Networking

Q: Discuss operational auditing. Include in your discussion what should be looked for in an operational audit and what methods might be used in the audit.

Q: What is security auditing and what type of information should be analyzed?

Q: List three types of changes for which you should use change management.

Q: How can change adversely affect your network?

Q: Discuss the process of IDPS signature evaluation.

Q: How does distributed data collection work when collecting data from multiple sensors?

Q: List the advantages of centralized data collection.

Q: If you determine that a Trojan program has been installed and is initiating a connection to a remote host and you suspect passwords have been compromised, what steps should you take? List three of them.

Q: List four type of events you should monitor as part of a security event management program.

Q: a. active defense in depth f. operational auditb. centralized data collection g. security event management programc. degaussing h. social engineeringd. distributed data collection i. target-to-console ratioe. independent audit j. Tinkerbell program1/ an audit in which an outside firm inspects audit logs to ensure that an organization is collecting the information it needs2/ a strong implementation of the DiD concept in which security personnel expect that attacks will occur and try to anticipate them3/ a technique of tricking employees into divulging passwords or other information4/ the process of magnetically erasing an electronic device, such as a monitor or a disk5/ the number of target computers on a network managed by a single command console6/ an audit by an organization's own staff that examines system and security logs7/ a system in which an organization's event and security data is funneled to a management console in the main office8/ a program in which network connections are scanned and alerts are generated when logons are attempted from a suspicious IDPS9/ a program that gathers and consolidates events from multiple sources so that the information can be analyzed to improve network security10/ a system in which data from security devices goes to a management console on its own local network

Q: A(n) ____________________ audit should look for accounts assigned to employees who have left the company or user group.

Q: One way to consolidate the data from several network and security devices is to transfer the information to a central _______________.

Q: Groups known as ______________ teams are assembled to actively test a network.

Q: _______________ management involves modifying equipment, systems, software, or procedures in a sequential, planned way.

Q: You monitor and evaluate network traffic to gather evidence that indicates whether your IDPS _________________ are working well or need to be updated.

Q: With ___________________ data collection, data from security devices goes to a management console on its own local network.

Q: Each IDPS has _____________ that gather data passing through the gateway.

Q: The ________________ command reviews the current connections and reports which ports a server is listening to.

Q: You should review the logs and alerts created by your security devices, a process called _________ monitoring.

Q: To manage the security information from the devices in a large network, you should establish a security incident _________________ team.

Q: How much space is typically needed to store IDPS data?a. a few hundred Kilobytes c. a megabyte or twob. a gigabyte or more d. at least a terabyte

Q: Which aspect of strengthening the performance of IDPS may involve degaussing?a. managing memory c. managing storageb. managing bandwidth d. managing processors

Q: What approach to security calls for security through a variety of defensive techniques that work together?a. DOA c. DiDb. WoL d. PoE

Q: What should an outside auditing firm be asked to sign before conducting a security audit?a. subpoena c. search and seizure contractb. nondisclosure agreement d. social engineering covenant

Q: The process of testing a network defense system is referred to as which of the following?a. security auditing c. IDPS evaluationb. change management d. distributed data collection

Q: Which type of change does NOT typically require the use of change management procedures?a. new VPN gateways c. changing a manager's permissions to a fileb. changes to ACLs d. new password systems or procedures

Q: Which of the following is a security-related reason for monitoring and evaluating network traffic?a. to determine if your IDPS signatures are working well b. to create substantial data to analyze c. to optimize your router and switch protocolsd. to see how many files employees download form the Internet

Q: Which of the following is a benefit of using centralized data collection to manage sensor data?a. less network traffic c. data stays on the local networkb. less administrative time d. must use a VPN to transport data

Q: Which of the following is NOT a type of event that you would normally monitor?a. user account creation c. antivirus scanningb. e-mail attachment handling d. access to shared folders

Q: Which of the following is NOT typically an aspect of a security event management program?a. monitoring events c. managing data from sensorsb. managing IDPS firmware d. managing change

Q: Since system intrusions take place over a very short period of time, there is no need to maintain IDPS log data for more than a few hours.

Q: An IDPS must have enough memory to maintain connection state information.

Q: Nonrepudiation is the use of encryption methods to ensure the confidentiality of data.

Q: An operational audit looks for accounts that have weak or blank passwords.

Q: Security auditing is the process of documenting countermeasures put in place due to attacks on the network.

Q: Change management should be used before making changes to firewall or IDPS rules that affect users.

Q: Most IDPSs use random ports to transfer security data, thereby making it difficult for attackers to exploit.

Q: In centralized data collection, data from sensors go to security managers at each corporate office.

Q: One of the events you should continually monitor is logins.

Q: Network protection is something you should implement initially and then only make changes if there is a serious security breach.

Q: Which best defines residual risk?a. risk that occurs as a result of new vulnerabilities b. the amount of risk remaining after countermeasures are implemented c. a vulnerability for which the risk has been reduced to zerod. the cost of implementing solutions to an assessed risk

Q: Which of the following would be considered a vulnerability?a. installation of a firewall c. Internet-connected computerb. antivirus software d. spyware

Q: Which of the following is NOT among the six factors needed to create a risk analysis?a. threats c. personnel profilesb. consequences d. probabilities

Q: What is considered the first step in formulating a security policy?a. risk analysis c. risk reductionb. elimination of threats d. system monitoring

Q: Which of the following is considered an asset?a. hacker c. disgruntled employeeb. unpatched Web server d. intellectual property

Q: Which of the following is NOT a phase in the system development life cycle?a. needs assessment c. system implementationb. security audit d. performance monitoring

Q: An extranet is a backup network that you can use if the main network fails.

Q: The people that manage security for the organization should not be same people that conduct risk analysis.

Q: The first step in SNA is the survivability analysis.

Q: The first phase of the system development life cycle is needs assessment.

Q: Once written, a security policy should not be altered so that you can maintain consistency.

Q: What are the three levels of escalation of threat or security incidents? Describe them.

Q: What is a server security policy? List at least three areas the policy should address.

Q: Describe a remote access and wireless connection policy and the use of role-based authentication. Include two-factor authentication in your discussion.

Q: What points should a third-party access policy include? List at least three.

Q: What is the purpose of a privileged access policy?

Q: What should you do if a security policy violation involves a criminal offense? Include the Fourth Amendment in your discussion.

Q: What are three questions you should ask in deciding how your organization should perform risk analysis?

Q: What are three areas in which the use of encryption should be considered to maintain confidentiality?

Q: What are the four steps of Threat and Risk Assessment?

Q: a. extranet f. search warrantb. network assets g. subpoenac. privileged access policy h. tunneling protocolsd. risk management i. two-factor authenticatione. role-based authentication j. vulnerabilities1/ a process of analyzing the threats an organization faces2/ a legal document that requires a person to appear in court, provide testimony,or cooperate with law enforcement3/ situations or conditions that increase threats, which in turn increase risk4/ a method of authentication that grants users limited system access based on their assigned role in the company5/ authentication that requires more than one form of verification for a user to be granted access6/ routers, cables, bastion hosts, servers, and firewall components that enable employees to communicate with one another7/ a legal document issued by a court that allows authorities to search a particular place for specific evidence8/ a private network that a company sets up as an extension of its corporate intranet9/ network protocols that encapsulate (wrap) one protocol or session inside another10/ a document that details additional access options and responsibilities of users with privileged access to resources

Q: The portion of a security policy that describes who responds when there has been a security breach is called the ______________ response section.

Q: VPNs create a _____________ to transport information through public communications media.

Q: Search warrants and subpoenas were developed in response to the _____________ Amendment which protects U.S. residents against illegal search and seizure.

Q: ________________ clauses exist in acceptable use policies so that companies can discipline employees whose computer activities interfere with productivity.

Q: By providing _________________ through backup systems, you ensure information remains accessible if primary systems go offline.

Q: SNA starts with the assumption that a system or network will be ________________.

Q: ____________________ risk is the amount of risk left over after countermeasures are implemented.

Q: Your exposure to risk increases if your organization has one or more factors that increase _____________ probabilities.

Q: The process called _____________ analysis determines the threats an organization faces.

Q: The __________________ phase of the system development life cycle can lead you to the needs assessment phase where the cycle begins again.

Q: The process of reviewing records of network computer activity is called which of the following?a. monitoring c. auditingb. archiving d. recording

Q: Which of the following best describes ROI?a. the chance that a threat will result in lost money b. how long before an investment will pay for itself c. the cost of mitigating a threatd. the benefits of setting security priorities

Q: Which of the following requires you to assist police by appearing in court or producing evidence?a. subpoena c. the 4th amendmentb. search warrant d. de facto agent

Q: Which of the following defines how employees should use the organization's computing resources?a. Network and Internet Policy c. Computing and Resource Policyb. Email and Spam Policy d. Acceptable Use Policy

Q: Which of the following shows how devices are connected and includes an IP allocation register?a. hardware inventory c. asset tableb. topology map d. security policy

Q: Which of the following best describes a Monte Carlo simulation?a. a technique for simulating an attack on a system b. a formula that estimates the cost of countermeasures c. a procedural system that simulates a catastrophed. an analytical method that simulates a real-life system for risk analysis

1 2 3 … 25 Next »

Subjects