Deck 12: Information Security Maintenance

Question 1

The target selection step involves using the external monitoring intelligence to configure a test engine (such as Nessus)for the tests to be performed.

Answer 1

False

Question 2

Over time,policies and procedures may become inadequate because of changes in agency mission and operational requirements,threats,or the environment.

Answer 2

True

Question 3

Often,US-CERT is viewed as the definitive authority for computer emergency response teams.

Answer 3

True

Question 4

A maintenance model such as the ISO model deals with methods to manage and operate systems.

Question 5

An effective security program demands comprehensive and continuous understanding of program and system configuration.

Question 6

Documentation procedures are not required for configuration and change management processes.

Question 7

When the amount of data stored on a particular hard drive averages 30-40% of available capacity for a prolonged period,consider an upgrade for the hard drive.

Question 8

Remediation of vulnerabilities can be accomplished by accepting or transferring the risk,removing the threat,or repairing the vulnerability.

Question 9

Over time,external monitoring processes should capture information about the external environment in a format that can be referenced both across the organization as threats emerge and for historical use.

Question 10

All systems that are mission critical should be enrolled in PSV measurement.

Question 11

Court decisions generally do not impact agency policy.

Question 12

The value of internal monitoring is low when the resulting knowledge of the network and systems configuration is fed into the vulnerability assessment and remediation maintenance domain.

Question 13

All telephone numbers controlled by an organization should be tested for modem vulnerability,unless the configuration of the phone equipment on premises can assure that no number can be dialed from the worldwide telephone system.

Question 14

Many publicly accessible information sources,both mailing lists and Web sites,are available to those organizations and individuals who have the time,expertise,and finances to make use of them.

Question 15

The characteristics concerned with manufacturer and software versions are about technical functionality,and they should be kept highly accurate and up-to-date.

Question 16

Digital forensics helps the organization understand what happened and how.

Question 17

External monitoring entails collecting intelligence from various data sources and then giving that intelligence context and meaning for use by decision makers within the organization.

Question 18

If an organization deals successfully with change and has created procedures and systems that can be adjusted to the environment,the existing security improvement program will probably continue to work well.

Question 19

An intranet scan starts with an Internet search engine.

Question 20

The vulnerability database,like the risk,threat,and attack database,both stores and tracks information.

Question 21

Organizations should have a carefully planned and fully populated inventory of all their network devices,communication channels,and computing devices._________________________

Question 22

The primary goal of the external monitoring domain is to maintain an informed awareness of the state of all of the organization's networks,information systems,and information security defenses._________________________

Question 23

Specific routine bulletins are issued when developing threats and specific attacks pose a measurable risk to the organization._________________________

Question 24

Major planning components should be reviewed on a periodic basis to ensure that they are current,accurate,and appropriate.

Question 25

UN-CERT is a set of moderated mailing lists full of detailed,full-disclosure discussions and announcements about computer security vulnerabilities._________________________

Question 26

CM assists in streamlining change management processes and prevents changes that could detrimentally affect the security posture of a system before they happen._________________________

Question 27

Each phase of the SDLC includes a(n)maximum set of information security-related activities required to effectively incorporate security into a system._________________________

Question 28

ISO 27001 Information Security Handbook: A Guide for Managers provides managerial guidance for the establishment and implementation of an information security program._________________________

Question 29

Tracking awareness involves assessing the status of the program as indicated by the database information and mapping it to standards established by the agency._________________________

Question 30

To be put to the most effective use,the information that comes from the IDPS must be integrated into the inventory process._________________________

Question 31

Threats cannot be removed without requiring a repair of the vulnerability.

Question 32

Policy needs to be reviewed and refreshed from time to time to ensure that it's sound.

Question 33

For configuration management (CM)and control,it is important to document the proposed or actual changes in the security plan of the system._________________________

Question 34

Rehearsal adds value by exercising the procedures,identifying shortcomings,and providing security personnel the opportunity to improve the security plan before it is needed.

Question 35

In some organizations,facilities management is the identification,inventory,and documentation of the current information systems status-hardware,software,and networking configurations._________________________

Question 36

The basic function of the external monitoring process is to monitor activity,report results,and escalate warnings._________________________

Question 37

CERTs stands for computer emergency recovery teams._________________________

Question 38

A trouble ticket is closed when a user calls about an issue._________________________

Question 39

An effective information security governance program requires constant change._________________________

Question 40

In some instances,risk is acknowledged as being part of an organization's business process.

Question 41

The CISO uses the results of maintenance activities and the review of the information security program to determine if the status quo can adequately meet the threats at hand._________________________

Question 42

The ____ is a center of Internet security expertise and is located at the Software Engineering Institute,a federally funded research and development center operated by Carnegie Mellon University.

A)Bug/CERT
B)Bugtraq/CERT
C)CC/CERT
D)CERT/CC

Question 43

The final process in the vulnerability assessment and remediation domain is the exit phase._________________________

Question 44

The ____ list is intended to facilitate the development of a free network exploration tool.

A)Nmap-hackers
B)Packet Storm
C)Security Focus
D)Snort-sigs

Question 45

WLAN stands for wide local area network._________________________

Question 46

A(n)war game puts a subset of plans in place to create a realistic test environment._________________________

Question 47

The primary mailing list,called simply ____,provides time-sensitive coverage of emerging vulnerabilities,documenting how they are exploited,and reporting on how to remediate them.Individuals can register for the flagship mailing list or any one of the entire family of its mailing lists.

A)Bug
B)Bugfix
C)Buglist
D)Bugtraq

Question 48

A(n)____ item is a hardware or software item that is to be modified and revised throughout its life cycle.

A)revision
B)update
C)change
D)configuration

Question 49

When possible,major plan elements should be rehearsed._________________________

Question 50

The internal vulnerability assessment is usually performed against all public-facing addresses,using every possible penetration testing approach._________________________

Question 51

When the memory usage associated with a particular CPU-based system averages ____% or more over prolonged periods,consider adding more memory.

A)30
B)60
C)90
D)100

Question 52

You can document the results of the verification by saving a(n)profile._________________________

Question 53

____ baselines are established for network traffic and also for firewall performance and IDPS performance.

A)System
B)Application
C)Performance
D)Environment

Question 54

____ are a component of the security triple.

A)Threats
B)Assets
C)Vulnerabilities
D)All of the above

Question 55

The optimum solution in most cases is to repair a(n)vulnerability._________________________

Question 56

An example of the type of vulnerability exposed via traffic analysis occurs when an organization is trying to determine if all its device signatures have been adequately masked._________________________

Question 57

To evaluate the performance of a security system,administrators must establish system performance ____.

A)baselines
B)profiles
C)maxima
D)means

Question 58

The ____ commercial site focuses on current security tool resources.

A)Nmap-hackers
B)Packet Storm
C)Security Laser
D)Snort-sigs

Question 59

The process of identifying and documenting specific and provable flaws in the organization's information asset environment is called VA._________________________

Question 60

A ____ is the recorded state of a particular revision of a software or hardware configuration item.

A)state
B)version
C)configuration
D)baseline

Question 61

There are ____ common vulnerability assessment processes.

A)two
B)three
C)four
D)five

Question 62

Detailed ____ on the highest risk warnings can include identifying which vendor updates apply to which vulnerabilities as well as which types of defenses have been found to work against the specific vulnerabilities reported.

A)escalation
B)intelligence
C)monitoring
D)elimination

Question 63

As an alternative view of the way data flows into the monitoring process,a(n)____ approach may prove useful.

A)DTD
B)DFD
C)Schema
D)ERP

Question 64

The ____ vulnerability assessment process is designed to find and document any vulnerability that is present on dial-up modems connected to the organization's networks.

A)modem
B)phone
C)dial-up
D)network

Question 65

The optimum approach for escalation is based on a thorough integration of the monitoring process into the ____.

A)IDE
B)CERT
C)ERP
D)IRP

Question 66

A performance ____________________ is an expected level of performance against which all subsequent levels of performance are compared.

Question 67

The ____ vulnerability assessment process is designed to find and document selected vulnerabilities that are likely to be present on the internal network of the organization.

A)intranet
B)Internet
C)LAN
D)WAN

Question 68

____________________ is the process of reviewing the use of a system,not to check performance,but rather to determine if misuse or malfeasance has occurred.

Question 69

The steps of the Internet vulnerability assessment include ____,which is when the penetration test engine is unleashed at the scheduled time using the planned target list and test selection.

A)scanning
B)target selection
C)test selection
D)analysis

Question 70

As the help desk personnel screen problems,they must also track the activities involved in resolving each complaint in a help desk ____________________ system.

Question 71

Virtually all aspects of a company's environment are ____________________.

Question 72

____ allows for the major planning components to be reviewed on a periodic basis to ensure that they are current,accurate,and appropriate.

A)System review
B)Project review
C)Program review
D)Application review

Question 73

Organizations should perform a(n)____________________ assessment of their information security programs.

Question 74

____ pen testing is usually used when a specific system or network segment is suspect and the organization wants the pen tester to focus on a particular aspect of the target.

A)White box
B)Black box
C)Gray box
D)Green box

Question 75

____ is used to respond to network change requests and network architectural design proposals.

A)Network connectivity RA
B)Dialed modem RA
C)Application RA
D)Vulnerability RA

Question 76

The ____ mailing list includes announcements and discussion of an open-source IDPS.

A)Nmap-hackers
B)Packet Storm
C)Security Focus
D)Snort-sigs

Question 77

One approach that can improve the situational awareness of the information security function uses a process known as ____ to quickly identify changes to the internal environment.

A)baseline
B)difference analysis
C)differential
D)revision

Question 78

The ____ process is designed to find and document the vulnerabilities that may be present because there are misconfigured systems in use within the organization.

A)ASP
B)ISP
C)SVP
D)PSV

Question 79

A(n)____ is a statement of the boundaries of the RA.

A)scope
B)disclaimer
C)footer
D)head

Question 80

____,a level beyond vulnerability testing,is a set of security tests and evaluations that simulate attacks by a malicious external source (hacker).

A)Penetration testing
B)Penetration simulation
C)Attack simulation
D)Attack testing