1 All of the following are basic components of a security policy EXCEPT the

A. definition of the issue and statement of relevant terms.

B. statement of roles and responsibilities

C. statement of applicability and compliance requirements.

D. statement of performance of characteristics and requirements.

Answer: D

Policies are considered the first and highest level of documentation, from which the
lower level elements of standards, procedures, and guidelines flow. This order,
however, does not mean that policies are more important than the lower elements.
2. Which one of the following is an important characteristic of an information security
policy?

A. Identifies major functional areas of information.

B. Quantifies the effect of the loss of the information.

C. Requires the identification of information owners.

D. Lists applications that support the business function.

Answer: A

Information security policies area high-level plans that describe the goals of the
procedures. Policies are not guidelines or standards, nor are they procedures or
controls. Policies describe security in general terms, not specifics.
3. Which of the following would be the first step in establishing an information
security program?

A.) Adoption of a corporate information security policy statement

B.) Development and implementation of an information security standards manual

C.) Development of a security awareness-training program

D.) Purchase of security access control software

Answer: A
4. What is the function of a corporate information security policy?

A. Issue corporate standard to be used when addressing specific security problems.

B. Issue guidelines in selecting equipment, configuration, design, and secure

operations.

C. Define the specific assets to be protected and identify the specific tasks which
must be completed to securethem.

D. Define the main security objectives which must be achieved and the security
framework to meet business objectives.

Answer: D

Information security policies are high-level plans that describe the goals of the
procedures or controls. Policies describe security in general, not specifics.
5. Why must senior management endorse a security policy?

A. So that they will accept ownership for security within the organization.

B. So that employees will follow the policy directives.

C. So that external bodies will recognize the organizations commitment to security.

D. So that they can be held legally accountable.

Answer: A

Upper management is legally accountable

6. When developing an information security policy, what is the FIRST step that
should be taken?

A. Obtain copies of mandatory regulations.

B. Gain management approval.

C. Seek acceptance from other departments.

D. Ensure policy is compliant with current working practices.

Answer: B
7. Which one of the following should NOT be contained within a computer policy?

A. Definition of management expectations.

B. Responsibilities of individuals and groups for protected information.

C. Statement of senior executive support.

D. Definition of legal and regulatory controls.

Answer: B
8. Which one of the following statements describes management controls that are
instituted to implement a security policy?

A. They prevent users from accessing any control function.

B. They eliminate the need for most auditing functions.

C. They may be administrative, procedural, or technical.

D. They are generally inexpensive to implement.

Answer: C
9. Which must bear the primary responsibility for determining the level of protection
needed for information systems resources?

A.) IS security specialists

B.) Senior Management

C.) Seniors security analysts

D.) system auditors

Answer: B
10. Which of the following choices is NOT part of a security policy?

A.) definition of overall steps of information security and the importance of security

B.) statement of management intend, supporting the goals and principles of

information security

C.) definition of general and specific responsibilities for information security

management

D.) description of specific technologies used in the field of information security

Answer: D
11. Which of the following embodies all the detailed actions that personnel are
required to follow?

A.) Standards

B.) Guidelines

C.) Procedures

D.) Baselines

Answer: C
12 Security is a process that is:

A. Continuous

B. Indicative

C. Examined

D. Abnormal

Answer: A
13 What are the three fundamental principles of security?

A.) Accountability, confidentiality, and integrity

B.) Confidentiality, integrity, and availability

C.) Integrity, availability, and accountability

D.) Availability, accountability, and confidentiality

Answer: B
14. Making sure that the data is accessible when and where it is needed is which of
the following?

A.) Confidentiality

B.) integrity

C.) acceptability

D.) availability

Answer: D
15 Most computer attacks result in violation of which of the following security
properties?

A. Availability

B. Confidentiality

C. Integrity and control

D. All of the choices.

Answer: D
16. An area of the Telecommunications and Network Security domain that directly
affects the Information Systems Security tenet of Availability can be defined as:

A.) Netware availability

B.) Network availability

C.) Network acceptability

D.) Network accountability

Answer: B
17. Which one of the following is the MOST crucial link in the computer security
chain?

A. Access controls

B. People

C. Management

D. Awareness programs

Answer: C
18. Information security is the protection of data. Information will be protected
mainly based on:

A. Its sensitivity to the company.

B. Its confidentiality.

C. Its value.

D. All of the choices.

Answer: D
19. Organizations develop change control procedures to ensure that

A. All changes are authorized, tested, and recorded.

B. Changes are controlled by the Policy Control Board (PCB).

C. All changes are requested, scheduled, and completed on time.

D. Management is advised of changes made to systems.

Answer: A
20. Which one of the following is the MAIN goal of a security awareness program
when addressing senior management?

A. Provide a vehicle for communicating security procedures.

B. Provide a clear understanding of potential risk and exposure.

C. Provide a forum for disclosing exposure and risk analysis.

D. Provide a forum to communicate user responsibilities.

Answer: B
21. In developing a security awareness program, it is MOST important to

A. Understand the corporate culture and how it will affect security.

B. Understand employees preferences for information security.

C. Know what security awareness products are available.

D. Identify weakness in line management support.

Answer: A
22. Which of the following would be best suited to provide information during a
review of the controls over the process of defining IT service levels?

A.) Systems programmer

B.) Legal stuff

C.) Business unit manager

D.) Programmer

Answer: C
23. Risk analysis is MOST useful when applied during which phase of the system
development process?

A.) Project identification

B.) Requirements definition

C.) System construction

D.) Implementation planning

Answer: A
24. Which of the following is not a part of risk analysis?

A.) Identify risks

B.) Quantify the impact of potential threats

C.) Provide an economic balance between the impact of the risk and the cost of the
associated countermeasures

D.) Choose the best countermeasure

Answer: D
25. How should a risk be handled when the cost of the countermeasures outweighs
the cost of the risk?

A.) Reject the risk

B.) Perform another risk analysis

C.) Accept the risk

D.) Reduce the risk

Answer: C
26. Which one of the following is the PRIMARY objective of penetration testing?

A. Assessment

B. Correction

C. Detection

D. Protection

Answer: C
27. Penetration testing will typically include

A. Generally accepted auditing practices.

B. Review of Public Key Infrastructure (PKI) digital certificate, and encryption.

C. Social engineering, configuration review, and vulnerability assessment.

D. Computer Emergency Response Team (CERT) procedures.

Answer: C
28. Annualized Loss Expectancy (ALE) value is derived from an algorithm of the
product of annual rate of occurrence and

A. Cost of all losses expected.

B. Previous year's actual loss.

C. Average of previous losses.

D. Single loss expectancy.

Answer: D
29. How is Annualized Loss Expectancy (ALE) derived from a threat?

A.) ARO x (SLE - EF)

B.) SLE x ARO

C.) SLE/EF

D.) AV x EF

Answer: B
30. Which risk management methodology uses the exposure factor multiplied by the
asset value to determine its outcome?

A. Annualized Loss Expectancy

B. Single Loss Expectancy

C. Annualized Rate of Occurrence

D. Information Risk Management

Answer: B
31. Valuable paper insurance coverage does not cover damage to which of the
following?

A.) Inscribed, printed and written documents

B.) Manuscripts

C.) Records

D.) Money and Securities

Answer: D
32. What is the Maximum Tolerable Downtime (MTD):

A.) Maximum elapsed time required to complete recovery of application data

B.) Minimum elapsed time required to complete recovery of application data

C.) Maximum elapsed time required to move back to primary site a major disruption

D.) It is maximum delay businesses that can tolerate and still remain viable

Answer: D
33. Who should determine the appropriate access control of information?

A. Owner

B. User

C. Administrator

D. Server

Answer: A
34. What is the main responsibility of the information owner?

A.) making the determination to decide what level of classification the information
requires

B.) running regular backups

C.) audit the users when they require access to the information

D.) periodically checking the validity and accuracy for all data in the information
system

Answer: A
35. What principle requires that a user be given no more privilege then necessary to
perform a job?

A. Principle of aggregate privilege.

B. Principle of most privilege.

C. Principle of effective privilege.

D. Principle of least privilege.

Answer: D
36. Cryptography does not concern itself with:

A.) Availability

B.) Integrity

C.) Confidentiality

D.) Authenticity

Answer: A
37. Which of the following measures would be the BEST deterrent to the theft of
corporate information from a laptop which was left in a hotel room?

A.) Store all data on disks and lock them in an in-room safe

B.) Remove the batteries and power supply from the laptop and store them separately
from the computer

C.) Install a cable lock on the laptop when it is unattended

D.) Encrypt the data on the hard drive

Answer: D
38. To support legacy applications that rely on risky protocols (e.g, plain text
passwords), which one of the following can be implemented to mitigate the risks on a
corporate network?

A. Implement strong centrally generated passwords to control use of the vulnerable

applications.

B. Implement a virtual private network (VPN) with controls on workstations joining

the VPN.

C. Ensure that only authorized trained users have access to workstations through
physical access control.

D. Ensure audit logging is enabled on all hosts and applications with associated
frequent log reviews.

Answer: B
39. The technique of skimming small amounts of money from multiple transactions is
called the

A. Scavenger technique

B. Salami technique

C. Synchronous attack technique

D. Leakage technique

Answer: B
40. Which security program exists if a user accessing low-level data is able to draw
conclusions about high-level information?

A. Interference

B. Inference

C. Polyinstatiation

D. Under-classification

Answer: B
41.Data inference violations can be reduced using

A. Polyinstantiation technique.

B. Rules based meditation.

C. Multi-level data classification.

D. Correct-state transformation.

Answer: A

"Polyinstantiation is the development of a detailed version of an object from another

object using different values in the new object. In the database information security,
this term is concerned with the same primary key for different relations at different
classification levels being stored in the same database.
42. What is it called when a computer uses more than one CPU in parallel to execute
instructions?

A.) Multiprocessing

B.) Multitasking

C.) Multithreading

D.) Parallel running

Answer: A
43. Which of the following statements pertaining to the security kernel is incorrect?

A.) It is made up of mechanisms that fall under the TCB and implements and
enforces the reference monitor concept.

B.) It must provide isolation for the processes carrying out the reference monitor
concept and they must be tamperproof

C.) It must be small enough to be able to be tested and verified in a complete and
comprehensive manner

D.) Is an access control concept, not an actual physical component

Answer: D
44. The concept that all accesses must be meditated, protected from modification, and
verifiable as correct is the concept of

A. Secure model

B. Security locking

C. Security kernel

D. Secure state

Answer: C

A security kernel is defined as the hardware, firmware, and software elements of a

trusted computing base that implements the reference monitor concept. A reference
monitor is a system component that enforces access controls on an object. Therefore,
the reference monitor concept is an abstract machine that mediates all access of
subjects to objects. The Security Kernel must mediate all accesses
45. The Common Criteria (CC) represents requirements for IT security of a product
or system under which distinct categories?

A. Functional and assurance

B. Protocol Profile (PP) and Security Target (ST)

C. Targets of Evaluation (TOE) and Protection Profile (PP)

D. Integrity and control

Answer: A
46. What are the assurance designators used in the Common Criteria (CC)?

A. EAL 1, EAL 2, EAL 3, EAL 4, EAL 5, EAL 6, and EAL 7

B. A1, B1, B2, B3, C2, C1, and D

C. E0, E1, E2, E3, E4, E5, and E6

D. AD0, AD1, AD2, AD3, AD4, AD5, and AD6

Answer: A
47. Which of the following uses protection profiles and security targets?

A.) ITSEC

B.) TCSEC

C.) CTCPEC

D.) International Standard 15408

Answer: D
48. The Common Criteria construct which allows prospective consumers or
developers to create standardized sets of security requirements to meet there needs is

A. a Protection Profile (PP).

B. a Security Target (ST).

C. an evaluation Assurance Level (EAL).

D. a Security Functionality Component Catalog (SFCC).

Answer: A
49. Which Orange Book evaluation level is described as "Verified Design"?

A.) A1

B.) B3

C.) B2

D.) B1

Answer: A

Orange Book = TCSEC

50. Which security model introduces access to objects only through programs?

A.) The Biba model

B.) The Bell-LaPadula model

C.) The Clark-Wilson model

D.) The information flow model

Answer: C
51. The Clark Wilson model has its emphasis on:

A. Security

B. Integrity

C. Accountability

D. Confidentiality

Answer: B
52. What does * (star) integrity axiom mean in the Biba model?

A.) No read up

B.) No write down

C.) No read down

D.) No write up

Answer: D
53. Which access control model states that for integrity to be maintained data must
not flow from a receptacle of given integrity to a receptacle of higher integrity?

A. Lattice Model

B. Bell-LaPadula Model

C. Biba Model

D. Take-Grant Model

Answer: C
54. Related to information security, confidentiality is the opposite of which of the
following?

A.) closure

B.) disclosure

C.) disposal

D.) disaster

Answer: B
55. What is the main concern of the Bell-LaPadula security model?

A.) Accountability

B.) Integrity

C.) Confidentiality

D.) Availability

Answer: C
56. Which of the following is a state machine model capturing confidentiality aspects
of access control?

A. Clarke Wilson

B. Bell-LaPadula

C. Chinese Wall

D. Lattice

Answer: B
57. With the BLP model, security policies prevent information flowing downwards
from a:

A. Low security level

B. High security level

C. Medium security level

D. Neutral security level

Answer: B

Remarks: BLP = Bell-LaPadula

58. In the Bell-LaPadula model, the Star-property is also called:

A.) The simple security property

B.) The confidentiality property

C.) The confinement property

D.) The tranquility property

Answer: C
59. Access control techniques do not include:

A.) Rule-Based Access Controls

B.) Role-Based Access Controls

C.) Mandatory Access Controls

D.) Random Number Based Access Control

Answer: D
60. The default level of security established for access controls should be

A. All access

B. Update access

C. Read access

D. No access

Answer: D
61. Which of the following is a type of mandatory access control?

A.) Rule-based access control

B.) Role-based access control

C.) User-directed access control

D.) Lattice-based access control

Answer: A
62. Which of the following is a means of restricting access to objects based on the
identity of the subject to which they belong?

A. Mandatory access control

B. Group access control

C. Discretionary access control

D. User access control

Answer: C
63. Which of the following is true about MAC?

A. It is more flexible than DAC.

B. It is more secure than DAC.

C. It is less secure than DAC.

D. It is more scalable than DAC.

Answer: B
64. A firewall can be classified as a:

A. Directory based access control.

B. Rule based access control.

C. Lattice based access control.

D. ID based access control.

Answer: B
65. What is one issue NOT addressed by the Bell-LaPadula model?

A. Information flow control

B. Security levels

C. Covert channels

D. Access modes

Answer: C
66. The access matrix model has which of the following common implementations?

A. Access control lists and capabilities.

B. Access control lists.

C. Capabilities.

D. Access control list and availability.

Answer: A
66. A channel within a computer system or network that is designed for the
authorized transfer of information is identified as a(n)?

A.) Covert channel

B.) Overt channel

C.) Opened channel

D.) Closed channel

Answer: B
68. Covert channel is a communication channel that can be used for:

A. Hardening the system.

B. Violating the security policy.

C. Protecting the DMZ.

D. Strengthening the security policy.

Answer: B
69. What is an indirect way to transmit information with no explicit reading of
confidential information?

A. Covert channels

B. Backdoor

C. Timing channels

D. Overt channels

Answer: A
70. What is the essential difference between a self-audit and an independent audit?

A.) Tools used

B.) Results

C.) Objectivity

D.) Competence

Answer: C
71. What is called the formal acceptance of the adequacy of a system's overall
security by the management?

A.) Certification

B.) Acceptance

C.) Accreditation

D.) Evaluation

Answer: C
72. Which of the following will you consider as the MOST secure way of
authentication?

A. Biometric

B. Password

C. Token

D. Ticket Granting

Answer: A
73. In biometric identification systems, at the beginning, it was soon apparent that
truly positive identification could only be based on physical attributes of a person.
This raise the necessarily of answering 2 questions:

A.) what was the sex of a person and his age

B.) what part of the body to be used and how to accomplish identification to be viable

C.) what was the age of a person and his income level

D.) what was the tone of the voice of a person and his habits

Answer: B
74. What is called the percentage of invalid subjects that are falsely accepted?

A.) False Rejection Rate (FRR) or Type I Error

B.) False Acceptance Rate (FAR) or Type II Error

C.) Crossover Error Rate (CER)

D.) True Acceptance Rate (TAR) or Type III error

Answer: B
75. Which one of the following is the MOST critical characteristic of a biometrics
system?

A. Acceptability

B. Accuracy

C. Throughput

D. Reliability

Answer: B
76. Biometric performance is most commonly measured in terms of:

A. FRR and FAR

B. FAC and ERR

C. IER and FAR

D. FRR and GIC

Answer: A
77. Which of the following biometric characteristics cannot be used to uniquely
authenticate an individual's identity?

A.) Retina scans

B.) Iris scans

C.) Palm scans

D.) Skin scans

Answer: D
78. You are comparing biometric systems. Security is the top priority. A low
________ is most important in this regard.

A. FAR

B. FRR

C. MTBF

D. ERR

Answer: A
79. Almost all types of detection permit a system's sensitivity to be increased or
decreased during an inspection process. To have a valid measure of the system
performance:

A.) The CER is used.

B.) the FRR is used

C.) the FAR is used

D.) none of the above choices is correct

Answer: A
80. Which of the following are the types of eye scan in use today?

A. Retinal scans and body scans.

B. Retinal scans and iris scans.

C. Retinal scans and reflective scans.

D. Reflective scans and iris scans.

Answer: B
81. In addition to the accuracy of the biometric systems, there are other factors that
must also be considered:

A.) These factors include the enrollment time and the throughput rate, but not
acceptability.

B.) These factors do not include the enrollment time, the throughput rate, and
acceptability.

C.) These factors include the enrollment time, the throughput rate, and acceptability.

D.) These factors include the enrollment time, but not the throughput rate, neither the
acceptability.

Answer: C
82. What physical characteristics does a retinal scan biometric device measure?

A.) The amount of light reaching the retina

B.) The amount of light reflected by the retina

C.) The size, curvature, and shape of the retina

D.) The pattern of blood vessels at the back of the eye

Answer: D
83. Type II errors occur when which of the following biometric system rates is high?

A. False accept rate

B. False reject rate

C. Crossover error rate

D. Speed and throughput rate

Answer: A
84. In the world of keystroke dynamics, what represents the amount of time you hold
down in a particular key?

A. Dwell time

B. Flight time

C. Dynamic time

D. Systems time

Answer: A

Keystroke dynamics looks at the way a person types at a keyboard. Specifically,

keyboard dynamics measures two distinct variables: "dwell time" which is the
amount of time you hold down a particular key and "flight time" which is the amount
of time it takes a person to switch between keys.
85. In the world of keystroke dynamics, what represents the amount of time it takes a
person to switch between keys?

A. Dynamic time

B. Flight time

C. Dwell time

D. Systems time.

Answer: B
86. Signature identification systems analyze what areas of an individual's signature?

A. All of the choices EXCEPT the signing rate.

B. The specific features of the signature.

C. The specific features of the process of signing one's signature.

D. The signature rate.

Answer: A
87. What is known as the probability that you are not authenticated to access your
account?

A. ERR

B. FRR

C. MTBF

D. FAR

Answer: B
88. Which of the following is true of two-factor authentication?

A.) It uses the RSA public-key signature based algorithm on integers with large prime
factors

B.) It requires two measurements of hand geometry

C.) It does not use single sign-on technology

D.) It relies on two independent proofs of identity

Answer: D
89. Which of the following is true about Kerberos?

A.) It utilized public key cryptography

B.) It encrypts data after a ticket is granted, but passwords are exchanged in plain text

C.) It depends upon symmetric ciphers

D.) It is a second party authentication system

Answer: C
90. The primary service provided by Kerberos is which of the following?

A.) non-repudiation

B.) confidentiality

C.) authentication

D.) authorization

Answer: C
91. Which of the following is a trusted, third party authentication protocol that was
developed under Project Athena at MIT?

A.) Kerberos

B.) SESAME

C.) KryptoKnight

D.) NetSP

Answer: A
92. A confidential number to verify a user's identity is called a:

A.) PIN

B.) userid

C.) password

D.) challenge

Answer: A
93. How are memory cards and smart cards different?

A.) Memory cards normally hold more memory than smart cards

B.) Smart cards provide a two-factor authentication whereas memory cards don't

C.) Memory cards have no processing power

D.) Only smart cards can be used for ATM cards

Answer: C
94. They in form of credit card-size memory cards or smart cards, or those resembling
small calculators, are used to supply static and dynamic passwords are called:

A.) Tickets

B.) Tokens

C.) Token passing networks

D.) Coupons

Answer: B
95. Memory only cards work based on:

A. Something you have.

B. Something you know.

C. None of the choices.

D. Something you know and something you have.

Answer: D
96. Processor card contains which of the following components?

A. Memory and hard drive.

B. Memory and flash.

C. Memory and processor.

D. Cache and processor.

Answer: C
97. Which of the following offers advantages such as the ability to use stronger
passwords, easier password administration, and faster resource access?

A.) Smart cards

B.) Single Sign-on (SSO)

C.) Kerberos

D.) Public Key Infrastructure (PKI)

Answer: B
98. What is the main concern with single sign-on?

A.) Maximum unauthorized access would be possible if a password is disclosed

B.) The security administrator's workload would increase

C.) The users' password would be to hard to remember

D.) User access rights would be increased

Answer: A
99. Which of the following addresses cumbersome situations where users need to log
on multiple times to access different resources?

A.) Single Sign-On (SSO) systems

B.) Dual Sign-On (DSO) systems

C.) Double Sign-On (DS0) systems

D.) Triple Sign-On (TSO) systems

Answer: A
100. Which of the following correctly describe the features of SSO?

A. More efficient log-on.

B. More costly to administer.

C. More costly to setup.

D. More key exchanging involved.

Answer: A
101. In a RADIUS architecture, which of the following acts as a client?

A. A network Access Server.

B. None of the choices.

C. The end user.

D. The authentication server.

Answer: A
102. Which of the following is the weakest authentication mechanism?

A.) Passphrases

B.) Passwords

C.) One-time passwords

D.) Token devices

Answer: B
103. Software generated passwords have what drawbacks?

A. Passwords are not easy to remember.

B. Passwords are too secure.

C. None of the choices.

D. Passwords are unbreakable.

Answer: A
104. Which of the following will you consider as most secure?

A. Password

B. One time password

C. Login phrase

D. Login ID

Answer: B
105. Which of the following are the correct guidelines of password deployment?

A. Passwords must be masked.

B. Password must have a minimum of 8 characters.

C. Password must contain a mix of both alphabetic and non-alphabetic characters.

D. All of the choices.

Answer: D
106. Why would a 16 characters password not desirable?

A. Hard to remember

B. Offers numerous characters.

C. Difficult to crack using brute force.

D. All of the choices.

Answer: A
107. Which of the following is NOT a good password deployment guideline?

A. Passwords must not be he same as user id or login id.

B. Password aging must be enforced on all systems.

C. Password must be easy to memorize.

D. Passwords must be changed at least once every 60 days, depending on your

environment.

Answer: C
108. What should you do immediately if the root password is compromised?

A. Change the root password.

B. Change all passwords.

C. Increase the value of password age.

D. Decrease the value of password history.

Answer: B
All passwords must be changed if the root password is compromised or disclosure is
suspected.
109. Which of the following is the most secure way to distribute password?

A. Employees must send in an email before obtaining a password.

B. Employees must show up in person and present proper identification before

obtaining a password.

C. Employees must send in a signed email before obtaining a password.

D. None of the choices.

Answer: B
110. Which of the following does not apply to system-generated passwords?

A.) Passwords are harder to remember for users

B.) If the password-generating algorithm gets to be known, the entire system is in

jeopardy

C.) Passwords are more vulnerable to brute force and dictionary attacks.

D.) Passwords are harder to guess for attackers

Answer: C
111. Passwords can be required to change monthly, quarterly, or any other intervals:

A.) depending on the criticality of the information needing protection

B.) depending on the criticality of the information needing protection and the
password's frequency of use

C.) depending on the password's frequency of use

D.) not depending on the criticality of the information needing protection but
depending on the password's frequency of use

Answer: B
112. Identification usually takes the form of:

A. Login ID.

B. User password.

C. None of the choices.

D. Passphrase

Answer: A
113. What is called the act of a user professing an identity to a system, usually in the
form of a log-on ID?

A.) Authentication

B.) Identification

C.) Integrity

D.) Confidentiality

Answer: B
114. What is called the verification that the user's claimed identity is valid and is
usually implemented through a user password at log-on time?

A.) Authentication

B.) Identification

C.) Integrity

D.) Confidentiality

Answer: A
115. Authentication is typically based upon:

A. Something you have.

B. Something you know.

C. Something you are.

D. All of the choices.

Answer: D

Authentication is a means of verifying the eligibility of an entity to receive specific

categories of information. The entity could be individual user, machine, or software
component. Authentication is typically based upon something you know, something
you have, or something you are.
116. A password represents:

A. Something you have.

B. Something you know.

C. All of the choices.

D. Something you are.

Answer: B
117. A smart card represents:

A. Something you are.

B. Something you know.

C. Something you have.

D. All of the choices.

Answer: C
118. Retinal scans check for:

A. Something you are.

B. Something you have.

C. Something you know.

D. All of the choices.

Answer: A
119. What type of authentication takes advantage of an individuals unique physical
characteristics in order to authenticate that persons identity?

A. Password

B. Token

C. Ticket Granting

D. Biometric

Answer: D
120. What is called an automated means of identifying or authenticating the identity
of a living person based on physiological or behavioral characteristics?

A.) Biometrics

B.) Micrometrics

C.) Macrometrics

D.) MicroBiometrics

Answer: A
121. Which of the following forms of authentication would most likely apply a digital
signature algorithm to every bit of data that is sent from the claimant to the verifier?

A.) Dynamic authentication

B.) Continuous authentication

C.) Encrypted authentication

D.) Robust authentication

Answer: C
122. In which situation would TEMPEST risks and technologies be of MOST
interest?

A. Where high availability is vital.

B. Where the consequences of disclose are very high.

C. Where countermeasures are easy to implement

D. Where data base integrity is crucial

Answer: B
123. Which one of the following addresses the protection of computers and
components from electromagnetic emissions?

A. TEMPEST

B. ISO 9000

C. Hardening

D. IEEE 802.2

Answer: A
124. What name is given to the study and control of signal emanations from electrical
and electromagnetic equipment?

A. EMI

B. Cross Talk

C. EMP

D. TEMPEST

Answer: D
125. TEMPEST addresses

A. The vulnerability of time-dependent transmissions.

B. Health hazards of electronic equipment.

C. Signal emanations from electronic equipment.

D. The protection of data from high energy attacks.

Answer: C
126. Which one of the following is the MOST solid defense against interception of a
network transmission?

A. Frequency hopping

B. Optical fiber

C. Alternate routing

D. Encryption

Answer: B
127. Which of the following media is MOST resistant to tapping?

A.) Microwave

B.) Twisted pair

C.) Coaxial cable

D.) Fiber optic

Answer: D
128. Which of the following could illegally capture network user passwords?

A.) Data diddling

B.) Sniffing

C.) Spoofing

D.) Smurfing

Answer: B
129. A system uses a numeric password with 1-4 digits. How many passwords need to
be tried before it is cracked?

A.) 1024

B.) 10000

C.) 100000

D.) 1000000

Answer: B

Number of password combination: 10 × 10 × 10 × 10 = 10,000

130. Which of the following can be used to protect your system against brute force
password attack?

A. Decrease the value of password history.

B. Employees must send in a signed email before obtaining a password.

C. After three unsuccessful attempts to enter a password, the account will be locked.

D. Increase the value of password age.

Answer: C
131. Which of the following is an effective measure against a certain type of brute
force password attack?

A. Password used must not be a word found in a dictionary.

B. Password history is used.

C. Password reuse is not allowed.

D. Password cannot be modified by users

Answer: A
132. Which type of attack will most likely provide an attacker with multiple
passwords to authenticate to a system?

A.) Password sniffing

B.) Dictionary attack

C.) Dumpster diving

D.) Social engineering

Answer: A
133. Which of the following are measures against password sniffing?

A. Passwords must not be sent through email in plain text.

B. Passwords must not be stored in plain text on any electronic media.

C. You may store passwords electronically if it is encrypted.

D. All of the choices.

Answer: D
134. Which one of the following conditions is NOT necessary for a long dictionary
attack to succeed?

A. The attacker must have access to the target system.

B. The attacker must have read access to the password file.

C. The attacker must have write access to the password file.

D. The attacker must know the password encryption mechanism and key variable.

Answer: C

The program encrypts the combination of characters and compares them to the
encrypted entries in the password file. If a match is found, the program has uncovered
a password.
135. Which one of the following BEST describes a password cracker?

A. A program that can locate and read a password file.

B. A program that provides software registration passwords or keys.

C. A program that performs comparative analysis.

D. A program that obtains privileged access to the system.

Answer: C
136. If a token and 4-digit personal identification number (PIN) are used to access a
computer system and the token performs off-line checking for the correct PIN, what
type of attack is possible?

A. Birthday

B. Brute force

C. Man-in-the-middle

D. Smurf

Answer: B
137. Which of the following actions can increase the cost of an exhaustive attack?

A. Increase the age of a password.

B. Increase the length of a password.

C. None of the choices.

D. Increase the history of a password.

Answer: B
138. Which of the following attacks focus on cracking passwords?

A. SMURF

B. Spamming

C. Teardrop

D. Dictionary

Answer: D
139. Which of the following can best eliminate dial-up access through a Remote
Access Server as a hacking vector?

A.) Using TACACS+ server

B.) Installing the Remote Access Server outside the firewall and forcing legitimate
users to uthenticate to the firewall.

C.) Setting modem ring count to at least 5

D.) Only attaching modems to non-networked hosts.

Answer: B
140. Which of the following attacks could be the most successful when the security
technology is properly implemented and configured?

A. Logical attacks

B. Physical attacks

C. Social Engineering attacks

D. Trojan Horse attacks

Answer: C

Social Engineering attacks - In computer security systems, this type of attack is

usually the most successful, especially when the security technology is properly
implemented and configured. Usually, these attacks rely on the faults in human
beings.
141. What type of attacks occurs when normal physical conditions are altered in order
to gain access to sensitive information on the smartcard?

A. Physical attacks

B. Logical attacks

C. Trojan Horse attacks

D. Social Engineering attacks

Answer: A
142. Which one of the following is an example of electronic piggybacking?

A. Attaching to a communications line and substituting data.

B. Abruptly terminating a dial-up or direct-connect session.

C. Following an authorized user into the computer room.

D. Recording and playing back computer transactions.

Answer: C
143. What attack involves actions to mimic one's identity?

A. Brute force

B. Exhaustive

C. Social engineering

D. Spoofing

Answer: D
144. Which access control model enables the owner of the resource to specify what
subjects can access specific resources?

A.) Discretionary Access Control

B.) Mandatory Access Control

C.) Sensitive Access Control

D.) Role-based Access Control

Answer: A
145. The type of discretionary access control that is based on an individual's identity
is called:

A.) Identity-based access control

B.) Rule-based access control

C.) Non-Discretionary access control

D.) Lattice-based access control

Answer: A
146. Which of the following access control types gives "UPDATE" privileges on
Structured Query Language (SQL) database objects to specific users or groups?

A. Supplemental

B. Discretionary

C. Mandatory

D. System

Answer: C
147. With Discretionary access controls, who determines who has access and what
privilege they have?

A. End users.

B. None of the choices.

C. Resource owners.

D. Only the administrators.

Answer: C
148. Under MAC, which of the following is true?

A. All that is expressly permitted is forbidden.

B. All that is not expressly permitted is forbidden.

C. All that is not expressly permitted is not forbidden.

D. None of the choices.

Answer: B
149. With MAC, who may make decisions that bear on policy?

A. None of the choices.

B. All users.
C. Administrators
D. All users except guests.

Answer: C
150. With MAC, who may NOT make decisions that derive from policy?

A. All users except the administrator.

B. The administrator.

C. The power users.

D. The guests.

Answer: A
151. Under the MAC control system, what is required?

A. Performance monitoring

B. Labeling

C. Sensing

D. None of the choices

Answer: B
152. Access controls that are not based on the policy are characterized as:

A. Secret controls

B. Mandatory controls

C. Discretionary controls

D. Corrective controls

Answer: C
153. In a discretionary mode, which of the following entities is authorized to grant
information access to other people?

A.) manager

B.) group leader

C.) security manager

D.) user

Answer: D
154. Under Role based access control, access rights are grouped by:

A. Policy name

B. Rules

C. Role name

D. Sensitivity label

Answer: C
155. DAC and MAC policies can be effectively replaced by:

A. Rule based access control.

B. Role based access control.

C. Server based access control.

D. Token based access control

Answer: B

Role based access control (RBAC) is an alternative to traditional discretionary (DAC)

and mandatory access control (MAC) policies. The principle motivation behind
RBAC is the desire to specify and enforce enterprise-specific security policies in a
way that maps naturally to an organization's structure. Traditionally, managing
security has required mapping an organization's security policy to a relatively low-
level set of controls, typically access control lists.
156. Which of the following correctly describe Role based access control?

A. It allows you to specify and enforce enterprise-specific security policies in a way

that maps to your user profile groups.

B. It allows you to specify and enforce enterprise-specific security policies in a way

that maps to your organizations structure.

C. It allows you to specify and enforce enterprise-specific security policies in a way

that maps to your ticketing system.

D. It allows you to specify and enforce enterprise-specific security policies in a way

that maps to your ACL.

Answer: B
157. Which one of the following is a security issue related to aggregation in a
database?

A. Polyinstantiation

B. Inference

C. Partitioning

D. Data swapping

Answer: B

Inference is the ability of users to infer or deduce information about data at sensitivity
levels for which they do not have access privileges.
158. Which of the following defines the software that maintains and provides access
to the database?

A.) database management system (DBMS)

B.) relational database management systems (RDBMS)

C.) database identification system (DBIS)

D.) Interface Definition Language system (IDLS)

Answer: A
159. Which of the following is not a responsibility of a database administrator?

A.) Maintaining databases

B.) Implementing access rules to databases

C.) Reorganizing databases

D.) Providing access authorization to databases

Answer: D
160. SQL commands do not include which of the following?

A.) Select, Update

B.) Grant, Revoke

C.) Delete, Insert

D.) Add, Replace

Answer: D
161. A persistent collection of interrelated data items can be defined as which of the
following?

A.) database

B.) database management system

C.) database security

D.) database shadowing

Answer: A
162. Which of the following is the marriage of object-oriented and relational
technologies combining the attributes of both?

A.) object-relational database

B.) object-oriented database

C.) object-linking database

D.) object-management database

Answer: A
163. To ensure integrity, a payroll application program may record transactions in the
appropriate accounting period by using

A. Application checkpoints

B. Time and date stamps

C. Accrual journal entries

D. End of period journals

Answer: B
164. What ensures that the control mechanisms correctly implement the security
policy for the entire life cycle of an information system?

A.) Accountability controls

B.) Mandatory access controls

C.) Assurance procedures

D.) Administrative controls

Answer: C

Assurance procedures ensure that the control mechanisms correctly implement the
security policy for the entire life cycle of an information system.
165. Which of the following is an advantage of using a high-level programming
language?

A.) It decreases the total amount of code writters

B.) It allows programmers to define syntax

C.) It requires programmer-controlled storage management

D.) It enforces coding standards

Answer: A
166. The design phase in a system development life cycle includes all of the following
EXCEPT

A. Determining sufficient security controls.

B. Conducting a detailed design review.

C. Developing an operations and maintenance manual.

D. Developing a validation, verification, and testing plan.

Answer: C
167. When considering the IT Development Life-Cycle, security should be:

A.) Mostly considered during the initiation phase.

B.) Mostly considered during the development phase.

C.) Treated as an integral part of the overall system design.

D.) Add once the design is completed.

Answer: C
168. Buffer overflow and boundary condition errors are subsets of:

A.) Race condition errors

B.) Access validation errors

C.) Exceptional condition handling errors

D.) Input validation errors

Answer: D
169. Which of the following would be the most serious risk where a systems
development life cycle methodology is inadequate?

A.) The project will be completed late

B.) The project will exceed the cost estimates

C.) The project will be incompatible with existing systems

D.) The project will fail to meet business and user needs

Answer: D
170. Which of the following would provide the best stress testing environment?

A.) Test environment using test data

B.) Test environment using live workloads

C.) Production environment using test data

D.) Production environment using live workloads

Answer: B
171. Which of the following functions is less likely to be performed by a typical
security administrator?

A.) Setting user clearances and initial passwords

B.) Adding and removing system users

C.) Setting or changing file sensitivity labels

D.) Reviewing audit data

Answer: B
172. Who is responsible for setting user clearances to computer-based information?

A.) Security administrators

B.) Operators

C.) Data owners

D.) Data custodians

Answer: A
173. Which of the following correctly describe "good" security practice?

A. Accounts should be monitored regularly.

B. You should have a procedure in place to verify password strength.

C. You should ensure that there are no accounts without passwords.

D. All of the choices.

Answer: D
174. Access to the _________ account on a Unix server must be limited to only the
system administrators that must absolutely have this level of access.

A. Superuser of inetd.

B. Manager or root.

C. Fsf or root

D. Superuser or root.

Answer: D
175. Root login should only be allowed via:

A. Rsh

B. System console

C. Remote program

D. VNC

Answer: B
176. In order to avoid mishandling of media or information, you should consider
using:

A. Labeling

B. Token

C. Ticket

D. SLL

Answer: A
177. In order to avoid mishandling of media or information, which of the following
should be labeled?

A. Printed copies

B. Tape

C. Floppy disks

D. All of the choices.

Answer: A
178. Removing unnecessary processes, segregating inter-process communications,
and reducing executing privileges to increase system security is commonly called

A. Hardening

B. Segmenting

C. Aggregating

D. Kerneling

Answer: A
179. Which one of the following entails immediately transmitting copies of on-line
transactions to a remote computer facility for backup?

A. Archival storage management (ASM)

B. Electronic vaulting

C. Hierarchical storage management (HSM)

D. Data compression

Answer: B
180. The alternate processing strategy in a business continuity plan can provide for
required backup computing capacity through a hot site, a cold site, or

A. A dial-up services program.

B. An off-site storage replacement.

C. An online backup program.

D. A crate and ship replacement.

Answer: C

Answer C is the best answers among those answers available.

181. The spare drives that replace the failed drives are usually hot swappable,
meaning they can be replaced on the server in which of the following scenarios?

A.) system is up and running

B.) system is quiesced but operational

C.) system is idle but operational

D.) system is up and in single-user-mode

Answer: A
182. This backup method makes a complete backup of every file on the server every
time it is run by:

A.) full backup method

B.) incremental backup method

C.) differential backup method

D.) tape backup method

Answer: A
183. A backup of all files that are new or modified since the last full backup is

A. In incremental backup

B. A father/son backup

C. A differential backup

D. A full backup

Answer: C
184. Which one of the following is a good defense against worms?

A. Differentiating systems along the lines exploited by the attack.

B. Placing limits on sharing, writing, and executing programs.

C. Keeping data objects small, simple, and obvious as to their intent.

D. Limiting connectivity by means of well-managed access controls.

Answer: B
185. What is the term used to describe a virus that can infect both program files and
boot sectors?

A. Polymorphic

B. Multipartite

C. Stealth

D. Multiple encrypting

Answer: B
186. In what way could Java applets pose a security threat?

A.) Their transport can interrupt the secure distribution of World Wide Web pages
over the internet by removing SSL and S-HTTP

B.) Java interpreters do not provide the ability to limit system access that an applet
could have on a client system

C.) Executables from the Internet may attempt an intentional attack when they are
downloaded on a client system

D.) Java does not check the bytecode at runtime or provide other safety mechanisms
for program isolation from the client system.

Answer: C
187. What setup should an administrator use for regularly testing the strength of user
passwords?

A.) A networked workstation so that the live password database can easily be accessed
by the cracking program

B.) A networked workstation so the password database can easily be copied locally
and processed by the cracking program

C.) A standalone workstation on which the password database is copied and processed
by the cracking program

D.) A password-cracking program is unethical; therefore it should not be used.

Answer: C
188. On UNIX systems, passwords shall be kept:

A. In any location on behalf of root.

B. In a shadow password file.

C. In the /etc/passwd file.

D. In root.

Answer: B
189. Which of the following would constitute the best example of a password to use
for access to a system by a network administrator?

A.) holiday

B.) Christmas12

C.) Jenny&30

D.) TrZc&45g

Answer: D
190. Which of the following refers to the data left on the media after the media has
been erased?

A.) remanence

B.) recovery

C.) sticky bits

D.) semi-hidden

Answer: A
191. What is the main issue with media reuse?

A.) Degaussing

B.) Data remanence

C.) Media destruction

D.) Purging

Answer: B
192. What should a company do first when disposing of personal computers that once
were used to store confidential data?

A.) Overwrite all data on the hard disk with zeroes

B.) Delete all data contained on the hard disk

C.) Demagnetize the hard disk

D.) Low level format the hard disk

Answer: C
193. In an on-line transaction processing system, which of the following actions
should be taken when erroneous or invalid transactions are detected?

A.) The transactions should be dropped from processing

B.) The transactions should be processed after the program makes adjustments

C.) The transactions should be written to a report and reviewed

D.) The transactions should be corrected and reprocessed

Answer: C
194. Which of the following is a reasonable response from the intrusion detection
system when it detects Internet Protocol (IP) packets where the IP source address is
the same as the IP destination address?

A. Allow the packet to be processed by the network and record the event.

B. Record selected information about the item and delete the packet.

C. Resolve the destination address and process the packet.

D. Translate the source address and resend the packet.

Answer: B
195. Which of the following is not a good response to a detected intrusion?

A.) Collect additional information about the suspected attack

B.) Inject TCP reset packets into the attacker's connection to the victim system

C.) Reconfigure routers and firewalls to block packets from the attacker's apparent
connection

D.) Launch attacks or attempt to actively gain information about the attacker's host

Answer: D
196. Which of the following is used to monitor network traffic or to monitor host
audit logs in order to determine violations of security policy that have taken place?

A.) Intrusion Detection System

B.) Compliance Validation System

C.) Intrusion Management System

D.)Compliance Monitoring System

Answer: A
197. Which one of the following is NOT a characteristic of an Intrusion Detection
System? (IDS)

A. Determines the source of incoming packets.

B. Detects intruders attempting unauthorized activities.

C. Recognizes and report alterations to data files.

D. Alerts to known intrusion patterns.

Answer: C
198. An IDS detects an attach using which of the following?

A.) an event-based ID or a statistical anomaly-based ID

B.) a discrete anomaly-based ID or a signature-based ID

C.) a signature-based ID or a statistical anomaly-based ID

D.) a signature-based ID or an event-based ID

Answer: C
199. Which of the following monitors network traffic in real time?

A.) network-based IDS

B.) host-based IDS

C.) application-based IDS

D.) firewall-based IDS

Answer: A
200. What technology is being used to detect anomalies?

A. IDS

B. FRR

C. Sniffing

D. Capturing

Answer: A
201. IDSs verify, itemize, and characterize threats from:

A. Inside your organization's network.

B. Outside your organization's network.

C. Outside and inside your organization's network.

D. The Internet.

Answer: C
202. The majority of commercial intrusion detection systems are:

A. Identity-based

B. Network-based

C. Host-based

D. Signature-based

Answer: B
203. Which of the following is a drawback of Network-based IDSs?

A. It cannot analyze encrypted information.

B. It is very costly to setup.

C. It is very costly to manage.

D. It is not effective.

Answer: A

Network-based IDSs cannot analyze encrypted information. This problem is

increasing as more organizations (and attackers) use virtual private networks. Most
network-based IDSs cannot tell whether or not an attack was successful; they can only
discern that an attack was initiated. This means that after a network-based IDS detects
an attack, administrators must manually investigate each attacked host to determine
whether it was indeed penetrated.
204. Host-based IDSs normally utilize information from which of the following
sources?

A. Operating system audit trails and system logs.

B. Operating system audit trails and network packets.

C. Network packets and system logs.

D. Operating system alarms and system logs.

Answer: A
205. When comparing host based IDS with network based ID, which of the following
is an obvious advantage?

A. It is unaffected by switched networks.

B. It cannot analyze encrypted information.

C. It is not costly to setup.

D. It is not costly to manage.

Answer: A
206. Which of the following IDS inflict a higher performance cost on the monitored
systems?

A. Encryption based

B. Host based

C. Network based

D. Trusted based

Answer: B
207. Application-based IDSs normally utilize information from which of the
following sources?

A. Network packets and system logs.

B. Operating system audit trails and network packets.

C. Operating system audit trails and system logs.

D. Application's transaction log files.

Answer: D
208. Which of the following are the major categories of IDSs response options?

A. Active responses

B. Passive responses

C. Hybrid

D. All of the choices.

Answer: D
209. What are the primary approaches IDS takes to analyze events to detect attacks?

A. Misuse detection and anomaly detection.

B. Log detection and anomaly detection.

C. Misuse detection and early drop detection.

D. Scan detection and anomaly detection.

Answer: A
210. Misuse detectors analyze system activity and identify patterns. The patterns
corresponding to know attacks are called:

A. Attachments

B. Signatures

C. Strings

D. Identifications

Answer: B
211. Which of the following would assist in intrusion detection?

A.) audit trails

B.) access control lists

C.) security clearances

D.) host-based authentication

Answer: A
212. Using clipping levels refers to:

A.) setting allowable thresholds on reported activity

B.) limiting access to top management staff

C.) setting personnel authority limits based on need-to-know basis

D.) encryption of data so that it cannot be stolen

Answer: A
213. When establishing a violation tracking and analysis process, which one of the
following parameters is used to keep the quantity of data to manageable levels?

A. Quantity baseline

B. Maximum log size

C. Circular logging

D. Clipping levels

Answer: D
214. Audit trails based upon access and identification codes establish...

A. intrustion detection thresholds

B. individual accountability

C. audit review critera

D. individual authentication

Answer: B
215. The primary reason for enabling software audit trails is which of the following?

A.) Improve system efficiency

B.) Improve response time for users

C.) Establish responsibility and accountability

D.) Provide useful information to track down processing errors

Answer: C
216. Tracing violations, or attempted violations of system security to the user
responsible is a function of?

A. authentication

B. access management

C. integrity checking

D. accountability

Answer: D
217. Which of the following questions is less likely to help in assessing controls over
audit trails?

A.) Does the audit trail provide a trace of user actions?

B.) Are incidents monitored and tracked until resolved?

C.) Is access to online logs strictly controlled?

D.) Is there separation of duties between security personnel who administer the access
control function and those who administer the audit trail?

Answer: B
218. You should keep audit trail on which of the following items?

A. Password usage.

B. All unsuccessful logon.

C. All successful logon.

D. All of the choices.

Answer: C
219. In addition to providing an audit trail required by auditors, logging can be used
to

A. provide backout and recovery information

B. prevent security violations

C. provide system performance statistics

D. identify fields changed on master files.

Answer: B
220. Who should NOT have access to the log files?

A. Security staff.

B. Internal audit staff.

C. System administration staff.

D. Manager's secretary.

Answer: D
221. Logs must be secured to prevent:

A. Creation, modification, and destruction.

B. Modification, deletion, and initialization.

C. Modification, deletion, and destruction.

D. Modification, deletion, and inspection.

Answer: C
222. To ensure dependable and secure logging, all computers must have their clock
synchronized to:

A. A central timeserver.

B. The log time stamp.

C. The respective local times.

D. None of the choices.

Answer: A
223. To ensure dependable and secure logging, logging information traveling on the
network should be:

A. Stored

B. Encrypted

C. Isolated

D. Monitored

Answer: B
224. The activity that consists of collecting information that will be used for
monitoring is called:

A. Logging

B. Troubleshooting

C. Auditing

D. Inspecting

Answer: A
225. How often should logging be run?

A. Once every week.

B. Always

C. Once a day.

D. During maintenance.

Answer: B
226. Which of the following are potential firewall problems that should be logged?

A. Reboot

B. Proxies restarted.

C. Changes to configuration file.

D. All of the choices.

Answer: D
227. The principle of accountability is a principle by which specific action can be
traced back to:

A. A policy

B. An individual

C. A group

D. A manager

Answer: B
228. The principle of _________ is a principle by which specific action can be traced
back to anyone of your users.

A. Security

B. Integrity

C. Accountability

D. Policy

Answer: C
229 Controls provide accountability for individuals who are accessing sensitive
information. This accountability is accomplished:

A.) through access control mechanisms that require identification and authentication
and through the audit function.

B.) through logical or technical controls involving the restriction of access to systems
and the protection of information

C.) through logical or technical controls but not involving the restriction of access to
systems and the protection of information.

D.) through access control mechanisms that do not require identification and
authentication and do not operate through the audit function.

Answer: A
230. In addition to ensuring that changes to the computer system take place in an
identifiable and controlled environment, configuration management provides
assurance that future changes:

A. The application software cannot bypass system security features.

B. Do not adversely affect implementation of the security policy.

C. To do the operating system are always subjected to independent validation and

verification.

D. In technical documentation maintain an accurate description of the Trusted

Computer Base.

Answer: B

B is the most appropriate answer although other answers seem correct.

231. If the computer system being used contains confidential information, users must
not:

A. Leave their computer without first logging off.

B. Share their desks.

C. Encrypt their passwords.

D. Communicate

Answer: A
232. Separation of duties is valuable in deterring:

A. DoS

B. external intruder

C. fraud

D. trojan horse

Answer: C
233. What principle requires that for particular sets of transactions, no single
individual be allowed to execute all transactions within the set?

A. Use of rights

B. Balance of power

C. Separation of duties

D. Fair use

Answer: C
234. Separation of duty can be:

A. Dynamic only

B. Encrypted

C. Static only

D. Static or dynamic

Answer: D
235. What is the company benefit, in terms of risk, for people taking a vacation of a
specified minimum length?

A. Reduces stress levels, thereby lowering insurance claims.

B. Improves morale, thereby decreasing errors.

C. Increases potential for discovering frauds.

D. Reduces dependence on critical individuals.

Answer: C
236. Which of the following would be less likely to prevent an employee from
reporting an incident?

A.) They are afraid of being pulled into something they don't want to be involved with

B.) The process of reporting incidents is centralized

C.) They are afraid of being accused of something they didn't do

D.) They are unaware of the company's security policies and procedures

Answer: A
237. What should you do to the user accounts as soon as employment is terminated?

A. Disable the user accounts and erase immediately the data kept.

B. Disable the user accounts and have the data kept for a specific period of time.

C. None of the choices.

D. Maintain the user accounts and have the data kept for a specific period of time.

Answer: B

A record of user logins with time and date stamps must be kept. User accounts shall
be disabled and data kept for a specified period of time as soon as employment is
terminated. All users must log on to gain network access.
238. What is the main objective of proper separation of duties?

A.) To prevent employees from disclosing sensitive information

B.) To ensure access controls are in place

C.) To ensure that no single individual can compromise a system

D.) To ensure that audit trails are not tampered with

Answer: C
239. Which of the following control pairing include organizational policies and
procedures, pre-employment background checks, strict hiring practices, employment
agreements, friendly and unfriendly employee termination procedures, vacation
scheduling, labeling of sensitive materials, increased supervision, security awareness
training, behavior awareness, and sign-up procedures to obtain access to information
systems and networks in?

A.) Preventive/Administrative Pairing

B.) Preventive/Technical Pairing

C.) Preventive/Physical Pairing

D.) Detective/Administrative Pairing

Answer: A
240. Which of the following are functions that are compatible in a properly segregated
environment?

A.) Application programming and computer operation

B.) Systems programming and job control analysis

C.) Access authorization and database administration

D.) Systems development and systems maintenance

Answer: D
241. Controls are implemented to:

A.) eliminate risk and reduce potential for loss

B.) mitigate risk and eliminate the potential for loss

C.) mitigate risk and reduce the potential for loss

D.) eliminate risk and eliminate the potential for loss

Answer: C
242. A timely review of system access audit records would be an example of which of
the basic security functions?

A.) avoidance

B.) deterrence

C.) prevention

D.) detection

Answer: D
243. A security control should

A. Allow for many exceptions.

B. Cover all contingencies.

C. Not rely on the security of its mechanism.

D. Change frequently.

Answer: C
244. What set of principles is the basis for information systems controls?

A. Authentication, audit trails, and awareness briefings

B. Individual accountability, auditing, and separation of duties

C. Need to know, identification, and authenticity

D. Audit trails, limited tenure, and awareness briefings

Answer: C
245. An audit trail is a category of what control?

A. System, Manual

B. Detective, Technical

C. User, Technical

D. Detective, Manual

Answer: B
246. An IDS is a category of what control?

A. Detective, Manual

B. Detective, Technical

C. User, Technical

D. System, Manual

Answer: B
247. Technical controls such as encryption and access control can be built into the
operating system, be software applications, or can be supplemental hardware/software
units. Such controls, also known as logical controls, represent which pairing?

A.) Preventive/Administrative Pairing

B.) Preventive/Technical Pairing

C.) Preventive/Physical Pairing

D.) Detective/Technical Pairing

Answer: B
248. Which of the following is not an example of an operation control?

A.) backup and recovery

B.) audit trails

C.) contingency planning

D.) operations procedures

Answer: C
249. Access control allows you to exercise directing influence over which of the
following aspects of a system?

A. Behavior, user, and content provider.

B. Behavior, use, and content.

C. User logs and content.

D. None of the choices.

Answer: B
250. ____________ is the means by which the ability to do something with a
computer resource is explicitly enabled or restricted.

A. Access control

B. Type of access

C. System resource

D. Work permit

Answer: A
251. The main categories of access control do NOT include:

A. Administrative Access Control

B. Logical Access Control

C. Random Access Control

D. Physical Access Control

Answer: C
252. A two factor authentication method is considered a:

A. Technical control

B. Patching control

C. Corrective control

D. Logical control

Answer: D
253. Which of the following are NOT considered technical controls?

A. Access Control software

B. Man trap

C. Passwords

D. Antivirus Software

Answer: B
254. Which of the following is NOT a type of access control?

A. Intrusive

B. Deterrent

C. Detective

D. Preventive

Answer: A
255. As a type of access control, which of the following asks for identifying
occurrences?

A. Deterrent

B. Preventive

C. Detective

D. Intrusive

Answer: C
256. As a type of access control, which of the following asks for discouraging
occurrence?

A. Detective

B. Intrusive

C. Deterrent

D. Preventive

Answer: C
257. As a type of access control, which of the following asks for restoring controls?

A. Deterrent

B. Intrusive

C. Corrective

D. Preventive

Answer: C
258. Access control is the collection of mechanisms that permits managers of a
system to exercise influence over the use of:

A. A man guard

B. An IS system

C. A threshold

D. A Trap

Answer: B
259. The Physical Security domain addresses three areas that can be utilized to
physically protect an enterprise's resources and sensitive information. Which of the
following is not one of these areas?

A.) Threats

B.) Countermeasures

C.) Vulnerabilities

D.) Risks

Answer: D
260. Which issue when selecting a facility site deals with the surrounding terrain,
building markings and signs, and high or low population in the area?

A.) surrounding area and external entities

B.) natural disasters

C.) accessibility

D.) visibility

Answer: D
261. Which of the following is not a physical control for physical security?

A.) lighting

B.) fences

C.) training

D.) facility construction materials

Answer: C
262. The main risks that physical security components combat are all of the following
EXCEPT:

A.) SYN flood

B.) physical damage

C.) theft

D.) availability

Answer: A
263. Examples of types of physical access controls include all except which of the
following?

A.) badges

B.) locks

C.) guards

D.) passwords

Answer: D
264. The concentric circle approach is used to

A. Evaluate environmental threats.

B. Assess the physical security facility,

C. Assess the communications network security.

D. Develop a personnel security program.

Answer: B
265. Closed circuit TV is a feature of:

A. Detective Physical Controls

B. Corrective Physical Controls

C. Corrective Logical Controls

D. Logical Physical Controls

Answer: A
266. Motion detector is a feature of:

A. Corrective Logical Controls.

B. Logical Physical Controls.
C. Corrective Physical Controls.
D. Detective Physical Controls.

Answer: D
267. Which of the following is a physical control?

A.) Monitoring of system activity

B.) Environmental controls

C.) Identification and authentication methods

D.) Logical access control mechanisms

Answer: B
268. Which of the following is a detective control?

A.) Segregation of duties

B.) Back-up procedures

C.) Audit trails

D.) Physical access control

Answer: C
269. Controls like guards and general steps to maintain building security, securing of
server rooms or laptops, the protection of cables, and the backing up of files are some
of the examples of:

A.) Administrative controls

B.) Logical controls

C.) Technical controls

D.) Physical controls

Answer: D
270. Which of the following measures would be the BEST deterrent to the theft of
corporate information from a laptop which was left in a hotel room?

A.) Store all data on disks and lock them in an in-room safe

B.) Remove the batteries and power supply from the laptop and store them separately
from the computer

C.) Install a cable lock on the laptop when it is unattended

D.) Encrypt the data on the hard drive

Answer: D
271. Guards are appropriate whenever the function required by the security program
involves which of the following?

A.) The use of discriminating judgment

B.) The use of physical force

C.) The operation of access control devices

D.) The need to detect unauthorized access

Answer: A
272. Sensor is:

A. Logical, Physical

B. Corrective, Logical

C. Detective, Physical

D. Corrective, Physical

Answer: C
273. Devices that supply power when the commercial utility power system fails are
called which of the following?

A.) power conditioners

B.) uninterruptible power supplies

C.) power filters

D.) power dividers

Answer: B
274. Under what conditions would use of a "Class C" hand-held fire extinguisher be
preferable to use of a "Class A" hand-held fire extinguisher?

A.) When the fire is in its incipient stage

B.) When the fire involves electrical equipment

C.) When the fire is located in an enclosed area

D.) When the fire is caused by flammable products

Answer: B
275. Which of the following is a class C fire?

A.) electrical

B.) liquid

C.) common combustibles

D.) soda acid

Answer: A
276. Under what conditions would the use of a Class C fire extinguisher be preferable
to a Class A extinguisher?

A.) When the fire involves paper products

B.) When the fire is caused by flammable products

C.) When the fire involves electrical equipment

D.) When the fire is in an enclosed area

Answer: C
277. Which of the following is true about a "dry pipe" sprinkler system?

A.) It is a substitute for carbon dioxide systems

B.) It maximizes chances of accidental discharge of water

C.) it minimizes chances of accidental discharge of water

D.) It uses less water than "wet pipe" systems

Answer: C
278. Which fire class can water be most appropriate for?

A.) Class A fires

B.) Class B fires

C.) Class C fires

D.) Class D fires

Answer: A
279. What category of water sprinkler system is currently the most recommended
water system for a computer room?

A.) Dry Pipe sprinkler system

B.) Wet Pipe sprinkler system

C.) Pre-action sprinkler system

D.) Deluge sprinkler system

Answer: C
280. What fire suppression system can be used in computer rooms that will not
damage computers and is safe for humans?

A.) Water

B.) FM200

C.) Halon

D.) CO2

Answer: B
281. The following are fire detector types EXCEPT:

A.) smoke activated

B.) flame actuated

C.) acoustical-seismic detection system

D.) heat activated

Answer: C
282. Which fire class can water be most appropriate for?

A.) Class A fires

B.) Class B fires

C.) Class C fires

D.) Class D fires

Answer: A
283. Which one of the following actions should be taken FIRST after a fire has been
detected?

A. Turn off power to the computers

B. Call the fire department

C. Notify management

D. Evacuate all personnel

Answer: D
284. Which of the following provides coordinated procedures for minimizing loss of
life or injury and protecting property damage in response to a physical threat?

A.) Business continuity plan

B.) Incident response plan

C.) Disaster recovery plan

D.) Occupant emergency plan

Answer: D
285. Disaster Recovery Plan emergency produces is a plan of action that commences
immediately to prevent or minimize property damage and to:

A. Prevent interruption of service.

B. Minimize embarrassment.

C. Prevent loss of life.

D. Evacuate the facility.

Answer: C
286. What is the PRIMARY concern during a disaster?

A. Recover of the critical functions.

B. Availability of a hot site.

C. Acceptable outage duration.

D. Personnel safety.

Answer: D
287. What is the role of IKE within the IPsec protocol:

A.) peer authentication and key exchange

B.) data encryption

C.) data signature

D.) enforcing quality of service

Answer: A
288. In a Public Key Infrastructure, how are public keys published?

A.) They are sent via e-mail

B.) Through digital certificates

C.) They are sent by owners

D.) They are not published

Answer: B
289. Which of the following defines the key exchange for Internet Protocol Security
(IPSEC)?

A. Internet Security Association Key Management Protocol (ISAKMP)

B. Internet Key Exchange (IKE)
C. Security Key Exchange (SKE)
D. Internet Communication Messaging Protocol (ICMP)

Answer: A

The Internet Security

Association and Key management Protocol (ISAKMP) is an authentication and key
exchange architecture that is independent of the type of keying mechanisms used
during the tunnel building process.
290. A network of five nodes is using symmetrical keys to securely transmit data.
How many new keys are required to re-establish secure communications to all nodes
in the event there is a key compromise?

A. 5

B. 10

C. 20

D. 25

Answer: A
291. What is the effective key size of DES?

A.) 56 bits

B.) 64 bits

C.) 128 bits

D.) 1024 bits

Answer: A
292. Matches between which of the following are important because they represent
references from one relation to another and establish the connection among these
relations?

A.) foreign key to primary key

B.) foreign key to candidate key

C.) candidate key to primary key

D.) primary key to secondary key

Answer: A
293. What is the PRIMARY advantage of secret key encryption systems as compared
with public key systems?

A. Faster speed encryption

B. Longer key lengths

C. Easier key management

D. Can be implemented in software

Answer: A
294. Which of the following can be defined as an attribute in one relation that has
values matching the primary key in another relation?

A.) foreign key

B.) candidate key

C.) Primary key

D.) Secondary key

Answer: A
295. What uses a key of the same length as the message?

A.) Running key cipher

B.) One-time pad

C.) Steganography

D.) Cipher block chaining

Answer: B
296. Which of the following statements related to a private key cryptosystem is
FALSE?

A.) The encryption key should be secure

B.) Data Encryption Standard (DES) is a typical private key cryptosystem

C.) The key used for decryption is known to the sender

D.) Two different keys are used for the encryption and decryption

Answer: D
297. Who is responsible for the security and privacy of data during a transmission on
a public communications link?

A. The carrier

B. The sender

C. The receiving party

D. The local service provider

Answer: B
298. Which of the following best provides e-mail message authenticity and
confidentiality?

A.) Signing the message using the sender's public key and encrypting the message
using the receiver's private key

B.) Signing the message using the sender's private key and encrypting the message
using the receiver's public key

C.) Signing the message using the receiver's private key and encrypting the message
using the sender's public key

D.) Signing the message using the receiver's public key and encrypting the message
with the sender's private key

Answer: B
299. Cryptography does not help in:

A.) Detecting fraudulent insertion

B.) Detecting fraudulent deletion

C.) Detecting fraudulent modifications

D.) Detecting fraudulent disclosure

Answer: D
300. How much more secure is 56 bit encryption opposed to 40 bit encryption?

A.) 16 times

B.) 256 times

C.) 32768 times

D.) 65,536 times

Answer: D

56-40 = 16 → 216 = 65,536

301. Which of the following statements is true about data encryption as a method of
protecting data?

A.) It should sometimes be used for password files

B.) It is usually easily administered

C.) It makes few demands on system resources

D.) It requires careful key Management

Answer: D
302. The primary purpose for using one-way encryption of user passwords within a
system is which of the following?

A.) It prevents an unauthorized person from trying multiple passwords in one logon
attempt

B.) It prevents an unauthorized person from reading or modifying the password list

C.) It minimizes the amount of storage required for user passwords

D.) It minimizes the amount of processing time used for encrypting password

Answer: B
303. Which of the following is not a known type of Message Authentication Code
(MAC)?

A.) Hash function-based MAC

B.) Block cipher-based MAC

C.) Signature-based MAC

D.) Stream cipher-based MAC

Answer: C
304. Where parties do not have a shared secret and large quantities of sensitive
information must be passed, the most efficient means of transferring information is to
use a hybrid encryption technique. What does this mean?

A.) Use of public key encryption to secure a secret key, and message encryption using
the secret key

B.) Use of the recipient's public key for encryption and decryption based on the
recipient's private key

C.) Use of software encryption assisted by a hardware encryption accelerator

D.) Use of elliptic curve encryption

Answer: A
305. One-way hash provides:

A.) Confidentiality

B.) Availability

C.) Integrity

D.) Authentication

Answer: C
306. What size is an MD5 message digest (hash)?

A.) 128 bits

B.) 160 bits

C.) 256 bits

D.) 128 bytes

Answer: A
307. Which of the following is NOT a property of a one-way hash function?

A.) It converts a message of a fixed length into a message digest of arbitrary length.

B.) It is computationally infeasible to construct two different messages with the same
digest

C.) It converts a message of arbitrary length into a message digest of a fixed length

D.) Given a digest value, it is computationally infeasible to find the corresponding

message

Answer: A
308. What are two types of ciphers?

A.) Transposition and Permutation

B.) Transposition and Shift

C.) Transposition and Substitution

D.) Substitution and Replacement

Answer: C
309. Which one of the following, if embedded within the ciphertext, will decrease the
likelihood of a message being replayed?

A. Stop bit

B. Checksum

C. Timestamp

D. Digital signature

Answer: C
310. Which of the following statements pertaining to block ciphers is incorrect?

A.) it operates on fixed-size blocks of plaintext

B.) it is more suitable for software than hardware implementation

C.) Plain text is encrypted with a public key and decrypted with a private key

D.) Block ciphers can be operated as a stream

Answer: C
311. The repeated use of the algorithm to encipher a message consisting of many
blocks is called

A. Cipher feedback

B. Elliptical curve

C. Cipher block chaining

D. Triple DES

Answer: C
312. When block chaining cryptography is used, what type of code is calculated and
appended to the data to ensure authenticity?

A. Message authentication code.

B. Ciphertext authentication code

C. Cyclic redundancy check

D. Electronic digital signature

Answer: A
313. Which of the following statements pertaining to block ciphers is incorrect?

A.) It operates on fixed-size blocks of plaintext

B.) It is more suitable for software than hardware implementations

C.) Plain text is encrypted with a public key and decrypted with a private key

D.) Block ciphers can be operated as a stream

Answer: C
314. Which of the following is a symmetric encryption algorithm?

A.) RSA

B.) Elliptic Curve

C.) RC5

D.) El Gamal

Answer: C
315. How many bits is the effective length of the key of the Data Encryption Standard
Algorithm?

A.) 16

B.) 32

C.) 56

D.) 64

Answer: C
316. Compared to RSA, which of the following is true of elliptic curse cryptography?

A.) It has been mathematically proved to be the more secure

B.) It has been mathematically proved to be less secure

C.) It is believed to require longer keys for equivalent security

D.) It is believed to require shorter keys for equivalent security

Answer: D
317. Which of the following is not a one-way algorithm?

A.) MD2

B.) RC2

C.) SHA-1

D.) DSA

Answer: B
318. A public key algorithm that does both encryption and digital signature is which
of the following?

A.) RSA

B.) DES

C.) IDEA

D.) DSS

Answer: A
319. The RSA algorithm is an example of what type of cryptography?

A.) Asymmetric key

B.) Symmetric key

C.) Secret Key

D.) Private Key

Answer: A
320. How many rounds are used by DES?

A.) 16

B.) 32

C.) 64

D.) 48

Answer: A
321. Which of the following is the most secure form of triple-DES encryption?

A.) DES-EDE3

B.) DES-EDE1

C.) DES-EEE4

D.) DES-EDE2

Answer: A

DES-EEE4 does not exist today.

322. Which of the following algorithms does NOT provide hashing?

A.) SHA-1

B.) MD2

C.) RC4

D.) MD5

Answer: C
323. Which of the following is unlike the other three?

A.) El Gamal

B.) Teardrop

C.) Buffer Overflow

D.) Smurf

Answer: A
324. Which of the following is not an encryption algorithm?

A.) Skipjack

B.) SHA-1

C.) Twofish

D.) DEA

Answer: B
325. What is the basis for the Rivest-Shamir-Adelman (RSA) algorithm scheme?

A. Permutations

B. Work factor

C. Factorability

D. Reversivibility

Answer: C
326. Which of the following encryption algorithms does not deal with discrete
logarithms?

A.) El Gamal

B.) Diffie-Hellman

C.) RSA

D.) Elliptic Curve

Answer: C
327. The RSA Algorithm uses which mathematical concept as the basis of its
encryption?

A.) Geometry

B.) Irrational numbers

C.) PI ( π )

D.) Large prime numbers

Answer: D
328. PGP provides which of the following? (Choose three)

A. Confidentiality

B. Accountability

C. Accessibility

D. Integrity

E. Interest

F. Non-repudiation

G. Authenticity

Answer: A,D,G
329. Which of the following mail standards relies on a "Web of Trust"?

A.) Secure Multipurpose Internet Mail extensions (S/MIME)

B.) Pretty Good Privacy (PGP)

C.) MIME Object Security Services (MOSS)

D.) Privacy Enhanced Mail (PEM)

Answer: B

PGP does not use a hierarchy of CA, or any type of formal trust certificates, but relies
on a "web of trust” in its key management approach. Each user generates and
distributes his or her public key, and users sign each other's public keys, which creates
a community of users who trust each other. This is different than the CA approach
where no one trusts each other, they only trust the CA.
330. Which of the following offers confidentiality to an e-mail message?

A.) The sender encrypting it with it's private key

B.) The sender encrypting it with it's public key

C.) The sender encrypting it with it's receiver's public key

D.) The sender encrypting it with the receiver's private key

Answer: C
331. In a Secure Electronic Transaction (SET), how many certificates are required for
a payment gateway to support multiple acquires?

A. Two certificates for the gateway only.

B. Two certificates for the gateway and two for the acquirers.

C. Two certificates for each acquirer.

D. Two certificates for the gateway and two for each acquirer.

Answer: B
332. Which of the following best describes the Secure Electronic Transaction (SET)
protocol?

A.) Originated by VISA and MasterCard as an Internet credit card protocol

B.) Originated by VISA and MasterCard as an Internet credit card protocol using
digital signatures

C.) Originated by VISA and MasterCard as an Internet credit card protocol using the
transport layer

D.) Originated by VISA and MasterCard as an Internet credit card protocol using SSL

Answer: B
323. What encryption algorithm is best suited for communication with handheld
wireless devices?

A.) ECC

B.) RSA

C.) SHA

D.) RC4

Answer: A
324. Which security measure BEST provides non-repudiation in electronic mail?

A. Digital signature

B. Double length Key Encrypting Key (KEK)

C. Message authentication code (MAC)

D. Triple Data Encryption Standard (DES)

Answer: A
335. Public key cryptography provides integrity verification through the use of public
key signature and ____________?

A. Secure hashes

B. Zero knowledge

C. Private key signature

D. Session key

Answer: C
336. Electronic signatures can prevent messages from being:

A.) Erased

B.) Disclosed

C.) Repudiated

D.) Forwarded

Answer: C
337. Why do vendors publish MD5 hash values when they provide software patches
for their customers to download from the Internet?

A. Recipients can verify the software's integrity after downloading.

B. Recipients can confirm the authenticity of the site from which they are
downloading the patch.

C. Recipients can request future updates to the software by using the assigned hash
value.

D. Recipients need the hash value to successfully activate the new software.

Answer: A
338. Digital signature users register their public keys with a certification authority,
which distributes a certificate containing the user's public key and digital signature of
the certification authority. In creating the certificate, the user's public key and the
validity period are combined with what other information before computing the
digital signature?

A. Certificate issuer and the Digital Signature Algorithm identifier

B. User's private key and the identifier of the master key code

C. Name of secure channel and the identifier of the protocol type

D. Key authorization and identifier of key distribution center

Answer: A
339. Which one of the following security technologies provides safeguards for
authentication before securely sending information to a web server?

A. Secure/Multipurpose Internet Mail Extension (S/MIME)

B. Common Gateway Interface (CGI) scripts

C. Applets

D. Certificates

Answer: D
340. The primary role of cross certification is:

A.) Creating trust between different PKIs

B.) Build an overall PKI hierarchy

C.) set up direct trust to a second root CA

D.) Prevent the nullification of user certifications by CA certificate revocation

Answer: A
341. Windows 98 includes the ability to check the digitally signed hardware drivers.
Which of the following are true?

A.) Drivers are the only files supplied with W98 that can checked for digital
signatures and all drivers included with W98 have been digitally signed

B.) If a file on a windows W98 has been digitally signed it means that the file has
passed quality testing by Microsoft.

C.) The level to which signature checking is implemented could only be changed by
editing the registry

D.) All of the statements are true

Answer: B
342. What is the purpose of certification path validation?

A. Checks the legitimacy of the certificates in the certification path.

B. Checks that all certificates in the certification path refer to same certification
practice statement.

C. Checks that no revoked certificates exist outside the certification path.

D. Checks that the names in the certification path are the same.

Answer: A
343. In what type of attack does an attacker try, from several encrypted messages, to
figure out the key using the encryption process?

A.) Known-plaintext attack

B.) Ciphertext-only attack

C.) Chosen-Ciphertext attack

D.) Known Ciphertext attack

Answer: B
344. The relative security of a commercial cryptographic system can be measured by
the?

A. Rating value assigned by the government agencies that use the system.

B. Minimum number of cryptographic iterations required by the system.

C. Size of the key space and the available computational power.

D. Key change methodology used by the cryptographic system.

Answer: C
345. Which one of the following describes Kerchoff's Assumption for cryptoanalytic
attack?

A. Key is secret; algorithm is Known

B. Key is known; algorithm is Known

C. Key is secret; algorithm is secret

D. Key is known; algorithm is secret

Answer: A
346. Which of the following actions can make a cryptographic key more resistant to
an exhaustive attack?

A. None of the choices.

B. Increase the length of a key.

C. Increase the age of a key.

D. Increase the history of a key.

Answer: B
347. Which type of attack is based on the probability of two different messages using
the same hash function producing a common message digest?

A.) Differential cryptanalysis

B.) Differential linear cryptanalysis

C.) Birthday attack

D.) Statistical attack

Answer: C
348. Frame-relay uses a public switched network to provide:

A.) Local Area Network (LAN) connectivity

B.) Metropolitan Area Network (MAN) connectivity

C.) Wide Area Network (WAN) connectivity

D.) World Area Network (WAN) connectivity

Answer: C
349. Which of the following is a Wide Area Network that was originally funded by
the department of Defense, which uses TCP/IP for data interchange?

A.) the Internet

B.) the Intranet

C.) the Extranet

D.) The Ethernet

Answer: A
350. Internet specifically refers to the global network of:

A.) public networks and Internet Service Providers (ISPs) throughout the world

B.) private networks and Internet Services Providers (ISPs) through the world

C.) limited networks and Internet Service Providers (ISPs) throughout the world

D.) point networks and Internet Service Providers (ISPs) throughout the world

Answer: A
351. Which of the following statements pertaining to Asynchronous Transfer Mode
(ATM) is false?

A.) It can be used for voice

B.) It can be used for data

C.) It carries various sizes of packets

D.) It can be used for video

Answer: C

ATM multiplexed 53-byte cell in the ATM network.

352. Satellite communications are easily intercepted because__________

A. transmissions are continuous 24 hours per day.

B. a satellite footprint is narrowly focused.

C. a satellite footprint is very large.

D. a satellite footprint does not change.

Answer: C
353. Fast ethernet operates at which of the following?

A.) 10 MBps

B.) 100 MBps

C.) 1000 MBps

D.) All of the above

Answer: B

Answer B is the best answer.

10M = ehternet
100M = fastethernet
1G = gigaethernet
354. Which of the following statements about the "Intranet" is NOT true?

A.) It is an add-on to a local area network.

B.) It is unrestricted and publicly available.

C.) It is usually restricted to a community of users

D.) t can work with MANS or WANS

Answer: B
355. Frame relay and X.25 networks are part of which of the following?

A.) Circuit-switched services

B.) Cell-switched services

C.) Packet-switched services

D.) Dedicated digital services

Answer: C
356. A Wide Area Network (WAN) may be privately operated for a specific user
community, may support multiple communication protocols, or may provide network
connectivity and services via:

A.) interconnected network segments (extranets, intranets, and Virtual Private

Networks)

B.) interconnected network segments (extranets, internets, and Virtual Private

Networks)

C.) interconnected netBIOS segments (extranets, intranets, and Virtual Private

Networks)

D.) interconnected NetBIOS segments (extranets, interest, and Virtual Private

Networks)

Answer: A
357. Which of the following is a LAN transmission protocol?

A.) Ethernet

B.) Ring Topology

C.) Unicast

D.) Polling

Answer: C
358. Which of the following access methods is used by Ethernet?

A.) CSMA/CD

B.) CSU/DSU

C.) TCP/IP

D.) FIFO

Answer: A
359. Unshielded (UTP) does not require the fixed spacing between connections that
is:

A.) necessary with telephone-type connections

B.) necessary with coaxial-type connections

C.) necessary with twisted pair-type connections

D.) necessary with fiber optic-type connections

Answer: B
360. On which Open System Interconnection (OSI) Reference Model layer are
repeaters used as communications transfer devices?

A. Data-link

B. Physical

C. Network

D. Transport

Answer: B

Repeater and hub are layer one equipment.

361. In the OSI/ISO model, at what level are TCP and UDP provided?

A.) Transport

B.) Network

C.) Presentation

D.) Application

Answer: A
362. DNS, FTP, TFTP, SNMP are provided at what level of the OSI/ISO model?

A.) Application

B.) Network

C.) Presentation

D.) Transport

Answer: A
363. Which of the following OSI layers does not provide confidentiality?

A.) Presentation

B.) Network

C.) Transport

D.) Session

Answer: C
364. Which of the following OSI layers provides routing and related services?

A.) Network

B.) Presentation

C.) Session

C.) Physical

Answer: A
365. The International Standards Organization/Open Systems Interconnection
(ISO/OSI) Layers does NOT have which of the following characteristics?

A.) Standard model for network communications

B.) Used to gain information from network devices such as count of packets received
and routing tables

C.) Allows dissimilar networks to communicate

D.) Defines 7 protocol layers (a.k.a. protocol stacks)

Answer: B
366. Which of the following layers supervises the control rate of packet transfers in an
Open Systems Interconnections (OSI) implementation?

A. Physical

B. Session

C. Transport

D. Network

Answer: C
367. ICMP and IGMP belong to which layer of the OSI model?

A.) Datagram

B.) Network

C.) Transport

D.) Link

Answer: B
368. The International Standards Organization / Open Systems Interconnection
(ISO/OSI) Layers 6 is which of the following?

A.) Application Layer

B.) Presentation Layer

C.) Data Link Layer

D.) Network Layer

Answer: B
369. Which OSI/ISO layer is IP implemented at?

A.) Session layer

B.) Transport layer

C.) Network layer

D.) Data link layer

Answer: C
370. Which of the following security-focused protocols operates at a layer different
from the others?

A.) Secure HTTP

B.) Secure shell (SSH-2)

C.) Secure socket layer (SSL)

D.) Simple Key Management for Internet Protocols (SKIP)

Answer: A
371. In the OSI/ISO model, at what layer are some of the SLIP, CSLIP, PPP control
functions are provided?

A.) Data Link

B.) Transport

C.) Presentation

D.) Application

Answer: A
372. Both TCP and UDP use port numbers of what length?

A.) 32 bits

B.) 16 bits

C.) 8 bits

D.) 4 bits

Answer: B
373. Which one of the following is an effective communications error-control
technique usually implemented in software?

A. Redundancy check

B. Packet filtering

C. Packet checksum

D. Bit stuffing

Answer: C
374. Each data packet is assigned the IP address of the sender and the IP address of
the:

A.) recipient

B.) host

C.) node

D.) network

Answer: A

A is the best answer among those answers.

375. What protocol was UDP based and mainly intended to provide validation of dial
up user login passwords?

A. PPTP

B. L2TP

C. IPSec

D. TACACS

Answer: D
376. On which port is POP3 usually run?

A.) 110

B.) 109

C.) 139

D.) 119

Answer: A
377. Telnet and rlogin use which protocol?

A.) UDP

B.) SNMP

C.) TCP

D.) IGP

Answer: C
378. The IP header contains a protocol field. If this field contains the value of 17,
what type of data is contained within the ip datagram?

A.) TCP

B.) ICMP

C.) UDP

D.) IGMP

Answer: C

Remarks:
Protocol field of ICMP = 1
Protocol field of TCP = 6
Protocol field of UDP = 17
379. Which of the following is true?

A.) TCP is connection-oriented. UDP is not

B.) UDP provides for Error Correction. TCP does not.

C.) UDP is useful for longer messages

D.) UDP guarantees delivers of data. TCP does not guarantee delivery of data.

Answer: A
380. What works as an E-mail message transfer agent?

A.) SMTP

B.) SNMP

C.) S-RPC

D.) S/MIME

Answer: A
381. A common way to create fault tolerance with leased lines is to group several T-
1's together with an inverse multiplexer placed:

A.) at one end of the connection

B.) at both ends of the connection

C.) somewhere between both end points

D.) in the middle of the connection

Answer: B
382. Which of the following is an IP address that is private (i.e. reserved for internal
networks and not a valid address to use on the internet)?

A.) 172.5.42.5

B.) 172.76.42.5

C.) 172.90.42.5

D.) 172.16.42.5

Answer: D
383. Which of the following is an ip address that is private (i.e. reserved for internal
networks and not a valid address to use on the internet)?

A.) 10.0.42.5

B.) 11.0.42.5

C.) 12.0.42.5

D.) 13.0.42.5

Answer: A
384. Which of the following is an ip address that is private (i.e. reserved for internal
networks and not a valid address to use on the internet)?

A.) 172.12.42.5

B.) 172.140.42.5

C.) 172.31.42.5

D.) 172.15.45.5

Answer: C
385. Which of the following is an ip address that is private (i.e. reserved for internal
networks and not a valid address to use on the Internet)?

A.) 192.168.42.5

B.) 192.166.42.5

C.) 192.175.42.5

D.) 172.1.42.5

Answer: A
386. How long are IPv4 addresses:

A.) 32 bits long

B.) 64 bits long

C.) 128 bits long

D.) 16 bits long

Answer: A
387. ARP and RARP map between which of the following?

A.) DNS addresses and IP addresses

B.) 32-bit hardware addresses and 48-bit IPv6 addresses

C.) 32-bit hardware addresses and 48-bit IPv4 addresses

D.) 32-bit addresses in IPv4 and 48-bit hardware addresses

Answer: D
388. Which protocol matches an Ethernet address to an Internet Protocol (IP) address?

A.) Address Resolution Protocol (ARP)

B.) Reverse Address Resolution Protocol (RARP)

C.) Internet Control Message Protocol (ICMP)

D.) User Datagram Protocol (UDP)

Answer: B
389. Which of the following statements pertaining to firewalls is incorrect?

A.) Firewalls should not run NIS (Network Information Systems)

B.) Firewalls should mount files systems via NFS

C.) All system logs on the firewall should log to a separate host

D.) Compilers should be deleted from the firewall

Answer: B
390. Which is the MAIN advantage of having an application gateway?

A. To perform change control procedures for applications.

B. To provide a means for applications to move into production.

C. To log and control incoming and outgoing traffic.

D. To audit and approve changes to applications.

Answer: C
391. Which process on a firewall makes permit/deny forwarding decisions based
solely on address and service port information?

A. Circuit Proxy

B. Stateful Packet Inspection Proxy

C. Application Proxy

D. Transparency Proxy

Answer: A
392. Which of the following is the biggest concern with firewall security?

A.) Internal hackers

B.) Complex configuration rules leading to misconfiguration

C.) Buffer overflows

D.) Distributed denial of service (DDOS) attacks

Answer: B
393. Which of the following statements pertaining to firewalls is incorrect?

A.) Firewalls may be bottlenecks between the internal and external network

B.) Firewalls allow for centralization of security services in machines optimized and
dedicated to the task

C.) Strong firewalls can protect a network at all layers of the OSI models

D.) Firewalls are used to create security checkpoints at the boundaries of private
networks

Answer: C
394. Which of the following is the least important security service provided by a
firewall?

A.) Packet filtering

B.) Encrypted tunnels

C.) Network Address Translation

D.) Proxy services

Answer: B
395. Which of the following firewall rules is less likely to be found on a firewall
installed between an organization's internal network and internet?

A.) Permit all traffic to and from local host

B.) Permit all inbound ssh traffic

C.) Permit all inbound tcp connections

D.) Permit all syslog traffic

Answer: C
396. Which of the following packets should NOT be dropped at a firewall protecting
an organization's internal network?

A.) Inbound packets with Source Routing option set

B.) Router information exchange protocols

C.) Inbound packets with an internal source IP address

D.) Outbound packets with an external destination IP address

Answer: D
397. By examining the "state" and "context" of the incoming data packets, it helps to
track the protocols that are considered "connectionless", such as UDP-based
applications and Remote Procedure Calls (RPC). This type of firewall system is used
in:

A.) first generation firewall systems

B.) second generation firewall systems

C.) third generation firewall systems

D.) fourth generation firewall systems

Answer: C
398. Which of the following statements pertaining to packet filtering is incorrect?

A.) It is based on ACLs

B.) It is not application dependant

C.) It operates at the network layer

D.) It keeps track of the state of a connection

Answer: D
399. A screening router can perform packet filtering based upon what data?

A. Translated source destination addresses.

B. Inverse address resolution.

C. Source and destination port number.

D. Source and destination addresses and application data.

Answer: C
400. Why are hardware security features preferred over software security features?

A. They lock in a particular implementation.

B. They have a lower meantime to failure.

C. Firmware has fever software bugs.

D. They permit higher performance.

Answer: D
401. Firewalls can be used to

A. Enforce security policy.

B. Protect data confidentiality.

C. Protect against protocol redirects.

D. Enforce Secure Network Interface addressing.

Answer: A
402. What is NOT an authentication method within IKE and IPsec:

A.) CHAP

B.) Pre-shared Key

C.) certificate based authentication

D.) Public Key authentication

Answer: A
403. In IPSec, if the communication mode is gateway-gateway or host-gateway:

A.) Only tunnel mode can be used

B.) Only transport mode can be used

C.) Encapsulating Security Payload (ESP) authentication must be used

D.) Both tunnel and transport mode can be used

Answer: D
404. Which of the following Internet Protocol (IP) security headers are defined by the
Security Architecture for IP (IPSEC)?

A. The IPv4 and IPv5 Authentication Headers

B. The Authentication Header Encapsulating Security Payload

C. The Authentication Header and Digital Signature Tag

D. The Authentication Header and Message Authentication Code

Answer: B
405. Which of the following statements is not true of IPSec Transport mode?

A.) It is required for gateways providing access to internal systems

B.) Set-up when end-point is host or communications terminates at end-points

C.) If used in gateway-to-host communication, gateway must act as host

D.)Detective or Administrative Pairing

Answer: A
406. What is the purpose of the Encapsulation Security Payload (ESP) in the Internet
Protocol (IP) Security Architecture for Internet Protocol Security?

A. To provide non-repudiation and confidentiality for IP transmission.

B. To provide integrity and confidentiality for IP transmissions.

C. To provide integrity and authentication for IP transmissions.

D. To provide key management and key distribution for IP transmissions.

Answer: B
407. How does the SOCKS protocol secure Internet Protocol (IP) connections?

A. By negotiating encryption keys during the connection setup.

B. By attaching Authentication Headers (AH) to each packet.

C. By distributing encryption keys to SOCKS enabled applications.

D. By acting as a connection proxy.

Answer: D
408. Which of the following is NOT true of SSL?

A.) By convention is uses 's-http://' instead of 'http://'.

B.) It stands for Secure Sockets Layer

C.) It was developed by Netscape

D.) IT is used for transmitting information securely over the internet

Answer: A
409. In which way does a Secure Socket Layer (SSL) server prevent a "man-in-the-
middle" attack?

A. It uses signed certificates to authenticate the server's public key.

B. A 128 bit value is used during the handshake protocol that is unique to the
connection.

C. It uses only 40 bits of secret key within a 128 bit key length.

D. Every message sent by the SSL includes a sequence number within the message
contents.

Answer: A
410. Secure Shell (SSH) and Secure Sockets Layer (SSL) are very heavily used for
protecting

A.) Internet transactions

B.) Ethernet transactions

C.) Telnet transactions

D.) Electronic Payment transactions

Answer: A
411. Which one of the following CANNOT be prevented by the Secure Shell (SSH)
program?

A. Internet Protocol (IP) spoofing.

B. Data manipulation during transmissions.

C. Network based birthday attack.

D. Compromise of the source / destination host.

Answer: D
412. Another name for a VPN is a:

A.) tunnel

B.) one-time password

C.) pipeline

D.) bypass

Answer: A

Answer A is the best answer

413. Which one of the following attacks is MOST effective against an Internet
Protocol Security (IPSEC) based virtual private network (VPN)?

A. Brute force

B. Man-in-the-middle

C. Traffic analysis

D. Replay

Answer: B
414. Which of the following is NOT an essential component of a VPN?

A.) VPN Server

B.) NAT Server

C.) authentication

D.) encryption

Answer: B
415. Virtual Private Network software typically encrypts all of the following
EXCEPT

A. File transfer protocol

B. Data link messaging

C. HTTP protocol

D. Session information

Answer: B
416. Which of the following is less likely to be used in creating a Virtual Private
Network?

A.) L2TP

B.) PPTP

C.) IPSec

D.) L2F

Answer: D
417. Which one of the following instigates a SYN flood attack?

A. Generating excessive broadcast packets.

B. Creating a high number of half-open connections.

C. Inserting repetitive Internet Relay Chat (IRC) messages.

D. A large number of Internet Control Message Protocol (ICMP) traces.

Answer: B
418. Which one of the following is defined as the process of distributing incorrect
Internet Protocol (IP) addresses/names with the intent of diverting traffic?

A. Network aliasing

B. Domain Name Server (DNS) poisoning

C. Reverse Address Resolution Protocol (ARP)

D. Port scanning

Answer: B
419. Which of the following is true related to network sniffing?

A.) Sniffers allow an attacker to monitor data passing across a network.

B.) Sniffers alter the source address of a computer to disguise and exploit weak
authentication methods.

C.) Sniffers take over network connections

D.) Sniffers send IP fragments to a system that overlap with each other.

Answer: A
420. Which one of the following threats does NOT rely on packet size or large
volumes of data?

A. SYN flood

B. Spam

C. Ping of death

D. Macro virus

Answer: D
421. A TCP SYN Attack:

A.) requires a synchronized effort by multiple attackers

B.) takes advantage of the way a TCP session is established

C.) may result in elevation of privileges.

D.) is not something system users would notice

Answer: B
422. What attack is typically used for identifying the topology of the target network?

A. Spoofing

B. Brute force

C. Teardrop

D. Scanning

Answer: D
423. Which one of the following is the reason for why hyperlink spoofing attacks are
usually successful?

A. Most users requesting DNS name service do not follow hyperlinks.

B. The attack performs user authentication with audit logs.

C. The attack relies on modifications to server software.

D. Most users do not make a request to connect to a DNS names, they follow
hyperlinks.

Answer: D
424. Which of the following identifies the first phase of a Distributed Denial of
Service attack?

A. Establishing communications between the handler and agent.

B. Disrupting the normal traffic to the host.

C. Disabling the router so it cannot filter traffic.

D. Compromising as many machines as possible.

Answer: D
425. This type of vulnerability enables the intruder to re-route data traffic from a
network device to a personal machine? This diversion enables the intruder to capture
data traffic to and from the devices for analysis or modification, or to steal the
password file from the server and gain access to user accounts.

A.) Network Address Translation

B.) Network Address Hijacking

C.) Network Address Supernetting

D.) Network Address Sniffing

Answer: B
426. Which one of the following is an example of hyperlink spoofing?

A. Compromising a web server Domain Name Service reference.

B. Connecting the user to a different web server.

C. Executing Hypertext Transport Protocol Secure GET commands.

D. Starting the user's browser on a secured page.

Answer: B
427. Why packet filtering routers NOT effective against mail bomb attacks?

A. The bomb code is obscured by the message encoding algorithm.

B. Mail bombs are polymorphic and present no consistent signature to filter on.

C. Filters do not examine the data portion of a packet.

D. The bomb code is hidden in the header and appears as a normal routing
information.

Answer: C
428. Which one of the following correctly identifies the components of a Distributed
Denial of Service Attack?

A. Node, server, hacker, destination

B. Client, handler, agent, target

C. Source, destination, client, server

D. Attacker, proxy, handler, agent

Answer: B
429. Which one of the following is a passive network attack?

A. Spoofing

B. Traffic Sniffing

C. Playback

D. Masquerading

Answer: B
430. What is called an attach where the attacker spoofs the source IP address in an
ICMP ECHO broadcast packet so it seems to have originated at the victim's system, in
order to flood it with REPLY packets?

A.) SYN flood attack

B.) Smurf attack

C.) Ping of Dead Attack

D.) Denial of Service (DOS) Attack

Answer: B
431. Which type of attack involves the alteration of a packet at the IP level to
convince a system that it is communicating with a known entity in order to gain
access to a system?

A.) TCP sequence number attack

B.) IP spoofing attack

C.) Piggybacking attack

D.) Teardrop attack

Answer: B
432. What attack is primarily based on the fragmentation implementation of IP and
large ICMP packet size?

A. Exhaustive

B. Brute force

C. Ping of Death

D. Spoofing

Answer: C
433. Land attack attacks a target by:

A. Producing large volume of ICMP echos.

B. Producing fragmented IP packets.

C. Attacking an established TCP connection.

D. None of the choices.

Answer: C
434. What attack is primarily based on the fragmentation implementation of IP?

A. Teardrop

B. Exhaustive

C. Spoofing

D. Brute force

Answer: A
435. What attack floods networks with broadcast traffic so that the network is
congested?

A. Spoofing

B. Teardrop

C. Brute force

D. SMURF

Answer: D
436. What attack involves repeatedly sending identical e-message to a particular
address?

A. SMURF

B. Brute force

C. Teardrop

D. Spamming

Answer: D
437. A stack overflow attack that "crashes" a Transmission Control Protocol/Internet
Protocol (TCP/IP) service daemon can result in a serious security breach because the

A. Process does not implement proper object reuse.

B. Process is executed by a privileged entity.

C. Network interface becomes promiscuous.

D. Daemon can be replaced by a trojan horse.

Answer: B
438. The intrusion detection system at your site has detected Internet Protocol (IP)
packets where the IP source address is the same as the destination address. This
situation indicates

A. Misdirected traffic jammed to the internal network.

B. A denial of service attack.

C. An error in the internal address matrix.

D. A hyper overflow in the IP stack.

Answer: B
439. What type of attacks occurs when a rogue application has been planted on an
unsuspecting user's workstation?

A. Physical attacks

B. Logical attacks

C. Trojan Horse attacks

D. Social Engineering attacks

Answer: C
440. Which of the following threats is not addressed by digital signature and token
technologies?

A.) Spoofing

B.) replay attacks

C.) password compromise

D.) denial-of-service

Answer: D
441. Which one of the following is concerned with masking the frequency, length,
and origin-destination patterns of the communications between protocol entities?

A. Masking analysis

B. Protocol analysis

C. Traffic analysis

D. Pattern analysis

Answer: C
442. Which of the following would NOT be considered a Denial of Service Attack?

A.) Zone Transfer

B.) Smurf

C.) Syn Flood

D.) TearDrop

Answer: A
443. Which step ensures the confidentiality of a facsimile transmission?

A. Pre-schedule the transmission of the information.

B. Locate the facsimile equipment in a private area.

C. Encrypt the transmission.

D. Phone ahead to the intended recipient.

Answer: C
444. Which one of the following could a company implement to help reduce PBX
fraud?

A. Call vectoring

B. Direct Inward System Access (DISA)

C. Teleconferencing bridges

D. Remote maintenance ports

Answer: B
445. Which of the following is a telecommunication device that translates data from
digital to analog form and back to digital?

A.) Multiplexer

B.) Modem

C.) Protocol converter

D.) Concentrator

Answer: B
446. The underlying reason for creating a disaster planning and recover strategy is to

A. Mitigate risks associated with disaster.

B. Enable a business to continue functioning without impact.

C. Protect the organization's people, place and processes.

D. Minimize financial profile.

Answer: A

Remarks: Answer B is impossible.

447. Which of the following is not a direct benefit of successful Disaster Recovery
Planning?

A.) Maintain Nance of Business Continuity

B.) Protection of Critical Data

C.) Increase in IS performance

D.) Minimized Impact of a disaster

Answer: C
448. Organizations should not view disaster recovery as which of the following?

A.) committed expense

B.) discretionary expense

C.) enforcement of legal statues

D.) compliance with regulations

Answer: B
449. Which of the following statements pertaining to disaster recovery is incorrect?

A.) A recovery team's primary task is to get the pre-defined critical business functions
at the alternate backup processing site.

B.) A salvage team's task is to ensure that the primary site returns to normal
processing conditions

C.) The disaster recovery plan should include how the company will return from the
alternate site to the primary site

D.) When returning to the primary site, the most critical applications should be
brought back first

Answer: D
450. Which of the following statements pertaining to dealing with the media after a
disaster occurred and disturbed the organization's activities is incorrect?

A.) The CEO should always be the spokesperson for the company during a disaster

B.) The disaster recovery plan must include how the media is to be handled during the
disaster

C.) The organization's spokesperson should report bad news before the press gets a
hold of it through another channel

D.) An emergency press conference site should be planned ahead

Answer: A
451. What is a disaster recovery plan for a company's computer system usually
focused on?

A.) Alternative procedures to process transactions

B.) The probability that a disaster will occur

C.) Strategic long-range planning

D.) Availability of compatible equipment at a hot site

Answer: A
452. What is the most critical piece to disaster recovery and continuity planning?

A.) Security Policy

B.) Management Support

C.) Availability of backup information processing facilities

D.) Staff training

Answer: B
453. Which of the following is the most important consideration in locating an
alternate computing facility during the development of a disaster recovery plan?

A.) it is unlikely to be affected by the same contingency

B.) it is close enough to become operation quickly

C.) is it close enough to serve it's users

D.) it is convenient to airports and hotels

Answer: A
454. Which of the following are PRIMARY elements that are required when
designing a Disaster Recovery Plan (DRP)?

A. Back-up procedures, off-site storage, and data recover.

B. Steering committee, emergency response team, and reconstruction team.

C. Impact assessment, recover strategy, and testing.

D. Insurance coverage, alternate site, and manual procedures.

Answer: C
455. Emergency actions are taken at the incipient stage of a disaster with the
objectives of preventing injuries or loss of life and of:

A.) determining the extent of property damage

B.) protecting evidence

C.) preventing looting and further damage

D.) mitigating the damage to avoid the need for recovery

Answer: D
456. Which of the following steps should be performed first in a business impact
analysis (BIA)?

A.) Identify all business units within the organization

B.) Evaluate the impact of the disruptive events

C.) Estimate the Recovery Time Objectives (RTO)

D.) Evaluate the criticality of business functions

Answer: A
457. What methodology is commonly used in Business Continuity Program?

A. Work Group Recovery

B. Business Impact Analysis

C. Qualitative Risk Analysis

D. Quantitative Risk Analysis

Answer: B
458. A Business Impact Analysis (BIA) does not:

A.) Recommend the appropriate recovery solution

B.) Determine critical and necessary business functions and their resource
dependencies

C.) Identify critical computer applications and the associated outage tolerance

D.) Estimate the financial and operation impact of a disruption

Answer: A
459. What assesses potential loss that could be caused by a disaster?

A.) The Business Assessment (BA)

B.) The Business Impact Analysis (BIA)

C.) The Risk Assessment (RA)

D.) The Business Continuity Plan (BCP)

Answer: B
460. Which of the following will a Business Impact Analysis (BIA) NOT identify?

A.) Areas that would suffer the greatest financial or operation loss in the event of a
disaster

B.) Systems critical to the survival of the enterprise

C.) The names of individuals to be contacted during a disaster

D.) The outage time that can be tolerated by the enterprise as a result of a disaster

Answer: C
461. System reliability s increased by:

A.) A lower MTBF and a lower MTTR

B.) A higher MTBF and a lower MTTR

C.) A lower MTBF and a higher MTTR

D.) A higher MTBF and a higher MTTR

Answer: B
462. When preparing a business continuity plan, who of the following is responsible
for identifying and prioritizing time-critical systems?

A.) Executive management staff

B.) Senior business unit management

C.) BCP committee

D.) Functional business units

Answer: B
463. Business Continuity Plan development depends most on:

A.) Directives of Senior Management

B.) Result of Business Impact Analysis (BIA)

C.) Scope and Plan Initiation

D.) Skills of BCP committee

Answer: B
464. Which primary element of BCP includes carrying out vulnerability analysis?

A.) Scope and Plan Initiation

B.) Business Impact Assessment

C.) Business Continuity Plan Development

D.) Plan Approval and Implementation

Answer: B
465. To mitigate the impact of a software vendor going out of business, a company
that uses vendor software should require which one of the following?

A. Detailed credit investigation prior to acquisition.

B. Source code held in escrow.

C. Standby contracts with other vendors.

D. Substantial penalties for breech of contract.'

Answer: B
466. Which one of the following processing alternatives involves a ready-to-use
computing facility with telecommunications equipment, but not computers?

A. Company-owned hot site

B. Commercial hot site

C. Cold site

D. Warm site

Answer: D
467. What is a hot-site facility?

A.) A site with pre-installed computers, raised flooring, air conditioning,

telecommunications, and networking equipment, and UPS

B.) A site is which space is reserved with pre-installed wiring and raised floors

C.) A site with raised flooring, air conditioning, telecommunications, and networking
equipment, and UPS

D.) A site with ready made work space with telecommunications equipment, LANs,
PCs, and terminals with work groups

Answer: A
468. Contracts and agreements are unenforceable in which of the following alternate
back facilities?

A.) hot site

B.) warm site

C.) cold site

D.) reciprocal agreement

Answer: D
469. Which of the following computer recovery sites is the least expensive and the
most difficulty to test?

A.) redundant site

B.) parallel site

C.) warm site

D.) cold site

Answer: D
470. Which of the following is an advantage of the use of hot sites as a backup
alternative?

A.) The costs associated with hot sites are low

B.) Hot sites can be made ready for operation within a short period of time

C.) Hot sites can be used for an extended amount of time

D.) Hot sites do not require that equipment and systems software be compatible with
the primary installation being backed up

Answer: B
471. What is not a benefit of Cold Sites?

A.) No resource contention with other organization

B.) Quick Recovery

C.) Geographical location that is not affected by the same disaster

D.) low cost

Answer: B
472. Which of the following alternative business recovery strategies would be LEAST
appropriate in a large database and on-line communications network environment
where the critical business continuity period is 7 days?

A.) Hot site

B.) Warm site

C.) Duplicate information processing facilities

D.) Reciprocal agreement

Answer: D
473. Which of the following statement pertaining to the maintenance of an IT
contingency plan is incorrect?

A.) The plan should be reviewed at least once a year for accuracy and completeness

B.) The Contingency Planning Coordinator should make sure that every employee
gets an up-to-date copy of the plan

C.) Strict version control should be maintained

D.) Copies of the plan should be provided to recovery personnel for storage at home
and office

Answer: B
474. Scheduled tests of application contingency plans should be based on the

A. Size and complexity of the application.

B. Number of changes to the application.

C. Criticality of the application.

D. Reliability of the application.

Answer: C
475. In the public sector, as opposed to the private sector, due care is usually
determined by

A. Minimum standard requirements.

B. Legislative requirements.

C. Insurance rates.

D. Potential for litigation.

Answer: B
476. Which of the following exceptions is less likely to make hearsay evidence
admissible in court?

A.) Records are collected during the regular conduct of business

B.) Records are collected by senior or executive management

C.) Records are collected at or near the time of occurrence of the act being
investigated

D.) Records are in the custody of the witness on a regular basis

Answer: B
477. Once evidence is seized, a law enforcement officer should emphasize which of
the following?

A.) chain of command

B.) chain of custody

C.) chain of control

D.) chain of communications

Answer: B
478. In order to preserver a proper chain of custody of evidence?
A.) Evidence has to be collected following predefined procedures in accordance with
all laws and legal regulations

B.) Law enforcement officials should be contacted for advice on how and when to
collect critical information

C.) Verifiable documentation indicating the sequence of individuals who have handled
a piece of evidence should be available.

D.) Log files containing information regarding an intrusion are retained for at least as
long as normal business records, and longer in the case of an ongoing investigation.

Answer: A
479. Why is the investigation of computer crime involving malicious damage
especially challenging?

A. Information stored in a computer is intangible evidence.

B. Evidence may be destroyed in an attempt to restore the system.

C. Isolating criminal activity in a detailed audit log is difficult.

D. Reports resulting from common user error often obscure the actual violation.

Answer: B
480. What category of law deals with regulatory standards that regulate performance
and conduct? Government agencies create these standards, which are usually applied
to companies and individuals within those companies.

A.) Standards law

B.) Conduct law

C.) Compliance law

D.) Administrative law

Answer: D
481. Something that is proprietary to that company and importance for its survival and
profitability is what type of intellectual property law?

A.) Trade Property

B.) Trade Asset

C.) Patent

D.) Trade Secret

Answer: D
482. Which category of law is also referenced as a Tort law?

A.) Civil law

B.) Criminal law

C.) Administrative law

D.) Public law

Answer: A
483. What is the primary goal of incident handling?

A.) Successfully retrieve all evidence that can be used to prosecute

B.) Improve the company's ability to be prepared for threats and disasters

C.) Improve the company's disaster recovery plan

D.) Contain and repair any damage caused by an event

Answer: D

Answer D is the best answer among others.

484. The ISC2 Code of Ethics does not include which of the following behaviors for a
CISSP:

A.) moral

B.) ethical

C.) legal

D.) control

Answer: D
485. A disk image backup is used for forensic investigation because it

A. Is based on secured hardware technology.

B. Creates a bit level copy of the entire disk.

C. Time stamps the files with the date and time of the copy operation.

D. Excludes areas that have never been used to store data.

Answer: B
486. Which is a characteristic of IDEA?

A. 56 bytes block

B. 64 bits block

C. 64 bytes block

D. All of the above

E. None of the above

Answer: B
487. A programmer creates a virus producing tool in order to test the performance of a
new virus diction product.

A. This is ethical because it was created to test and enhance the performance of a
virus protection tool

B. It's unethical because the virus creating tool may become available to the public.

C. All of the above

D. None of the above

Answer: B
488. In a discretionary mode, which of the following entities is authorized to grant
information access to other people?

A. Manager

B. Group leader

C. Security manager

D. User

Answer: D
489. Intrusion detection has which of the following sets of characteristics.

A. It is adaptive rather than preventive.

B. It is administrative rather than preventive.

C. It is disruptive rather than preventative.

D. It is detective rather than preventative.

Answer: D
490. Why does compiled code pose more risk than interpreted code?

A. Because malicious code can be embedded in the compiled code and can be
difficult to detect.

B. Because the browser can safely execute all interpreted applets.

C. Because compilers are not reliable.

D. It does not. Interpreted code poses more risk than compiled code.

Answer: A
491. If an operating system permits executable objects to be used simultaneously by
multiple users without a refresh of the objects, what security problem is most likely to
exist?

A. Disclosure of residual data.

B. Unauthorized obtaining of a privileged execution state.

C. Data leakage through covert channels.

D. Denial of service through a deadly embrace.

Answer: A
492. Which of the following is used in database information security to hide
information?

A. Inheritance

B. Polyinstantiation

C. Polymorphism

D. Delegation

Answer: B
493. What attack involves the perpetrator sending spoofed packet(s) with the SYN
flag set to the victim's machine on any open port that is listening?

A. Bonk attack

B. Land attack

C. Teardrop attack

D. Smurf attack

Answer: B

The Land attack involves the perpetrator sending spoofed packet(s) with the
SYN flag set to the victim's machine on any open port that is listening. If the packet(s)
contain the same destination and source IP address as the host, the victim's machine
could hang or reboot.
494. Ensuring that printed reports reach proper users and that receipts are signed
before releasing sensitive documents are examples of?

A. Deterrent controls

B. Output controls

C. Information flow controls

D. Asset controls

Answer: B
495. Making sure that the data is accessible when and where it is needed is which of
the following?

A. Confidentiality

B. Integrity

C. Acceptability

D. Availability

Answer: D
496. Which layer defines the X.25, V.35, X,21 and HSSI standard interfaces?

A. Transport layer

B. Network layer

C. Data link layer

D. Physical layer

Answer: D
497. Which of the following statements pertaining to VPN protocol standards is false?

A. L2TP is a combination of PPTP and L2F.

B. L2TP and PPTP were designed for single point-to-point client to server
communication.

C. L2TP operates at the network layer.

D. PPTP uses native PPP authentication and encryption services.

Answer: C

PPTP and L2TP are Layer 2 tunneling protocols; both encapsulate the payload in a
Point-to-Point Protocol (PPP) frame to be sent across an intermediate network.
498. The guarantee that the message sent is the message received, and that the
message was not intentionally or unintentionally altered is?

A. Integrity

B. Confidentiality

C. Availability

D. Identity

Answer: A
499. An offsite backup facility intended to operate an information processing facility,
having no computer or communications equipment, but having flooring, electrical
writing, air conditioning, etc. is better known as a?

A. Hot site

B. Duplicate processing facility

C. Cold site

D. Warm site

Answer: C
500. Why is public key cryptography recommended for use in the process of securing
facsimiles during transmission?

A. Keys are never transmitted over the network.

B. Data compression decreases key change frequency.

C. Key data is not recognizable from facsimile data.

D. The key is securely passed to the receiving machine.

Answer: D
501. Database views are not used to:

A. Implement referential integrity.

B. Implement least privilege.

C. To implement content-dependent access restrictions.

D. Implement need-to-know.

Answer: A
502. Which of the following statements pertaining to the Trusted Computer System
Evaluation Criteria (TCSEC) is incorrect?

A. With TCSEC, functionality and assurance are evaluated separately.

B. TCSEC provides a means to evaluate the trustworthiness of an information system.

C. The Orange book does not cover networks and communications.

D. Data base management systems are not covered by the TCSEC.

Answer: A
503. Which of the following is an ip address that is private? (i.e. reserved for internal
networks, and not a valid address to use on the Internet)?

A. 172.5.42.5

B. 172.76.42.5

C. 172.90.42.5

D. 172.16.42.5

Answer: D
504. How fast is private key cryptography compared to public key cryptography?

A. 10 to 100 times faster.

B. 100 to 1000 times faster.

C. 1000 to 10000 times faster.

D. 10000 to 20000 times faster.

Answer: C
505. In an organization, an Information Technology security function should:

A. Be a function within the information systems function of an organization.

B. Report directly to a specialized business unit such as legal, corporate security or

insurance.

C. Be lead by a Chief Security Officer and report directly to the CEO.

D. Be independent but report to the Information Systems function.

Answer: C
506. Packet Filtering Firewalls system is considered a?

A. First generation firewall.

B. Second generation firewall.

C. Third generation firewall.

D. Fourth generation firewall.

Answer: A
507. Which of the following can be used as a covert channel?

A. Storage and timing.

B. Storage and low bits.

C. Storage and permissions.

D. Storage and classification.

Answer: A
508. In order to ensure the privacy and integrity of the data, connections between
firewalls over public networks should use?

A. Screened subnets

B. Digital certificates

C. Encrypted Virtual Private Networks

D. Encryption

Answer: C
509. Which of the following is unlike the other three?

A. El Gamal

B. Teardrop

C. Buffer Overflow

D. Smurf

Answer: A
510. Immune to the effects of electromagnetic interference (EMI) and therefore has a
much longer effective usable length (up to two kilometers in some cases) is?

A. Coaxial cable

B. Twisted Pair cable

C. Axial cable

D. Fiber Optic cable

Answer: D
511. Which of the following is the most reliable, secure means of removing data from
magnetic storage media such as a magnetic tape, or cassette?

A. Degaussing

B. Parity Bit Manipulation

C. Certification

D. Buffer overflow

Answer: A
512. Which integrity model defines a constrained data item, an integrity verification
procedure and a transformation procedure?

A. The Take-Grant model

B. The Biba integrity model

C. The Clark Wilson integrity model

D. The Bell-LaPadula integrity model

Answer: C
513. What are suitable protocols for securing VPN connections?

A. S/MIME and SSH

B. TLS and SSL

C. IPsec and L2TP

D. PKCS# and X.509

Answer: C
514. RAID Level 1 mirrors the data from one disk to set of disks using which of the
following techniques?

A. Copying the data onto another disk or set of disks.

B. Moving the data onto another disk or set of disks.

C. Establishing dual connectivity to another disk or set of disks.

D. Establishing dual addressing to another disk or set of disks.

Answer: A
515. A cluster looks like a?

A. Single server from the user's point of view.

B. Dual server from the user's point of view.

C. Tripe server from the user's point of view.

D. Quadra server from the user's point of view.

Answer: A
516. Which of the following is responsible for the most security issues?

A. Outside espionage

B. Hackers

C. Personnel

D. Equipment failure

Answer: C
517. Which of the following best describes the purpose of debugging programs?

A. To generate random data that can be used to test programs before implementing
them

B. To ensure that program coding flaws are detected and corrected.

C. To protect, during the programming phase, valid changes from being overwritten
by other changes.

D. To compare source code versions before transferring to the test environment.

Answer: B
518. What is the process that RAID Level 0 uses as it creates one large disk by using
several disks?

A. Striping

B. Mirroring

C. Integrating

D. Clustering

Answer: A
519. Which of the following is used to create and delete views and relations within
tables?

A. SQL Data Definition Language

B. SQL Data Manipulation Language

C. SQL Data Relational Language

D. SQL Data Identification Language

Answer: A

SQL supports the data definition language (DDL) for creating, altering, and
deleting tables and other database objects.
520. The Diffie-Hellman algorithm is used for?

A. Encryption

B. Digital signature

C. Key exchange

D. Non-repudiation

Answer: C
521. Which of the following is not considered firewall technology?

A. Screened subnet

B. Screened host

C. Duel gateway host

D. Dual homed host

Answer: C
522. Why is fiber the most secure means of transmission?

A. High speed multiplexing

B. Interception of traffic is more difficult because it is optically based

C. Higher data rates make it more secure

D. Multiplexing prevents traffic analysis

Answer: B
523. What is a commercial application of steganography that is used to identify
pictures or verify their authenticity?

A. A MAC

B. A digital checksum

C. A MD5 hash

D. A digital signature

E. A watermark

Answer: E
524. Which of the following is a connection-orientated protocol?

A. IP

B. UDP

C. TCP

D. ICMP

Answer: C
525. Which of the following can reproduce itself without the help of system
applications or resources?

A. Trojan

B. Logic bomb

C. Virus

D. Worm

Answer: D
526. _______ are the step-by-step instructions used to satisfy control requirements.

A. Policy

B. Procedure

C. Guideline

D. Standard

Answer: B
527. ____________ is the first step of access control.

A. Identification

B. Authorization

C. Validation

D. Interrogation

Answer: A
528. Which of the following is an example of a symmetric key algorithm?(Choose all
that apply)

A. Rijndael

B. RSA

C. Diffie-Hellman

D. Knapsack

E. IDEA

Answer: A,E.