TestOut Security Pro QA Chapter 1

Quiz yourself by thinking what should be in each of the black spaces below before clicking on it to display the answer.

Help!

Question

Answer

What challenges does a security professional face?

-Sophisticated Attacks -Proliferation of Attack Software -Attack Scale and Velocity

🗑

What is the difference between integrity and non-repudiation?

Integrity, which ensures that data is not modified or tampered with. This is provided through hashing. Non-repudiation, which provides validation of a message's origin. For example, if a user sends a digitally signed email, they cannot claim later that the email was not sent. Non-repudiation is enforced by digital signatures.

🗑

What are the three main goals of the CIA of Security?

The CIA of Security refers to -confidentiality, -integrity, and -availability

🗑

What are the key components of risk management?

Asset: Something that has value Threat: entity that can cause the loss of an asset or danger Threat agent: The attacker the entity that carries out the attack or threat Vulnerability: A weakness Exploit: A procedure or product that takes advantage of a vulnerability to carry out a threat

🗑

What are three types of threat agents?

-Employee -Spy -Hacker

🗑

Describe Sophisticated Attacks

attacks are complex, making them difficult to detect and thwart. Sophisticated attacks: Use common internet tools and protocols, making it difficult to distinguish an attack from legitimate traffic. Vary their behavior, making the same attack appear differently each time.

🗑

Describe the Proliferation of Attack Software

A wide variety of attack tools are available on the internet, allowing anyone with a moderate level of technical knowledge to download the tools and run an attack.

🗑

Describe Attack Scale and Velocity

attack can grow to millions of computers in a matter of minutes or days due to its ability to proliferate on the internet. Because modern attacks are not limited to user interactions, such as using a floppy disk, to spread an attack from machine to machine, the attacks often affect very large numbers of computers in a relatively short amount of time.

🗑

What is risk management?

is the process of identifying security issues and deciding which countermeasures to take in reducing risk to an acceptable level.

🗑

Describe a spy threat agent

can be employed in corporate espionage to obtain information about competitors for commercial purposes. Spies are typically deployed in the following scenarios: A spy applies for a job with a commercial competitor and then exploits internal vulnerabilities to steal information and return it to their client. A spy attacks an organization from the outside by exploiting external vulnerabilities and then returns the information to their client.

🗑

How is an employee a threat agent

can be the most overlooked yet most dangerous threat agent because they have greater access to information assets than anyone on the outside trying to break in. Employees are also known as internal threats. Employees can: -Become disgruntled with their employer -Be bribed by a competitor -Be an unintentional participant in an attack -Accidentally delete or cause data corruption

🗑

Describe what a hacker is

is any threat agent who uses their technical knowledge to bypass security mechanisms to exploit a vulnerability to access information. Hacker subcategories include the following:

🗑

What are script Kiddies

They download and run attacks available on the internet, but generally are not technically savvy enough to create their own attacking code or script.

🗑

Who are cybercriminals

usually seek to exploit security vulnerabilities for some kind of financial reward or revenge.

🗑

Cyber terrorists

generally use the Internet to carry out terrorist activities, such as disrupting network-dependent institutions.

🗑

Name 3 types of hacker subcategories

Script kiddies Cybercriminals Cyber terrorists

🗑

A user copies files from her desktop computer to a USB flash device and puts the device into her pocket. Which of the following security risks is most pressing?

Confidentiality Confidentiality ensures that data is not disclosed to unintended persons. Removable media poses a big threat to confidentiality because it makes it easy to remove data and share data with unauthorized users.

🗑

Smart phones with cameras and internet capabilities pose a risk to which security concept?

Confidentiality Smart phones with cameras and data transfer capabilities pose a risk to confidentiality. Users can take pictures of computer screens or save data to cell phones and make that information available to non-authorized users.

🗑

By definition, which security concept ensures that only authorized parties can access data?

Confidentiality Confidentiality ensures that only authorized parties can access data. When a cryptographic system protects data confidentiality, unauthorized users cannot view the resource.

🗑

Your computer system is a participant in an asymmetric cryptography system. You've created a message to send to another user. Before transmission, you hash the message and encrypt the hash using your private key. You then attach this encrypted hash to your message as a digital signature before sending it to the other user. In this example, what protection does the hashing activity provide?

Integrity Hashing of any sort at any time, including within a digital signature, provides data integrity. Signing the message with the private key creates non-repudiation. A digital signature activity, as a whole, does not provide protection for confidentiality because the original message is sent in clear form. No form of cryptography provides protection for availability.

🗑

Which of the following is an example of an internal threat?

A user accidentally deletes the new product designs. Internal threats are intentional or accidental acts by employees, including: Malicious acts such as theft, fraud, or sabotage Intentional or unintentional actions that destroy or alter data Disclosing sensitive information by snooping or espionage

🗑

What is the greatest threat to the confidentiality of data in most secure organizations?

USB devices The greatest threat to data confidentiality in most secure organizations is portable devices (including USB devices). There are so many devices that can support file storage that stealing data has become easy, and preventing data theft is difficult.

🗑

Which of the following is the correct definition of a threat?

Any potential danger to the confidentiality, integrity, or availability of information or systems

🗑

Which of the following is an example of a vulnerability?

A misconfigured server A misconfigured server is a vulnerability. A vulnerability is the absence or weakness of a safeguard that could be exploited, such as a USB port that is enabled on the server hosting the database.

🗑

By definition, which security concept uses the ability to prove that a sender sent an encrypted message?

Non-repudiation The ability to prove that a sender sent a message is known as non-repudiation. By various mechanisms in different cryptographic solutions, you can prove that only the sender is able to initiate a communication. Therefore, the sender cannot repute that they originated a message.

🗑

Which of the following is not a valid concept to associate with integrity?

Control access to resources to prevent unwanted access To control access to resources and prevent unwanted access is to protect of confidentiality, not integrity.

🗑

Review the information in the table. When you are ready to quiz yourself you can hide individual columns or the entire table. Then you can click on the empty cells to reveal the answer. Try to recall what will be displayed before clicking the empty cell.

To hide a column, click on the column name.

To hide the entire table, click on the "Hide All" button.

You may also shuffle the rows of the table by clicking on the "Shuffle" button.

Or sort by any of the columns using the down arrow next to any column heading.
If you know all the data on any row, you can temporarily remove it by tapping the trash can to the right of the row.

Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.

Normal Size Small Size show me how

Created by: jacobth