Chapter 8

If a person knowingly accesses a government computer without permission, what federal act laws would the person be subject to?

• SOX

• ECPA

• CFAA

• GLBA

Unauthorized visitors have entered a company office and are walking around the building. What two measures can be implemented to prevent unauthorized visitor access to the building? (Choose two.)

• Lock cabinets.

• Conduct security awareness training regularly.

• Prohibit exiting the building during working hours.

• Establish policies and procedures for guests visiting the building.

An auditor is asked to assess the LAN of a company for potential threats. What are three potential threats the auditor may point out? (Choose three.)

• the acceptable use policy

• a misconfigured firewall

• unauthorized port scanning and network probing

• complex passwords

• unlocked access to network equipment

A company has had several incidents involving users downloading unauthorized software, using unauthorized websites, and using personal USB devices. The CIO wants to put in place a scheme to manage the user threats. What three things might be put in place to manage the threats? (Choose three.)

• Use content filtering.

• Implement disciplinary action.

• Provide security awareness training.

• Disable CD and USB access.

• Monitor all activity by the users.

As part of HR policy in a company, an individual may opt-out of having information shared with any third party other than the employer. Which law protects the privacy of personal shared information?

• PCI

• FIRPA

• SOX

• GLBA

What can be used to rate threats by an impact score to emphasize important vulnerabilities?

• ACSC

• ISC

• NVD

• CERT

A breach occurs in a company that processes credit card information. Which industry specific law governs credit card data protection?

• SOX

• ECPA

• GLBA

• PCI DSS

Why is Kali Linux a popular choice in testing the network security of an organization?

• It can be used to test weaknesses by using only malicious software.

• It can be used to intercept and log network traffic.

• It is an open source Linux security distribution and contains over 300 tools.

• It is a network scanning tool that prioritizes security risks.

A company is attempting to lower the cost in deploying commercial software and is considering a cloud based service. Which cloud based service would be best to host the software?

• PaaS

• RaaS

• SaaS

• IaaS

A security professional is asked to perform an analysis of the current state of a company network. What tool would the security professional use to scan the network only for security risks?

• malware

• pentest

• packet analyzer

• vulnerability scanner