156-110 Online Practice Questions and Answers

A(n) ________________ is a one-way mathematical function that maps variable values into smaller values of a fixed length.

A. Symmetric key

B. Algorithm

C. Back door

D. Hash function

E. Integrity

Which of the following calculations is used when selecting countermeasures?

A. Annualized Rate of Occurrence

B. Single Loss Expectancy

C. Annualized Loss Expectancy

D. Business Impact Analysis

E. Business Continuity Plan

Which of the following is an integrity requirement for Remote Offices/Branch Offices (ROBOs)?

A. Private data must remain internal to an organization.

B. Data must be consistent between ROBO sites and headquarters.

C. Users must be educated about appropriate security policies.

D. Improvised solutions must provide the level of protection required.

E. Data must remain available to all remote offices.

If e-mail is subject to review by individuals other than the sender and recipient, what should be clearly stated in the organization's e-mail policy?

A. Technologies and methods used to monitor and enforce the organization's policies

B. Senior management and business-unit owner responsibilities and delegation options

C. Clear, legally defensible definition of what constitutes a business record

D. Consequences for violation of the organization's acceptable-use policy

E. No expectation of privacy for e-mail communications, using the organization's resources

Distinguish between the role of the data owner and the role of the data custodian. Complete the following sentence. The data owner is the:

A. department in the organization responsible for the data's physical storage location. The data custodian is anyone who has access the data for any reason.

B. person or entity who accesses/and or manipulates data or information, in the course of assigned duties. The data custodian is a person or process with the appropriate level of privilege to access the data.

C. person or entity ultimately responsible for the security of an information asset. The data custodian is the person or entity responsible for imposing and enforcing policies and restrictions, dictated by the data owner.

D. person or process that originally creates the information. The data custodian is a role that shifts to any person or process currently accessing the data, and passes to the next person or process to access the data.

E. person or entity responsible for imposing and enforcing policies and restrictions, dictated by the functional user. The data custodian is a person or process who accesses and/or manipulates the information.

How is bogus information disseminated?

A. Adversaries sort through trash to find information.

B. Adversaries use anomalous traffic patterns as indicators of unusual activity. They will employ other methods, such as social engineering, to discover the cause of the noise.

C. Adversaries use movement patterns as indicators of activity.

D. Adversaries take advantage of a person's trust and goodwill.

E. Seemingly, unimportant pieces of data may yield enough information to an adversary, for him to disseminate incorrect information and sound authoritative.

What type of document contains information on alternative business locations, IT resources, and personnel?

A. End-user license agreement

B. Nondisclosure agreement

C. Acceptable use policy

D. Security policy

E. Business continuity plan

Internal intrusions are loosely divided into which categories? (Choose TWO.)

A. Attempts by insiders to perform appropriate acts, on information assets to which they have been given rights or permissions.

B. Attempts by insiders to access resources, without proper access rights.

C. Attempts by insiders to access external resources, without proper access rights.

D. Attempts by insiders to perform inappropriate acts, on external information assets to which they have been given rights or permissions.

E. Attempts by insiders to perform inappropriate acts, on information assets to which they have been given rights or permissions.

Which of the following best describes an external intrusion attempt on a local-area network (LAN)?

A. Internal users try to gain unauthorized access to information assets outside the organizational perimeter.

B. External-intrusion attempts from sources outside the LAN are not granted permissions or rights to an organization's information assets.

C. External users attempt to access public resources.

D. External intruders attempt exploitation of vulnerabilities, to remove their own access.

E. Internal users perform inappropriate acts on assets to which they have been given rights or permissions.

What is the purpose of resource isolation?

A. To reduce the level of broadcast traffic on physical segments.

B. To ensure that anyone accessing a resource has appropriate integrity.

C. To automate the creation of access control lists and Trusted Computing Bases.

D. To enforce access controls, and clearly separate resources from each other.

E. To make people buy more computers than they really need.