IAS101 Information Assurance and Security Mock Midterm Review

Flashcard practice set based on the IAS101 Information Assurance and Security 100-Item Mock Midterm Exam transcript.

What are laws defined as in the context of Information Security?

Rules that mandate or prohibit certain behavior, drawn from ethics, which define socially acceptable behaviors.

In information security, what is defined as a threat?

A category of persons, objects, or other entities that presents a danger to an organization's asset.

What is an attack?

An act that takes advantage of a vulnerability or weakness to compromise a controlled system.

What is Risk Management?

The process of identifying risk, as represented by vulnerabilities, to an organization's information assets and infrastructure, and taking steps to reduce this risk to an acceptable level.

Does technological obsolescence constitute a threat to information security?

True.

Which component of an information system poses a greater risk because employees may accidentally or intentionally damage or lose information?

People.

What is Social Engineering?

A type of attack that uses social skills to convince people to reveal access credentials or other valuable information to the attacker.

What is Spoofing?

An attack used to gain unauthorized access to computers, wherein the attacker sends messages with a source IP address that has been forged to indicate that the messages are coming from a trusted host.

What are Policies?

Guidelines that describe acceptable and unacceptable employee behaviors in the workplace.

Which law protects Intellectual Property assets in the U.S., such as published works, including electronic formats?

U.S. Copyright Law.

Which law protects the confidentiality and security of health care data by establishing and enforcing standards?

Health Insurance Portability and Accountability Act of 1996 (HIPAA).

What criteria are required for a policy to become enforceable?

Dissemination, Review, Comprehension, Compliance, and Uniform enforcement (Purpose and Private are exceptions).

What threat category refers to unauthorized access and/or data collection?

Espionage or Trespass.

What threat category refers to accidents or employee mistakes?

Human error or failure.

What is Cost Avoidance in risk management?

The process of preventing the financial impact of an incident by implementing a control.

What is Benefit in the context of risk control?

The value that an organization realizes by using controls to prevent losses associated with specific vulnerabilities.

Is Cost Benefit Analysis considered a qualitative risk control practice?

False (it is a quantitative analysis).

What is Benchmarking?

An alternative method to economic feasibility analysis that seeks out and studies the practices used in other organizations that produce the results desired in an organization.

What is the Transfer control strategy?

A strategy that attempts to shift risk to other assets, their processes, or other organizations (e.g., outsourcing or purchasing insurance).

Which Linux terminal command displays the contents of notes.txt?

cat notes.txt

Which Linux command creates a new user named student1?

useradd student1

Which Linux command creates a group named developers?

groupadd developers

Which Linux command changes the password for existing user maria?

passwd maria

Which command is commonly used to add an existing user (maria) to a supplementary group (developers)?

usermod -aG developers maria

Which Linux command changes file permissions?

chmod

What permissions are specified by the file string -rwxr-xr--?

The owner can read, write, and execute; the group can read and execute; others can only read.

What permissions are represented by the numeric mode 640?

Owner rw-, group r--, others ---.

What permissions will the group have after executing chmod 750 project.sh?

Read and execute.

What permissions result from running chmod 700 private.txt?

The owner has full permissions, while the group and others have no permissions.

Which three principles form the CIA Triad?

Confidentiality, Integrity, and Availability.

Which CIA principle protects information from unauthorized disclosure?

Confidentiality.

Which CIA principle ensures that information remains whole, complete, and uncorrupted?

Integrity.

Which CIA principle ensures that authorized users can access information when needed?

Availability.

What characteristic means information is genuine or original rather than fabricated?

Authenticity.

What characteristic means information is free from mistakes and has the value expected by its user?

Accuracy.

What characteristic refers to information having value for a particular purpose?

Utility.

What characteristic refers to ownership or control of information?

Possession.

What is an Asset in information security?

The organizational resource being protected.

What is a Vulnerability?

A weakness or fault in a system that opens it to attack or damage.

What is a Control or countermeasure?

A security mechanism, policy, or procedure used to reduce risk or counter an attack.

What is an Exploit?

A technique used to compromise a system.

What is Security Posture?

The entire collection of controls and safeguards implemented to protect an organization's assets.

What are the six components of an information system?

Software, hardware, data, people, procedures, and networks.

Which component of an information system is commonly considered the most valuable organizational asset and main target of attacks?

Data.

What is another name for the CNSS Security Model, and who created it in 1991?

McCumber Cube, created by John McCumber.

How many cells are formed by the three dimensions of the McCumber Cube?

27

Which dimension of the McCumber Cube describes information states?

Storage, processing, and transmission.

What approach to security implementation is initiated and supported by upper-level management?

Top-down approach.

What does SDLC stand for?

Systems Development Life Cycle.

What is the correct order of the six SDLC phases?

Investigation, analysis, logical design, physical design, implementation, maintenance and change.

During which SDLC phase are scope, goals, costs, resources, and feasibility initially examined?

Investigation.

During which SDLC phase are preliminary system requirements developed and the current system assessed?

Analysis.

During which SDLC phase are multiple possible solutions and required applications/structures identified?

Logical design.

During which SDLC phase are technologies selected and build vs. purchase decisions made?

Physical design.

During which SDLC phase are components obtained, users trained, and the system tested?

Implementation.

During which SDLC phase is the system monitored, modified, upgraded, and patched throughout its life?

Maintenance and change.

What security-focused variation of the SDLC is used to develop an information-security program?

SecSDLC.

Who has primary responsibility for assessing, managing, and implementing information security in an organization?

CISO (Chief Information Security Officer).

In a security project team, who is the Champion?

A senior executive who promotes a security project and obtains financial and administrative support.

Who is responsible for the security and appropriate use of a particular set of information?

Data owner.

Who is responsible for the storage, maintenance, and protection of information?

Data custodian.

Who uses information to perform assigned duties supporting the organization's mission?

Data user.

Which threat category includes viruses, worms, macros, and denial-of-service attacks?

Deliberate software attacks.

Which threat category includes fire, floods, earthquakes, and lightning?

Forces of nature.

What is Information Extortion?

Blackmail or a demand for payment to prevent information disclosure.

What is a Brute-force attack?

An attack that tries every possible password combination.

How does a Dictionary Attack differ from a standard Brute-force attack?

It uses a list of commonly used passwords.

What is a Distributed Denial-of-Service (DDoS) attack?

An attack that uses a coordinated stream of requests from many locations to overwhelm a target.

What is a Man-in-the-middle attack?

An attack that enables an attacker to intercept, alter, delete, reroute, or forge data exchanged between two parties.

What is Spam?

Unsolicited commercial email.

What attack sends large quantities of email to a target?

Mail bombing.

What is a Sniffer?

A program or device that monitors data traveling over a network.

What is Pharming?

An attack that redirects legitimate website traffic to a fraudulent website to collect private information.

What is Risk?

The probability that something unwanted will happen to an information asset.

What is Risk Appetite?

The quantity and nature of risk an organization is willing to accept.

What is the first major step of risk management?

Risk identification.

What process determines what an information asset is worth to an organization?

Asset valuation.

What does the Defend risk strategy entail?

Applies safeguards to prevent a vulnerability from being exploited.

What does the Mitigate risk strategy entail?

Reduces the effect of an attack by preparing plans and controls.

What does the Accept risk strategy entail?

Doing nothing beyond documenting and understanding a risk because it falls within the organization's risk appetite.

What does the Terminate risk strategy entail?

Eliminates the activity, asset, or process that creates the risk.

What is Cost-Benefit Analysis?

A quantitative analysis that compares the expected value of a control's benefits with its costs.

Which planning level establishes the organization's long-term direction and major goals?

Strategic planning.

Which planning level converts strategic plans into specific projects and actions?

Tactical planning.

Which planning level concerns day-to-day tasks and procedures?

Operational planning.

What document provides rules for protecting an organization's information assets?

Information-security policy.

What document provides a detailed plan for implementing an organization's information-security program?

Security blueprint.

What does SETA stand for?

Security Education, Training, and Awareness.

What plan specifies how an organization detects, responds to, and recovers from a security incident?

Incident Response Plan.

What plan prepares an organization to maintain or restore critical business operations after a disruption?

Business Continuity Plan.

What is the difference between Authentication and Authorization?

Authentication verifies a user's claimed identity, while Authorization determines what an authenticated user is allowed to access or perform.

What is a Packet-filtering firewall?

A firewall that examines packet-header information and applies rules to allow or deny packets.

What network area provides an intermediate security zone between the public Internet and an organization's internal network?

DMZ.

What is a Dual-homed host firewall?

A firewall architecture that uses a bastion host with two network interface cards, one connected externally and one internally.

What authentication system uses symmetric-key encryption and is named after the three-headed dog from Greek mythology?

Kerberos.

What dominant protocol is commonly used to protect VPN communications?

IPSec.

What happens in IPSec Tunnel mode?

The entire original client packet is encrypted and placed inside another packet between tunnel servers.