Deck 14: On-Going Security Management

Question 1

An operational audit looks for accounts that have weak or blank passwords.

Answer 1

True

Question 2

Which of the following is a security-related reason for monitoring and evaluating network traffic?

A) to determine if your IDPS signatures are working well
B) to create substantial data to analyze
C) to optimize your router and switch protocols
D) to see how many files employees download form the Internet

Answer 2

A

Question 3

Which aspect of strengthening the performance of IDPS may involve degaussing?

A) managing memory
B) managing bandwidth
C) managing storage
D) managing processors

Answer 3

C

Question 4

Change management should be used before making changes to firewall or IDPS rules that affect users.

Question 5

One of the events you should continually monitor is logins.

Question 6

The process of testing a network defense system is referred to as which of the following?

A) security auditing
B) change management
C) IDPS evaluation
D) distributed data collection

Question 7

How much space is typically needed to store IDPS data?

A) a few hundred Kilobytes
B) a gigabyte or more
C) a megabyte or two
D) at least a terabyte

Question 8

Which of the following is NOT a type of event that you would normally monitor?

A) user account creation
B) e-mail attachment handling
C) antivirus scanning
D) access to shared folders

Question 9

Since system intrusions take place over a very short period of time,there is no need to maintain IDPS log data for more than a few hours.

Question 10

An IDPS must have enough memory to maintain connection state information.

Question 11

What should an outside auditing firm be asked to sign before conducting a security audit?

A) subpoena
B) nondisclosure agreement
C) search and seizure contract
D) social engineering covenant

Question 12

Security auditing is the process of documenting countermeasures put in place due to attacks on the network.

Question 13

In centralized data collection,data from sensors go to security managers at each corporate office.

Question 14

Which of the following is a benefit of using centralized data collection to manage sensor data?

A) less network traffic
B) less administrative time
C) data stays on the local network
D) must use a VPN to transport data

Question 15

Most IDPSs use random ports to transfer security data,thereby making it difficult for attackers to exploit.

Question 16

Nonrepudiation is the use of encryption methods to ensure the confidentiality of data.

Question 17

Which of the following is NOT typically an aspect of a security event management program?

A) monitoring events
B) managing IDPS firmware
C) managing data from sensors
D) managing change

Question 18

Which type of change does NOT typically require the use of change management procedures?

A) new VPN gateways
B) changes to ACLs
C) changing a manager's permissions to a file
D) new password systems or procedures

Question 19

Network protection is something you should implement initially and then only make changes if there is a serious security breach.

Question 20

What approach to security calls for security through a variety of defensive techniques that work together?

A) DOA
B) WoL
C) DiD
D) PoE

Question 21

MATCHING
a.active defense in depth
b.centralized data collection
c.degaussing
d.distributed data collection
e.independent audit
f.operational audit
g.security event management program
h.social engineering
i.target-to-console ratio
j.Tinkerbell program
a system in which data from security devices goes to a management console on its own local network

Question 22

MATCHING
a.active defense in depth
b.centralized data collection
c.degaussing
d.distributed data collection
e.independent audit
f.operational audit
g.security event management program
h.social engineering
i.target-to-console ratio
j.Tinkerbell program
an audit in which an outside firm inspects audit logs to ensure that an organization is collecting the information it needs

Question 23

With ___________________ data collection,data from security devices goes to a management console on its own local network.

Question 24

MATCHING
a.active defense in depth
b.centralized data collection
c.degaussing
d.distributed data collection
e.independent audit
f.operational audit
g.security event management program
h.social engineering
i.target-to-console ratio
j.Tinkerbell program
a technique of tricking employees into divulging passwords or other information

Question 25

A(n)____________________ audit should look for accounts assigned to employees who have left the company or user group.

Question 26

The ________________ command reviews the current connections and reports which ports a server is listening to.

Question 27

MATCHING
a.active defense in depth
b.centralized data collection
c.degaussing
d.distributed data collection
e.independent audit
f.operational audit
g.security event management program
h.social engineering
i.target-to-console ratio
j.Tinkerbell program
an audit by an organization's own staff that examines system and security logs

Question 28

You should review the logs and alerts created by your security devices,a process called _________ monitoring.

Question 29

Each IDPS has _____________ that gather data passing through the gateway.

Question 30

To manage the security information from the devices in a large network,you should establish a security incident _________________ team.

Question 31

MATCHING
a.active defense in depth
b.centralized data collection
c.degaussing
d.distributed data collection
e.independent audit
f.operational audit
g.security event management program
h.social engineering
i.target-to-console ratio
j.Tinkerbell program
a program that gathers and consolidates events from multiple sources so that the information can be analyzed to improve network security

Question 32

MATCHING
a.active defense in depth
b.centralized data collection
c.degaussing
d.distributed data collection
e.independent audit
f.operational audit
g.security event management program
h.social engineering
i.target-to-console ratio
j.Tinkerbell program
a system in which an organization's event and security data is funneled to a management console in the main office

Question 33

You monitor and evaluate network traffic to gather evidence that indicates whether your IDPS _________________ are working well or need to be updated.

Question 34

MATCHING
a.active defense in depth
b.centralized data collection
c.degaussing
d.distributed data collection
e.independent audit
f.operational audit
g.security event management program
h.social engineering
i.target-to-console ratio
j.Tinkerbell program
a program in which network connections are scanned and alerts are generated when logons are attempted from a suspicious IDPS

Question 35

Groups known as ______________ teams are assembled to actively test a network.

Question 36

_______________ management involves modifying equipment,systems,software,or procedures in a sequential,planned way.

Question 37

One way to consolidate the data from several network and security devices is to transfer the information to a central _______________.

Question 38

MATCHING
a.active defense in depth
b.centralized data collection
c.degaussing
d.distributed data collection
e.independent audit
f.operational audit
g.security event management program
h.social engineering
i.target-to-console ratio
j.Tinkerbell program
the process of magnetically erasing an electronic device,such as a monitor or a disk

Question 39

MATCHING
a.active defense in depth
b.centralized data collection
c.degaussing
d.distributed data collection
e.independent audit
f.operational audit
g.security event management program
h.social engineering
i.target-to-console ratio
j.Tinkerbell program
a strong implementation of the DiD concept in which security personnel expect that attacks will occur and try to anticipate them

Question 40

MATCHING
a.active defense in depth
b.centralized data collection
c.degaussing
d.distributed data collection
e.independent audit
f.operational audit
g.security event management program
h.social engineering
i.target-to-console ratio
j.Tinkerbell program
the number of target computers on a network managed by a single command console

Question 41

How does distributed data collection work when collecting data from multiple sensors?

Question 42

Discuss the process of IDPS signature evaluation.

Question 43

How can change adversely affect your network?

Question 44

List three types of changes for which you should use change management.

Question 45

Discuss operational auditing.Include in your discussion what should be looked for in an operational audit and what methods might be used in the audit.

Question 46

If you determine that a Trojan program has been installed and is initiating a connection to a remote host and you suspect passwords have been compromised,what steps should you take? List three of them.

Question 47

What is security auditing and what type of information should be analyzed?

Question 48

List and define the areas for which DiD calls for maintenance.

Question 49

List the advantages of centralized data collection.

Question 50

List four type of events you should monitor as part of a security event management program.