Question 1

Describe what information security process the term hardening refers to.

Accepted Answer

The answer of Describe what information security process the term...

Question 2

ShareIt is a social networking site that boasts over a million registered users and a quarterly membership growth rate in the double digits.As a consequence,the size of the information technology department has been growing very rapidly,with many new hires.Each employee is provided with a name badge with a photo and embedded computer chip that is used to gain entry to the facility.This is an example of a(n)

Accepted Answer

The use of name badges with embedded computer chips for entry control is an example of authentication control. It verifies the identity of the employee entering the facility, ensuring that only authorized personnel gain access. Biometric devices use physical traits, such as fingerprints or retinal scans, to verify identity, which is not mentioned in the scenario. Remote access control refers to the management of accessing a computer or network remotely, not physical entry control. Authorization control involves determining what actions or activities an employee is authorized to perform within the organization, which is not relevant to the scenario.

Question 3

A border router

Accepted Answer

A border router connects an organization's information system to the Internet.

Question 4

In recent years,many of the attacks carried out by hackers have relied on this type of vulnerability in computer software.

Accepted Answer

The type of vulnerability in computer software that many attacks by hackers have relied on in recent years is a buffer overflow. This occurs when a program tries to write more data to a buffer than its capacity, resulting in the overwriting of adjacent memory locations. This allows the hacker to inject malicious code into the system and potentially take control of it.

Question 5

All employees of E.C.Hoxy are required to pass through a gate and present their photo identification cards to the guard before they are admitted.Entry to secure areas,such as the Information Technology Department offices,requires further procedures.This is an example of a(n)

Accepted Answer

The described procedure is an example of physical access control, which involves controlling physical access to a specific location or resource by requiring individuals to pass through a checkpoint or gate and present identification. Authentication controls typically involve verifying the identity of a user through passwords or biometrics, while authorization controls involve determining what actions or resources a user can access based on their role or permissions. Hardening procedures refer to measures taken to secure systems and networks against attacks.

Question 6

The most effective method for protecting an organization from social engineering attacks is providing

Accepted Answer

The most effective method for protecting an organization from social engineering attacks is employee awareness training. Social engineering preys on human error and the best defense against it is to educate employees on how to recognize and avoid common tactics used by attackers. Firewalls, stateful packet filtering, and demilitarized zones are all important components of network security, but they do not address the human element of social engineering attacks.

Question 7

A demilitarized zone

Accepted Answer

A demilitarized zone (DMZ) is a network segment that permits controlled access from the Internet to selected resources. It separates an organization's public-facing servers from its private internal network. While it may have some firewall functions, it is not typically the main firewall but rather a network security architecture that helps protect an organization's critical assets from external threats. It does not route electronic communications within an organization, and it is not a direct connection between an organization's information system and the Internet.

Question 8

The ________ disseminates information about fraud,errors,breaches and other improper system uses and their consequences.

Accepted Answer

The Chief Security Officer (CSO) is responsible for ensuring the security of an organization's digital and physical assets. This includes protecting against fraud, errors, breaches, and improper system uses, and disseminating information about their consequences to relevant parties. The Chief Information Officer (CIO) is responsible for an organization's technology strategy and implementation, while the Chief Operations Officer (COO) oversees the day-to-day operations and may not have specific responsibility for information security. The Computer Emergency Response Team (CERT) is responsible for responding to and mitigating cyber threats and attacks, but may not have the specific responsibility for disseminating information about fraud or improper system uses.

Question 9

Describe four requirements of effective passwords .

Accepted Answer

The answer of Describe four requirements of effective passwords ....

Question 10

Identify six physical access controls.

Accepted Answer

The answer of Identify six physical access controls....

Question 11

A major financial institution hired a renowned security firm to attempt to compromise its computer network.A few days later,the security firm reported that it had successfully entered the financial institution's computer system without being detected.The security firm presented an analysis of the vulnerabilities that had been found to the financial institution.This is an example of a

Accepted Answer

The hiring of a security firm to attempt to compromise a computer network is an example of a detective control, as it is designed to detect and identify any potential vulnerabilities or breaches in the system. The fact that the security firm was able to successfully enter the financial institution's system without being detected highlights the need for additional preventative and corrective controls to be implemented to minimize the risk of future security breaches.

Question 12

New employees of Baker Technologies are assigned user names and appropriate permissions.Each of them were given a company's issued laptop that have an integrated fingerprint reader.In order to log in,the user's fingerprint must be recognized by the reader.This is an example of a(n)

Accepted Answer

The integrated fingerprint reader is a type of biometric device that is used for authentication and access control. This is a form of biometric authentication which help to identify the user through their unique characteristics such as fingerprints, facial recognition, etc.

Question 13

Identify three ways users can be authenticated and give an example of each.

Accepted Answer

The answer of Identify three ways users can be authenticated...

Question 14

Residents in Berryhill received an e-mail stating that there is an armed robber on the loose.The e-mail claimed to be from the Berryhill police department,but it wasn't.Computer forensic experts later determined that the e-mail was sent from a computer lab in the Berryhill's public library.The police were then able to uniquely identify the computer that was used by means of its network interface card's ________ address.Security cameras later help the police to reveal the identity of the individual responsible for the hoax.

Accepted Answer

The network interface card's (NIC) address is commonly referred to as the MAC (Media Access Control) address. This is a unique identifier assigned to each NIC and allowed the police to identify the computer used to send the hoax email. Therefore, C is the best choice.

Question 15

New employees of Baker Technologies are assigned user names and appropriate permissions.Their credentials are then entered into the company's information system's access control matrix.This is an example of a(n)

Accepted Answer

This is an example of an authorization control, as it involves assigning permissions to specific individuals within the access control system. Authentication controls involve verifying the identity of individuals attempting to access a system, while biometric devices are a type of authentication control that uses physiological or behavioral characteristics to verify identity. Remote access control involves controlling access to a system from a remote location.

Question 16

Which of the following is commonly true of the default settings for most commercially available wireless access points?

Accepted Answer

Most commercially available wireless access points are set to the lowest level of security that the device is capable of handling by default. This means that users need to manually adjust the security settings to ensure that their network is adequately protected.

Question 17

Information technology managers are often in a bind when a new exploit is discovered in the wild.They can respond by updating the affected software or hardware with new code provided by the manufacturer,which runs the risk that a flaw in the update will break the system.Or they can wait until the new code has been extensively tested,but that runs the risk that they will be compromised by the exploit during the testing period.Dealing with these issues is referred to as

Accepted Answer

The task of updating software or hardware with new code to patch vulnerabilities is commonly referred to as patch management. It involves finding a balance between timely updates to mitigate risks and testing the new code to ensure that it doesn't introduce new vulnerabilities or break the system. Change management refers to the process of planning and implementing changes to an organization's IT infrastructure, and it may include patch management as a subset of its activities. Cloud computing refers to the delivery of computing resources such as software and storage over the internet. User account management involves managing user access to IT resources such as systems, applications, and data.

Question 18

The most effective way to protect network resources that are exposed to the internet,yet reside outside of a network is

Accepted Answer

A demilitarized zone (DMZ) is the best choice for protecting network resources that are exposed to the internet but not inside a network. A DMZ is a physical or logical subnetwork that separates an organization's internal network from an untrusted network, such as the internet. This provides an additional layer of security and allows for secure communication between the internet and the internal network without compromising security. Firewalls and stateful packet filtering can be used within a DMZ to provide further protection. Employee training is important but not sufficient to protect external-facing network resources.

Question 19

Explain the value of penetration testing.

Accepted Answer

The answer of Explain the value of penetration testing....

Question 20

Explain social engineering.

Accepted Answer

The answer of Explain social engineering....

Quiz 8: Controls for Information Security