IST 462
Test 4 NAME Monique DePass
Part 2
True/False
Indicate whether the statement is true or false.
True 1. One of the most important assets any organization possesses is its data.
True 2. Determining vulnerabilities often depends upon the background and experience of the assessor.
False 3. Security weaknesses can always be entirely eliminated.
False 4. Because port numbers are 32 bits in length they can have a decimal value from 0 to 65,535.
True 5. Most network mappers utilize the TCP/IP protocol Internet Control Message Protocol (ICMP).
True 6. A decentralized organizational structure for privilege management delegates the authority for assigning or revoking privileges more closely to the geographic location or end user.
True 7. Permissions inheritance becomes less complicated with GPOs.
True 8. A baseline is a reference set of data against which operational data is compared.
True 9. Although hashing is considered a cryptographic algorithm, its function is not to create a ciphertext that can later be decrypted by the receiving party.
False 10. Hashing is the same as creating a checksum.
Multiple Choice
Identify the choice that best completes the statement or answers the question.
C 11. In information security, a ____ is the likelihood that a threat agent will exploit a vulnerability.
a. / hole / c. / Riskb. / threat / d. / Weakness
C 12. Identifying vulnerabilities through a(n) ____ determines the current security weaknesses that could expose assets to threats.
a. / asset identification / c. / vulnerability appraisalb. / threat identification / d. / risk mitigation
C 13. Most communication in TCP/IP involves the exchange of information between a program running on one device (known as a ____) and the same or a corresponding process running on another device.
a. / port / c. / Scannerb. / socket / d. / Process
C 14. TCP/IP uses a numeric value as an identifier to applications and services on the systems. These are known as the ____.
a. / process / c. / port numberb. / socket / d. / Protocol
B 15. ____ are typically used to determine the state of a port to know what applications are running and could be exploited.
a. / Network scanners / c. / Port testersb. / Port scanners / d. / Network testers
B 16. ____ are software tools that can identify all the systems connected to a network.
a. / Port scanners / c. / ICMP mappersb. / Network mappers / d. / ICMP scanners
A 17. ____ provides support to IP in the form of ICMP messages that allow different types of communication to occur between IP devices.
a. / SNMP / c. / HTTPb. / SMTP / d. / ICMP
D 18. ____ is a generic term that refers to a range of products that look for vulnerabilities in networks or systems.
a. / Port scanner / c. / Pingb. / Network mapper / d. / Vulnerability scanner
D 19. ____ is a method of evaluating the security of a computer system or network by simulating a malicious attack instead of just scanning for vulnerabilities.
a. / Vulnerability scanning / c. / Port scanningb. / Network mapping / d. / Penetration testing
A 20. The ____ is typically defined as the person responsible for the information, who determines the level of security needed for the data, and delegates security duties as required.
a. / guardian / c. / Ownerb. / manager / d. / Custodian
D 21. The Windows file and folder ____ permission allows files or folders to be opened as read-only and to be copied.
a. / Write / c. / Modifyb. / Read and Execute / d. / Read
B 22. ____ assigns a level of business importance, availability, sensitivity, security and regulation requirements to data.
a. / Usage auditing / c. / Usage classificationb. / Security auditing / d. / Data classification
B 23. ____ is the process for generating, transmitting, storing, analyzing, and disposing of computer security log data.
a. / Log management / c. / Event managementb. / Log auditing / d. / Event auditing
C 24. ____ servers are intermediate hosts through which Web sites are accessed.
a. / NIDS / c. / Proxyb. / Authentication / d. / HIPS
B 25. Logs based on ____ are the second common type of security-related operating system logs.
a. / event records / c. / event logsb. / system events / d. / audit records
C 26. ____ refers to a methodology for making changes and keeping track of those changes, often manually.
a. / Event auditing / c. / Change managementb. / Event management / d. / Log management
B 27. ____ monitoring compares activities against a predefined signature.
a. / Signature-based / c. / Behavior-basedb. / Anomaly-based / d. / Time-based
B 28. A ____ baseline is a reference set of data established to create the “norm” of performance for a system or systems.
a. / configuration / c. / Systemb. / performance / d. / monitoring
A 29. Data that is in an unencrypted form is called ____ data.
a. / plaintext / c. / hidetextb. / caesartext / d. / cleartext
A 30. ____, also called a one-way hash, is a process for creating a unique “signature” for a set of data.
a. / Digital signing / c. / Hashingb. / Decrypting / d. / Encrypting
B 31. The simplest type of stream cipher is a ____ cipher. It simply substitutes one letter or character for another.
a. / transposition / c. / permutationb. / substitution / d. / homoalphabetic
A 32. A ____ substitution cipher maps a single plaintext character to multiple ciphertext characters.
a. / polyalphabetic / c. / homoalphabeticb. / monoalphabetic / d. / random
A 33. ____ was approved by the NIST in late 2000 as a replacement for DES.
a. / AES / c. / Twofishb. / 3DES / d. / Blowfish
C 34. ____ is a block cipher that processes blocks of 64 bits.
a. / SHA-1 / c. / RC2b. / RC4 / d. / MD5
D 35. The asymmetric algorithm ____ was published in 1977 and patented by MIT in 1983.
a. / AES / c. / SHAb. / Diffie-Hellman / d. / RSA
C 36. The strength of the ____ algorithm is that it allows two users to share a secret key securely over a public network.
a. / DES / c. / Diffie-Hellmanb. / RSA / d. / AES
D 37. Microsoft’s ____ is a cryptography system for Windows operating systems that use the Windows NTFS file system.
a. / GPG / c. / PGPb. / AES / d. / EFS
B 38. Cryptography can also be applied to entire disks. This is known as ____ encryption.
a. / symmetric / c. / file systemb. / whole disk / d. / EFS
C 39. To protect data stored on a hard drive, Microsoft Windows Vista includes ____ drive encryption.
a. / IDEA / c. / BitLockerb. / TPM / d. / AES
B 40. ____ is a hardware-enabled data encryption feature.
a. / BitLocker / c. / AESb. / EFS / d. / DES