|
Related Questions |
View Answer |
|
What must system administrators do when they cannot access a complete replica of their production environment for testing? A. Extrapolate results from a limited subset. B. Eliminate the testing phase of change control. C. Request additional hardware and software. D. Refuse to implement change requests. E. Deploy directly to the production environment.
|
View Answer
|
|
A _______ attack uses multiple systems to launch a coordinated attack. A. Distributed denial-of-service B. Teardrop C. Birthday D. FTP Bounce E. Salami
|
View Answer
|
|
_______ is the process of confirming that implemented security safeguards work as expected. A. Penetration testing B. Exploitation C. Baselining D. A vulnerability E. A countermeasure
|
View Answer
|
|
Enterprise employees working remotely require access to data at an organization's headquarters. Which of the following is the BEST method to transfer this data? A. Standard e-mail B. Faxed information C. Dial-in access behind the enterprise firewall D. Virtual private network E. CD-ROMs shipped with updated versions of the data
|
View Answer
|
|
You are a system administrator managing a pool of database servers. Your software vendor releases a service pack, with many new features. What should you do? (Choose TWO.) A. Eliminate the testing phase of change control. B. Read the release notes. C. Refuse to install the service pack. D. Install the service pack on all production database servers. E. Install the service pack on a database server, in a test environment.
|
View Answer
|
|
____________________ are the people who consume, manipulate, and produce information assets. A. Information asset owners B. Business-unit owners C. Audit-control groups D. Information custodians E. Functional users
|
View Answer
|
|
Which of the following is an integrity requirement for Remote Offices/Branch Offices (ROBOs)? A. Private data must remain internal to an organization. B. Data must be consistent between ROBO sites and headquarters. C. Users must be educated about appropriate security policies. D. Improvised solutions must provide the level of protection required. E. Data must remain available to all remote offices.
|
View Answer
|
|
_________ is a smaller, enhanced version of the X.500 protocol. It is used to provide directory- service information. (Choose the BEST answer.) A. Lightweight Directory Access Protocol B. X.400 Directory Access Protocol C. Access control list D. Lightweight Host Configuration Protocol E. Role-based access control
|
View Answer
|
|
_______________________________ occurs when an individual or process acquires a higher level of privilege, or access, than originally intended. A. Security Triad B. Privilege aggregation C. Need-to-know D. Privilege escalation E. Least privilege
|
View Answer
|
|
A (n) __________________________ is issued by senior management, and defines an organization's security goals. A. Records-retention procedure B. Acceptable-use policy C. Organizational security policy D. Security policy mission statement E. Service level agreement
|
View Answer
|
|
Which of the following is NOT a restriction, for partners accessing internal corporate resources through an extranet? A. Preventing modification of restricted information B. Using restricted programs, to access databases and other information resources C. Allowing access from any location D. Preventing access to any network resource, other than those explicitly permitted E. Viewing inventory levels for partner products only
|
View Answer
|
|
Which of these choices correctly describe denial-of-service (DoS) attacks? (Choose THREE.) A. DoS attacks do not require attackers to have any privileges on a target system. B. DoS attacks are nearly impossible to stop, once they begin. C. DoS attacks free the target system of excessive overhead. D. DoS ties up a system with so many requests, system resources are consumed, and performance degrades. E. DoS attacks cause the attacked system to accept legitimate access requests.
|
View Answer
|
|
Virtual corporations typically use a(n) _______ for maintaining centralized information assets. A. Off-line repository B. Floppy disk C. Data warehouse D. CD-ROM burner E. Colocation
|
View Answer
|
|
Which of the following calculations is used when selecting countermeasures? A. Annualized Rate of Occurrence B. Single Loss Expectancy C. Annualized Loss Expectancy D. Business Impact Analysis E. Business Continuity Plan
|
View Answer
|
|
traffic, known as attack signatures. A. Pattern matching B. Statistical anomaly C. Behavioral analysis D. Host E. Network
|
View Answer
|
|
Why should the number of services on a server be limited to required services? A. Every open service represents a potential vulnerability. B. Closed systems require special connectivity services. C. Running extra services makes machines more efficient. D. All services are inherently stable and secure.
|
View Answer
|
|
Which of these metrics measure how a biometric device performs, when attempting to authenticate subjects? (Choose THREE.) A. False Rejection Rate B. User Acceptance Rate C. Crossover Error Rate D. False Acceptance Rate E. Enrollment Failure Rate
|
View Answer
|
|
To comply with the secure design principle of fail-safe defaults, what must a system do if it receives an instruction it does not understand? The system should: A. send the instruction to a peer server, to see if the peer can execute. B. not attempt to execute the instruction. C. close the connection, and refuse all further traffic from the originator. D. not launch its debugging features, and attempt to resolve the instruction. E. search for a close match in the instruction set it understands.
|
View Answer
|
|
Which of the following is the MOST important consideration, when developing security- awareness training materials? A. Training material should be accessible and attractive. B. Delivery mechanisms should allow easy development of additional materials, to complement core material. C. Security-awareness training materials should never contradict an organizational security policy. D. Appropriate language should be used to facilitate localization, should training materials require translation. E. Written documentation should be archived, in case of disaster.
|
View Answer
|
|
_______ can mimic the symptoms of a denial-of-service attack, and the resulting loss in productivity can be no less devastating to an organization. A. ICMP traffic B. Peak traffic C. Fragmented packets D. Insufficient bandwidth E. Burst traffic
|
View Answer
|