Security Part 1

In the context of complying with industry standards for data protection, which action is MOST critical to enhancing security and compliance?

• Ensuring all data is backed up to encrypted storage.

• Implementing multi factor authentication for all systems.

• Restricting the use of removable media on company devices.

• Auditing user activities and system access logs.

Answer explanation

nsuring that all data is backed up to encrypted storage not only safeguards against data loss but also ensures that backups are secure from unauthorized access, which is essential for compliance with data protection standards. While auditing user activities, restricting the use of removable media, and implementing multi factor authentication are important security measures, the direct impact on data protection and compliance provided by secure, encrypted backups is most critical.

What is the primary purpose of using password managers?

• They require users to reuse passwords across multiple sites

• They eliminate the need for password expiration

• They generate random and complex passwords

• They store passwords in an encrypted format

Answer explanation

one of the main advantages of using password managers is that they store passwords in an encrypted format. This helps protect the passwords from unauthorized access in case of a data breach or unauthorized access to the password manager itself. Password managers often have the capability to generate random and complex passwords for users. This is advantageous as it helps users create strong and unique passwords without having to remember them but this is not a password manager's primary purpose. Password managers encourage users to use unique passwords for each site or service they use. Reusing passwords across multiple sites can be a security risk, as a compromise of one site can potentially lead to unauthorized access to other accounts. Password managers do not eliminate the need for password expiration. Password expiration is a separate security measure that is typically implemented to ensure that passwords are regularly changed, reducing the risk of compromised passwords.

What term is used to describe the unauthorized interception and monitoring of telephonic or digital communications by tapping into the wire or cable carrying the communication?

• Snooping

• Social engineering

• Eavesdropping

• Wiretapping

Answer explanation

Wiretapping accurately describes the act mentioned in the question. It refers to the unauthorized interception and monitoring of telephonic or digital communications by tapping into the wire or cable carrying the communication. This makes it the correct answer. Social engineering does not directly relate to the interception and monitoring of telephonic or digital communications by tapping into the wire or cable carrying the communication. It involves manipulating individuals to gain unauthorized access or information. Eavesdropping involves secretly listening to or monitoring private conversations or communications without permission. While it includes the unauthorized interception and monitoring of communications, it does not specifically mention the method of tapping into the wire or cable carrying the communication. Snooping refers to the unauthorized act of observing or accessing someone else's private information or activities. It does not specifically pertain to the interception and monitoring of telephonic or digital communications by tapping into the wire or cable carrying the communication.

Sarah, a system administrator at Dion Training, wants to implement a security measure to prevent unauthorized access to company devices. She decides to enforce a requirement for users to authenticate using a unique username and password. Which of the following security measures is Sarah implementing?

• User access control

• Biometric authentication

• Firewall protection

• Data encryption

Answer explanation

User access control is the security measure Sarah is implementing. It involves requiring users to authenticate using a unique username and password before accessing company devices. This measure helps prevent unauthorized access and ensures that only authorized users can use the devices. Firewall protection is a security measure that monitors and controls network traffic, allowing or blocking specific connections based on predefined rules. While it is an important security measure, it is not specifically related to enforcing unique username and password authentication. Data encryption involves converting information into a secret code to protect its confidentiality. While it is a valuable security measure, it does not directly relate to enforcing unique username and password authentication. Biometric authentication refers to the use of unique physical characteristics, such as fingerprints or facial recognition, to authenticate users. While biometric authentication can be a strong security measure, the scenario explicitly mentions implementing a unique username and password, not biometric features.

When handling client data, which of the following measures is most critical for safeguarding data integrity and ensuring compliance with legal regulations?

• Deploying biometric security measures for device access.

• Implementing a strict password policy across the organization.

• Encrypting all client data, both at rest and in transit.

• Configuring firewalls to monitor and control incoming and outgoing network traffic.

Answer explanation

Encrypting all client data, both at rest and in transit, is the most critical measure as it ensures that sensitive client information remains confidential and unaltered, protecting against unauthorized data breaches and supporting compliance with privacy regulations. While deploying biometric security, implementing a strict password policy, and configuring firewalls significantly enhance security measures, they do not provide the same direct protection of client data at multiple stages as encryption does.

Which of the following methods of authentication involves something that the user has?

• Biometrics

• 
  Hardware Token

• Security Questions

• PIN

Answer explanation

Hardware tokens are physical devices used for authentication. They fall under the category of something the user possesses. Security questions are a type of knowledge-based authentication. They are categorized as something the user knows, not something the user possesses. Biometrics involve unique physical or behavioral attributes of a user, they are categorized as something the user is, not something the user possesses. A PIN (Personal Identification Number) is a knowledge factor used for authentication. It's categorized as something the user knows, not something the user possesses.

Which factor is NOT considered when determining password strength?

• Password history

• Password expiration

• Password length

• Password complexity

Answer explanation

Password expiration is not directly related to determining password strength. It is a separate concept that enforces users to change their passwords after a certain period, typically for security reasons, but it does not impact the inherent strength of the password. Password complexity should be considered when determining password strength. Password complexity requirements aim to make passwords more difficult to guess or crack by incorporating different character types and avoiding easily guessable patterns. Password length should be considered when determining password strength. Longer passwords generally provide better security. Password history should be considered because it prevents users from reusing the same passwords or similar variations, enhancing security.

Which of the following security measures is most effective in addressing known vulnerabilities and fixing software bugs in computer systems?

• Host firewall

• Changing default passwords

• Patching updates

• Antivirus/Anti-malware

Answer explanation

Patching updates involve applying software updates, including security patches and bug fixes, to address known vulnerabilities and software bugs in computer systems. Regularly applying patches helps to close security gaps, improve system stability, and mitigate potential threats. A host firewall controls network traffic for a specific device, acting as a barrier between the device and the network. While it is an important security measure, it does not directly address known vulnerabilities and software bugs in computer systems. Changing default passwords is a good security practice to prevent unauthorized access to devices or systems. However, it does not specifically address known vulnerabilities and software bugs in computer systems. Antivirus and anti-malware software are designed to detect and remove malicious software, protecting against various types of threats. However, they do not specifically address known vulnerabilities and software bugs in computer systems.

In what scenario would an administrator prefer disabling SSID broadcasting over enabling it on a corporate wireless network?

• Disabling SSID broadcasting improves the network's performance by reducing traffic.

• 
  Disabling SSID broadcasting hides the network from casual scanning.

• Enabling SSID broadcasting is required for all devices to connect to the network.

• Enabling SSID broadcasting provides better encryption and security protocols.

Answer explanation

Disabling SSID broadcasting does not prevent determined hackers from detecting the network but can reduce visibility to casual scanners or opportunistic attackers, thus adding a basic layer of security through obscurity.

Which terms specifically involve the unauthorized interception of communication? (Select TWO)

• Eavesdropping

• Social engineering

• Snooping

• Dumpster diving

• Wiretapping

Answer explanation

Wiretapping is the act of intercepting and listening to telephonic or digital communications by tapping into the wire or cable carrying the communication. It directly pertains to the unauthorized interception of communication or data, making it one of the correct answer choices. Eavesdropping involves secretly listening to or monitoring private conversations or communications without permission. It accurately describes the unauthorized interception of communication or data, making it one of the correct answer choices. Social engineering refers to manipulating people to gain unauthorized access to information or systems. While it can indirectly lead to the interception of communication or data, it does not specifically involve the act of interception. Snooping refers to the unauthorized act of observing or accessing someone else's private information or activities. While snooping can involve unauthorized access, it does not specifically focus on the interception of communication or data. Dumpster diving refers to the practice of searching through trash or discarded materials to gather sensitive information or valuable items. It does not specifically involve the interception of communication or data.