Question 1

The __________ is a statement of the boundaries of the RA.

Accepted Answer

The scope defines the limits and parameters of the RA. It outlines what will and will not be covered in the analysis.

Question 2

The __________ vulnerability assessment is a process designed to find and document selected vulnerabilities that are likely to be present on the organization's internal network.

Accepted Answer

The term "internal network" suggests that the assessment is focused on the organization's own network, namely its intranet. The other options, such as the Internet, LAN or WAN, may involve external networks or connections that are outside of the organization's control.

Question 3

A primary mailing list for new vulnerabilities, called simply __________, provides time-sensitive coverage of emerging vulnerabilities, documenting how they are exploited and reporting on how to remediate them. Individuals can register for the flagship mailing list or any one of the entire family of its mailing lists.

Accepted Answer

Bugtraq is a well-known primary mailing list that provides coverage of emerging vulnerabilities, how they are exploited, and how to remediate them. It is widely used by security professionals to stay updated on the latest security vulnerabilities.

Question 4

The __________ Web site and list site seclists.org is home to the leading free network exploration tool, Nmap.

Accepted Answer

The statement directly mentions that the website and list site seclists.org is home to Nmap, which is a free network exploration tool. Among the given options, Nmap is associated with insecure.org, making option A the correct choice. Packet Storm, Security Focus, and Snort-sigs are not associated with Nmap according to the statement.

Question 5

__________, a level beyond vulnerability testing, is a set of security tests and evaluations that simulate attacks by a malicious external source (hacker).

Accepted Answer

Penetration testing, also known as pen testing, is a simulated cyber attack on a computer system, network, or web application to check for vulnerabilities and potential security threats. It goes beyond vulnerability testing and involves a systematic approach to identify security weaknesses in the system and assess the potential impact of a successful cyber attack. The goal of penetration testing is to identify potential security gaps so that they can be addressed before an actual attack by a malicious external source (hacker) occurs.

Question 6

__________ is used to respond to network change requests and network architectural design proposals.

Accepted Answer

Network connectivity RA (Request for Action) is a formal response used to approve or deny network change requests or network architectural design proposals. It outlines the actions that will be taken to implement the proposed changes or design. Dialed modem RA is not a commonly used term. Application RA and Vulnerability RA are not directly related to network change requests or architectural design proposals.

Question 7

The __________ process is designed to find and document vulnerabilities that may be present because there are misconfigured systems in use within the organization.

Accepted Answer

PSV stands for "Preventative System Vulnerability." This process is designed to proactively search for and identify misconfigured systems that could potentially create vulnerabilities within an organization's network. It aims to identify both configuration issues as well as potential exploits that could be leveraged against the organization.

Question 8

A step commonly used for Internet vulnerability assessment includes __________, which occurs when the penetration test engine is unleashed at the scheduled time using the planned target list and test selection.

Accepted Answer

Scanning is the process of using a penetration test engine to examine a target system or network for vulnerabilities. It involves identifying what devices are on the network and their associated characteristics, such as open ports and running services, in order to identify potential points of attack. Subrogation, delegation, and targeting are not commonly used steps in Internet vulnerability assessment.

Question 9

The __________ is a center of Internet security expertise and is located at the Software Engineering Institute, a federally funded research and development center operated by Carnegie Mellon University.

Accepted Answer

The center of Internet security expertise located at the Software Engineering Institute is known as CERT/CC (Computer Emergency Response Team/Coordination Center). US-CERT (United States Computer Emergency Readiness Team) is a separate organization within the Department of Homeland Security that coordinates defense against and responses to cyber attacks. Bugtraq is a mailing list used for discussing computer security vulnerabilities and is not a center of expertise. CM-CERT is not a known organization in the field of cybersecurity.

Question 10

__________ penetration testing is usually used when a specific system or network segment is suspect and the organization wants the pen tester to focus on a particular aspect of the target.

Accepted Answer

The answer of __________ penetration testing is usually used when...

Question 11

To maintain optimal performance, one typical recommendation suggests that when the memory usage associated with a particular CPU-based system averages __________% or more over prolonged periods, you should consider adding more memory.

Accepted Answer

When the memory usage associated with a particular CPU-based system averages 60% or more over prolonged periods, you should consider adding more memory. This is because when memory usage reaches such high levels, it can cause the system to slow down or even crash, negatively affecting performance. Adding more memory can help alleviate this issue and allow the system to continue operating optimally.

Question 12

One approach that can improve the situational awareness of the information security function is to use a process known as __________ to quickly identify changes to the internal environment.

Accepted Answer

Difference analysis is a process used to identify changes by comparing current data against a baseline or previous data, thus improving situational awareness.

Question 13

Control __________ baselines are established for network traffic and for firewall performance and IDPS performance.

Accepted Answer

Control performance baselines are used to establish a standard for measuring the effectiveness of network traffic, firewall performance, and IDPS performance. These baselines include measurements of response times, throughput, error rates, and other relevant metrics that can help assess the health and efficiency of the network and security infrastructure. By analyzing performance data over time, IT managers can identify potential issues, adjust settings or configurations, and optimize network performance to meet business needs.  So, the correct choice is C.

Question 14

Detailed __________ on the highest risk warnings can include identifying which vendor updates apply to which vulnerabilities as well as which types of defenses have been found to work against the specific vulnerabilities reported.

Accepted Answer

The term "intelligence" refers to detailed information and analysis on security threats, and in this case, it specifically refers to information on high-risk vulnerabilities. The description of the intelligence provided in the sentence suggests that it includes information about which specific updates and defenses are effective against particular vulnerabilities. Therefore, the best choice is B, intelligence.

Question 15

The __________ commercial site focuses on current security tool resources.

Accepted Answer

Packet Storm is a popular commercial site that focuses on security tool resources, offering tools, exploits, and advisories for IT security professionals. The other options (Nmap-hackerz, Security Laser, Snort-SIGs) do not primarily focus on security tool resources.

Question 16

To evaluate the performance of a security system, administrators must establish system performance __________.

Accepted Answer

Establishing system performance baselines is necessary to measure the effectiveness and efficiency of a security system. It involves recording and analyzing the system's performance in normal operating conditions to identify any deviations or anomalies that may indicate a potential security threat. Profiles, maxima, and means are not as relevant in evaluating security system performance as baselines.

Question 17

A process called __________ examines the traffic that flows through a system and its associated devices to identify the most frequently used devices.

Accepted Answer

Traffic analysis examines the traffic that flows through a system and its associated devices. This process is used to identify the most frequently used devices, which can help in optimizing network performance and identifying potential security threats. Option A, difference analysis, is not relevant to this process. Option C, schema analysis, typically refers to the examination of database schemas and is not relevant to traffic analysis. Option D, data flow assessment, is a broader term that may include traffic analysis, but it is not specific enough.

Question 18

The optimum approach for escalation is based on a thorough integration of the monitoring process into the __________.

Accepted Answer

The optimum approach for escalation is based on a thorough integration of the monitoring process into the Incident Response Plan (IRP). The IRP documents the process and procedures to be followed to detect, contain, and recover from an incident. Therefore, integrating monitoring into the IRP ensures a streamlined and effective escalation process in the event of an incident. Choices A, B, and C are not relevant to the escalation process.

Question 19

Common vulnerability assessment processes include:

Accepted Answer

All three options - Internet VA, wireless VA, and intranet VA - are common vulnerability assessment processes. Therefore, the best choice would be option D - All of these.

Question 20

The __________ mailing list includes announcements and discussion of a leading open-source IDPS.

Accepted Answer

The Snort mailing list specifically discusses a leading open-source IDPS. Nmap-hackers, Packet Storm, and Security Focus may also discuss security topics, but they are not specific to discussing an open-source IDPS.

Quiz 12: Information Security Maintenance