In-Class Quizzes

You are moving to a new location and have been asked to assess the security additions required in the new location. Which of the following concerns could be addressed with a mantrap?

You work for a cable company that utilizes VLANs in its internal network and provides customers with connections between locations. If the company were to offer MPLS, what additional service would the company be able to offer customers that it currently cannot offer?

What port number does HTTPS use?

Network access control (NAC) is a service that goes beyond authentication of the user and includes an examination of the state of the computer?

RAID 3 requires at least three drives, writes the data across all drives, and then writes parity information across all drives as well, so there is no single point of failure?

Your company, a healthcare provider, is considering outsourcing its messaging system to a managed service provider. The proposal presented makes no mention of a DLP functionality. If this is not present, which of the following are you in danger of experiencing?

Your organization recently deployed a standard operating system image to all desktop systems and is now scanning the computers weekly against a security baseline. Which of the following cannot be learned by scanning against the baseline?

Input validation is a technique used to prevent which of the following application attacks?

One of the disadvantages when using sandboxing is the incompatibility issues with the many different types of applications and other utilities?

Bluesnarfing is when an unsolicited message is sent to a Bluetooth-enabled device, often for the purpose of adding a business card to the victim’s contact list?

The following code is an example of what type of attack? #include char *code = "AAAABBBBCCCCDDD"; //including the character '\0' size = 16 bytes void main() {char buf[8]; strcpy(buf, code); }

In the following raw HTTP request, which part is problematic? GET /disp_reports.php?SectionEntered=57&GroupEntered=- 1&report_type=alerts&to_date=01- 01-0101&Run= Run&UserEntered=dsmith&SessionID=5f04189bc&from_date=31-10- 2010&TypesEntered=1 HTTP/1.1 Host: test.example.net Accept: */* Accept-Language: en Connection: close Cookie: java14=1; java15=1; java16=1; js=1292192278001;

You have been asked to improve the quality of the code produced by the software development team, so you are creating a secure coding standard document. Which of the following is NOT a topic that should be covered in the document?

The WASC is the organization that maintains a list of top 10 attacks on an ongoing basis?

Fuzzing is used for testing how an application reacts when injecting invalid or unexpected inputs?

Companies A and B are merging, with the security administrator for Company A becoming head of IT. In which of the following scenarios would the first step be to perform a vulnerability assessment of Company B’s network?

Company E has a contract with a smaller company. The smaller company provides security at a high-security location. Company E discovers that the smaller company has subcontracted some of the functions. What is the minimum step that Company E must take in reaction to this situation? A. Do nothing. It is shielded from liability. B. Execute a new contract that includes the subcontractor. C. Require the security contractor to execute a service agreement with the subcontractor. D. Fire the security consulting company.

Which of the following refers to responsibilities that an organization has due to partnerships with other organizations and customers? A. Due process B. Downstream liability C. Due diligence D. Indirect costs

Generally speaking, an increase in security measures in a network is accompanied by an increase in performance?

Due care is when an organization understands the security risks it faces and has taken reasonable measures to meet those risks?

Your organization has recently implemented several new security policies in response to a recent risk analysis. One of the new policies states that controls must be configured to protect files from unauthorized or accidental deletion. Which aspect of security does this new policy address? A. confidentiality B. integrity C. availability D. authorization

Your company completes a risk analysis. After the analysis, management requests that you deploy security controls that will mitigate any of the identified risks. What is risk mitigation? A. risk that is left over after safeguards have been implemented B. terminating the activity that causes a risk or choosing an alternative that is not as risky C. passing the risk on to a third party D. defining the acceptable risk level the organization can tolerate and reducing the risk to that level

An organization has a research server farm with a value of $12,000. The exposure factor for a complete power failure is 10%. The annualized rate of occurrence that this will occur is 5%. What is the ALE for this event? A. $1,200 B. $12,000 C. $60 D. $600

You have been asked to document the different threats to an internal file server. As part of that documentation, you need to include the monetary impact of each threat occurrence. You should determine the SLE for each threat occurrence?

Standards often include step-by-step lists on how polices, guidelines, and procedures are implemented?

Your company recently had a third party review all internal procedures. As a result of this review, the third party made several recommendations for procedural changes. One of the recommendations is that critical financial transactions should be split between two independent parties. Of which principle is this an example? A. job rotation B. separation of duties C. least privilege D. mandatory vacation

As part of the process of conducting a business impact analysis (BIA), you perform the MTD, MTTR, and MTBF calculations. Which step of the BIA are you performing? A. Identify critical processes and resources. B. Identify resource requirements. C. Identify outage impacts, and estimate downtime. D. Identify recovery priorities.

Which of the following describes the average amount of time it will take to get a device fixed and back online? A. MTBF B. MTTR C. RTO D. RPO

To identify vulnerabilities and threats is the first step of a risk assessment?

Several invalid password attempts for multiple users is considered an incident?

The company you work for has implemented the following security controls: ■ All workstations have the latest patches and antivirus. ■ All sensitive data is encrypted in transit. ■ Dual-factor user authentication is used. ■ A firewall at the edge of the network is implemented. What is missing from this security posture? A. no local encryption B. weak user authentication C. insufficient edge control D. exposure to viruses

If you implement FCoE in your storage network, which of the following security issues should concern you? A. a breach of the Fibre Channel network B. a breach of the Ethernet network C. the use of iSCSI commands D. the inability to use encryption

Placing older data on low-cost, low-performance storage while keeping more active data on faster storage systems is called what? A. multipathing B. tiering C. consolidating D. masking

A community cloud is a solution owned and managed by one company solely for that company’s use?

Synchronous replication provides near-real-time replication but uses more bandwidth and cannot tolerate latency?