Deck 1: Check Point Certified Security Principles Associate (CCSPA)

Question 1

A new U.S. Federal Information Processing Standard specifies a cryptographic algorithm. This algorithm is used by U.S. government organizations to protect sensitive, but unclassified, information. What is the name of this Standard?

A) Triple DES
B) Blowfish
C) AES
D) CAST
E) RSA

Answer 1

C

Question 2

Which type of Business Continuity Plan (BCP) test involves shutting down z on-line, and moving all operations to the alternate site?

A) Parallel
B) Full interruption
C) Checklist
D) Structured walkthrough
E) Simulation

Answer 2

B

Question 3

Internal intrusions are loosely divided into which categories? (Choose TWO.)

A) Attempts by insiders to perform appropriate acts, on information assets to which they have been given rights or permissions.
B) Attempts by insiders to access resources, without proper access rights
C) Attempts by insiders to access external resources, without proper access rights.
D) Attempts by insiders to perform inappropriate acts, on external information assets to which they have been given rights or permissions.
E) Attempts by insiders to perform inappropriate acts, on information assets to which they have been given rights or permissions.

Answer 3

B,E

Question 4

Which of the following is NOT an auditing function that should be performed regularly?

A) Reviewing IDS alerts
B) Reviewing performance logs
C) Reviewing IDS logs
D) Reviewing audit logs
E) Reviewing system logs

Question 5

Organizations____________ risk, when they convince another entity to assume the risk for them.

A) Elevate
B) Assume
C) Deny
D) Transfer
E) Mitigate

Question 6

_________ educate(s) security administrators and end users about organizations' security policies.

A) Security-awareness training
B) Information Security (INFOSEC) briefings
C) Acceptable-use policies
D) Continuing education
E) Nondisclosure agreements

Question 7

What type of document contains information on alternative business locations, IT resources, and personnel?

A) End-user license agreement
B) Nondisclosure agreement
C) Acceptable use policy
D) Security policy
E) Business continuity plan

Question 8

Which of the following is an integrity requirement for Remote Offices/Branch Offices (ROBOs)?

A) Private data must remain internal to an organization.
B) Data must be consistent between ROBO sites and headquarters.
C) Users must be educated about appropriate security policies.
D) Improvised solutions must provide the level of protection required.
E) Data must remain available to all remote offices.

Question 9

Operating-svstem fingerprinting uses all of the following, EXCEPT ______, to identify a target operating system.

A) Sequence Verifier
B) Initial sequence number
C) Address spoofing
D) Time to Live
E) IP ID field

Question 10

Which of the following is a cost-effective solution for securely transmitting data between remote offices?

A) Standard e-mail
B) Fax machine
C) Virtual private network
D) Bonded courier
E) Telephone

Question 11

Which of the following is likely in a small-business environment?

A) Most small businesses employ a full-time information-technology staff.
B) Resources are available as needed.
C) Small businesses have security personnel on staff.
D) Most employees have experience with information security.
E) Security budgets are very small.

Question 12

Which types of security solutions should a home user deploy? (Choose TWO.)

A) Managed Security Gateway
B) Access control lists on a router
C) Personal firewall
D) Network intrusion-detection system
E) Anti-virus software

Question 13

Which of the following statements about encryption's benefits is false? Encryption can: (Choose TWO.)

A) significantly reduce the chance information will be modified by unauthorized entities.
B) only be used to protect data in transit. Encryption provides no protection to stored data.
C) allow private information to be sent over public networks, in relative safety.
D) significantly reduce the chance information will be viewed by unauthorized entities.
E) prevent information from being destroyed by malicious entities, while in transit.

Question 14

Which encryption algorithm has the highest bit strength?

A) AES
B) Blowfish
C) DES
D) CAST
E) Triple DES

Question 15

Which of these metrics measure how a biometric device performs, when attempting to authenticate subjects? (Choose THREE.)

A) False Rejection Rate
B) User Acceptance Rate
C) Crossover Error Rate
D) False Acceptance Rate
E) Enrollment Failure Rate

Question 16

Which TWO of the following items should be accomplished, when interviewing candidates for a position within an organization?

A) Hire an investigation agency to run background checks.
B) Verify all dates of previous employment.
C) question candidates, using polygraphs, n
D) Contact personal and professional references.
E) Run criminal-background checks.

Question 17

Which type of access management uses information about job duties and positions, to indicate subjects' clearance levels?

A) Discretionary
B) Role-based
C) Nondiscretionary
D) Hybrid
E) Mandatory

Question 18

Which of the following equations results in the Single Loss Expectancy for an asset?

A) Asset Value x % Of Loss From Realized Exposure
B) Asset Value x % Of Loss From Realized Threat
C) Annualized Rate of Occurrence / Annualized Loss Expectancy
D) Asset Value x % Of Loss From Realized Vulnerability
E) Annualized Rate of Occurrence x Annualized Loss Expectancy

Question 19

When attempting to identify OPSEC indicators, information-security professionals must: (Choose THREE.)

A) Discover the information daily activities yield.
B) Meet with adversaries.
C) Perform business impact analysis surveys.
D) Scrutinize their organizations' daily activities.
E) Analyze indicators, to determine the information an adversary can glean both from routine and nonroutine activities.

Question 20

_________ intrusion detection involves comparing traffic to known characteristics of malicious traffic, known as attack signatures.

A) Pattern matching
B) Statistical anomaly
C) Behavioral analysis
D) Host
E) Network

Question 21

ABC Corporation's network requires users to authenticate to cross the border firewall, and before entering restricted segments. Servers containing sensitive information require separate authentication. This is an example of which type of access-control method?

A) Single sign-on
B) Decentralized access control
C) Hybrid access control
D) Layered access control
E) Mandatory access control

Question 22

Which of the following should be included in an enterprise Business Continuity Plan (BCP)? (Choose THREE.)

A) Accidental or intentional data deletion
B) Severe weather disasters
C) Employee terminations
D) Employee administrative leave
E) Minor power outages

Question 23

INFOSEC professionals are concerned about providing due care and due diligence. With whom should they consult, when protecting information assets?

A) Law enforcement in their region
B) Senior management, particularly business-unit owners
C) IETF enforcement officials
D) Other INFOSEC professionals
E) Their organizations' legal experts

Question 24

Virtual corporations typically use a(n) ___________ for maintaining centralized information assets.

A) Off-line repository
B) Floppy disk
C) Data warehouse
D) CD-ROM burner
E) Colocation

Question 25

One individual is selected from each department, to attend a security-awareness course. Each person returns to his department, delivering the course to the remainder of the department. After training is complete, each person acts as a peer coach. Which type of training is this?

A) On-line training
B) Formal classroom training
C) Train-the-mentor training
D) Alternating-facilitator training
E) Self-paced training

Question 26

A __________ posture provides many levels of security possibilities, for access control.

A) Layered defensive
B) Multiple offensive
C) Flat defensive
D) Reactive defensive
E) Proactive offensive

Question 27

_________ is a type of cryptography, where letters of an original message are systematically rearranged into another sequence.

A) Symmetric-key exchange
B) Steganography
C) Transposition cipher
D) Asymmetric-key encryption
E) Simple substitution cipher

Question 28

A(n) __________ occurs when intrusion-detection measures fail to recognize suspicious traffic or activity.

A) False positive
B) False negative
C) CIFS pop-up
D) Threshold
E) Alarm

Question 29

A(n)___________ is a one-way mathematical function that maps variable values into smaller values of a fixed length.

A) Symmetric key
B) Algorithm
C) Back door
D) Hash function
E) Integrity

Question 30

Maintenance of the Business Continuity Plan (BCP) must be integrated with________an organization's process.

A) Change-control
B) Disaster-recovery
C) Inventory-maintenance
D) Discretionary-budget
E) Compensation-review

Question 31

Distinguish between the role of the data owner and the role of the data custodian. Complete the following sentence. The data owner is the:

A) department in the organization responsible for the data's physical storage location. The data custodian is anyone who has access the data for any reason.
B) person or entity who accesses/and or manipulates data or information, in the course of assigned duties. The data custodian is a person or process with the appropriate level of privilege to access the data.
C) person or entity ultimately responsible for the security of an information asset. The data custodian is the person or entity responsible for imposing and enforcing policies and restrictions, dictated by the data owner.
D) person or process that originally creates the information. The data custodian is a role that shifts to any person or process currently accessing the data, and passes to the next person or process to access the data.
E) person or entity responsible for imposing and enforcing policies and restrictions, dictated by the functional user. The data custodian is a person or process who accesses and/or manipulates the information.

Question 32

A(n) ___________ is the first step for determining which technical information assets should be protected.

A) Network diagram
B) Business Impact Analysis
C) Office floor plan
D) Firewall
E) Intrusion detection system

Question 33

Which of the following best describes the largest security challenge for Remote Offices/Branch Offices?

A) Leased-line security
B) Salami attacks
C) Unauthorized network connectivity
D) Distributed denial-of-service attacks
E) Secure access to remote organizational resources

Question 34

Which of the following statements about the maintenance and review of information security policies is NOT true?

A) The review and maintenance of security policies should be tied to the performance evaluations of accountable individuals.
B) Review requirements should be included in the security policies themselves.
C) When business requirements change, security policies should be reviewed to confirm that policies reflect the new business requirements.
D) Functional users and information custodians are ultimately responsible for the accuracy and relevance of information security policies.
E) In the absence of changes to business requirements and processes, information-security policy reviews should be annual.

Question 35

What is mandatory sign-on? An authentication method that:

A) uses smart cards, hardware tokens, and biometrics to authenticate users; also known as three-factor authentication
B) requires the use of one-time passwords, so users authenticate only once, with a given set of credentials
C) requires users to re-authenticate at each server and access control
D) stores user credentials locally, so that users need only authenticate the first time a local machine is used
E) allows users to authenticate once, and then uses tokens or other credentials to manage subsequent authentication attempts

Question 36

Why does the (ISC)2 access-control systems and methodology functional domain address both the confidentiality and integrity aspects of the Information Security Triad? Access-control systems and methodologies:

A) are required standards in health care and banking.
B) provide redundant systems and data backups.
C) control who is allowed to view and modify information.
D) are academic models not suitable for implementation.
E) set standards for acceptable media-storage devices.

Question 37

The items listed below are examples of ___________ controls. *Procedures and policies *Employee security-awareness training *Employee background checks *Increasing management security awareness

A) Technical
B) Administrative
C) Role-based
D) Mandatory
E) Physical

Question 38

Enterprise employees working remotely require access to data at an organization's headquarters. Which of the following is the BEST method to transfer this data?

A) Standard e-mail
B) Faxed information
C) Dial-in access behind the enterprise firewall
D) Virtual private network
E) CD-ROMs shipped with updated versions of the data

Question 39

A(n) __________ is an abstract machine, which mediates all access subjects have to objects.

A) ACL
B) Reference monitor
C) State machine
D) TCB
E) Router

Question 40

All of the following are possible configurations for a corporate intranet, EXCEPT:

A) Value-added network
B) Wide-area network
C) Campus-area network
D) Metropolitan-area network
E) Local-area network

Question 41

------------ is the process of subjects establishing who they are to an access control.

A) Identification
B) Authentication
C) Authorization
D) Validation
E) Biometrics

Question 42

Which of the following are appropriate uses of asymmetric encryption? (Choose THREE.)

A) Authentication
B) Secure key-exchange mechanisms
C) Public Web site access
D) Data-integrity checking
E) Sneaker net

Question 43

Which principle of secure design states that a security mechanism's methods must be testable?

A) Separation of privilege
B) Least common mechanism
C) Complete mediation
D) Open design
E) Economy of mechanism

Question 44

Which of the following is the BEST method for managing users in an enterprise?

A) Enter user data in a spreadsheet.
B) Implement centralized access control.
C) Deploy Kerberos.
D) Place them in a centralized Lightweight Directory Access Protocol.
E) Use a Domain Name System.

Question 45

Why should user populations be segmented?

A) To allow resources to be shared among employees
B) To allow appropriate collaboration, and prevent inappropriate resource sharing
C) To prevent appropriate collaboration
D) To provide authentication services
E) To prevent the generation of audit trails from gateway devices

Question 46

----------- is issued by senior management, and defines an organization's security goals.

A) Records-retention procedure
B) Acceptable-use policy
C) Organizational security policy
D) Security policy mission statement
E) Service level agreement

Question 47

------- can mimic the symptoms of a denial-of-service attack, and the resulting loss in productivity can be no less devastating to an organization.

A) ICMPtraffic
B) Peak traffic
C) Fragmented packets
D) Insufficient bandwidth
E) Burst traffic

Question 48

Which of the following are enterprise administrative controls? (Choose TWO.)

A) Network access control
B) Facility access control
C) Password authentication
D) Background checks
E) Employee handbooks

Question 49

When should procedures be evaluated?

A) When new functional users join an organization
B) On the anniversary of the procedures' implementation
C) Each time procedures are used
D) Whenever business processes are modified
E) When new exploits and attacks are discovered

Question 50

Which of the following tests provides testing teams some information about hosts or networks?

A) Partial-knowledge test
B) Full-knowledge test
C) Zero-knowledge test

Question 51

A _____________ attack uses multiple systems to launch a coordinated attack.

A) Distributed denial-of-service
B) Teardrop
C) Birthday
D) FTP Bounce
E) Salami

Question 52

What is the purpose of resource isolation?

A) To reduce the level of broadcast traffic on physical segments.
B) To ensure that anyone accessing a resource has appropriate integrity.
C) To automate the creation of access control lists and Trusted Computing Bases.
D) To enforce access controls, and clearly separate resources from each other.
E) To make people buy more computers than they really need.

Question 53

Who should have physical access to network-connectivity devices and corporate servers?

A) Customers and clients
B) Accounting, information-technology, and auditing staff
C) Managers and C-level executives
D) Only appropriate information-technology personnel
E) Only the maintenance staff

Question 54

Which of the following represents a valid reason for testing a patch on a non-production system, before applying it to a production system?

A) Patches may re-enable services previously disabled.
B) Patches are a kind of virus.
C) Patches always overwrite user data.
D) Only patches on vendor-pressed CDs can be trusted.
E) Patches usually break important system functionality.

Question 55

You are considering purchasing a VPN solution to protect your organization's information assets. The solution you are reviewing uses RFC-compliant and open-standards encryption schemes. The vendor has submitted the system to a variety of recognized testing authorities. The vendor does not make the source code available to testing authorities. Does this solution adhere to the secure design principle of open design?

A) No, because the software vendor could have changed the code after testing, which is not verifiable.
B) No, because the software vendor submitted the software to testing authorities only, and did not make the software available to the public for testing.
C) Yes, because the methods were tested by recognized testing authorities, and the source code is protected from vandalism.
D) Yes, because the methods are open, and the system does not rely on the secrecy of its internal mechanisms to provide protection.
E) No, because if a software vendor refuses to reveal the source code for a product, it cannot comply with the open-design principle.

Question 56

Which of the following is MOST likely to cause management to view a security-needs proposal as invalid?

A) Real-world examples
B) Exaggeration
C) Ranked threats
D) quantified risks
E) Temperate manner

Question 57

You are a system administrator managing a pool of database servers. Your software vendor releases a service pack, with many new features. What should you do? (Choose TWO.)

A) Eliminate the testing phase of change control.
B) Read the release notes
C) Refuse to install the service pack.
D) Install the service pack on all production database servers.
E) Install the service pack on a database server, in a test environment.

Question 58

Public servers are typically placed in the --------- to enhance security.

A) Restricted Entry Zone
B) Open Zone
C) Internet Zone
D) Demilitarized Zone
E) Public Entry Zone

Question 59

Which of the following entities review partner-extranet requirements?

A) Information systems
B) Shipping and receiving
C) Marketing
D) Requesting department
E) Chief Information Officer

Question 60

Which of these strategies can be employed to test training effectiveness? (Choose THREE.)

A) Create a survey for managers, to see if participants practice behaviors presented during training.
B) Provide feedback forms for employees to rate instruction and training material, immediately after training has ended.
C) Include auditors before and after the training. This checks to see if the number of security-related incidents is reduced, because of the training.
D) Give incentives to employees who attend security-awareness training. Perform spot-checks, to see if incentives are displayed.
E) Test employees on security concepts several months after training has ended.