Deck 1: Computer Systems Overview

Question 1

Computer security is protection of the integrity, availability, andconfidentiality of information system resources.

Answer 1

True

Question 2

The first step in devising security services and mechanisms is todevelop a security policy.

Answer 2

True

Question 3

________ assures that a system performs its intended function in an unimpaired manner, free from deliberate or inadvertent unauthorized manipulation of the system.

A) System Integrity
B) Data Integrity
C) Availability
D) Confidentiality

Answer 3

A

Question 4

Computer security is essentially a battle of wits between a perpetratorwho tries to find holes and the administrator who tries to close them.

Question 5

Assurance is the process of examining a computer product or systemwith respect to certain criteria.

Question 6

__________ assures that individuals control or influence what information related to them may be collected and stored and by whom and to whom that information may be disclosed.

A) Availability
B) System Integrity
C) Privacy
D) Data Integrity

Question 7

The more critical a component or service, the higher the level ofavailability required.

Question 8

X.800 architecture was developed as an international standard andfocuses on security in the context of networks and communications.

Question 9

Many security administrators view strong security as an impediment toefficient and user-friendly operation of an information system.

Question 10

Hardware is the most vulnerable to attack and the least susceptible toautomated controls.

Question 11

The "A" in the CIA triad stands for "authenticity".

Question 12

Contingency planning is a functional area that primarily requirescomputer security technical measures.

Question 13

Threats are attacks carried out.

Question 14

In the context of security our concern is with the vulnerabilities ofsystem resources.

Question 15

T F 4. Availability assures that systems works promptly and service is notdenied to authorized users.

Question 16

A flaw or weakness in a system's design, implementation, or operation and management that could be exploited to violate the system's security policy is a(n) __________.

A) countermeasure
B) vulnerability
C) adversary
D) risk

Question 17

A ________ level breach of security could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.

A) low
B) normal
C) moderate
D) high

Question 18

Data integrity assures that information and programs are changed onlyin a specified and authorized manner.

Question 19

Security mechanisms typically do not involve more than one particularalgorithm or protocol.

Question 20

A loss of _________ is the unauthorized disclosure of information.

A) confidentiality
B) integrity
C) authenticity
D) availability

Question 21

A __________ is any action that compromises the security of information owned by an organization.

A) security mechanism
B) security attack
C) security policy
D) security service

Question 22

__________ is the protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity, availability, and confidentiality of information system resources.

Question 23

Confidentiality, Integrity, and Availability form what is often referred to as the _____.

Question 24

A(n) __________ is an action, device, procedure, or technique that reduces a threat, a vulnerability, or an attack by eliminating or preventing it, by minimizing the harm it can cause, or by discovering and reporting it so that correct action can be taken.

A) attack
B) countermeasure
C) adversary
D) protocol

Question 25

In the United States, student grade information is an asset whose confidentiality is regulated by the __________.

Question 26

An example of __________ is an attempt by an unauthorized user to gain access to a system by posing as an authorized user.

A) masquerade
B) interception
C) repudiation
D) inference

Question 27

__________ is the insertion of bits into gaps in a data stream to frustrate traffic analysis attempts.

A) Traffic padding
B) Traffic routing
C) Traffic control
D) Traffic integrity

Question 28

Release of message contents and traffic analysis are two types of _________ attacks.

Question 29

A loss of _________ is the disruption of access to or use of information or an information system.

Question 30

A threat action in which sensitive data are directly released to an unauthorized entity is __________.

A) corruption
B) disruption
C) intrusion
D) exposure

Question 31

Masquerade, falsification, and repudiation are threat actions that cause __________ threat consequences.

A) unauthorized disclosure
B) deception
C) disruption
D) usurpation

Question 32

Misappropriation and misuse are attacks that result in ________ threat consequences.

Question 33

A(n) _________ is an attempt to learn or make use of information from the system that does not affect system resources.

A) passive attack
B) inside attack
C) outside attack
D) active attack

Question 34

A(n) _________ is any means taken to deal with a security attack.

Question 35

The assets of a computer system can be categorized as hardware, software, communication lines and networks, and _________.

Question 36

The assurance that data received are exactly as sent by an authorized entity is __________.

A) authentication
B) data confidentiality
C) access control
D) data integrity

Question 37

An assault on system security that derives from an intelligent act that is a deliberate attempt to evade security services and violate the security policy of a system is a(n) __________.

A) risk
B) asset
C) attack
D) vulnerability

Question 38

Replay, masquerade, modification of messages, and denial of service are example of _________ attacks.

Question 39

A(n) _________ is a threat that is carried out and, if successful, leads to an undesirable violation of security, or threat consequence.

Question 40

The _________ prevents or inhibits the normal use or management of communications facilities.

A) passive attack
B) traffic encryption
C) denial of service
D) masquerade

Question 41

Security implementation involves four complementary courses of action: prevention, detection, response, and _________.

Question 42

A __________ is data appended to, or a cryptographic transformation of, a data unit that allows a recipient of the data unit to prove the source and integrity of the data unit and protect against forgery.

Question 43

A(n) _________ assessment is periodically assessing the risk to organizational operations, organizational assets, and individuals, resulting from the operation of organizational information systems and the associated processing, storage, or transmission or organizational information.

Question 44

The OSI security architecture focuses on security attacks, __________, and services.

Question 45

Establishing, maintaining, and implementing plans for emergency response, backup operations, and post disaster recovery for organizational information systems to ensure the availability of critical information resources and continuity of operations in emergency situations is a __________ plan.