Q&A Hero

Q: The normal standard for deciding a case in ________ trials is a preponderance of the evidence. A) civil B) criminal C) Both A and B D) Neither A nor B

Q: The normal standard for deciding a case in ________ trials is guilt beyond a reasonable doubt. A) civil B) criminal C) Both A and B D) Neither A nor B

Q: Plaintiffs initiate legal proceedings in ________ cases. A) civil B) criminal C) Both A and B D) Neither A nor B

Q: Prosecutors initiate legal proceedings in ________ cases. A) civil B) criminal C) Both A and B D) Neither A nor B

Q: ________ punishments may result in jail time. A) Criminal B) Civil C) Both A and B D) Neither A nor B

Q: ________ punishments may result in fines. A) Criminal B) Civil C) Both A and B D) Neither A nor B

Q: ________ deals with the violation of criminal statutes. A) Criminal law B) Civil law C) Both A and B D) Neither A nor B

Q: ________ deals with interpretations of rights and duties that companies or individuals have relative to each other. A) Criminal law B) Civil law C) Both A and B D) Neither A nor B

Q: Which of the following should the CSIRT include? A) senior manager B) PR director C) firm's legal counsel D) All of the above

Q: The only person who should speak on behalf of a firm should be ________. A) the public relations director B) the firm's legal counsel C) Both A and B D) Neither A nor B

Q: Who should head the CSIRT? A) IT B) IT security C) A senior manager D) None of the above

Q: ________ investigate(s) most violations of local and state computer laws. A) Local police B) The FBI C) Both A and B D) Neither A nor B

Q: ________ evidence is evidence that is acceptable for court proceedings. A) Title 18 B) Title 11 C) Forensic D) Expert

Q: It is easier to punish employees than to prosecute outside attackers.

Q: Which of the following is not one of the three rules for apologies? A) Explain what happened. B) Acknowledge responsibility and harm. C) Use wording aimed at reducing lawsuits. D) Explain what action will be taken to compensate victims, if any.

Q: ________ eliminates the problem of having to re-baseline the system to proper security levels. A) Using a disk image B) Total software reinstallation C) Both A and B D) Neither A nor B

Q: Total software reinstallation effectively addresses data loss.

Q: Repair during ongoing server operation is ________. A) desirable B) dangerous C) Both A and B D) Neither A nor B

Q: If it can be applied, the least-damaging recovery option is ________. A) restoration from backup tapes B) total reinstallation C) repair during continuing server operation D) All of the above are about equally damaging

Q: Restoration of data files from tape ________. A) is the fastest recovery method B) always results in data loss C) Both A and B D) Neither A nor B

Q: The decision to let an attack continue should be made by ________. A) IT B) IT security C) senior business executives D) public relations

Q: Allowing an attacker to continue working in a system after the attack has been discovered ________. A) may allow the company to collect evidence for prosecution B) can be dangerous by allowing the attacker to do more damage C) Both A and B D) Neither A nor B

Q: Once an attack has begun, a company should never allow the attacker to continue.

Q: Black holing is an effective long-term containment solution.

Q: Dropping all future packets from a particular IP address is called ________. A) black holing B) disconnection C) IP address spoofing D) damaging

Q: Disconnection ________. A) is the most decisive way to do termination B) harms legitimate users C) Both A and B D) Neither A nor B

Q: Shredding is the best approach to destroying media.

Q: Wiping/clearing is the best approach to destroying media.

Q: The term sanitizing has lost its distinct meaning as special laboratory methods become ineffective.

Q: After destroying, data is ________. A) recoverable B) reusable C) Both A and B D) Neither A nor B

Q: After wiping/clearing, data is ________. A) recoverable B) reusable C) Both A and B D) Neither A nor B

Q: With basic file deletion, data is ________. A) recoverable B) reusable C) Both A and B D) Neither A nor B

Q: With nominal deletion, data is ________. A) recoverable B) reusable C) Both A and B. D) Neither A nor B.

Q: Using the delete key prevents data from being easily recovered.

Q: Wiped data can be read.

Q: The most common form of deletion in Windows-based systems is nominal deletion.

Q: Data destruction is ________. A) optional B) necessary C) Both A and B D) Neither A nor B

Q: One of the most often overlooked mechanisms used to reduce data loss is employee training.

Q: Most companies are quick to enforce strict data management policies.

Q: Restrictions on removable media should be enforced by relying on user behavior, rather than technological restrictions.

Q: To find out who is sending trade secrets out of the firm, you can use ________. A) DRM B) data extrusion management C) watermarking D) None of the above

Q: Adding invisible information to a file that can be used to identify its source is called ________. A) DRM B) data extrusion management C) watermarking D) None of the above.

Q: DRM usually is difficult to enforce.

Q: DRM restricts what people can do with sensitive material.

Q: Profiling uses ________ to find patterns in a dataset which uniquely identify an individual. A) statistical methods B) algorithms and mathematics C) All of the above. D) None of the above

Q: ________ is the process of obscuring data such that it cannot identify a specific person, but remains practically useful. A) DLP B) PII C) Data masking D) None of the above

Q: ________ is an example of PII. A) Individual database names B) Social Security number C) Process run to backup servers D) None of the above

Q: If a PC user has full-disk encryption, a weak password is not as great a danger as it would be if the disk were not encrypted.

Q: Encryption is usually fully transparent to the PC user.

Q: Trusting users to do key escrow is risky because ________. A) the user may not do it B) the user may not be able to find the key later C) the user may refuse to give it up if fired D) All of the above

Q: Companies address the risk of losing a security key by using ________. A) encryption key resets B) key escrow C) Both A and B D) Neither A nor B

Q: Losing an encryption key is not a serious danger.

Q: Changing the default listening port is an effective way of discouraging attackers from accessing the database.

Q: DLL triggers are used to ________. A) maliciously attack databases B) produce automatic responses if the data of the database has been altered. C) Both A and B D) Neither A nor B

Q: DML triggers are used to ________. A) maliciously attack databases B) produce automatic responses if the data of the database has been altered. C) Both A and B D) Neither A nor B

Q: DML triggers are used to ________. A) maliciously attack databases B) produce automatic responses if the structure of the database has been altered. C) Both A and B D) Neither A nor B

Q: DDL triggers are used to ________. A) maliciously attack databases B) produce automatic responses if the structure of the database has been altered. C) Both A and B. D) Neither A nor B.

Q: Triggers are damaging code that attackers use to destroy databases.

Q: Which of the following database events should be regularly audited? A) Warnings and exceptions B) Special access and logins C) Changes D) All of the above

Q: Sanitation can protect against SQL injection attacks.

Q: Validation can protect against SQL injection attacks.

Q: Example of DBMSs include ________. A) MySQL, Oracle B) IBM DB2, Microsoft SQL Server C) A only D) Both A and B

Q: When performing trend analysis, decreasing granularity in queries is desirable.

Q: When performing trend analysis, increasing granularity in queries is desirable.

Q: In relational database, an attribute is the same as a tuple or record.

Q: In relational database, a row is the same as a tuple or record.

Q: In relational database, a row is different from a record.

Q: In a relational database, examples of entities include ________. A) persons B) things C) events D) All of the above

Q: Most databases are relational databases.

Q: Databases are ________. A) integrated collections of data B) integrated collections of metadata C) Neither A nor B D) Both A and B

Q: Spreadsheets are rarely the subject of compliance regulations.

Q: Training users what not to put into e-mail messages is the most effective method of avoiding problems during the legal discovery process.

Q: Technology is the most effective method of avoiding problems during the legal discovery process.

Q: Retaining data can be ________. A) expensive B) susceptible to discovery of damaging information C) A only D) Both A and B

Q: Retaining data can create negative consequences.

Q: Policies should not require that backup data be encrypted.

Q: From a legal standpoint, loss of encrypted data comes with negligible risk from the loss private information.

Q: Who should be involved in the creation of retention policies? A) Business units B) The legal department C) Both A and B D) Neither A nor B

Q: Checkouts of backup media for restoration ________. A) are very common B) should be possible to be done immediately if the person checking out the tapes is an on-duty system administrator and signs out for the backup media. C) Both A and B D) Neither A nor B

Q: In the long term, backup media should be stored at a different site.