Security+Guide to Network fundamentals

Anwers for Review questions Security+guide to network security fundamentals Third edition; Mark ciampa

2009-11-16T04:21:00.000-08:00

Chapter 1
Chapter 2
Chapter 3
Chapter 4
Chapter 5
Chapter 6
Chapter 7
Chapter 8
Chapter 9
Chapter 10

Chapter 11

View all chapter answers Clean in one page (Clear format)

Chapter 11

2009-11-16T04:13:00.001-08:00

Review Questions

1. The areas of a file in which steganography can hide data including all of the following except ______.

A. in data that is used to describe the content or structure of the actual data

B. in the file header fields that describe the file

C. in areas that contain the content data itself

D. in the directory structure of the file system

2. Data that is to be encrypted by inputting into an algorithm is called ______.

A. clear text

B. open text

C. ciphertext

D. plaintext

3. Each of the following is a basic security protection over information that cryptography can provide except ______.

A. confidentiality

B. stop loss

C. integrity

D. authenticity

4. Proving that a user sent an e-mail message is known as ______.

A. non-repudiation

B. reverse confidentiality

C. integrity

D. availability

5. A(n) _____ is never intended to be decrypted but is only used for comparison purposes.

A. plaintext

B. algorithm

C. key

D. digest

6. Each of the following is an example of how hashing is used except ______.

A. bank automatic teller machine (ATM)

B. verifying a user password entered on a Linux system

C. determining the integrity of a message

D. encrypting and decrypting e-mail attachments

7. Which of the following is NOT a characteristic of a secure hash algorithm?

A. The results of a hash function should not be reversed.

B. The hash should always be the same fixed size.

C. A message cannot be produced from a predefined hash.

D. Collisions should be rare.

8. The data added to a section of text when using the Message Digest (MD) algorithm is called ______.

A. filler

B. extender

C. padding

D. byte extensions

9. Which of the following is a protection provided by hashing?

A. confidentiality

B. integrity

C. availability

D. authenticity

10. Symmetric cryptographic algorithms are also called ______.

A. cipherkey cryptography

B. public/private key cryptography

C. public key cryptography

D. private key cryptography

11. Monoalphabetic substitution ciphers and homoalphabetic substitution ciphers are examples of ______.

A. symmetric stream ciphers

B. generic block ciphers

C. asymmetric block ciphers

D. hash ciphers

12. Which of the following is the strongest symmetric cryptographic algorithm?

A. Data Encryption Standard

B. Triple Data Encryption Standard

C. Advanced Encryption Standard

D. Rivest Cipher (RC) 1

13. When Bob wants to send a secure message to Alice using an asymmetric cryptographic algorithm, which key does he use to encrypt the message?

A. Bob’s public key

B. Alice's public key

C. Bob’s private key

D. Alice’s private key

14. A digital signature can provide each of the following benefits except ______.

A. Verify the receiver

B. Verify the sender

C. Enforce non-repudiation

D. Prove the integrity of the message

15. Which of the following asymmetric cryptographic algorithms is the most secure?

A. RSA

B. MD-17

C. SHA-2

D. ERFGA

16. _____ uses the Windows NTFS file system to automatically encrypt all files.

A. Encrypting File System (EFS)

B. GNU PGP

C. IDEA

D. MD-1

17. The Microsoft Windows BitLocker whole disk encryption cryptography technology can protect each of the following except ______.

A. Windows system files

B. User files

C. Temporary files

D. Domain name system files

18. The Trusted Platform Module (TPM) _____.

A. is only available on Windows computers running BitLocker

B. includes a pseudorandom number generator (PRNG)

C. provides cryptographic services in hardware instead of software

D. allows the user to boot a corrupted disk and repair it

19. Most security experts recommend that _____ be replaced with a more secure algorithm.

A. DES

B. RSA

C. AES-256

D. MD-17

20. The Microsoft Windows LAN Manager hash ______.

A. is part of BitLocker

B. is required to be present when using TPM

C. is weaker than NTLMv2

D. is the same as MD-5

E. Behavior-based monitoring

Chapter 10

2009-11-16T04:12:00.000-08:00

Review Questions

1. Reviewing a subject’s privileges over an object is known as _____.

A. privilege auditing

B. threat auditing

C. risk appraisal

D. exploitation evaluation

2. _____ is the process of assigning and revoking privileges to objects and covers the procedures of managing object authorizations.

A. Privilege management

B. Risk assessment

C. Threat mitigation

D. Risk management

3. One of the disadvantages of centralized privilege management is that ______.

A. attackers can exploit it easier

B. most hardware and software do not support it

C. it places more of a burden on the network infrastructure

D. users may have to wait longer for requested changes to security privileges

4. The individual elements or settings within group policies are known as ______.

A. Group Policy Objects (GPOs)

B. Policy Templates

C. AD Infrastructures (ADI)

D. Group Tiers

5. _____ is a set of strategies for administering, maintaining, and managing computer storage systems in order to retain data.

A. Supervised data storage

B. Strategic AD retention

C. Storage and retention administration

D. Information lifecycle management (ILM)

6. _____ assigns a level of business importance, availability, sensitivity, security and regulation requirements to data.

A. Risk assessment

B. Threat mitigation

C. Data classification

D. Information assignment

7. When grouping data into categories, which of the following is NOT a question that is asked of users regarding their use of data?

A. How long must the data be kept?

B. How often will it be accessed?

C. How quickly should it be retrieved?

D. How was it first created?

8. _____ typically involves an examination of which subjects are accessing specific objects and how frequently.

A. Usage auditing

B. User reporting

C. Permission auditing

D. Resource reporting

9. When permissions are assigned to a folder, any current subfolders and files within that folder ________.

A. inherit the same permissions

B. can be deleted only by the administrator

C. are available to the currently logged-in user

D. cannot be accessed

10. GPOs that are inherited from parent containers are processed first followed by _____.

A. the order that policies were linked to a container object

B. the date that the policy was enacted

C. policies that are only on the AD

D. any policy that has been designated “VITAL”

11. Each of the following has contributed to an increase in the number of logs generated except ______.

A. faster network access

B. larger number of systems

C. escalating number of attacks

D. most hardware and software can create logs

12. Each of the following is an example of a security application log except ______,

A. antivirus software

B. Domain Name System (DNS) servers

C. remote access software

D. automated patch update service

13. If a firewall log reveals a high number of probes to ports that have no application services running on them, this could indicate ______.

A. attackers are trying to determine if the ports and corresponding applications are already in use

B. an attack from the internal network

C. an IP Map Protocol (IPMP) attack

D. suspicious outbound traffic

14. A(n) _____ is an occurrence within a software system that is communicated to users or other programs outside the operating system.

A. session

B. task

C. event

D. supplicant

15. Client request and server responses are found in which type of logs?

A. System event logs

B. Risk security logs

C. User application logs

D. Security alert logs

16. Each of the following is an advantage to using logs except ______.

A. Logs can help to identify security incidents

B. Logs can be useful for performing auditing analysis

C. Logs can be used to provide documentation that the organization is complying with laws

D. Logs can be useful for identifying user passwords that may have been lost

17. Each of the following is a challenge to log management except ______.

A. Single standard for log formats

B. Inconsistent timestamps

C. Variety of recorded information

D. Large number of log sources

18. _____ refers to a methodology for making changes and keeping track of those changes, often manually.

A. Change management

B. Resource logging

C. Assessment auditing

D. Vulnerability scanning

19. A group that oversees changes is known as a(n) _______.

A. change management team (CMT)

B. review log team (RLT)

C. asset track organization (ATO)

D. log panel (LP)

20. Each of the following is a monitoring mechanism except ______.

A. Anomaly-based monitoring

B. Signature-based monitoring

C. Risk-based monitoring

D. Behavior-based monitoring

Chapter 9

2009-11-16T04:11:00.000-08:00

Review Questions

1. In information security a(n) _____ is the likelihood that a threat agent will exploit a vulnerability.

A. attack

B. threat

C. risk

D. exploitation

2. _____ is a systematic and structured approach to managing the potential for loss that is related to a threat.

A. Asset management

B. Risk assessment (RA)

C. Threat mitigation

D. Risk management

3. Each of the following is a step in risk management except ______.

A. vulnerability appraisal

B. threat identification

C. risk mitigation

D. attack assessment

4. Which of the following is NOT an asset classification?

A. data

B. software

C. physical assets

D. logical assets

5. A threat agent _____.

A. is limited to attacks using viruses and worms

B. does not include natural disasters

C. is something that cannot be determined in advance

D. is any person or thing with the power to carry out a threat against an asset

6. _____ constructs scenarios of the types of threats that assets can face in order to learn who the attackers are, why they attack, and what types of attacks may occur

A. Risk assessment

B. Attack stems

C. Vulnerability prototyping

D. Threat modeling

7. _____ is a current snapshot of the security of an organization.

A. Risk evaluation

B. Threat mitigation

C. Asset liability

D. Vulnerability appraisal

8. The _____ is the proportion of an asset’s value that is likely to be destroyed by a particular risk.

A. Annualized Rate of Occurrence (ARO)

B. Annualized Loss Expectancy (ALE)

C. Single Loss Expectancy (SLE)

D. Exposure Factor (EF)

9. Which of the following is NOT an option for dealing with risk?

A. diminish the risk

B. eliminate the risk

C. transfer the risk

D. accept the risk

10. TCP/IP port numbers ________.

A. are optional

B. can be used in place of IP numbers in some circumstances

C. identify the process that receives the transmission

D. range from 1024 to 65525

11. Each of the following is a state of a port that can be returned by a port scanner except _____.

A. Busy

B. Open

C. Closed

D. Blocked

12. Each of the following is true regarding TCP SYN port scanning except ______.

A. Instead of using the operating system's network functions, the port scanner generates IP packets itself and monitors for responses.

B. The scanner host closes the connection before the handshake is completed.

C. It uses FIN messages that can pass through firewalls and avoid detection.

D. This scan type is also known as "half-open scanning" because it never actually opens a full TCP connection.

13. Network mappers utilize the TCP/IP protocol _____.

A. Data Access Protocol (DAP)

B. Message Response Protocol (MRP)

C. IP Map Protocol (IPMP)

D. Internet Control Message Protocol (ICMP)

14. A protocol analyzer places the computer’s network interface card (NIC) adapter into _____ mode.

A. authenticator

B. promiscuous

C. stealth

D. supplicant

15. Each of the following is a function of a vulnerability scanner except ______.

A. Detect which ports are served and which ports are browsed for each individual system

B. Maintain a log of all interactive network sessions

C. Detect when an application is compromised or subverted

D. Alert users when a new patch cannot be found

16. Which of the following is true of the Open Vulnerability and Assessment Language (OVAL)?

A. It is anticipated to be available by 2012.

B. It contains six components.

C. It is a product of IBM.

D. It attempts to standardize vulnerability assessments.

17. A UNIX and Linux defense that does not store password hashes in a world-readable file is known as a _________.

A. shadow password

B. passwd restriction

C. master file relocation

D. locked psswrd file

18. _____ is a method of evaluating the security of a computer system or network by simulating a malicious attack.

A. Probing

B. Hacker simulation

C. Vulnerability assessment

D. Penetration testing

19. Protocol analyzers can _______.

A. evaluate patches after they have been applied

B. only be used by licensed security personnel

C. view all encrypted transmissions

D. fully decode application-layer network protocols

20. Network mappers _______.

A. perform the same function as protocol analyzers

B. are identical to port mappers

C. are only used by attackers

D. can send a request packet to each system within a range of IP addresses

Chapter 8

2009-11-16T04:10:00.000-08:00

false false false EN-US X-NONE X-NONE

Review Questions

1. Determining what a user did on a system is called _____.

A. identification

B. authentication

C. authorization

D. accounting

2. Which of the following is NOT an authentication method?

A. what a user knows

B. what a user has

C. what a user discovers

D. what a user is

3. One-time passwords that utilize a token with an algorithm and synchronized time setting is known as a(n) __________.

A. time-signature OTP

B. challenge-based OTP

C. time-synchronized OTP

D. token OTP

4. Which of the following is a difference between a time-synchronized OTP and a challenge-based OTP?

A. Only time-synchronized OTPs use tokens.

B. The user must enter the challenge into the token with a challenge-based OTP.

C. Challenge-based OTPs use authentication servers while time-synchronized OTPs do not.

D. Time-synchronized OTPs cannot be used with Web accounts while challenge-based OTPs can.

5. Keystroke dynamics is an example of what type of biometrics?

A. behavioral biometrics

B. cognitive biometrics

C. adaptive biometrics

D. resource biometrics

6. Creating a pattern of when and from where a user accesses a remote Web account is an example of ________.

A. computer footprinting

B. Time-Location Resource Monitoring (TLRM)

C. cognitive biometrics

D. keystroke dynamics

7. _____ is a decentralized open source FIM that does not require specific software to be installed on the desktop.

A. Windows CardSpace

B. OpenID

C. Windows Live ID

D. .NET Login

8. A RADIUS authentication server requires that the _____ must be authenticated first.

A. supplicant

B. authenticator

C. authentication server

D. user

9. Each of the following make up the AAA elements in network security except _______.

A. determining user need (analyzing)

B. controlling access to network resources (authentication)

C. enforcing security policies (authorization)

D. auditing usage (accounting)

10. Each of the following human characteristics can be used for biometric identification except _______.

A. weight

B. fingerprint

C. retina

D. face

11. _____ biometrics is related to the perception, thought processes, and understanding of the user.

A. Behavioral

B. Standard

C. Cognitive

D. Intelligence

12. Using one authentication to access multiple accounts or applications is known as _______.

A. credentialization

B. identification authentication

C. federal login

D. single sign-on

13. With the development of IEEE 802.1x port security, the authentication server _____ has seen even greater usage.

A. DAP

B. RADIUS

C. AAA

D. RDAP

14. A(n) _____ makes a request to join the network.

A. authenticator

B. Resource Allocation Entity (RAE)

C. applicant

D. supplicant

15. _____ is an authentication protocol available as a free download and runs on Microsoft Windows Vista, Windows Server 2008, Apple Mac OS X, and Linux.

A. IEEE 802.1x

B. RADIUS

C. Kerberos

D. LDAP

16. The version of the X.500 standard that runs on a personal computer over TCP/IP is_____.

A. DAP

B. LDAP

C. IEEE X.501

D. Lite RDAP

17. The management protocol of IEEE 802.1x that governs the interaction between the system, authenticator, and RADIUS server is known as _____.

A. RADIUS Server Protocol

B. Authentication Protocol

C. Transmission Control Protocol (TCP)

D. Extensible Authentication Protocol (EAP)

18. Which of the following protocols is the strongest?

A. EAP with Transport Layer Security (EAP-TLS)

B. Password Authentication Protocol (PAP)

C. Challenge-Handshake Authentication Protocol (CHAP)

D. Microsoft Challenge-Handshake Authentication Protocol (MS-CHAP)

19. A user-to-LAN virtual private network connection used by remote users is called a(n) _____.

A. site-to-site VPN

B. remote –access VPN

C. endpoint VPN

D. concentration VPN

20. Endpoints that provide _____ capability require that a separate VPN client application be installed on each device that connects to a VPN server.

A. built-in VPN

B. transparent endpoint VPN

C. pass-through VPN

D. concentration VPN

Chapter 7

2009-11-16T04:07:00.000-08:00

Review Questions

1. A user entering her username would correspond to the _____ action in access control.

A. identification

B. authentication

C. authorization

D. access

2. Access control can be accomplished by each of the following except ______.

A. resource management

B. hardware

C. software

D. policy

3. A process functioning on behalf of the user that attempts to access a file is known as a(n) _______.

A. object

B. subject

C. resource

D. operation check

4. The individual who periodically reviews security settings and maintains records of access by users is called the _____.

A. owner

B. custodian

C. manager

D. supervisor

5. In the _____ model, the end user cannot change any security settings.

A. Discretionary Access Control

B. Mandatory Access Control

C. Security Access Control

D. Restricted Access Control

6. Rule Based Access Control _____.

A. dynamically assigns roles to subjects based on rules

B. is considered a real-world approach by linking a user’s job function with security

C. requires that a custodian set all rules

D. is considered obsolete today

7. Separation of duties requires that _____.

A. end users cannot set security for themselves

B. managers must monitor owners for security purposes

C. processes should be divided between two or more individuals

D. jobs be rotated among different individuals

8. _____ in access control means that if a condition is not explicitly met then it is to be rejected.

A. Implicit deny

B. Explicit rejection

C. Denial of duties

D. Prevention control

9. A(n) _____ is a set of permissions that is attached to an object.

A. Subject Access Entity (SAE)

B. object modifier

C. access control list (ACL)

D. security entry designator

10. _____ is a Microsoft Windows feature that provides centralized management and configuration of computers and remote users who are using Active Directory.

A. Windows Register Settings

B. Resource Allocation Entities

C. AD Management Services (ADMS)

D. Group Policy

11. Which of the following is NOT a characteristic of a brute force attack?

A. They are faster than dictionary attacks.

B. They are generally not feasible.

C. They can take a long time to be successful.

D. Each attempt must be entered into the login program to determine if it is correct.

12. _____ create a large pre-generated data set of hashes from nearly every possible password combination.

A. LM hashes

B. NTLM databases

C. Dictionary tables

D. Rainbow tables

13. Which of the following is NOT a password policy defense against an attacker stealing a Windows password file?

A. Password-protect the ROM BIOS.

B. Physically lock the computer case so that it cannot be opened.

C. Disable all necessary accounts.

D. Ensure that all servers and computers are regularly patched.

14. The Domain password policy _____ determines the number of unique new passwords a user must use before an old password can be reused.

A. Maximum password time

B. Minimum password expiration

C. Set password reuse

D. Enforce password history

15. A(n) _____ extends a solid metal bar into the door frame for extra security.

A. preset lock

B. key-in-knob lock

C. tab lock

D. deadbolt lock

16. A(n) _____ uses buttons that must be pushed in the proper sequence to open the door.

A. keyboard lock

B. user bolt lock (UBL)

C. pad lock

D. cipher lock

17. An ID badge fitted with _____ makes it unnecessary to swipe or scan the badge for entry.

A. radio frequency (RFID) tags

B. electromagnetic sentry buttons

C. cipher scans

D. passive cores

18. Using video cameras to transmit a signal to a specific and limited set of receivers is called _____.

A. security monitoring transmission (SMT)

B. vector security (VS)

C. closed circuit television (CCTV)

D. restricted access television

19. The least restrictive access control model is _____.

A. Mandatory Access Control (MAC)

B. Discretionary Access Control (DAC)

C. Role Based Access Control (RBAC)

D. Rule Based Access Control (RBAC)

20. The principle known as _____ in access control means that each user should only be given the minimal amount of privileges necessary for that person to perform their job function.

A. least privilege

B. deny all

C. Enterprise Security

D. Mandatory Limitations