)

• failure to prevent security incidents

• single points of failure

• failure to detect errors as they occur

• failure to protect against poor maintenance

• failure to design for reliability

A company is concerned with traffic that flows through the network. There is a concern that there may be malware that exists that is not being blocked or eradicated by antivirus. What technology can be put in place to detect potential malware traffic on the network?

• NAC

• IPS

• IDS

• firewall

A user is a consultant who is hired to prepare a report to Congress as to which industries should be required to maintain five nine availability. Which three industries should the user include in a report? (Choose three.)

• food service

• healthcare

• finance

• education

• public safety

A security breach has happened at a major corporation. The incident team has responded and executed their incident response plan. During which phase are lessons learned applied?

• analyze

• post-incident

• recovery

• detection

• preparation

A user is redesigning a network for a small company and wants to ensure security at a reasonable price. The user deploys a new application-aware firewall with intrusion detection capabilities on the ISP connection. The user installs a second firewall to separate the company network from the public network. Additionally, the user installs an IPS on the internal network of the company. What approach is the user implementing?

• layered

• attack based

• structured

• risk based

The CEO of a company is concerned that if a data breach should occur and customer data is exposed, the company could be sued. The CEO makes the decision to buy insurance for the company. What type of risk mitigation is the CEO implementing?

• avoidance

• mitigation

• transference

• reduction