The CISA credential is promoted by ISACA as the certification that is appropriate for all but which type of professionals?

A(n) reviews the log files generated by servers, network devices, and even other IDPSs looking for patterns and signatures that may indicate an attack or intrusion is in process or has already occurred.

Some cases of are simple, such as requiring employees to begin using a new password on an announced date.

A step commonly used for Internet vulnerability assessment includes , which occurs when the penetration test engine is unleashed at the scheduled time using the planned target list and test selection.

The proxy server is often placed in an unsecured area of the network or is placed in the zone.

benchmark and monitor the status of key system files and detect when an intruder creates, modifies, or deletes monitored files.

Which of the following is not a major processing mode category for firewalls?

In TCP/IP networking, port is not used.

Known as the ping service, is a common method for hacker reconnaissance and should be turned off to prevent snooping.

The ISSMP concentration examination is designed to provide CISSPs with a mechanism to demonstrate competence in

More advanced substitution ciphers use two or more alphabets, and are referred to as substitutions.

occurs when an authorized person opens a door, and other people, who may or may not be authorized, also enter.

Which of the following ports is commonly used for the HTTP protocol?

The is the title most commonly associated with the top information security officer in the organization.

Which of the following versions of TACACS is still in use?

A filtering firewall can react to an emergent event and update or create rules to deal with the event.

and TACACS are systems that authenticate the credentials of users who are trying to access an organization's network via a dial-up connection.

Which of the following is NOT a described IDPS control strategy?

To assess the effect that changes will have on the organization's personnel management practices, the organization should conduct a behavioral feasibility study before the program is

A(n) port, also known as a monitoring port, is a specially configured connection on a network device that is capable of viewing all of the traffic that moves through the entire device.

The algorithm, developed in 1977, was the first public-key encryption algorithm published for commercial use.

An X.509 v3 certificate binds a , which uniquely identifies a certificate entity, to a user's public key.

Tasks or action steps that come after the task at hand are called

The commercial site focuses on current security tool resources.

The model commonly used by large organizations places the information security department within the department.

Effective planning for information security involves:

Many organizations use a(n) interview to remind the employee of contractual obligations, such as nondisclosure agreements, and to obtain feedback on the employee's tenure in the organization.

A(n) works like a burglar alarm in that it detects a violation (some system activities analogous to an opened or broken window) and activates an alarm.

During the phase, specific technologies are selected to support the alternatives identified and evaluated in the prior phases.

are a component of the "security triple."

inspection firewalls keep track of each network connection between internal and external systems.

The process is designed to find and document vulnerabilities that may be present because there are misconfigured systems in use within the organization.

Network behavior analysis system sensors are typically intended for network perimeter use, so they are deployed in close proximity to the perimeter firewalls, often between the firewall and the Internet border router to limit incoming attacks that could overwhelm the firewall.

The Web site is home to several security tools including the leading free network exploration tool, Nmap.

A(n) IDPS is focused on protecting network information assets.

is an integrated system of software, encryption methodologies, protocols, legal agreements, and third-party services that enables users to communicate securely.

applications use a combination of techniques to detect an intrusion and then follow it back to its source.

firewalls examine every incoming packet header and can selectively filter packets based on header information such as destination address, source address, packet type, and other key information.

was developed by Phil Zimmermann and uses the IDEA cipher for message encoding.

A device that assures the delivery of electric power without interruption is a(n) ________.

In PKI, the CA periodically distributes a(n) _____ to all users that identifies all revoked certificates.

Many who enter the field of information security are technical professionals such as _____ who find themselves working on information security applications and processes more often than traditional IT assignments.

The _____ vulnerability assessment is a process designed to find and document selected vulnerabilities that are likely to be present on the organization's internal network.

_____ testing is a straightforward testing technique that looks for vulnerabilities in a program or protocol by feeding random input to the program or a network running the protocol.

In most cases, organizations look for a technically qualified information security _____ who has a solid understanding of how an organization operates.

Intrusion _____ activities finalize the restoration of operations to a normal state and seek to identify the source and method of the intrusion in order to ensure that the same type of attack cannot occur again.

_____ penetration testing, also known as disclosure testing, is usually used when a specific system or network segment is suspect and the organization wants the pen tester to focus on a particular aspect of the target.

A methodology and formal development strategy for the design and implementation of an information system is referred to as a _____.

_____ filtering requires that the firewall's filtering rules for allowing and denying packets are manually developed and installed with the firewall.

According to Schwartz, "_____" are the real techies who create and install security solutions.

A _____ vulnerability scanner listens in on the network and identifies vulnerable versions of both server and client software.

The application layer proxy firewall is also known as a(n) _____.

Many who move to business-oriented information security were formerly _____ who were often involved in national security or cybersecurity.

Some vulnerability scanners feature a class of attacks called _____, that are so dangerous they should only be used in a lab environment.

Security managers accomplish _____ identified by the CISO and resolve issues identified by technicians

_____ is an open-source protocol framework that can be used to secure communications across any IP-based network such as LANs, WANs, and the Internet.

Many public organizations must spend all budgeted funds within the fiscal year—otherwise, the subsequent year's budget is _____.

_____ are decoy systems designed to lure potential attackers away from critical systems.

_____ is one of the most crucial ongoing responsibilities in security management with strategic, tactical, and operating elements that must align with and support organizational and IT objectives.

_____ make filtering decisions based on the specific host computer's identity, as represented by its network interface card (NIC) address, and operate at the data link layer of the OSI model or the subnet layer of the TCP/IP model.

A(n) _____ is a private data network that makes use of the public telecommunication infrastructure, maintaining privacy through the use of a tunneling protocol and security procedures.

One of the leading causes of damage to sensitive circuitry is __________.

Because the _____ host stands as a sole defender on the network perimeter, it is commonly referred to as the sacrificial host.

The _____ is responsible for the fragmentation, compression, encryption, and attachment of an SSL header to the cleartext prior to transmission.

Common vulnerability assessment processes include:

The _____ methodology has been used by many organizations and requires that issues be addressed from the general to the specific, and that the focus be on systematic solutions instead of individual problems.

Organizations are moving toward more _____-focused development approaches, seeking to improve not only the functionality of the systems they have in place, but consumer confidence in their product.

The _____ layer of the bull's-eye model includes computers used as servers, desktop computers, and systems used for process control and manufacturing.

The _____ level of the bull's-eye model establishes the ground rules for the use of all systems and describes what is appropriate and what is inappropriate; it enables all other information security components to function correctly.

A(n) _____ is a software program or hardware appliance that can intercept, copy, and interpret network traffic.

Computing and other electrical equipment used in areas where water can accumulate must be uniquely grounded using _____ equipment.

Configuring firewall _____ is viewed as much an art as it is a science.

The (ISC)2 _____ certification program has added a number of concentrations that can demonstrate advanced knowledge beyond the basic certification's common body of knowledge.

A _____ is a key-dependent, one-way hash function that allows only specific recipients (symmetric key holders) to access the message digest.

The goal of the _____ is to resolve any pending project-related issues, critique the overall effort of the project, and draw conclusions about how to improve the project management process for the future.

Activities that scan networks for active systems and then identify the network services offered by the host systems are known as _____.

An emerging methodology to integrate the effort of the development team and the operations team to improve the functionality and security of applications is known as _____.

Which of the following are NOT technologies commonly deployed in biometric locks?

_____ functions are mathematical algorithms that generate a message summary or digest to confirm the identity of a specific message and to confirm that there have not been any changes to the content.

Detailed intelligence on the highest risk warnings can include identifying which _____ apply to which vulnerabilities as well as which types of defenses have been found to work against the specific vulnerabilities reported.

Digital signatures should be created using processes and products that are based on the _____.

Using a database of precomputed hashes from sequentially calculated passwords called a(n) _____, an attacker can simply look up a hashed password and read out the text version.

A _____ is usually the best approach to security project implementation.

A(n) _____ determines the impact that a specific technology or approach can have on the organization’s information assets and what it may cost.

_____ is a hybrid cryptosystem that combines some of the best available cryptographic algorithms and has become the open-source de facto standard for encryption and authentication of e-mail and file storage applications.

_____ is the action of luring an individual into committing a crime to get a conviction.

Kerberos _____ provides tickets to clients who request services.

_____ are hired by the organization to serve in a temporary position or to supplement the existing workforce.

The date for sending the final RFP to vendors is considered a milestone because it signals that __________.

In some organizations, the CISO’s position may be combined with physical security responsibilities or may even report to a security manager who is responsible for both logical (information) security and physical security and such a position is generally referred to as a _____.

The ability to detect a target computer’s _____ is very valuable to an attacker.

_____, a level beyond vulnerability testing, is a set of security tests and evaluations that simulate attacks by a malicious external source like a hacker.

The ISSEP concentration allows CISSP certificate holders to demonstrate expert knowledge of all of the following except _____.

At the World Championships in Athletics in Helsinki in August 2005, a virus called Cabir infected dozens of _____, the first time this occurred in a public setting.

A method of encryption that requires the same secret key to encipher and decipher the message is known as _____ encryption.

A primary mailing list for new vulnerabilities, called simply _____, provides time-sensitive coverage of emerging vulnerabilities, documenting how they are exploited and reporting on how to remediate them. Individuals can register for the flagship mailing list or any one of the entire family of its mailing lists.

The _____ protocol provides system-to-system authentication and data integrity verification, but does not provide secrecy for the content of a network communication.

In a _____ when significant deviation occurs, corrective action is taken to bring the deviating task back into compliance with the project plan; otherwise, the project is revised in light of the new information.

Most guards have clear __________ that help them to act decisively in unfamiliar situations.

The _____ is an intermediate area between a trusted network and an untrusted network.

To use a packet sniffer legally, the administrator must _____.

The _____ vulnerability assessment is designed to find and document vulnerabilities that may be present in the organization’s wireless local area networks.

A(n) _____ is a simple project management planning tool used to break the project plan into smaller and smaller steps.

_____ is the process of classifying IDPS alerts so that they can be more effectively managed.

Which of the following is not one of the categories of positions defined by Schwartz?

A process called _____ examines the data packets that flows through a system and its associated devices to identify the most frequently used devices.

The _____ layer of the bull’s-eye model receives attention last.

In most common implementation models, the content filter has two components: _____.

SHA-1 produces a(n) _____-bit message digest, which can then be used as an input to a digital signature algorithm.

The dominant architecture used to secure network access today is the _____ firewall.

If the task is to write firewall specifications for the preparation of a(n) _____, the planner would note that the deliverable is a specification document suitable for distribution to vendors.

In SESAME, the user is first authenticated to an authentication server and receives a token. The token is then presented to a privilege attribute server as proof of identity to gain a(n) _____.

One approach that can improve the situational awareness of the information security function is to use a process known as _____ to quickly identify changes to the internal environment.

In _____ mode, the data within an IP packet is encrypted, but the header information is not.

U.S. Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency (CISA) coordinates CERT services at __________.

_____ access control is a form of _____ access control in which users are assigned a matrix of authorizations for particular areas of access.

Like the CISSP, the SSCP certification is more applicable to the security_____ than to the security _____.

_____ is the amount of effort (usually in hours) required to perform cryptanalysis to decode an encrypted message when the key or algorithm (or both) are unknown.

Data or the trends in data that may indicate the effectiveness of security countermeasures or technical and managerial controls implemented in the organization are known as performance _____.

_____ allows for major security control components to be reviewed on a periodic basis to ensure that they are current, accurate, and appropriate.

_____ is a cornerstone in the protection of information assets and in the prevention of financial loss.

Technology _____ guides how frequently technical systems are updated, and how technical updates are approved and funded, and also facilitates communication about technical advances and issues across the organization.

The service within Kerberos that generates and issues session keys is known as _____.

The InfoSec measurement development process recommended by NIST is divided into major activities that include all of the following EXCEPT _____.

The Cybersecurity Analyst+ certification from _____ is an intermediate certification with both knowledge-based and performance-based assessment.

_____ are the technically qualified individuals tasked to configure firewalls, deploy IDPSs, implement security software, diagnose and troubleshoot problems, and coordinate with systems and network administrators to ensure that an organization’s security technology is properly implemented.

_____ is the process of converting an original message into a form that is unreadable to unauthorized individuals.

Project managers can reduce resistance to change by involving employees in the project plan. In the systems development parts of a project, this is referred to as _____.

Which of the following phases is often considered the longest and most expensive phase of the systems development life cycle?

_____ is the requirement that every employee be able to perform the work of another employee.

A type of SDLC in which each phase has results that flow into the next phase is called the _____ model.

DES uses a(n) _____-bit block size.

_____ are usually passive devices, but cannot analyze encrypted packets, making some traffic invisible to the process.

The _____ design phase of an SDLC methodology is implementation independent, meaning that it contains no reference to specific technologies, vendors, or products.

To determine whether an attack has occurred or is underway, NIDPSs compare measured activity to known _____ in their knowledge base.

By managing the _____, the organization can reduce unintended consequences by having a process to resolve the potential conflict and disruption that uncoordinated change can introduce.

Bit stream methods commonly use algorithm functions like the _____ OR operation.

_____ is the current federal information processing standard that specifies a cryptographic algorithm used within the U.S. government to protect information in federal agencies that are not a part of the national defense infrastructure.

The Lewin change model includes _____.

The monitoring process has three primary deliverables. Which of the following is NOT one of them?

The breadth and depth covered in each of the domains makes the _____ one of the most difficult-to-attain certifications on the market.

Most network behavior analysis system sensors can be deployed in _____ mode only, using the same connection methods as network-based IDPSs.

In a _____ implementation, the entire security system is put in place in a single office, department, or division before expanding to the rest of the organization.

The former System Administration, Networking, and Security Organization is now better known as _____.

A(n) _____ is an event that triggers an alarm when no actual attack is in progress.

The latest forecasts for information security-related positions expect _____ openings than in many previous years.

A _____ is the information used in conjunction with an algorithm to create the ciphertext from the plaintext or derive the plaintext from the ciphertext.

The information security function can be placed within the _____.

_____ is the entire range of values that can possibly be used to construct an individual key.

Telnet protocol packets usually go to TCP port _____, whereas SMTP packets go to port _____.

The restrictions most commonly implemented in packet-filtering firewalls are based on _____.

The primary benefit of a VPN that uses _____ is that an intercepted packet reveals nothing about the true destination system.