Quiz about IIS 4

Question 1

Which of the following refers to the work product satisfying the real-world requirements and concepts? Select one:

Accepted Answer

validation

Answer

concurrence

Answer

verification

Answer

accuracy

Question 2

Which of the following is an advantage of a qualitative over quantitative risk analysis? Select one:

Accepted Answer

It prioritizes the risks and identifies areas for immediate improvement in addressing the vulnerabilities.

Answer

It makes cost-benefit analysis of recommended controls easier.

Answer

It provides specific quantifiable measurements of the magnitude of the impacts.

Question 3

What represents the amount of time you hold down in a particular key? Select one:

Accepted Answer

Dwell time

Answer

Dynamic time

Answer

Flight time

Answer

Systems time

Question 4

Which of the following is an effective measure against a certain type of brute force password attack? Select one:

Accepted Answer

Password used must not be a word found in a dictionary.

Answer

Password history is used.

Answer

Password reuse is not allowed.

Question 5

Which of the following questions is less likely to help in assessing controls over hardware and software maintenance? Select one:

Accepted Answer

Are integrity verification programs used by applications to look for evidences of data tampering, errors, and omissions?

Answer

Are system components tested, documented, and approved prior to promotion to production?

Answer

Is access to all program libraries restricted and controlled?

Answer

Is there version control?

Question 6

They in form of credit card-size memory cards or smart cards, or those resembling small calculators, are used to supply static and dynamic passwords are called:

Accepted Answer

Tokens

Answer

Tickets

Answer

Coupons

Answer

Token passing networks

Question 7

Why would an Ethernet LAN in a bus topology have a greater risk of unauthorized disclosure than switched Ethernet in a hub-and-spoke or star topology?

Accepted Answer

Ethernet is a broadcast technology.

Answer

TCP/IP is an insecure protocol.

Answer

Hub and spoke connections are highly multiplexed.

Answer

IEEE 802.5 protocol for Ethernet cannot support encryption.

Question 8

Which of the following is true regarding a secure access model?

Accepted Answer

Secure information cannot flow to a less secure user.

Answer

None of the choices.

Answer

Secure information cannot flow to a more secure user.

Answer

Secure information can flow to a less secure user.

Question 9

Retinal scans check for:

Accepted Answer

Something you are.

Answer

All of the choices.

Answer

Something you have.

Answer

Something you know.

Question 10

With mandatory access control (MAC), who may NOT make decisions that derive from policy?

Accepted Answer

All users except the administrator.

Answer

The administrator.

Answer

The power users.

Answer

The guests.

Question 11

What was introduced for circumventing difficulties in classic approaches to computer security by limiting damages produced by malicious programs?

Accepted Answer

Reference Monitor

Answer

Non-Interference

Answer

Integrity-preserving

Answer

Integrity-monitoring

Question 12

Which one of the following control steps is usually NOT performed in data warehousing applications?

Accepted Answer

Monitor summary tables for regular use.

Answer

Control meta data from being used interactively.

Answer

Reconcile data moved between the operations environment and data warehouse.

Answer

Monitor the data purging plan.

Question 13

Which of the following would best describe the difference between white-box testing and black-box testing?

Accepted Answer

White-box testing examines the program internal logical structure.

Answer

Black-box testing involves the business units.

Answer

White-box testing is performed by an independent programmer team.

Answer

Black-box testing uses the bottom-up approach.

Question 14

Program change controls must ensure that all changes are

Accepted Answer

Tested to ensure correctness

Answer

Implemented into production systems.

Answer

Within established performance criteria

Answer

Audited to verify intent

Question 15

Which of the following is not a form of a passive attack?

Accepted Answer

Data diddling

Answer

Shoulder surfing

Answer

Scavenging

Answer

Sniffing

Question 16

What physical characteristics does a retinal scan biometric device measure?

Accepted Answer

The pattern of blood vessels at the back of the eye

Answer

The amount of light reaching the retina

Answer

The size, curvature, and shape of the retina

Answer

The amount of light reflected by the retina

Question 17

What best describes a scenario when an employee has been shaving off pennies from multiple accounts and depositing the funds into his own bank account?

Accepted Answer

Salami techniques

Answer

Data fiddling

Answer

Trojan horses

Answer

Data diddling

Question 18

With _____, access decisions are based on the roles that individual users have as part of an organization.

Accepted Answer

Role based access control

Answer

Token based access control

Answer

Server based access control

Answer

Rule based access control

Question 19

What type of attacks occurs when normal physical conditions are altered in order to gain access to sensitive information on the smartcard?

Accepted Answer

Physical attacks

Answer

Logical attacks

Answer

Trojan Horse attacks

Answer

Social Engineering attacks

Question 20

Programmed procedures which ensure that valid transactions are processed accurately and only once in the current timescale are referred to as

Accepted Answer

Application controls

Answer

Data installation controls

Answer

Operation controls

Answer

Physical controls

Question 21

By far, the largest security exposure in application system development relates to

Accepted Answer

Maintenance and debugging hooks.

Answer

Errors and lack of training.

Answer

Deliberate compromise.

Answer

Change control.

Question 22

Memory only cards work based on:

Accepted Answer

Something you know and something you have.

Answer

Something you have.

Answer

None of the choices.

Answer

Something you know.

Question 23

Removing unnecessary processes, segregating inter-process communications, and reducing executing privileges to increase system security is commonly called:

Accepted Answer

Hardening

Answer

Segmenting

Answer

Kerneling

Answer

Aggregating

Question 24

Which of the following is the most reliable authentication device?

Accepted Answer

Smart card system

Answer

Combination of variable and fixed callback system

Answer

Fixed callback system

Answer

Variable callback system

Question 25

Which of the following can be used to protect your system against brute force password attack?

Accepted Answer

After three unsuccessful attempts to enter a password, the account will be locked.

Answer

Employees must send in a signed email before obtaining a password.

Answer

Increase the value of password age.

Answer

Decrease the value of password history.

Question 26

Which of the following offers advantages such as the ability to use stronger passwords, easier password administration, and faster resource access?

Accepted Answer

Single Sign-on (SSO)

Answer

Smart cards

Answer

Kerberos

Answer

Public Key Infrastructure (PKI)

Question 27

In a very large environment, which of the following is an administrative burden?

Accepted Answer

ID bases access control

Answer

Directory based access control.

Answer

Rule based access control.

Answer

Lattice based access control

Question 28

Monitoring electromagnetic pulse emanations from PCs and CRTs provides a hacker with what significant advantage?

Accepted Answer

Undetectable active monitoring.

Answer

Bypass the system security application.

Answer

Gain system information without trespassing

Answer

Defeat the TEMPEST safeguard

Question 29

Which of the following is NOT a system-sensing wireless proximity card?

Accepted Answer

magnetically striped card

Answer

passive device

Answer

transponder

Answer

field-powered device

Question 30

Which one of the following tests determines whether the content of data within an application program falls within predetermined limits?

Accepted Answer

Reasonableness check

Answer

Check digit verification

Answer

Mathematical accuracy check

Answer

Parity check

Question 31

To support legacy applications that rely on risky protocols (e.g., plain text passwords), which one of the following can be implemented to mitigate the risks on a corporate network?

Accepted Answer

Implement a virtual private network (VPN) with controls on workstations joining the VPN.

Answer

Use a simple password policy.

Answer

Allow unrestricted access to all users.

Answer

Disable all encryption protocols.

Question 32

What tool do you use to determine whether a host is vulnerable to known attacks?

Accepted Answer

Vulnerability analysis

Answer

IDS

Answer

Padded Cells

Question 33

A system using Discretionary Access Control (DAC) is vulnerable to which one of the following attacks?

Accepted Answer

Spoofing

Answer

Trojan horse

Answer

SYN flood

Question 34

Which one of the following is the MOST crucial link in the computer security chain?

Accepted Answer

Management

Answer

Access Controls

Answer

Awareness programs

Answer

People

Question 35

Which of the following describes the major disadvantage of many SSO implementations?

Accepted Answer

Once a user obtains access to the system through the initial log-on they can freely roam the network resources without any restrictions

Answer

Once a user obtains access to the system through the initial log-on, he has to logout from all other systems

Answer

A user must log in multiple times to access different resources

Answer

SSO systems are more expensive to implement

Question 36

To ensure that integrity is attained through the Clark and Wilson model, certain rules are needed. These rules are:

Accepted Answer

Certification rules and enforcement rules.

Answer

Integrity-bouncing rules.

Answer

Certification rules and general rules.

Answer

Processing rules and enforcement rules.

Question 37

Which security program exists if a user accessing low-level data is able to draw conclusions about high-level information?

Accepted Answer

Inference

Answer

Under-classification

Answer

Interference

Answer

Polyinstantiation

Question 38

Under MAC, who may grant a right of access that is explicitly forbidden in the access control policy?

Accepted Answer

None of the choices.

Answer

All managers.

Answer

All users.

Answer

Administrators only.

Question 39

Which of the following phases of a system development life-cycle is most concerned with authenticating users and processes to ensure appropriate access control decisions?

Accepted Answer

Operation/ Maintenance

Answer

Implementation

Answer

Innitation

Answer

Development/ Acquisition

Question 40

Which of the following can be defined as the set of allowable values that an attribute can take?

Accepted Answer

domain of a relation

Answer

domain name service of a relation

Answer

domain analysis of a relation

Answer

domains, in database of a relation

Question 41

What can best be described as an abstract machine which must mediate all access to subjects to objects?

Accepted Answer

The reference monitor

Answer

A security domain

Answer

The security kernel

Answer

The security perimeter

Question 42

The alternate processing strategy in a business continuity plan can provide for required backup computing capacity through a hot site, a cold site, or

Accepted Answer

An online backup program.

Answer

A dial-up services program.

Answer

An off-site storage replacement.

Answer

A crate and ship replacement.

Question 43

Which of the following provide network redundancy in a local network environment?

Accepted Answer

Dual backbones

Answer

Shadowing

Answer

Single backbone

Answer

Network mirroring

Question 44

What tool is being used to determine whether attackers have altered system files of executables?

Accepted Answer

File Integrity Checker

Answer

Padded Cells

Answer

Honey Pots

Answer

Vulnerability Analysis Systems

Question 45

What is an access control model?

Accepted Answer

A formal description of security policy.

Answer

A formal description of access control ID specification.

Answer

None of the choices.

Answer

A formal description of a sensibility label.

Question 46

What way could Java applets pose a security threat?

Accepted Answer

Executables from the Internet may attempt an intentional attack when they are downloaded on a client system

Answer

Their transport can interrupt the secure distribution of World Wide Web pages over the Internet by removing SSL and S-HTTP

Answer

Java interpreters do not provide the ability to limit system access that an applet could have on a client system

Answer

Java does not check the bytecode at runtime or provide other safety mechanisms for program isolation from the client system

Question 47

What is called the access protection system that limits connections by calling back the number of a previously authorized location?

Accepted Answer

Callback systems

Answer

Sendback system

Answer

Callback forward systems

Answer

Sendback forward systems

Question 48

Discretionary access control (DAC) are characterized by many organizations as:

Accepted Answer

Need-to-know controls

Answer

Preventive controls

Answer

Mandatory adjustable controls

Question 49

In the process of facial identification, the basic underlying recognition technology of facial identification involves:

Accepted Answer

Eigenfeatures of eigenfaces

Answer

Detection and scanning.

Answer

None of the choices.

Answer

Scanning and recognition

Question 50

Which of the following rules is less likely to support the concept of least privilege?

Accepted Answer

Only data to and from critical systems and applications should be allowed through the firewall

Answer

Administrators should use regular accounts when performing routine operations like reading mail

Answer

The number of administrative accounts should be kept to a minimum

Answer

Permissions on tools that are likely to be used by hackers should be as restrictive as possible

Question 51

What is one advantage of deploying Role based access control in large networked applications?

Accepted Answer

Lower cost

Answer

Higher security

Answer

User friendliness

Answer

Higher bandwidth

Question 52

An access control policy for a bank teller is an example of the implementation of which of the following?

Accepted Answer

role-based policy

Answer

user-based policy

Answer

identity-based policy

Answer

rule-based policy

Question 53

What is the MAIN purpose of a change control/management system?

Accepted Answer

Document the change for audit and management review.

Answer

Ensure that the change meets user specifications.

Answer

Ensure the orderly processing of a change request.

Answer

Notify all interested parties of the completion of the change.

Question 54

Which one of the following describes a covert timing channel?

Accepted Answer

Allows one process to signal information to another by modulating its own use of system resources.

Answer

Used by a supervisor to monitor the productivity of a user without their knowledge.

Answer

Modulated to carry an unintended information signal that can only be detected by special, sensitive receivers.

Answer

Provides the timing trigger to activate a malicious program disguised as a legitimate function.

Question 55

Which state must a computer system operate to process input/output instructions?

Accepted Answer

Supervisor mode

Answer

User mode

Answer

Stateful inspection

Answer

Interprocess communication

Question 56

All of the following are basic components of a security policy EXCEPT the _____.

Accepted Answer

statement of performance of characteristics and requirements.

Answer

definition of the issue and statement of relevant terms.

Answer

statement of roles and responsibilities

Answer

statement of applicability and compliance requirements.

Question 57

Which of the following media is MOST resistant to tapping?

Accepted Answer

Fiber optic

Answer

Coaxial cable

Answer

Microwave

Answer

Twisted pair

Question 58

With non-continuous backup systems, data that was entered after the last backup prior to a system crash will have to be:

Accepted Answer

recreated

Answer

deleted

Answer

updated

Answer

created

Question 59

Which of the following addresses cumbersome situations where users need to log on multiple times to access different resources?

Accepted Answer

Single Sign-On (SSO) systems

Answer

Triple Sign-On (TSO) systems

Answer

Dual Sign-On (DSO) systems

Answer

Double Sign-On (DSO) systems

Question 60

Which one of the following is true about information that is designated with the highest of confidentiality in a private sector organization?

Accepted Answer

It is available to anyone in the organization whose work relates to the subject and requires authorization for each access.

Answer

It is restricted to those in the department of origin for the information.

Answer

It is classified only by the information security officer and restricted to those who have made formal requests for access.

Answer

It is limited to named individuals and creates an audit trail.

Question 61

Which of the following actions can increase the cost of an exhaustive attack?

Accepted Answer

Increase the length of a password.

Answer

Increase the history of a password.

Answer

Increase the age of a password.

Question 62

An active content module, which attempts to monopolize and exploits system resources is called a

Accepted Answer

Hostile applet

Answer

Macro virus

Answer

Cookie

Answer

Plug-in worm

Question 63

Which of the following attacks could be the most successful when the security technology is properly implemented and configured?

Accepted Answer

Social Engineering attacks

Answer

Trojan Horse attacks

Answer

Logical attacks

Answer

Physical attacks

Question 64

Under Mandatory Access Control (MAC), which of the following is true?

Accepted Answer

All that is not expressly permitted is forbidden.

Answer

All that is expressly permitted is forbidden.

Answer

All that is not expressly permitted is not forbidden.

Create a free account and access millions of resources

Similar Resources on Wayground

Popular Resources on Wayground

Discover more resources for Science