Question 1

Jane spends quite a bit of time on Facebook,and other social networking sites during work hours.This has resulted in reduced productivity.This is likely a violation of which policy?

Accepted Answer

Jane's behavior is likely a violation of the acceptable use policy, which outlines rules for using company resources such as computers and internet access. Social networking sites may not be an approved use during work hours, and excessive use can result in reduced productivity.

Question 2

Which of the following is a security model that addresses integrity?

Accepted Answer

The Biba security model addresses integrity by focusing on preventing unauthorized modifications to data. It does this by enforcing a set of rules that restrict the flow of information in a system based on levels of trust or integrity. The Bell-LaPadula model, on the other hand, focuses on confidentiality, while Layered defense and Ring models are not specific security models related to integrity.

Question 3

Authentication means that the person who sends and e-mail will be unable to deny sending the e-mail.

Accepted Answer

Authentication verifies the identity of the sender, but it does not prevent them from denying sending the email. Digital signatures can be used for non-repudiation, which means that the sender cannot deny sending the message, but this is not the same as authentication.

Question 4

Access controls,firewalls,and encryption are technologies used for prevention.

Accepted Answer

Access controls, firewalls, and encryption are all technologies used to prevent unauthorized access and protect data from potential threats.

Question 5

Computer security and information assurance are the same thing.

Accepted Answer

While computer security and information assurance are related, they are not the same thing. Computer security involves protecting computer systems and networks from unauthorized access or attacks, while information assurance involves ensuring the confidentiality, integrity, and availability of information.

Question 6

The policies of the Biba model are

Accepted Answer

The answer of The policies of the Biba model are
...

Question 7

Background checks,drug testing,retirement,and termination are elements found in which type of policy?

Accepted Answer

These elements, such as background checks, drug testing, retirement, and termination, are all related to the employment of personnel and human resources management. Therefore, they are found in human resources policies. Option A is incorrect because due diligence is a general term that refers to the process of conducting a thorough investigation and assessment before entering into a business relationship or transaction. Option C is incorrect because equal opportunity policies focus on anti-discrimination, affirmative action, and diversity initiatives. Option D is also incorrect because privacy policies mainly deal with data protection, confidentiality, and consent.

Question 8

Auditability refers to whether a control can be verified as functioning or not.

Accepted Answer

Auditability is the ability to verify whether a control is functioning effectively or not. Therefore, the statement "Auditability refers to whether a control can be verified as functioning or not" is true.

Question 9

A person who tries to gradually obtain information necessary to compromise a network-by first appealing for help,and then,if necessary,by a more aggressive approach-is a(n)__________.

Accepted Answer

The person described in the question is a social engineer. Social engineering is the use of psychological manipulation to trick people into divulging sensitive information or access to secure systems. This often involves an attacker posing as a colleague, customer, or authority figure to gain the victim's trust and convince them to provide information or perform certain actions. The other choices (phreaker, hacktivist, and terrorist) do not accurately describe the type of attacker in this scenario.

Question 10

Nonrepudiation means that the person who sends an e-mail will be unable to deny sending the e-mail.

Accepted Answer

Nonrepudiation ensures that the sender of an e-mail cannot deny having sent it, providing accountability and authenticity for electronic transactions.

Question 11

The A in CIA refers to the term auditability.

Accepted Answer

The A in CIA refers to the term "availability". The full form of CIA is Confidentiality, Integrity, and Availability.

Question 12

Audit logs,intrusion detection systems,and honeypots are technologies used for detection.

Accepted Answer

Audit logs, intrusion detection systems, and honeypots are all technologies used for detecting security threats and incidents. Audit logs record activity on systems and networks, allowing administrators to review and investigate suspicious events. Intrusion detection systems monitor network traffic for signs of unauthorized access or malicious activity. Honeypots are decoy systems designed to lure attackers and record their actions for analysis and mitigation.

Question 13

During the day,it takes an employee twice as long to retrieve files from the server that is under attack.The attack has resulted in a degradation of availability.
If the employee is able to get the files,but it takes twice as long,it means that the employee can only get half as many files in a day.

Accepted Answer

If it takes an employee twice as long to retrieve files, they will only be able to retrieve half as many files in a day. This is because it takes them longer to access and download each individual file.

Question 14

When files are modified by someone who is not authorized to do so,this is problem of confidentiality.

Accepted Answer

The problem in this scenario is actually a problem of integrity, as the unauthorized modification of files can compromise their accuracy and reliability. Confidentiality refers to the protection of sensitive information from unauthorized access or disclosure.

Question 15

The formula for the operational model of computer security is Prevention = Protection + (Detection + Response)

Accepted Answer

The correct formula for the operational model of computer security is Defense = Prevention + (Detection + Response). This model emphasizes that a comprehensive security strategy involves not just preventing attacks but also detecting them when they occur and responding effectively.

Question 16

A company doing business online conducted all financial transactions over the Internet without any encryption.As a result,customer information such as credit card numbers,expiration dates,and the security codes found on the back of the credit cards was stolen.This is a violation of which policy?

Accepted Answer

This is a violation of the company's due diligence policy, which requires them to take reasonable steps to protect sensitive customer information such as encrypting financial transactions over the Internet.

Question 17

John,who is in the development group,has admin passwords to both the development group files and the production group files.This might be a violation of which policy?

Accepted Answer

The policy of "Need to know" requires that users should only have access to the information that is necessary for them to perform their duties. In this case, John's access to both development and production group files is not necessary for him to perform his role in the development group, which means that he has been given access beyond what he needs to know.

Question 18

Which of the following is a security model that uses transactions as the basis for its rules?

Accepted Answer

Clark-Wilson is a security model that emphasizes data integrity through the use of transactions. It ensures that all data modifications are subject to a set of well-defined rules and that each transaction starts with a validated set of inputs and ends with a validated set of outputs. The other models listed here either do not use transactions as their basis or do not have data integrity as their primary focus.

Question 19

Rumors spread around the office that Mrs.Smith was stealing office supplies as well as talking badly about the senior management.This rumor eventually reached her boss,who then fired her.This is likely a violation of which policy?

Accepted Answer

This is a violation of due process, as Mrs. Smith was terminated without being given the opportunity to defend herself against the rumor or having an investigation conducted to determine the truth of the accusation. Without due process, termination of this nature would be wrongful and could lead to legal consequences.

Question 20

The policies of the Bell-LaPadula model are

Accepted Answer

The Bell-LaPadula model includes two main policies: the *-Property (pronounced star-property) which prohibits write-down operations, and the Simple Security Rule which prohibits read-up operations. Therefore, the correct choice is D, which includes both policies in its answer. The other options include policies that are not part of the Bell-LaPadula model.

Quiz 2: General Security Concepts