Question 1

What challenges does a security professional face?

Accepted Answer

-Sophisticated Attacks
-Proliferation of Attack Software
-Attack Scale and Velocity

Question 2

What is the difference between integrity and non-repudiation?

Accepted Answer

Integrity, which ensures that data is not modified or tampered with. This is provided through hashing.

Non-repudiation, which provides validation of a message's origin. For example, if a user sends a digitally signed email, they cannot claim later that the email was not sent. Non-repudiation is enforced by digital signatures.

Question 3

What are the three main goals of the CIA of Security?

Accepted Answer

The CIA of Security refers to
-confidentiality, 
-integrity, and 
-availability

Question 4

What are the key components of risk management?

Accepted Answer

Asset: Something that has value

Threat: entity that can cause the loss of an asset or danger 

Threat agent: The attacker the entity that carries out the attack or threat

Vulnerability: A weakness

Exploit: A procedure or product that takes advantage of a vulnerability to carry out a threat

Question 5

What are three types of threat agents?

Accepted Answer

-Employee
-Spy
-Hacker

Question 6

Describe Sophisticated Attacks

Accepted Answer

attacks are complex, making them difficult to detect and thwart. Sophisticated attacks:

    Use common internet tools and protocols, making it difficult to distinguish an attack from legitimate traffic.
    Vary their behavior, making the same attack appear differently each time.

Question 7

Describe the Proliferation of Attack Software

Accepted Answer

A wide variety of attack tools are available on the internet, allowing anyone with a moderate level of technical knowledge to download the tools and run an attack.

Question 8

Describe  Attack Scale and Velocity

Accepted Answer

attack can grow to millions of computers in a matter of minutes or days due to its ability to proliferate on the internet. Because modern attacks are not limited to user interactions, such as using a floppy disk, to spread an attack from machine to machine, the attacks often affect very large numbers of computers in a relatively short amount of time.

Question 9

What is risk management?

Accepted Answer

is the process of identifying security issues and deciding which countermeasures to take in reducing risk to an acceptable level.

Question 10

Describe a spy threat agent

Accepted Answer

can be employed in corporate espionage to obtain information about competitors for commercial purposes. Spies are typically deployed in the following scenarios:

    A spy applies for a job with a commercial competitor and then exploits internal vulnerabilities to steal information and return it to their client.
    A spy attacks an organization from the outside by exploiting external vulnerabilities and then returns the information to their client.

Question 11

How is an employee a threat agent

Accepted Answer

can be the most overlooked yet most dangerous threat agent because they have greater access to information assets than anyone on the outside trying to break in. Employees are also known as internal threats. Employees can:

    -Become disgruntled with their employer
    -Be bribed by a competitor
    -Be an unintentional participant in an attack
    -Accidentally delete or cause data corruption

Question 12

Describe what a hacker is

Accepted Answer

is any threat agent who uses their technical knowledge to bypass security mechanisms to exploit a vulnerability to access information. Hacker subcategories include the following:

Question 13

What are script Kiddies

Accepted Answer

They download and run attacks available on the internet, but generally are not technically savvy enough to create their own attacking code or script.

Question 14

Who are cybercriminals

Accepted Answer

usually seek to exploit security vulnerabilities for some kind of financial reward or revenge.

Question 15

Cyber terrorists

Accepted Answer

generally use the Internet to carry out terrorist activities, such as disrupting network-dependent institutions.

Question 16

Name 3 types of hacker subcategories

Accepted Answer

Script kiddies

Cybercriminals

Cyber terrorists

Question 17

A user copies files from her desktop computer to a USB flash device and puts the device into her pocket. Which of the following security risks is most pressing?

Accepted Answer

Confidentiality

Confidentiality ensures that data is not disclosed to unintended persons. Removable media poses a big threat to confidentiality because it makes it easy to remove data and share data with unauthorized users.

Question 18

Smart phones with cameras and internet capabilities pose a risk to which security concept?

Accepted Answer

Confidentiality

Smart phones with cameras and data transfer capabilities pose a risk to confidentiality. Users can take pictures of computer screens or save data to cell phones and make that information available to non-authorized users.

Question 19

By definition, which security concept ensures that only authorized parties can access data?

Accepted Answer

Confidentiality

Confidentiality ensures that only authorized parties can access data. When a cryptographic system protects data confidentiality, unauthorized users cannot view the resource.

Question 20

Your computer system is a participant in an asymmetric cryptography system. You've created a message to send to another user. Before transmission, you hash the message and encrypt the hash using your private key. You then attach this encrypted hash to your message as a digital signature before sending it to the other user. 

In this example, what protection does the hashing activity provide?

Accepted Answer

Integrity

Hashing of any sort at any time, including within a digital signature, provides data integrity.

Signing the message with the private key creates non-repudiation. A digital signature activity, as a whole, does not provide protection for confidentiality because the original message is sent in clear form. No form of cryptography provides protection for availability.

Question 21

Which of the following is an example of an internal threat?

Accepted Answer

A user accidentally deletes the new product designs.

Internal threats are intentional or accidental acts by employees, including:

    Malicious acts such as theft, fraud, or sabotage

    Intentional or unintentional actions that destroy or alter data

    Disclosing sensitive information by snooping or espionage

Question 22

What is the greatest threat to the confidentiality of data in most secure organizations?

Accepted Answer

USB devices

The greatest threat to data confidentiality in most secure organizations is portable devices (including USB devices). There are so many devices that can support file storage that stealing data has become easy, and preventing data theft is difficult.

Question 23

Which of the following is the correct definition of a threat?

Accepted Answer

Any potential danger to the confidentiality, integrity, or availability of information or systems

Question 24

Which of the following is an example of a vulnerability?

Accepted Answer

A misconfigured server

A misconfigured server is a vulnerability. A vulnerability is the absence or weakness of a safeguard that could be exploited, such as a USB port that is enabled on the server hosting the database.

Question 25

By definition, which security concept uses the ability to prove that a sender sent an encrypted message?

Accepted Answer

Non-repudiation

The ability to prove that a sender sent a message is known as non-repudiation. By various mechanisms in different cryptographic solutions, you can prove that only the sender is able to initiate a communication. Therefore, the sender cannot repute that they originated a message.

Question 26

Which of the following is not a valid concept to associate with integrity?

Accepted Answer

Control access to resources to prevent unwanted access

To control access to resources and prevent unwanted access is to protect of confidentiality, not integrity.

Question

Question

Question

TestOut ITSec QA C1

TestOut Security Pro QA Chapter 1

Question	Answer
What challenges does a security professional face?	-Sophisticated Attacks -Proliferation of Attack Software -Attack Scale and Velocity
What is the difference between integrity and non-repudiation?	Integrity, which ensures that data is not modified or tampered with. This is provided through hashing. Non-repudiation, which provides validation of a message's origin. For example, if a user sends a digitally signed email, they cannot claim later that the email was not sent. Non-repudiation is enforced by digital signatures.
What are the three main goals of the CIA of Security?	The CIA of Security refers to -confidentiality, -integrity, and -availability
What are the key components of risk management?	Asset: Something that has value Threat: entity that can cause the loss of an asset or danger Threat agent: The attacker the entity that carries out the attack or threat Vulnerability: A weakness Exploit: A procedure or product that takes advantage of a vulnerability to carry out a threat
What are three types of threat agents?	-Employee -Spy -Hacker
Describe Sophisticated Attacks	attacks are complex, making them difficult to detect and thwart. Sophisticated attacks: Use common internet tools and protocols, making it difficult to distinguish an attack from legitimate traffic. Vary their behavior, making the same attack appear differently each time.
Describe the Proliferation of Attack Software	A wide variety of attack tools are available on the internet, allowing anyone with a moderate level of technical knowledge to download the tools and run an attack.
Describe Attack Scale and Velocity	attack can grow to millions of computers in a matter of minutes or days due to its ability to proliferate on the internet. Because modern attacks are not limited to user interactions, such as using a floppy disk, to spread an attack from machine to machine, the attacks often affect very large numbers of computers in a relatively short amount of time.
What is risk management?	is the process of identifying security issues and deciding which countermeasures to take in reducing risk to an acceptable level.
Describe a spy threat agent	can be employed in corporate espionage to obtain information about competitors for commercial purposes. Spies are typically deployed in the following scenarios: A spy applies for a job with a commercial competitor and then exploits internal vulnerabilities to steal information and return it to their client. A spy attacks an organization from the outside by exploiting external vulnerabilities and then returns the information to their client.
How is an employee a threat agent	can be the most overlooked yet most dangerous threat agent because they have greater access to information assets than anyone on the outside trying to break in. Employees are also known as internal threats. Employees can: -Become disgruntled with their employer -Be bribed by a competitor -Be an unintentional participant in an attack -Accidentally delete or cause data corruption
Describe what a hacker is	is any threat agent who uses their technical knowledge to bypass security mechanisms to exploit a vulnerability to access information. Hacker subcategories include the following:
What are script Kiddies	They download and run attacks available on the internet, but generally are not technically savvy enough to create their own attacking code or script.
Who are cybercriminals	usually seek to exploit security vulnerabilities for some kind of financial reward or revenge.
Cyber terrorists	generally use the Internet to carry out terrorist activities, such as disrupting network-dependent institutions.
Name 3 types of hacker subcategories	Script kiddies Cybercriminals Cyber terrorists
A user copies files from her desktop computer to a USB flash device and puts the device into her pocket. Which of the following security risks is most pressing?	Confidentiality Confidentiality ensures that data is not disclosed to unintended persons. Removable media poses a big threat to confidentiality because it makes it easy to remove data and share data with unauthorized users.
Smart phones with cameras and internet capabilities pose a risk to which security concept?	Confidentiality Smart phones with cameras and data transfer capabilities pose a risk to confidentiality. Users can take pictures of computer screens or save data to cell phones and make that information available to non-authorized users.
By definition, which security concept ensures that only authorized parties can access data?	Confidentiality Confidentiality ensures that only authorized parties can access data. When a cryptographic system protects data confidentiality, unauthorized users cannot view the resource.
Your computer system is a participant in an asymmetric cryptography system. You've created a message to send to another user. Before transmission, you hash the message and encrypt the hash using your private key. You then attach this encrypted hash to your message as a digital signature before sending it to the other user. In this example, what protection does the hashing activity provide?	Integrity Hashing of any sort at any time, including within a digital signature, provides data integrity. Signing the message with the private key creates non-repudiation. A digital signature activity, as a whole, does not provide protection for confidentiality because the original message is sent in clear form. No form of cryptography provides protection for availability.
Which of the following is an example of an internal threat?	A user accidentally deletes the new product designs. Internal threats are intentional or accidental acts by employees, including: Malicious acts such as theft, fraud, or sabotage Intentional or unintentional actions that destroy or alter data Disclosing sensitive information by snooping or espionage
What is the greatest threat to the confidentiality of data in most secure organizations?	USB devices The greatest threat to data confidentiality in most secure organizations is portable devices (including USB devices). There are so many devices that can support file storage that stealing data has become easy, and preventing data theft is difficult.
Which of the following is the correct definition of a threat?	Any potential danger to the confidentiality, integrity, or availability of information or systems
Which of the following is an example of a vulnerability?	A misconfigured server A misconfigured server is a vulnerability. A vulnerability is the absence or weakness of a safeguard that could be exploited, such as a USB port that is enabled on the server hosting the database.
By definition, which security concept uses the ability to prove that a sender sent an encrypted message?	Non-repudiation The ability to prove that a sender sent a message is known as non-repudiation. By various mechanisms in different cryptographic solutions, you can prove that only the sender is able to initiate a communication. Therefore, the sender cannot repute that they originated a message.
Which of the following is not a valid concept to associate with integrity?	Control access to resources to prevent unwanted access To control access to resources and prevent unwanted access is to protect of confidentiality, not integrity.

"Know" box contains:
Time elapsed:
Retries: