Business Terms
Knowledge I
Bonus
Knowledge II
Security+ Logic
100
Software vendors protect themselves from the liabilities of their own vulnerabilities with this.
End-User License Agreement (EULA)
100
The process of protecting a resource so that it is used only by those allowed to use it; a particular method used to restrict or allow access to resources.
access control
100
Which of the following pieces of information makes it easiest for a subject to steal your identity? a.) Full Name b.) DOB c.) SSN d.) Current Address
c.) SSN
100
The administrator is updating firmware on routers throughout the company. Where should the administrator document this work? a.) Event Viewer b.) Router's System Log c.) Change Management System d.) Compliance Review System
c.) Change Management System
100
AAA stands for this.
Authentication Authorization Accounting
200
This is the amount of time it takes to recover and make a system, application, and data available for use after an outage.
Recovery time objective (RTO)
200
An authentication token used to process challenge-response authentication with a server. It takes the server's challenge value and calculates a response. The user enters the response to authenticate a connection.
asynchronous token
200
access-list 101 deny ip any any
an ACL that will block all IP traffic
200
Sally is sending an e-mail, and she encrypted a portion of the e-mail with her private key. What can this provide? a.) Confidentiality b.) Validation of her certificate c.) Non-repudiation d.) One-time pad
c.) Non-repudiation
200
Kyle uses asymmetric encryption. He encrypted a message file with his private key and posted it in a forum. A user would like to reply to Kyle. What information is need for the user to reply through encryption while retaining confidentiality?
The user will need Kyle's Public Key
300
This is known as the annual probability that a stated threat will be realized.
Annual rate of occurrence (ARO)
300
A security firm has been engaged to assess a software application. A production-like test environment, login details, production documentation, and source code have been provided. Which of the following types of testing is being described? a.) White box b.) Gray box c.) Black box d.) Red teaming
a.) White box
300
access-list 10 deny 10.1.10.0 0.0.0.255 access-list 10 permit any
An ACL that will block any traffic from the 10.1.10.0/24 network
300
The C-I-A triad stands for this
Confidentiality Integrity Availability
300
A bulk update process fails and writes incorrect data throughout the database. Which of the following concepts describes what has been compromised? a.) Authenticity b.) Integrity c.) Availablility d.) Confidentiality
b.) Integrity
400
This name is given to a risk-analysis method that uses relative ranking to provide further definition of the identified risks in order to determine responses to them.
Qualitative risk analysis
400
An authentication method in which a user is authenticated at multiple times or event intervals.
continuous authentication
400
This is the process by which data is packaged as segments, segments as packets, packets as frames, and frames becoming bits placed on the medium.
Encapsulation
400
On-going annual awareness security training should be coupled with: a.) succession planning b.) implementation of security controls c.) user rights and permissions review d.) signing of a user agreement
d.) signing of a user agreement
400
This is the basis for authentication used in Kerberos
Ticket
500
This is a formal analysis of an organization's functions and activities that classifies them as critical or noncritical.
Business impact analysis (BIA)
500
What name is given to an access control method that bases access control approvals on the jobs the user is assigned?
Role-based access control (RBAC)
500
access-list 101 deny tcp 10.1.50.0 0.0.0.63 host 10.1.80.16 eq www access-list 101 permit ip any any
An ACL to block any web traffic from network 10.1.50.0/26(.192) to specific host with the address of 10.1.80.16.
500
Due to sensitive data concerns, a security administrator has enacted a policy preventing the use of flash drives. Additionally, which of the following can the administrator implement to reduce the risk of data leakage? a.) Enact a policy that all work files are to be password protected. b.) Enact a policy banning users from bringing in personal music devices. c.) Provide users with encrypted storage devices that remain on-site. d.) Disallow users from saving data to any network share.
b.) Enact a policy banning users from bringing in personal music devices.
500
Which proprietary authentication protocol uses TCP and which non-proprietary authentication protocol uses UDP?
TACACS+ and RADIUS
M
e
n
u