Deck 1: Introduction

Question 1

A loss of confidentiality is the unauthorized modification or destruction of information.

Answer 1

False

Question 2

__________ attacks attempt to alter system resources or affect their operation.


A)Active 

B)Release of message content
C)Passive 

D)Traffic analysis

Answer 2

A

Question 3

A connection-oriented integrity service deals with individual messages without regard to any larger context and generally provides protection against message modification only.

Answer 3

False

Question 4

Information access threats exploit service flaws in computers to inhibit use by legitimate users.

Question 5

The emphasis in dealing with passive attacks is on prevention rather than detection.

Question 6

In developing a particular security mechanism or algorithm one must always consider potential attacks on those security features.

Question 7

Patient allergy information is an example of an asset with a moderate requirement for integrity.

Question 8

Viruses and worms are two examples of software attacks.

Question 9

There are clear boundaries between network security and internet security.

Question 10

__________ assures that a system performs its intended function in an unimpaired manner, free from deliberate or inadvertent unauthorized manipulation of the system.


A)Data confidentiality 

B)Availability
C)System integrity 

D)Privacy

Question 11

There is a natural tendency on the part of users and system managers to perceive little benefit from security investment until a security failure occurs.

Question 12

_________ security consists of measures to deter, prevent, detect, and correct security violations that involve the transmission of information.


A)Computer
B)Internet
C)Intranet
D)Network

Question 13

Data origin authentication provides protection against the duplication or modification of data units.

Question 14

Data integrity is the protection of data from unauthorized disclosure.

Question 15

The more critical a component or service, the higher the level of availability required.

Question 16

The CIA triad embodies the fundamental security objectives for both data and for information and computing services.

Question 17

Verifying that users are who they say they are and that each input arriving at the system came from a trusted source

A)authenticity
B)accountability 

C)integrity 

D)confidentiality

Question 18

The security goal that generates the requirement for actions of an entity to be traced uniquely to that entity is _________ .

A)accountability 

B)authenticity 

C)privacy 

D)integrity

Question 19

With the introduction of the computer the need for automated tools for protecting files and other information stored on the computer became evident.

Question 20

__________ assures that systems work promptly and service is not denied to authorized users.


A)Integrity 

B)Availability
C)System integrity 

D)Data confidentiality

Question 21

A possible danger that might exploit a vulnerability, a _________ is a potential for violation of security which exists when there is a circumstance, capability, action, or event that could breach security and cause harm.


Question 22

The prevention of unauthorized use of a resource is __________ .


A)access control 

B)authentication
C)data confidentiality 

D)nonrepudiation

Question 23

An intelligent act that is a deliberate attempt to evade security services and violate the security policy of a system is an __________ .


Question 24

Student grade information is an asset whose confidentiality is considered to be highly important by students and, in the United States, the release of such information is regulated by the __________.


Question 25

Active attacks can be subdivided into four categories: replay, modification of messages, denial of service, and __________ .


Question 26

A __________ takes place when one entity pretends to be a different entity.


A)passive attack 

B)masquerade
C)modification of message 

D)replay

Question 27

The __________ service addresses the security concerns raised by denial-of-service attacks.


A)event detection 

B)integrity 

C)availability 

D)routing control

Question 28


X.800 divides security services into five categories: authentication, access control, nonrepudiation, data integrity and __________ .


Question 29

The protection of data from unauthorized disclosure is _________ .


A)access control 

B)authentication
C)data confidentiality 

D)nonrepudiation

Question 30

_________ is a professional membership society with worldwide organizational and individual membership that provides leadership in addressing issues that confront the future of the Internet and is the organization home for the groups responsible for Internet infrastructure standards, including the IETF and the IAB.

A)ITU-T 

B)ISO 

C)FIPS 

D)ISOC

Question 31

_________ is the insertion of bits into gaps in a data stream to frustrate traffic analysis attempts.


A)Notarization 

B)Authentication exchange
C)Routing control 

D)Traffic padding

Question 32

_________ is a variety of mechanisms used to assure the integrity of a data unit or stream of data units.


A)Data integrity 

B)Authentication exchange
C)Trusted functionality 

D)Event detection

Question 33

__________ is a U.S.federal agency that deals with measurement science, standards, and technology related to U.S.government use and to the promotion of U.S.private sector innovation.

A)ISO 

B)NIST 

C)ITU-T 

D)ISOC

Question 34

The common technique for masking contents of messages or other information traffic so that opponents, even if they captured the message, could not extract the information from the message is _________ .


Question 35

A __________ attack attempts to learn or make use of information from the system but does not affect system resources.


Question 36

X.800 defines _________ as a service that is provided by a protocol layer of communicating open systems and that ensures adequate security of the systems or of data transfers.


A)replay 

B)integrity 

C)authenticity 

D)security service

Question 37

__________ is the use of mathematical algorithms to transform data into a form that is not readily intelligible, in which the transformation and subsequent recovery of the data depend on an algorithm and zero or more encryption keys.


Question 38

_________ is defined as "the protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity, availability, and confidentiality of information system resources".

Question 39

Three key objectives that are at the heart of computer security are: confidentiality, availability, and _________ .


Question 40

A loss of _________ is the disruption of access to or use of information or an information system.

Question 41

A __________ is data appended to, or a cryptographic transformation of, a data unit that allows a recipient of the data unit to prove the source and integrity of the data unit and protect against forgery.

Question 42

__________ prevents either sender or receiver from denying a transmitted message; when a message is sent the receiver can prove that the alleged sender in fact sent the message and when a message is received the sender can prove that the alleged receiver in fact received the message.


Question 43

In the context of network security, _________ is the ability to limit and control the access to host systems and applications via communications links.


Question 44

The __________ is a worldwide federation of national standards bodies that promote the development of standardization and related activities with a view to facilitating the international exchange of goods and services and to developing cooperation in the spheres of intellectual, scientific, technological, and economic activity.