Computer Security Fundamentals, 5th edition William Chuck Easttom Test Bank

Computer Security Fundamentals, 5th edition BY William Chuck Easttom

Email: richard@qwconsultancy.com

Computer Security Fundamentals 5e Chapter 1 Introduction to Computer Security True / False 1. The Domain Name System is what translates human-readable domain names into IP addresses that computers and routers understand.

True 2. The type of hacking that involves breaking into telephone systems is called sneaking.

False—This type of hacking is called phreaking.

3. The technique for breaching a system’s security by exploiting human nature rather than technology is war-driving.

False—This describes social engineering.

4. Malware is a generic term for software that has a malicious purpose.

True 5. Software that lays dormant until some specific condition is met is a Trojan horse.

False—This describes a logic bomb. Usually, the condition that is met is a date and time.

6. Someone who breaks into a system legally to assess security deficiencies is a penetration tester.

True 7. Auditing is the process to determine if a user’s credentials are authorized to access a network resource.

False—This describes authentication. Auditing is the process of reviewing logs, records, and procedures.

8. Confidentiality, integrity, and availability are three pillars of security, called the CIA triangle.

True 9. The Health Insurance Portability and Accountability Act of 1996 requires government agencies to identify sensitive systems, conduct computer security training, and develop computer security plans.

False—This describes the Computer Security Act of 1987.

10. The SANS Institute website is a vast repository of security-related documentation.

True

Multiple Choice

1. Which type of hacking is designed to prevent legitimate access to a computer system? a. Denial of service b. Web attack c. Session hijacking d. DNS poisoning Answer A. 2. Your company is instituting a new security awareness program. You are responsible for educating end users on a variety of threats, including social engineering. Which of the following best defines social engineering? a. Illegal copying of software b. Gathering information from discarded manuals and printouts c. Using people skills to obtain proprietary information d. Destruction or alteration of data Answer C. 3. Which type of hacking occurs when the attacker monitors an authenticated session between the client and the server and takes over that session? a. Denial of service b. Web attack c. Session hijacking d. DNS poisoning Answer C. 4. Someone who finds a flaw in a system and reports that flaw to the vendor of the system is a __________. a. White hat hacker b. Black hat hacker c. Gray hat hacker d. Red hat hacker Answer A. 5. Someone who gains access to a system and causes harm is a __________? a. White hat hacker b. Black hat hacker c. Gray hat hacker d. Red hat hacker Answer B. 6. A black hat hacker is also called a __________.

a. Thief b. Cracker c. Sneaker d. Script kiddy Answer B. 7. Someone who calls himself a hacker but lacks the expertise is a __________. a. Script kiddy b. Sneaker c. White hat hacker d. Black hat hacker Answer A. 8. Someone who legally breaks into a system to assess security deficiencies is a __________. a. Script kiddy b. Penetration tester c. Gray hat hacker d. Black hat hacker Answer B. 9. A(n) __________ is a basic security device that filters traffic and is a barrier between a network and the outside world or between a system and other systems. a. Firewall b. Proxy server c. Intrusion detection system d. Network monitor Answer A. 10. A(n) __________ hides the internal network’s IP address and presents a single IP address to the outside world. a. Firewall b. Proxy server c. Intrusion detection system d. Network monitor Answer B. 11. Which one of these is NOT one of the three pillars of security in the CIA triangle? a. Confidentiality b. Integrity c. Availability

d. Authentication Answer D. 12. Which of these is the process to determine if the credentials given by a user or another system are authorized to access the network resource in question? a. Confidentiality b. Integrity c. Availability d. Authentication Answer D. 13. Which of these is a repository of security-related documentation and also sponsors a number of security research projects? a. Computer Emergency Response Team b. F-Secure c. SANS Institute d. Microsoft Security Response Center Answer C. 14. Which of these was the first computer incident-response team? a. Computer Emergency Response Team b. F-Secure c. SANS Institute d. Microsoft Security Response Center Answer A. 15. Which of these is a repository for detailed information on virus outbreaks? a. Computer Emergency Response Team b. F-Secure c. SANS Institute d. Microsoft Security Response Center Answer B.

Computer Security Fundamentals 5e Chapter 2 Networks and the Internet True / False 1. The notation used to perform variable-length subnet masking for IP addresses is CIDR. True 2. The name you type into a browser’s address bar, such as www.microsoft.com, is known as the IP locator.

False—This is called the uniform resource locator (URL).

3. The IP command-line command to determine your computer’s IP address, subnet mask, and default gateway is ping.

False—The command that displays this information is ipconfig.

4. The IP command-line command to determine the number of hops it takes to get from your computer to its destination is nslookup.

False—The command is tracert, followed by the IP address of the destination.

5. No protocols operate at the physical layer of the OSI model.

True 6. The session layer of the OSI model provides the mechanism to manage the dialogue between end-user application processes.

True 7. The TCP protocol works at the network layer of the OSI model.

False—The TCP protocol works at the transport layer, which is Layer 4. The IP and ICMP protocols work at the network layer.

8. A MAC address is a unique address for a NIC. True 9. A polycloud combines the elements of private and public clouds.

False—This describes hybrid clouds.

10. A host is a machine with data on it, to which you can connect.

True

Multiple Choice 1. Unshielded twisted-pair cable capable with a specification of 100 MHz/100 Mbps is also called Category __________. a. 5

b. 6 c. 7 d. 8 Answer A. 2. Which device can connect many computers and send packets out of every port? a. Hub b. Repeater c. Switch d. Router Answer A. 3. Which device is used to boost a signal? a. Hub b. Repeater c. Switch d. Router Answer B. 4. Which device can connect many computers and send data only out of one port based on the MAC address? a. Hub b. Repeater c. Switch d. Router Answer C. 5. Which device can relay packets from one network to another and is usually programmable? a. Hub b. Repeater c. Switch d. Router Answer D. 6. Which TCP/IP protocol operates on port 53 and translates URLs into web addresses? a. FTP b. SMTP c. HTTP d. DNS

Answer D. 7. Which TCP/IP protocol operates on ports 20 and 21 and is used for transferring files between computers? a. FTP b. SMTP c. HTTP d. DNS Answer A. 8. Which TCP/IP protocol operates on port 80 and displays web pages? a. FTP b. SMTP c. HTTP d. DNS Answer C. 9. Which TCP/IP protocol operates on port 25 and sends email? a. FTP b. SMTP c. HTTP d. DNS Answer B. 10. A(n) __________ hides the internal network’s IP address and presents a single IP address to the outside world. a. Firewall b. Proxy server c. Intrusion detection system d. Network monitor Answer B. 11. An IP version 4 address is a series of four values, separated by periods. Each number is called a(n) __________. a. Subnet b. Octet c. Bit d. CIDR Answer B.

12. If an IP address has the number 194 in the first octet, it is a class __________ address. a. A b. B c. C d. D Answer C. 13. If an IP address has the number 191 in the first octet, it is a class __________ address. a. A b. B c. C d. D Answer B. 14. What is the binary equivalent of the decimal number 240? a. 11110000 b. 11111000 c. 11111100 d. 11111110 Answer A. 15. The IP utility used to send a test packet to a machine to find out if the machine is reachable and how long the packet takes to reach the machine is called __________. a. CIDR b. tracert c. ping d. ipconfig Answer C.

Computer Security Fundamentals 5e Chapter 3: Cyber Stalking, Fraud, and Abuse True / False 1. The “pump and dump” scheme occurs when a con artist purchases a large amount of a virtually worthless stock, then circulates rumors that inflate the stock’s value, and then sells for a profit.

True 2. When fraudulent sellers bid on the seller’s items to drive up the auction price, it is called bid shielding.

False—This describes shill bidding.

3. Identity theft and identity fraud refer to all types of crime in which someone wrongfully obtains and uses another person’s personal data in some way that involves fraud or deception.

True 4. The process to induce you to provide personal information through a website is called cyber stalking.

False—This process is called phishing.

5. Experts consider Romania the country with the strictest cybercrime laws.

True 6. Firefox is an example of a phishing site.

False—Firefox is a web browser.

7. One good practice in a chat room is not to use your real name.

True 8. Someone who uses the Internet to harass, threaten, or intimidate another person is guilty of identity theft.

False—This describes cyber stalking.

9. One good rule that applies to online investing is “Never invest money that you cannot afford to lose.”

True 10. One of the best ways to stop cookies you don’t want is to install anti-spyware software.

True

Multiple Choice

1. Which of the following is a type of fraud in which an auction site bidder is actually the seller with a fake identity, who bids high to drive up the price? a. Shill bidding b. Bid shielding c. Bid siphoning d. Phishing Answer A. 2. Which of the following occurs when a fraudulent buyer submits high bids to discourage other bidders, and then retracts the bids so people they know can get the item at a lower price? a. Shill bidding b. Bid shielding c. Bid siphoning d. Phishing Answer B. 3. Which of the following occurs when a con artist lures bidders off legitimate auction sites by claiming to offer the same item at a lower price? a. Shill bidding b. Bid shielding c. Bid siphoning d. Phishing Answer C. 4. Which of the following is the process of trying to induce someone to provide you with personal information? a. Cyber stalking b. Auction fraud c. Phishing d. Investment fraud Answer C. 5. Which of the following involves using the Internet to harass, threaten, or intimidate another person? a. Cyber stalking b. Auction fraud c. Phishing d. Investment fraud Answer A.

6. A file on your computer that websites use to store information about you is a __________. a. Cookie b. Browser c. Tab d. Firewall Answer A. 7. Which of the following is one way to protect yourself against identity theft? a. Do not provide personal information to anyone unless absolutely necessary. b. Use Firefox as your web browser. c. Use Windows as your operating system. d. None of the above.

Answer A. 8. Which country is described by experts as having the strictest cybercrime laws? a. United States b. Russia c. France d. Romania Answer D. 9. Which of these could be considered a course of conduct directed at a specific person that causes substantial emotional distress in such a person and serves no legitimate purpose? a. Phishing b. Browsing c. Harassment d. Auction fraud Answer C. 10. Why should a cybercrime law be specific? a. To prevent defendants from finding loopholes b. So it will be internationally recognized c. So that multiple laws will not be necessary d. To increase the number of fraud cases Answer A. 11. Which of the following refers to the general tone of cyber stalking communications, the nature of the language, and the level of the threat?

a. Credibility b. Specificity c. Intensity d. Frequency Answer C. 12. The recommended Microsoft Edge privacy setting is __________. a. Medium b. Medium High c. High d. Very High Answer B. 13. Firefox and Google Chrome are examples of __________. a. Cookies b. Web browsers c. Websites d. Proxy servers Answer B. 14. When using a chat room, one way to protect yourself from online harassment is __________. a. Not to use your real name b. Not to use the chat room at night c. Not to say too much in the chat room d. None of the above Answer A. 15. One way to protect yourself on auction sites is __________. a. Use a separate credit card with a low limit b. Bid late in the process c. Bid early in the process d. Have someone else bid for you Answer A.

Computer Security Fundamentals 5e Chapter 4 Denial of Service Attacks True / False 1. Blocking ICMP packets may help prevent denial of service attacks.

True 2. A Smurf attack is a type of malware attack.

False—A Smurf attack is a denial of service attack.

3. The ping –l option changes the size of the packet you can send.

True 4. A denial of service attack is one of the most common attacks on the Internet.

True 5. SYN cookies are a form of attack.

False—SYN cookies are a method to defend against denial of service attacks.

6. The weakness in any denial of service attack, from the attacker’s point of view, is that the flood of packets must be sustained.

True 7. A teardrop attack involves overloading the login process by continually sending login requests.

False—This describes a login DoS attack.

8. A yo-yo attack occurs when the attacker sends a forged packet with the same source IP address and destination IP address as the target’s IP address.

False—This describes a land attack.

9. ISPs often use a process called upstream filtering that examines traffic to determine if it is part of a denial of service attack and then blocks suspected traffic.

True 10. A firewall can be configured to disallow certain types of incoming traffic that may be attacking.

True

Multiple Choice 1. Which type of attack attempts to overload a system with requests, denying legitimate users access? a. Denial of service

b. IP spoofing c. Phishing d. Cyber stalking Answer A. 2. Which defensive technique involves the server sending an incorrect SYN+ACK to the client, so the client sends an RST packet notifying the server of an error? This makes the server think the client request is legitimate. a. SPI firewalls b. RST cookies c. SYN cookies d. Micro blocks Answer B. 3. Which attack involves sending an ICMP packet to the broadcast address so that it is then sent to the spoofed source address, causing the network to perform a DoS attack on one or more of its member servers? a. UDP flood attack b. Teardrop attack c. Smurf IP attack d. ICMP flood attack Answer C. 4. Which defensive technique involves allocating a micro-record instead of allocating a complete connection object (an entire buffer segment) to the SYN object? a. Micro blocks b. RST cookies c. SYN cookies d. SPI firewalls Answer A. 5. Micro blocks, SYN cookies, RST cookies, and upstream filtering are defenses against __________. a. TCP SYN flood attacks b. Phishing c. Viruses d. Cyber stalking Answer A. 6. Which defensive technique involves examining traffic to determine if it is part of a denial of service attack and then blocking suspected traffic?

a. SYN cookies b. SPI firewalls c. Micro blocks d. Upstream filtering Answer D. 7. One tool used for a denial of service attack is __________. a. Linux b. Tribal Flood Network c. UDP d. ARP Answer B. 8. __________ attacks damage a system so badly that the victim machine needs an operating system reinstall or even new hardware. a. DHCP starvation b. Land c. PDoS d. Login DoS Answer C. 9. The command-line command that determines how many milliseconds the ping utility will wait for a response from the target is ping __________. a. -w b. -i c. -j d. -s Answer A. 10. The command-line command to instruct the ping utility to send packets until explicitly told to stop is ping __________. a. -s b. -t c. -u d. -l Answer B. 11. The attack in which the attacker sends a forged packet with the same source IP address and destination IP address is a __________ attack. a. PDoS

b. Land c. Teardrop d. UDP flood Answer B. 12. The attack in which the attacker sends a fragmented message that the victim cannot reconstruct is a(n) __________ attack. a. Teardrop b. PoD c. Land d. ICMP flood Answer A. 13. The attack in which the attacker sends a packet that is too large and can shut down a target machine is a(n) __________ attack. a. ICMP flood b. PoD c. Teardrop d. UDP flood Answer B. 14. One defense against denial of service attacks is to __________ ICMP packets. a. Block b. Convert c. Permit d. Modify Answer A. 15. A distributed reflection denial of service attack exploits the communication line on port __________ and gets routers to attack a target system. a. 179 b. 7 c. 80 d. 19 Answer A.

Computer Security Fundamentals 5e Chapter 5 Malware True / False 1. A common way for a virus to spread is by emailing itself to contacts in your email address book.

True 2. After a virus is on your system, it can do anything a legitimate program can do.

True 3. The Sasser virus/buffer overflow attack spreads by copying itself to shared drives and emailing itself out to everyone in your address book.

False—This describes the Sobig virus. The Sasser virus/buffer overflow attack spreads by exploiting a buffer overrun.

4. The most common method to deliver spyware to a target system is by using a Trojan horse.

True 5. A rootkit provides the hacker root or privileged access.

True 6. Malware that is portable to all operating systems or platforms is considered web-based code.

True 7. Malware that executes when a specific criterion is met is a logic bomb.

True 8. In a virus attack, the victim machine is the source.

False—The victim machine is the target.

9. Thanatos ransomware first encrypts files and then places a readme.txt file on the desktop computer.

True 10. A virus is any file that can self-replicate.

True

Multiple Choice 1. A common way for a virus to spread is by __________.

a. Scanning your computer for network connections and copying itself to other machines on the network b. Installing security software c. Locating Linux machines d. Using a buffer-overflow attack Answer A. 2. The Microsoft Office suite is a tempting target for viruses because __________. a. It is so ubiquitous b. It is designed so that legitimate programmers can access its internal objects c. It contains virus programming tools d. It copies virus files faster Answer B. 3. The Shlayer virus caused harm because __________. a. It had a negative payload b. It erased data on computers c. It installed a variety of malicious programs d. It attempted to identify and sell personal or financial data Answer C. 4. Which type of virus uses techniques that make it hard to analyze, such as code confusion? a. Armored b. Multi-partite c. Boot sector d. Polymorphic Answer A. 5. Which type of virus attempts to elude detection by performing its malicious activities only sporadically? a. Memory resident b. Sparse infector c. Armored d. Boot sector Answer B. 6. The virus that specifically targets Mac computers is __________. a. FakeAV b. Petya c. MacDefender

d. Flame Answer C. 7. The malware that specifically targets Linux computers is __________. a. Petya b. FakeAV c. Clop d. None of the above Answer D. 8. The virus that collected email addresses from your address book and other documents on your machine was the __________ virus. a. Mimail b. Kedi RAT c. Sobig d. Petya Answer A. 9. The malware that was specifically designed by the U.S. government for espionage is the __________ virus. a. Nonvirus b. Schlayer c. Flame d. FakeAV Answer C. 10. A virus that sends emails to victims telling them to delete a needed system file is a __________ virus. a. WannaCry b. Mindware c. Nonvirus d. Kedi RAT Answer C. 11. A program that looks benign but has a malicious purpose is a __________. a. Trojan horse b. Virus c. Worm d. Cookie Answer A.

12. McAfee and Norton are examples of __________. a. Viruses b. Worms c. Trojan horses d. Virus scanners Answer D. 13. A program that can propagate without human interference is a __________. a. Virus b. Worm c. Trojan horse d. Buffer-overflow attack Answer B. 14. Any file that can self-replicate is a __________. a. Virus b. Worm c. Trojan horse d. Cookie Answer A. 15. If a program writes more information into the computer’s memory than the memory was designed to hold, it is a(n) __________ attack. a. Buffer-overflow b. RAM c. Spyware d. Adware Answer A.

Computer Security Fundamentals 5e Chapter 6 Techniques Used by Hackers True / False 1. Nmap is a popular hacking tool.

False—It is a port scanner tool.

2. Black hat hackers are also known as script kiddies.

False—Black hat hackers are also known as crackers.

3. Hacking into phone systems is also known as phreaking.

True 4. Checking an organization’s website is a form of active scanning.

False—This is a form of passive scanning.

5. NetBIOS is an example of a port scanner.

False—NetBIOS is a Windows protocol or form of network communication.

6. A ping scan may be stopped by blocking ICMP packets.

True 7. ACK scans and NULL scans work only on UNIX systems.

True 8. A SQL statement may begin with the word SELECT. True 9. Sid2User, UserInfo, and DumpSec are examples of password-cracking tools.

False—These are examples of enumeration tools.

10. Windows passwords are stored in a hash file in one of the system directories.

True

Multiple Choice 1. Testing an organization’s security by using hacking techniques is known as __________ testing. a. Penetration b. Location c. Virus d. Black hat hacking Answer A.

2. People who perform a cyber attack without really understanding what they are doing are called __________. a. Gray hat hackers b. White hat hackers c. Script kiddies d. Black hat hackers Answer C. 3. Hacking into phone systems is called __________. a. Cracking b. Scripting c. Phreaking d. Scanning Answer C. 4. Examples of __________ include scanning bulletin boards, chat rooms, and discussion groups. a. Active scanning b. Passive scanning c. Phreaking d. Scouring Answer B. 5. There are 1024 well-known __________ that are usually associated with specific services. a. Ports b. Processes c. Applications d. Programs Answer A. 6. The most popular port scanner in the hacking and security community is __________. a. ophcrack b. Nmap c. Brutus d. NetBIOS Answer B. 7. The most reliable Nmap scan is a __________ scan. a. Ping

b. Connect c. SYN d. FIN Answer B. 8. With a(n) __________ scan, if the port is closed, the response is an RST. If the port is open, the response is an SYN/ACK. a. FIN b. XMAS c. SYN d. ACK Answer C. 9. Nmap enables you to set __________ such as –sP, -sS, and -oA. a. Parameters b. Flags c. Switches d. Ports Answer B. 10. __________ is the process of finding out what is on a target system. a. Enumeration b. Phishing c. Mapping d. Scanning Answer A. 11. Passing structured query language commands to a web application and getting the website to execute them is called SQL script __________. a. Injection b. Processing c. Attacking d. Execution Answer A. 12. With __________, an attacker injects client-side scripts into web pages viewed by other users. a. Cross-site scripting b. Phreaking c. Phishing d. SQL script injection

Answer A. 13. __________ is a popular tool for cracking Windows passwords. a. Sid2User b. Cheops c. Netcat d. ophcrack Answer D. 14. The Dark Web is an area of the Internet that is accessible only via __________. a. Bluesnarfing b. Penetration testing c. Onion routing d. Net user scripts Answer C. 15. Which phase of penetration testing, as described by the NIST 800-115 standard, uses various tools to identify or discover any issues with a target network? a. Discovery b. Attack c. Reporting d. Planning Answer A.

Computer Security Fundamentals 5e Chapter 7 Industrial Espionage in Cyberspace True / False 1. Microsoft Windows includes BitLocker in some editions, so entire hard drives can be encrypted.

True 2. Employees with access to sensitive information should be asked to sign nondisclosure agreements.

True 3. The Patriot Act was the first U.S. law to criminalize the theft of commercial trade secrets.

False—This describes the Industrial Espionage Act of 1996.

4. Crafting emails and websites to specifically target certain victims is called spear phishing.

True 5. Asset identification is the process of listing the assets that you believe support your organization.

True 6. Funcrypt is a free tool that can be used to encrypt drives, folders, or partitions.

False—This describes VeraCrypt.

7. Hiding a message in images is an example of stenography.

False—This describes steganography.

8. Sending a forged email asking for sensitive data is an example of steganography.

False—This describes social engineering.

9. The formula for economic gain can be expressed as: VI (value of information) = C (cost to produce) + VG (value gained) True 10. Industrial espionage is the use of spying techniques to find out key information that is of economic value.

True

Multiple Choice

1. __________ is the use of spying techniques to find out key information that is of economic value. a. Industrial espionage b. Port scanning c. Electronic monitoring d. Asset identification Answer A. 2. Which of the following is NOT an example of industrial espionage? a. Details on a competitor’s new project b. A list of a competitor’s clients c. Denial of service attack d. Research data Answer C. 3. For security reasons, when an employee leaves a company, you should conduct a(n) __________ interview. a. Security b. Exit c. Employment d. Sensitive Answer B. 4. VI (value of information) = C (cost to produce) + __________. a. MU (markup) b. GM (gross margin) c. VG (value gained) d. VL (value lost) Answer C. 5. Data stored in computer systems has a high value because there is a great deal of time and effort that goes into creating and analyzing it and __________. a. Data often has intrinsic value b. Data is an asset that appreciates c. Data lasts forever d. Data has little economic value Answer A. 6. The process of listing assets that you believe support your organization is called __________. a. Business planning

b. Asset identification c. Making a balance sheet d. Organizational charting Answer B. 7. The company whose employee was accused of stealing trade secrets related to selfdriving cars and providing them to the Chinese government was __________. a. General Motors b. Energy Technology International c. Apple Inc. d. RedCurl Answer C. 8. The company that paid $7 million to keep secret an alleged corporate espionage program including wiretapping, hacking, bribery, and the use of former intelligence officers was __________. a. RedCurl b. General Motors c. Uber Technologies Inc. d. Apple Inc. Answer C. 9. The chief executive officer of Oracle Corporation defends his practice to hire private investigators to sift through the garbage of which competitor? a. Red Hat b. McAfee c. Norton d. Microsoft Answer D. 10. Cookies and key loggers are examples of __________. a. Viruses b. Worms c. Spyware d. Social engineering Answer C. 11. The single greatest security risk to any organization is __________. a. A disgruntled employee b. Lack of a disaster recovery plan c. Lack of antivirus software

d. Out-of-date software Answer A. 12. The most obvious use of __________ involves talking to an employee and getting him to reveal sensitive data. a. Spyware b. Keylogging c. Social engineering d. Steganography Answer C. 13. Sending an email that claims to come from a different sender and asking for sensitive data is an example of __________. a. Whaling b. Steganography c. Keylogging d. Social engineering Answer D. 14. QuickStego and Invisible Secrets are two software tools that can be used for __________. a. Port scanning b. Steganography c. Keylogging d. Industrial espionage Answer B. 15. Giving personnel access to only data that they absolutely need to perform their jobs is referred to as __________. a. Least privileges b. Job rotation c. Business continuation planning d. None of the above Answer A.

Computer Security Fundamentals 5e Chapter 8 Encryption True / False 1. Cryptography is the art of writing or deciphering secret code.

True 2. Asymmetric cryptography means the same key is used to encrypt and decrypt the message.

False—This describes symmetric cryptography.

3. One of the oldest encryption methods is the Caesar cipher.

True 4. The bits combined with the plain text to encrypt it are called keys.

True 5. A digital signature is used to ensure the confidentiality of a message.

False—A digital signature is used to guarantee who sent the message.

6. Public key encryption is important because there are no issues to deal with concerning the distribution of the keys.

True 7. PGP is not considered secure by most experts.

False—PGP is a widely used system that is considered very secure by most experts.

8. The most widely used symmetric key algorithm is Advanced Encryption Standard (AES).

True 9. Cipher text is encrypted text.

True 10. Binary numbers are made up of 0s and 1s.

True

Multiple Choice 1. __________ is the process of scrambling a message or other information so that it cannot be easily read by someone intercepting the message. a. Encryption b. Cryptography

c. Keying d. Decryption Answer A. 2. __________ is the art of writing in or deciphering secret code. a. Encryption b. Cryptography c. Keying d. Decryption Answer B. 3. In __________ cryptography, a different key is used to encrypt the message than is used to decrypt the message. a. Asymmetric b. Symmetric c. Forward d. Backward Answer A. 4. With symmetric cryptography, the same __________ is used to encrypt the message and decrypt the message. a. Code b. Key c. Lock d. Script Answer B. 5. Using the __________ cipher, you choose some number by which to shift each letter of a text. a. Multi-alphabet substitution b. Caesar c. Atbash d. Rail fence Answer B. 6. Using the __________ cipher, you select multiple numbers by which to shift letters. a. Polybius b. Atbash c. Multi-alphabet substitution d. Scytale

Answer C. 7. Which of the following is an operation used on binary numbers not found in normal math? a. AND b. PLUS c. MINUS d. LESS Answer A. 8. __________ refers to the bits that are combined with the plain text to encrypt it. a. A key b. Plain text c. Cipher text d. An algorithm Answer A. 9. __________ refers to the unencrypted text. a. A key b. Plain text c. An algorithm d. Cipher text Answer B. 10. __________ refers to the encrypted text. a. A key b. Plain text c. An algorithm d. Cipher text Answer D. 11. A(n) __________ is a mathematical process for doing something. a. Formula b. Algorithm c. Cipher d. Key Answer B. 12. Which of these is NOT a type of symmetric algorithm? a. Stream b. Block

c. Transcription d. None of the above Answer C. 13. __________ is a block cipher that uses a variable-length key ranging from 32 to 448 bits. a. 3DES b. AES c. Blowfish d. RC4 Answer C. 14. With __________ encryption, one key is used to encrypt a message, and another is used to decrypt the message. a. Private key b. Public key c. Cipher d. MD5 Answer B. 15. Windows stores passwords using a method called __________. a. Hashing b. Authentication c. Steganography d. Cryptanalysis Answer A.

Computer Security Fundamentals 5e Chapter 9 Computer Security Technology True / False 1. Snort is an open-source firewall.

False—Snort is an open-source intrusion detection system.

2. A server with fake data that attracts an attacker is a honey pot.

True 3. The method to attract an intruder to a subsystem set up for the purpose of observing him is called intrusion deterrence.

False—This describes intrusion detection. Intrusion deterrence occurs when the administrator tries to make the system seem like a less palatable target.

4. An on-demand virus scanner runs in the background and constantly checks your PC for any sign of a virus.

False—This describes an ongoing virus scanner. An on-demand virus scanner runs only when launched.

5. Heuristic scanning uses rules to determine whether a file or program behaves like a virus.

True 6. Linux and Windows typically are not shipped with firewalls.

False—Both Linux and Windows ship with firewalls.

7. Kerberos is an authentication protocol that uses a ticket-granting system that sends an encrypted ticket to the user’s machine.

True 8. A virtual private network is a way to use the Internet to create a connection between a remote user and a central location.

True 9. L2TP uses IPsec for its encryption.

True 10. IPsec can only encrypt the packet data but not the header information.

False—IPsec encrypts both the packet data and the header information.

Multiple Choice 1. A list of virus definitions is typically in a small file with a __________ extension.

a. .dat b. .txt c. .vir d. .def Answer A. 2. Typically, when you update virus definitions __________. a. The virus program scans your computer b. Your computer restarts c. You are updating the virus definition file on your computer d. None of the above Answer C. 3. A file that stays in memory after it executes is a(n) __________. a. Terminate and stay resident (TSR) program b. Executable c. Text file d. Bug Answer A. 4. The virus scanning technique that uses rules to determine if a program behaves like a virus is __________ scanning. a. Download b. File c. Heuristic d. Sandbox Answer C. 5. The virus scanning technique that means you have a separate area isolated from the operating system in which a file is run, so it won’t infect the system is __________. a. Download b. File c. Heuristic d. Sandbox Answer D. 6. Java and ActiveX codes should be scanned before they are __________. a. Downloaded to your computer b. Known about c. Infected d. Filtered

Answer A. 7. Mistaking a legitimate program for a virus is a __________. a. Heuristic error b. False negative c. False positive d. Download error Answer C. 8. A __________ is a barrier between two computers or computer systems. a. Firewall b. Web server c. Sandbox d. File server Answer A. 9. The simplest form of firewall is a(n) __________ firewall. a. Packet filtering b. Application gateway c. Circuit-level gateway d. Stateful packet inspection Answer A. 10. A(n) __________ firewall examines the entire conversation between client and server, not just individual packets. a. Circuit-level gateway b. Stateful packet inspection c. Packet filtering d. Application gateway Answer B. 11. In which firewall configuration is the software installed on an existing machine with an existing operating system? a. Network host-based b. Dual-homed host c. Router-based d. Screened host Answer A.

12. In which firewall configuration is the firewall running on a server with at least two network interfaces? a. Network host-based b. Dual-homed host c. Router-based d. Screened host Answer B. 13. A firewall __________ is a tool that can provide information after an incident has occurred. a. Log b. Scan c. Port d. Rule Answer A. 14. A security information and event management (SIEM) system helps coordinate security activity on a(n) __________. a. Firewall b. Individual computer c. Gateway d. Network Answer D. 15. Which of the following is a stateful packet inspection firewall with features such as integrated intrusion detection systems, application gateway features, and deep packet inspection? a. Web application firewall (WAF) b. Application-layer firewall c. Next-generation firewall (NGFW) d. Circuit-level gateway Answer C.

Computer Security Fundamentals 5e Chapter 10 Security Policies True / False 1. A security policy is a document that defines how an organization will deal with some aspect of security.

True 2. Effective user policies must cover passwords.

True 3. A good password should have at least eight characters and use all lowercase letters.

False—A good password should have at least eight characters and include letters, numbers, and special characters.

4. An organization should not permit end users to install anything on their computers.

True 5. After an employee discontinues employment, his or her workstation hard drive should be searched.

True 6. The concept of least privileges means that no one person can perform critical tasks.

False—This describes the separation of duties. The concept of least privileges means that a user gets the least access he can have and still effectively do his job.

7. One reason allowing a user to change the desktop configuration poses a security risk is that to change a desktop, the user must be given rights that also allow them to change other system settings.

True 8. You cannot disable some USB devices from end-user computers and allow others.

False—An administrator may allow some USB devices and disallow any additional devices to be added.

9. Standards are specific instructions on how to handle specific issues.

False—Procedures are specific instructions on how to handle specific issues. A standard is a general statement of the desired level of operation.

10. Security policies toward programmers and web developers are development policies.

True

Multiple Choice

1. A document that defines how an organization deals with some aspect of security is a(n) __________. a. Security policy b. Business plan c. Security update d. Access control Answer A. 2. Password guidelines, Internet use, instant messaging, and software installation processes are areas of __________. a. Computer policies b. User policies c. Documentation d. Network policies Answer B. 3. The plan to return a business to normal operations after a disaster occurs is a(n) __________. a. BCP b. DRP c. BIA d. ALE Answer B. 4. __________ is the most obvious reason for organizations to provide their users with Internet access. a. Email b. Job searching c. Emergency communications d. Conducting personal business Answer A. 5. Which of the following is an activity that falls into a gray area and might be acceptable for Internet use in some organizations but not others? a. Email b. Online training c. Web meetings d. Online shopping during a break time Answer D.

6. Which of the following should NOT be a part of an organization’s policy regarding email attachments? a. It was an expected attachment. b. It came from a known source, and the source is confirmed. c. It appears to be a legitimate business document. d. None of the above Answer D. 7. Use for business communications only and the disallowing of the transmission of confidential business information are recommended guidelines for __________. a. Desktop configuration b. Instant messaging c. USB drives d. Online shopping Answer B. 8. The background, screensaver, font size, and resolution are elements of __________. a. Desktop configuration b. File extensions c. Passwords d. Access controls Answer A. 9. Procedures for adding users, removing users, and dealing with security issues are examples of __________ policies. a. User b. Computer c. System administration d. Password Answer C. 10. New employees should receive a copy of the company’s __________ policies. a. Business continuation b. Disaster recovery c. Computer security/acceptable use d. Administrative Answer C. 11. When an employee leaves, all __________ should be terminated. a. Web histories b. Logins

c. Desktops d. Change requests Answer B. 12. When a virus strikes a system, the first step is to __________. a. Scan and clean infected system(s) b. Log the incident c. Unplug the machine(s) from the network d. Notify appropriate organization leaders Answer C. 13. If you experience a denial of service (DoS) attack, you can use firewall logs to determine the __________ from which the attack originated. a. Computer operating system b. Computer manufacturer c. IP address d. None of the above Answer C. 14. The conflict between the users’ goal for unfettered access to data and the security administrator’s goal to protect that data is an issue of __________. a. System administration b. Access control c. Password protection d. Social engineering Answer B. 15. The principle that users only have access to network resources when an administrator explicitly grants them is called __________. a. Implicit deny b. Least privileges c. Separation of duties d. Job rotation Answer A.

Computer Security Fundamentals 5e Chapter 11 Network Scanning and Vulnerability Scanning True / False 1. The stages of assessing a system’s security can be categorized into the six Ps: patch, ports, protect, policies, probe, and physical.

True 2. Nessus is the premiere network vulnerability scanner.

True 3. Experience is the most important factor when looking for a security professional.

True 4. CNE, MCITP, and CISSP are examples of industry certifications.

True 5. Every open port on a router is a possible avenue of entry for malware or an intruder.

True 6. For individual computers not running firewall software, you should directly close ports.

False—You should shut down the service using a particular port.

7. Windows has a built-in firewall, but Linux does not.

False—Both Windows (from XP through 11) and Linux have built-in firewalls.

8. There should be a firewall between your network and the outside world.

True 9. A good password should contain only letters and numbers.

False—A good password should contain uppercase and lowercase letters, numbers, and characters.

10. A good rule of thumb for a password history policy is a history depth of five.

True

Multiple Choice 1. The first rule of computer security is to check __________. a. Patches b. Ports c. Policies d. Probes

Answer A. 2. Any __________ you do not explicitly need should be shut down. a. Patch b. Port c. Policy d. Probe Answer B. 3. For an individual machine that is not running firewall software, you do not directly close ports; instead, you shut down the __________ using that port. a. Patch b. Router c. Policy d. Service Answer D. 4. A password policy for a 90- or 180-day replacement schedule is called password __________. a. History b. Uniqueness c. Age d. Update Answer C. 5. You would set a __________ to prevent users from immediately changing their password several times in one day to return to their current password. a. Minimum password age b. Maximum password age c. Minimum password length d. Maximum password length Answer A. 6. A good password has at least __________ characters. a. 6 b. 8 c. 10 d. 12 Answer B.

7. Probing your network for security flaws should occur once a quarter, and a complete audit of your security should be completed __________ per year. a. Once b. Twice c. Three times d. Four times Answer A. 8. The process of securing a computer system against hackers, malware, and other intruders is sometimes referred to as __________ a system. a. Securitizing b. Hardening c. Routing d. Patching Answer B. 9. On a server, you should create your accounts with __________ that do not reflect their level of permission. a. Names b. Numbers c. Passwords d. Properties Answer A. 10. A __________ involves setting up two firewalls: an outer and an inner firewall. a. DMZ (demilitarized zone) b. Proxy server c. DNS server d. Network scan Answer A. 11. The rule that packets not originating from inside your LAN should not be forwarded relates to __________. a. Servers b. Workstations c. Routers d. Web servers Answer C. 12. The most widely used vulnerability scanner available today is __________. a. Shodan

b. OWASP c. Nikto d. Nessus Answer D. 13. The standard for web application vulnerability is __________. a. Shodan b. OWASP c. Nikto d. Nessus Answer B. 14. A search engine for vulnerabilities that is widely used by black hat hackers and security professionals is __________. a. Shodan b. OWASP c. Nikto d. Nessus Answer A. 15. A Kali Linux tool that scans websites for common vulnerabilities is __________. a. Shodan b. OWASP c. Nikto d. Nessus Answer C.

Computer Security Fundamentals 5e Chapter 12 Cyber Terrorism and Information Warfare True / False 1. Cyber terrorism is using computers and the Internet connectivity between them to launch a terrorist attack.

True 2. CENTCOM, or Central Command, is the U.S. military command responsible for operations in the Middle East and Near East.

True 3. The MyDoom virus was directed against the Pentagon.

False—The MyDoom virus was directed against the Santa Cruz Organization.

4. The Stuxnet virus was directed against Iraqi nuclear facilities.

False—The Stuxnet virus was directed against Iranian nuclear facilities.

5. Information warfare is any attempt to manipulate information to pursue a military or political goal.

True 6. Radio Free Europe was supported by Western democracies during the Cold War. True 7. Usenet is an example of an email service.

False—Usenet is an example of a service that provides newsgroups and discussion boards.

8. One technique of disinformation is to produce false news stories.

True 9. The Internet serves as a communications and recruiting tool for terrorist groups.

True 10. Title VIII of the U.S. PATRIOT Act specifically deals with cyber terrorism.

True

Multiple Choice 1. According to the FBI, __________ is the premeditated, politically motivated attack against information, computer systems, computer programs, and data that results in violence against noncombatant targets by subnational groups or clandestine agents. a. Cyber terrorism

b. Ecoterrorism c. Cyberespionage d. Propaganda Answer A. 2. According to ISight Partners, a cyber intelligence firm, in 2014 hackers from __________ were spying on computers used in NATO and the European Union. a. Russia b. Latvia c. Lithuania d. Estonia Answer A. 3. The __________ virus, specifically designed for espionage, first appeared in 2012 and targeted Windows operating systems. a. Stuxnet b. Flame c. BlackEnergy d. FinFisher Answer B. 4. A(n) __________ attack on data can include stealing or destroying data. a. Money center b. Memory c. Economic d. Hardware Answer C. 5. Which virus that infected Iranian nuclear facilities was exploiting a vulnerability in SCADA systems? a. MyDoom b. Stuxnet c. FinFisher d. Flame Answer B. 6. Any attempt to manipulate information in pursuit of a military or political goal is __________. a. Cyber terrorism b. Economic terrorism c. Information warfare

d. Disinformation Answer C. 7. The __________ War was the first modern war in which there was strong and widespread domestic opposition. a. Korean b. Persian Gulf c. Iraqi d. Vietnam Answer D. 8. During the __________ War, Western democracies invested time and money in radio broadcasts to communist nations. a. Korean b. Vietnam c. Cold d. Iraqi Answer C. 9. A propaganda agent can manage multiple online personalities, posting to many different __________. a. Bulletin boards and email accounts b. Bulletin boards and discussion groups c. Discussion groups and email accounts d. None of the above Answer B. 10. In 1996, a hacker allegedly associated with the white supremacist movement temporarily disabled a __________ ISP. a. Massachusetts b. New York c. Sri Lankan d. Chinese Answer A. 11. In 1998, ethnic Tamil guerrillas swamped __________ embassies with 800 emails a day. a. Chinese b. Iraqi c. Sri Lankan d. Russian

Answer C. 12. Although the Cyberterrorism Preparedness Act of 2002 was not passed, many of its goals were addressed by the __________. a. CIA b. Pentagon c. PATRIOT Act d. FBI Answer C. 13. The joint task force representing components of all portions of the U.S Armed Forces is the __________. a. U.S. Cyber Command b. Patriot Command c. Cyber Terror Association d. U.S. Office of Personnel Management Answer A. 14. __________ was a 2012 hacktivist-led effort that executed DoS attacks on the New York Stock Exchange and various banks. a. APT29 b. GhostNet c. Cutting Sword of Justice d. Operation Ababil Answer D. 15. In August 2010 the United States publicly warned that the __________ military was targeting American companies as well as government agencies. a. Iraqi b. Chinese c. Russian d. Iranian Answer B.

Computer Security Fundamentals 5e Chapter 13 Cyber Detective True / False 1. A discarded credit card receipt may become the starting point from which an identity fraud perpetrator finds enough information to assume the victim’s identity.

True 2. The term dumpster diving refers to searching trash for valuable information.

True 3. Many states have court records online.

True 4. Nearly all services on the Web charge a fee to search for information such as addresses and phone numbers for specific people.

False—There are a number of free services on the Web that will allow you to perform this sort of search.

5. There are sites on the Internet for searching images and for performing reverse searches on images.

True 6. Company information is, to a large extent, private information.

False—The SEC and many other websites aggregate company information for public use.

7. There is an app for the iPhone/iPad called Offender Locator that uses your GPS location to list registered sex offenders nearby.

True 8. The National Center for State Courts has a website that lists links to state courts throughout the United States.

True 9. There are no restrictions on the information you can post on Usenet.

True 10. Montego is an open-source intelligence and forensics application that offers data mining and intelligence-gathering capabilities.

False—This describes the Maltego application.

Multiple Choice

1. A discarded credit card receipt or utility bill could be the starting point from which a perpetrator finds enough information to assume a victim’s __________. a. Identity b. Password c. Appearance d. Email address Answer A. 2. Hackers want information about a target person, organization, and __________ to assist in compromising security. a. License plate b. System c. Clothing size d. Age Answer B. 3. Unfortunately, some companies perform the same __________ background check of network administrators as they do of any other person. a. Thorough b. Cursory c. Digital d. None of the above Answer B. 4. It would be advisable to obtain __________ before running a background check on any person. a. A Social Security number b. An IP address c. Written permission d. An email address Answer C. 5. You can access the Wolfram Language Image Identification Project by going to __________. a. www.wolframproject.com b. www.imagesearch.com c. www.imageidentify.com d. www.wolframimage.com Answer C. 6. Most U.S. states have online __________ registries.

a. Sex offender b. Voter c. Hospital d. License plate Answer A. 7. There have been cases of mistaken identity with __________ lists. a. Voter registration b. Sex offender c. Computer hardware d. Auto registration Answer B. 8. A website that may help locate federal prison records is __________. a. www.pacer.uscourts.gov b. www.bop.gov c. www.searchsystems.net d. www.pro.gov.uk Answer B. 9. __________ is a global group of bulletin boards that exist on any subject you can imagine. a. Usenet b. www.bulletin.com c. www.oscn.net d. www.maltego.com Answer A. 10. Which search parameter directs Google to search only within the text of a particular file type? a. link b. intitle c. inurl d. filetype Answer D. 11. Which search parameter directs Google to search only within the specified URL of a document? a. site b. intitle c. inurl

d. filetype Answer C. 12. Which search parameter directs Google to search within hyperlinks for a specific term? a. link b. intitle c. inurl d. site Answer A. 13. Which search parameter directs Google to search for a term within the title of a document? a. link b. intitle c. inurl d. filetype Answer B. 14. Which search parameter directs Google to search only within a given site? a. site b. link c. inurl d. filetype Answer A. 15. __________ is an open-source intelligence and forensics application that offers extraordinary data mining and intelligence-gathering capabilities. a. Usenet b. Google c. Experian d. Maltego Answer D.

Computer Security Fundamentals 5e Chapter 14 Introduction to Forensics True / False 1. Frequently, the first responder to a computer crime is the network administrator.

True 2. You use the netstat command with a forensic copy of a machine to compare two files and show the differences.

False—This describes the fc command.

3. The Windows Registry contains a list of USB devices that have been connected to the machine.

True 4. In Linux, you use the dd command to set up a target forensics server to receive a copy of a drive.

False—This describes the netcat command.

5. The chain of custody documents the handling of evidence from the moment of seizure until it is presented in court.

True 6. Most Windows logs are turned on automatically.

False—If you don’t turn on logging, there won’t be anything in the logs.

7. Windows stores information such as web addresses, search queries, and recently opened files in a file called index.dat.

True 8. Windows logging can be turned on and off with a tool called auditpol.exe.

True 9. The Windows fc command lists any active sessions connected to a computer.

False— This describes the net sessions command.

10. The Windows Registry is organized into five sections referred to as hives.

True

Multiple Choice 1. Frequently, the first responder to a computer crime is __________. a. The network administrator b. A law enforcement officer

c. The news media d. A private investigator Answer A. 2. If you fail to handle evidence properly __________. a. You may damage the hard drive b. It may be unusable in court c. Law enforcement may not look at it d. None of the above Answer B. 3. You may use Linux to make a __________ of the hard drive. a. Bootable copy b. Screenshot c. New version d. Forensically valid copy Answer D. 4. Use the Linux __________ command-line command to wipe the target drive in a forensics examination. a. cc b. dd c. nc d. md5sum Answer B. 5. Use the Linux __________ command-line command to back up your hard drive if you want to create a hash. a. cc b. dd c. nd d. md5sum Answer D. 6. Documentation of every person who had access to evidence, how they interacted with it, and where it was stored is called the __________. a. Forensic trail b. Chain of custody c. Audit trail d. Inspection report

Answer B. 7. Usually, the first thing you do to a computer to prevent further tampering is to __________. a. Make a backup b. Make a copy c. Take it offline d. Lock it in a secure room Answer C. 8. __________ can include logs, portable storage devices, emails, tablets, and cell phones. a. Computer evidence b. Ancillary hardware c. Network devices d. The Windows Registry Answer A. 9. Windows stores information on web addresses, search queries, and recently opened files in a file called__________. a. internet.txt b. index.dat c. default.dat d. explore.exe Answer B. 10. In Windows, the log that stores events from a single application or component rather than events that might have a systemwide impact is the __________ log. a. Application b. System c. ForwardedEvents d. Applications and Services Answer D. 11. In Windows, the log that contains events collected from remote computers is the __________ log. a. Application b. System c. ForwardedEvents d. Applications and Services

Answer C. 12. The Linux log file that contains activity related to the web server is __________. a. /var/log/kern.log b. /var/log/apache2/* c. /var/log/lpr.log d. /var/log/apport.log Answer B. 13. The Linux log file that can reveal attempts to compromise the system or the presence of a virus or spyware is __________. a. /var/log/kern.log b. /var/log/apache2/* c. /var/log/lpr.log d. /var/log/apport.log Answer D. 14. __________ is a free tool that can be used to recover Windows files. a. SearchIt b. DiskDigger c. FileRecover d. FTK Imager Answer B. 15. Which cell phone state identified by the U.S. National Institute of Standards is a dormant mode that conserves battery life while maintaining user data and performing other background functions? a. Quiescent b. Active c. Nascent/factory default d. Semi-active Answer A.

Computer Security Fundamentals 5e Chapter 15 Cybersecurity Engineering True / False 1. There are cybersecurity professionals with a strong background in computer science or engineering and others with virtually no technical background at all.

True 2. Every cybersecurity project should begin by defining the requirements, which must meet the SMART criteria (Specific, Measurable, Achievable, Realistic, and Timely) to be effective.

True 3. Once requirements have been gathered and approved by the stakeholder, those requirements should form the foundation of the traceability matrix.

False—The requirements should form the foundation of the penetration test.

4. The Work Breakdown Structure (WBS) is a diagram that takes a large process and breaks it down into smaller, manageable pieces.

True 5. Any integration of systems engineering with cybersecurity must be based on specific standards.

True 6. MATLAB is a set of diagrams used to model software.

False—This describes the Unified Modeling Language (UML).

7. The RMF cybersecurity engineering standard provides a framework to assist in securing systems regardless of industry or the size of the organization.

False—This describes the ISO 27001 cybersecurity engineering standard.

8. The NIST SP 800-53 document identifies 18 categories of security controls.

True 9. The ISO 27001 standard has 16 different domains.

False—The ISO 27001 standard has 14 different domains.

10. Systems Modeling Language (SysML) is an extension of the Unified Modeling Language (UML).

True

Multiple Choice

1. The traditional engineering disciplines include mechanical, electrical, civil, and __________. a. Computer b. Aerospace c. Chemical d. Nuclear Answer C. 2. In the SMART acronym that defines what makes a good requirement for a cybersecurity project, the “A” stands for __________. a. Accessible b. Applicable c. Available d. Achievable Answer D. 3. __________ is a set of diagrams used to model software. a. UML b. WBS c. SecML d. MATLAB Answer A. 4. There are __________ categories in the NIST 800-53 Security Control Families. a. 15 b. 18 c. 20 d. 22 Answer B. 5. Which domain in the ISO 27001 standard includes controls that protect the network infrastructure and services, as well as the information that travels through them? a. A.8: Asset Management b. A.10: Cryptography c. A.13: Communications Security d. A.18: Compliance Answer C. 6. Which domain in the ISO 27001 standard includes controls that ensure that the IT systems, including operating systems and software, are secure and protected against data loss?

a. A.5: Information Security Policies b. A.9: Access Control c. A.12: Operations Security d. A.16: Information Security Incident Management Answer C. 7. The ISO 27004 standard is all about __________. a. Compliance b. Metrics c. Continuity d. Modeling Answer B. 8. The NIST SP 800-63B standard provides guidance for __________. a. Authentication b. Maintenance c. Accountability d. Planning Answer A. 9. Which standard lists 114 security controls and is one of the most widely accepted cybersecurity standards? a. ISO 27001 b. RMF c. ISO 27004 d. NIST SP 800-63B Answer A. 10. __________ is the primary modeling tool used in systems engineering. a. MCD b. INCOSE c. DID d. SysML Answer D. 11. In the traditional use-case diagram, activities appear as __________. a. Stick figures b. Lines c. Labeled ovals d. <<extend>> labels

Answer C. 12. In SysML, a __________ diagram shows how objects interact over time. a. Data interface b. Sequence c. Use-case d. Security block Answer B. 13. In SecML, the __________ diagram models the flow of data into and out of any system. a. Data interface b. Sequence c. Use-case d. Security block Answer A. 14. __________ created the acronym STRIDE for identifying security threats in six separate categories: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privileges. a. NIST b. Microsoft c. IEEE d. ISO Answer B. 15. Which of the following is the first stage of the Process for Attack Simulation and Threat Analysis (PASTA)? a. Application decomposition b. Threat analysis c. Define objectives d. Attack modeling Answer C.