Question 1

Ensuring that users have access only to the files they need to complete their tasks is an example of which principle?

Accepted Answer

The principle of least privilege states that users should only have access to the files, system resources, and applications they need to complete their tasks. This helps to minimize the potential damage that could be caused by a security breach or unauthorized access. Separation of duties is a principle that involves dividing tasks among multiple users to prevent any single user from having too much control over a system. Implicit deny is a security mechanism that denies access to a resource unless it has been explicitly granted. Keep it simple is a design principle that suggests that systems should be kept as simple as possible to minimize the potential for errors or security vulnerabilities.

Question 2

Which of the following is not one of the three general methods used in authentication?

Accepted Answer

The three general methods used in authentication are something you have, something you are, and something you know. "Something you do" is not one of the methods.

Question 3

A database server is put on the network by the for a project manager.No one is told it is there except for the project manager,so that he can work on it without worrying that other individuals will try to get to it.This is an example of which principle?

Accepted Answer

This scenario is an example of security through obscurity, which relies on keeping the existence and details of a security measure a secret in the hope that it will not be targeted by attackers. However, this principle is widely considered to be weak and unreliable, as attackers can still discover and exploit hidden systems or practices.

Question 4

Jane is in the finance department.Although she should not be able to modify files or folders from the marketing department,she can,and does.This a problem of ___________.

Accepted Answer

The problem described is a violation of integrity, which means that data is not being safeguarded from unauthorized modifications. This is different from confidentiality, which involves ensuring that data is restricted only to authorized individuals. Availability refers to ensuring that data is accessible to authorized users when needed. Authentication involves verifying the identity of a user attempting to access a system or data. Nonrepudiation involves ensuring that actions taken by a user within a system cannot be later denied or disavowed.

Question 5

The incident response team reviewed the security logs and discovered that the network had been breached,due to a misconfigured firewall.This is a failure of which element of the operational model of computer security?

Accepted Answer

The misconfigured firewall led to the network breach, indicating a failure in the prevention element of the operational model of computer security. The preventive measures in place failed to prevent the incident from occurring.

Question 6

The network engineer suggests purchasing two firewalls from different companies so that a vulnerability affecting one type of firewall will not leave the entire network vulnerable.This is an example of which principle?

Accepted Answer

The principle being described is diversity of defense, which involves using multiple types of defenses to guard against potential vulnerabilities. Option A (layered defense) is similar, but refers specifically to using multiple layers of defense within a single system or network, rather than using multiple types of defense. Option B (job rotation) is not relevant to this situation, and option D (security through obscurity) is the opposite of the recommended approach, as it involves relying on secrecy rather than robust defenses.

Question 7

A list of web sites that can be visited is created.Only sites that are on the list are allowed to be accessed.This is an example of which principle?

Accepted Answer

This is an example of the implicit deny principle, which states that all access should be denied by default unless it is explicitly granted. In this case, the list of allowed web sites serves as the explicit grant. The other principles listed (least privilege, separation of duties, and keep it simple) may also be important in an overall security strategy, but they are not directly related to the scenario described.

Question 8

Bob inadvertently disconnects the cable from the company file server.This creates a problem of ________.

Accepted Answer

The problem created by Bob inadvertently disconnecting the cable from the company file server is a problem of availability. The server is no longer accessible to the users, which affects their ability to access the information and resources they need for their work. Confidentiality, integrity, authentication, and nonrepudiation are all related to the security and verification of information, but they are not directly affected by the loss of availability.

Question 9

Requiring one employee to place an order and another employee to authorize the sale is an example of which principle?

Accepted Answer

Separation of duties is the principle of dividing the privileges of a process between multiple people to avoid any single person having control over all aspects of a process. In the given example, one employee places the order and another employee authorizes the sale, which is an example of separation of duties. This ensures that there is a check and balance system in place to prevent any single employee from having too much control over the process.

Question 10

The database administrator falls ill and is not able to come to work for three weeks.No one else in the company knows how to administer the database server.This is a result of not following which principle?

Accepted Answer

Job rotation is the principle of ensuring that multiple employees are cross-trained in various roles to mitigate the risk of single point of failure. If this principle was followed, there would have been someone else in the company who could administer the database server in the absence of the database administrator.

Question 11

The IDS fails to alert on an intruder's ping sweep and port scan.This is a failure of which element of the operational model of computer security?

Accepted Answer

The failure of IDS to alert on intruder's ping sweep and port scan is an issue of detection. IDS is deployed to detect malicious activities and provide alerts. In this case, IDS has failed to detect the intruder's activity, resulting in an undetected intrusion.

Question 12

Ensuring that and individual is who they claim to be is the function of _________.

Accepted Answer

Ensuring that an individual is who they claim to be is the function of authentication. Confidentiality is about keeping data secret, integrity is about maintaining data accuracy and completeness, availability is about making sure data is accessible when needed, and nonrepudiation is about preventing someone from denying that they performed an action.

Question 13

Reducing the number of services to the least number necessary for it to properly perform its functions is an example of which principle?

Accepted Answer

Keeping the number of services to the minimum required helps simplify the configuration of a computer, making it easier to manage, secure and reduce the attack surface, hence the "Keep it simple" principle. Option A, "Least privilege," refers to providing the minimum amount of access rights necessary for users or processes to perform their functions. Option B, "Separation of duties," aims at dividing tasks among different individuals to prevent conflicts of interests or fraud. Option C, "Implicit deny," is a default-deny approach to security, only allowing access to resources that have been explicitly granted permission.

Question 14

The hacker was successful in breaching the firewall,the packet filtering router,and the internal firewall,but was quickly detected and unable to get past the workstation personal firewall.This is an example of what principle?

Accepted Answer

This scenario illustrates the concept of layered security, also known as defense in depth, where multiple layers of security controls are used to protect assets. In this case, the hacker was able to bypass several layers of security but was ultimately stopped by the personal firewall on the workstation. This shows that even if one layer of security fails, there are additional layers in place to provide protection.

Question 15

Joe sends a scathing e-mail to his boss regarding increased work hours.Joe tries to deny sending the e-mail,but is unable to due to the use of digital signatures.This is an example of ________.

Accepted Answer

The situation described is an example of nonrepudiation, which is the assurance that a sender cannot deny sending a message, thanks to the use of digital signatures. This helps to ensure accountability and prevent disputes over the origin of a message.

Question 16

___________ places the focus on the security processes and the actual data.

Accepted Answer

Information assurance focuses on protecting the security and integrity of data, as opposed to just securing the computer or network. It encompasses processes such as risk assessments, access controls, and encryption to ensure the confidentiality, availability, and reliability of information.

Question 17

The term which refers to the attempt to gain unauthorized access to systems and computers used by a telephone company to operate its telephone network is a _______.

Accepted Answer

The term "phreaker" specifically refers to individuals who attempt to gain unauthorized access to telephone systems and networks. The other choices may refer to individuals who engage in unauthorized access to other types of systems or networks.

Question 18

Jane is in the finance department.Although she should not be able to open files or folders from the marketing department,she can and does.This a problem of ___________.

Accepted Answer

The problem described is a breach of confidentiality, as Jane is able to access files that should be restricted to the marketing department. Integrity refers to maintaining the accuracy and consistency of data, availability concerns the accessibility of data, authentication involves verifying the identity of users, and nonrepudiation entails ensuring that actions or transactions cannot be denied by the parties involved.

Question 19

A newly purchased server with a defect catches fire and all data on the device is lost.A backup was never performed.This is a failure of which element of the operational model of computer security?

Accepted Answer

The answer of A newly purchased server with a defect...

Question 20

The operational model of security is _____________.

Accepted Answer

The answer of The operational model of security is _____________.
...

Quiz 2: General Security Concepts