IIS 4

Which of the following refers to the work product satisfying the real-world requirements and concepts? Select one:

• concurrence

• verification

• validation

• accuracy

Which of the following is an advantage of a qualitative over quantitative risk analysis? Select one:

• It makes cost-benefit analysis of recommended controls easier.

• It prioritizes the risks and identifies areas for immediate improvement in addressing the vulnerabilities.

• It provides specific quantifiable measurements of the magnitude of the impacts.

What represents the amount of time you hold down in a particular key? Select one:

• Dynamic time

• Flight time

• Dwell time

• Systems time

Which of the following is an effective measure against a certain type of brute force password attack? Select one:

• Password history is used.

• Password used must not be a word found in a dictionary.

• Password reuse is not allowed.

Which of the following questions is less likely to help in assessing controls over hardware and software maintenance? Select one:

• Are system components tested, documented, and approved prior to promotion to production?

• Is access to all program libraries restricted and controlled?

• Are integrity verification programs used by applications to look for evidences of data tampering, errors, and omissions?

• Is there version control?

They in form of credit card-size memory cards or smart cards, or those resembling small calculators, are used to supply static and dynamic passwords are called:

• Tickets

• Coupons

• Token passing networks

• Tokens

Why would an Ethernet LAN in a bus topology have a greater risk of unauthorized disclosure than switched Ethernet in a hub-and-spoke or star topology?

• Ethernet is a broadcast technology.

• TCP/IP is an insecure protocol.

• Hub and spoke connections are highly multiplexed.

• IEEE 802.5 protocol for Ethernet cannot support encryption.

Which of the following is true regarding a secure access model?

• Secure information cannot flow to a less secure user.

• None of the choices.

• Secure information cannot flow to a more secure user.

• Secure information can flow to a less secure user.

Which of the following is most relevant to determining the maximum effective cost of access control?

• The cost to replace lost data.

• Management’s perceptions regarding data importance.

• The value of information that is protected.

• The number of users accessing the data.

Retinal scans check for:

• All of the choices.

• Something you have.

• Something you know.

• Something you are.