Deck 12: Information Security Maintenance

Question 1

A management model such as ISO 27000 deals with methods to maintain systems.

Answer 1

False

Question 2

A general guideline for performance of hard drives suggests that when the amount of data stored on a particular hard drive averages 95% of available capacity for a prolonged period, you should consider an upgrade for the drive.

Answer 2

False

Question 3

Wireless vulnerability assessment begins with the planning, scheduling, and notification of all Internet connections, using software such as Wireshark.

Answer 3

False

Question 4

Inventory characteristics for hardware and software assets that record the manufacturer and versions are related to technical functionality, and should be highly accurate and updated each time there is a change.

Question 5

The vulnerability database, like the risk, threat, and attack database, both stores and tracks information.

Question 6

The target selection step of Internet vulnerability assessment involves using the external monitoring intelligence to configure a test engine (such as Nessus) for the tests to be performed.

Question 7

An intranet vulnerability scan starts with the scan of the organization's default Internet search engine.

Question 8

Over time, policies and procedures may become inadequate due to changes in the organization's mission and operational requirements, threats, or the environment.

Question 9

External monitoring entails collecting intelligence from various data sources and then giving that intelligence context and meaning for use by decision makers within the organization.

Question 10

The internal monitoring domain is the component of the maintenance model that focuses on identifying, assessing, and managing the physical security of assets in an organization.

Question 11

Digital forensics helps an organization understand what happened, and how, after an incident.

Question 12

All systems that are mission critical should be enrolled in platform security validation (PSV) measurement.

Question 13

Documenting information system changes and assessing their potential impact on system security is an important and consequential part of digital forensics.

Question 14

Over time, external monitoring processes should capture information about the external environment in a format that can be referenced across the organization as threats emerge and for historical use.

Question 15

Remediation of vulnerabilities can be accomplished by accepting or transferring the risk, removing the threat, or repairing the vulnerability.

Question 16

If an organization deals successfully with change and has created procedures and systems that can be adjusted to the environment, the existing security improvement program will probably continue to work well.

Question 17

Documentation procedures are not required for configuration and change management processes.

Question 18

An effective information security governance program requires no ongoing review once it is well established.

Question 19

US-CERT is generally viewed as the definitive authority for computer emergency response teams.

Question 20

Intelligence for external monitoring can come from a number of sources: vendors, CERT organizations, public network sources, and membership sites.

Question 21

CM assists in streamlining change management processes and prevents changes that could detrimentally affect the security posture of a system before they happen. _________________________

Question 22

For configuration management (CM) and control, it is important to document the proposed or actual changes in the system security plan. _________________________

Question 23

Rehearsal adds value by exercising the procedures, identifying shortcomings, and providing security personnel the opportunity to improve the security plan before it is needed.

Question 24

An affidavit is sworn testimony that certain facts are in the possession of an investigating officer and that they warrant the examination of specific items located at a specific place.

Question 25

The systems development life cycle (SDLC) is the overall process of developing, implementing, and retiring information systems through a multistep approach-initiation, analysis, design, implementation, and use. _________________________

Question 26

Threats cannot be removed without requiring a repair of the vulnerability.

Question 27

The basic function of the external monitoring process is to monitor activity, report results, and escalate warnings. _________________________

Question 28

A maintenance ​ticket is opened when a user calls about an issue. _________________________

Question 29

CERT stands for "computer emergency recovery team." _________________________

Question 30

In some instances, risk is acknowledged as being part of an organization's business process.

Question 31

The NIST SP 800-100 Information Security Handbook provides technical guidance for the establishment and implementation of an information security program. _________________________

Question 32

Major planning components should be reviewed on a periodic basis to ensure that they are current, accurate, and appropriate.

Question 33

Specific routine bulletins are issued when developing threats and specific attacks pose a measurable risk to the organization. _________________________

Question 34

Policy needs to be reviewed and refreshed from time to time to ensure that it's providing a current foundation for the information security program.

Question 35

When setting a policy about whether to pursue attacks against its systems, organizations must choose from three approaches.

Question 36

In some organizations, facilities management is the identification, inventory, and documentation of the current information system's status-hardware, software, and networking configurations. _________________________

Question 37

US-CERT is a set of moderated mailing lists full of detailed, full-disclosure discussions and announcements about computer security vulnerabilities. It is sponsored in part by SecurityFocus. _________________________

Question 38

Digital forensics involves chemical and microscopic analysis of evidence using computerized laboratory instruments.

Question 39

Tracking compliance involves assessing the status of the program as indicated by the database information and mapping it to goals established by the agency. _________________________

Question 40

An effective information security governance program requires constant change. _________________________

Question 41

A __________ is the recorded condition of a particular revision of a software or hardware configuration item.

A) state
B) version 
C) configuration
D) baseline

Question 42

A chain of custody is the detailed documentation of the collection, storage, transfer, and ownership of evidence from the crime scene through its presentation in court. ___________

Question 43

The internal vulnerability assessment is usually performed against every device that is exposed to the Internet, using every possible penetration testing approach. _________________________

Question 44

__________ are a component of the security triple.

A) Threats
B) Assets 
C) Vulnerabilities
D) All of the above

Question 45

The final process in the vulnerability assessment and remediation domain is the exit phase. _________________________

Question 46

The simplest part of an investigation is analyzing a copy or image for potential evidentiary material. __________

Question 47

To be put to the most effective use, the information that comes from the IDPS must be integrated into the inventory process. _________________________

Question 48

In digital forensic investigations for information security, most operations focus on policies-documents that provide managerial guidance for ongoing implementation and operations. ____________

Question 49

WLAN stands for "wide local area network." _________________________

Question 50

The primary goal of the external monitoring domain is to maintain an informed awareness of the state of all the organization's networks, information systems, and information security defenses. _________________________

Question 51

A(n) war game puts a subset of plans in place to create a realistic test environment. _________________________

Question 52

An affidavit is used as permission to search for evidentiary material at a specified location and/or to seize items to return to an investigator's lab for examination after being signed by an approving authority. _____________

Question 53

The process of identifying and documenting specific and provable flaws in the organization's information asset environment is called vulnerability assessment (VA). _________________________

Question 54

The best method of remediation in most cases is to repair a vulnerability. _________________________

Question 55

The CISO uses the results of maintenance activities and the review of the information security program to determine if the status quo can adequately meet the threats at hand. _________________________

Question 56

When possible, major incident response plan elements should be rehearsed. _________________________

Question 57

Organizations should have a carefully planned and fully populated inventory of all their network devices, communication channels, and computing devices. _________________________

Question 58

An example of the type of vulnerability exposed via traffic analysis occurs when an organization is trying to determine if all its device signatures have been adequately masked. _________________________

Question 59

You can document the results of the verification of a vulnerability by saving the results in what is called a(n) profile. _________________________

Question 60

A(n) __________ item is a hardware or software item that is to be modified and revised throughout its life cycle.

A) revision
B) update 
C) change
D) configuration

Question 61

The __________ is a statement of the boundaries of the RA.

A) scope
B) disclaimer 
C) footer
D) head

Question 62

The __________ vulnerability assessment is a process designed to find and document selected vulnerabilities that are likely to be present on the organization's internal network.

A) intranet
B) Internet 
C) LAN
D) WAN

Question 63

A primary mailing list for new vulnerabilities, called simply __________, provides time-sensitive coverage of emerging vulnerabilities, documenting how they are exploited and reporting on how to remediate them. Individuals can register for the flagship mailing list or any one of the entire family of its mailing lists.

A) Bug
B) Bugfix 
C) Buglist
D) Bugtraq

Question 64

The __________ Web site and list site seclists.org is home to the leading free network exploration tool, Nmap.

A) insecure.org
B) Packet Storm 
C) Security Focus
D) Snort-sigs

Question 65

__________, a level beyond vulnerability testing, is a set of security tests and evaluations that simulate attacks by a malicious external source (hacker).

A) Penetration testing
B) Penetration simulation 
C) Attack simulation
D) Attack testing

Question 66

__________ is used to respond to network change requests and network architectural design proposals.

A) Network connectivity RA
B) Dialed modem RA 
C) Application RA
D) Vulnerability RA

Question 67

The __________ process is designed to find and document vulnerabilities that may be present because there are misconfigured systems in use within the organization.

A) ASP
B) ISP 
C) SVP
D) PSV

Question 68

A step commonly used for Internet vulnerability assessment includes __________, which occurs when the penetration test engine is unleashed at the scheduled time using the planned target list and test selection.

A) scanning
B) subrogation 
C) delegation
D) targeting

Question 69

The __________ is a center of Internet security expertise and is located at the Software Engineering Institute, a federally funded research and development center operated by Carnegie Mellon University.

A) US-CERT
B) Bugtraq 
C) CM-CERT
D) CERT/CC

Question 70

__________ penetration testing is usually used when a specific system or network segment is suspect and the organization wants the pen tester to focus on a particular aspect of the target.

A) White box
B) Black box 
C) Gray box
D) Green box

Question 71

To maintain optimal performance, one typical recommendation suggests that when the memory usage associated with a particular CPU-based system averages __________% or more over prolonged periods, you should consider adding more memory.

A) 40
B) 60 
C) 10
D) 100

Question 72

One approach that can improve the situational awareness of the information security function is to use a process known as __________ to quickly identify changes to the internal environment.

A) baselining
B) difference analysis 
C) differentials
D) revision

Question 73

Control __________ baselines are established for network traffic and for firewall performance and IDPS performance.

A) system
B) application 
C) performance
D) environment

Question 74

Detailed __________ on the highest risk warnings can include identifying which vendor updates apply to which vulnerabilities as well as which types of defenses have been found to work against the specific vulnerabilities reported.

A) escalation
B) intelligence 
C) monitoring
D) elimination

Question 75

The __________ commercial site focuses on current security tool resources.

A) Nmap-hackerz
B) Packet Storm 
C) Security Laser
D) Snort-SIGs

Question 76

To evaluate the performance of a security system, administrators must establish system performance __________.

A) baselines
B) profiles 
C) maxima
D) means

Question 77

A process called __________ examines the traffic that flows through a system and its associated devices to identify the most frequently used devices.

A) difference analysis
B) traffic analysis 
C) schema analysis
D) data flow assessment

Question 78

The optimum approach for escalation is based on a thorough integration of the monitoring process into the __________.

A) IDE
B) CERT 
C) ERP
D) IRP

Question 79

Common vulnerability assessment processes include: 

A) Internet VA
B) wireless VA 
C) intranet VA
D) All of these

Question 80

The __________ mailing list includes announcements and discussion of a leading open-source IDPS.

A) Nmap-hackers
B) Packet Storm 
C) Security Focus
D) Snort