156-110 Online Practice Questions and Answers

Which of the following statements about the maintenance and review of information security policies is NOT true?

A. The review and maintenance of security policies should be tied to the performance evaluations of accountable individuals.

B. Review requirements should be included in the security policies themselves.

C. When business requirements change, security policies should be reviewed to confirm that policies reflect the new business requirements.

D. Functional users and information custodians are ultimately responsible for the accuracy and relevance of information security policies.

E. In the absence of changes to business requirements and processes, information-security policy reviews should be annual.

Why should the number of services on a server be limited to required services?

A. Every open service represents a potential vulnerability.

B. Closed systems require special connectivity services.

C. Running extra services makes machines more efficient.

D. All services are inherently stable and secure.

E. Additional services make machines more secure.

A(n) __________________________ is issued by senior management, and defines an organization's security goals.

A. Records-retention procedure

B. Acceptable-use policy

C. Organizational security policy

D. Security policy mission statement

E. Service level agreement

A(n) _______ occurs when intrusion-detection measures fail to recognize suspicious traffic or activity.

A. False positive

B. False negative

C. CIFS pop-up

D. Threshold

E. Alarm

What is single sign-on? An authentication method:

A. that allows users to authenticate once, and then uses tokens or other credentials to manage subsequent authentication attempts

B. that stores user credentials locally, so that users need only authenticate the first time, a local machine is used

C. requiring the use of one-time passwords, so users authenticate only once, with a given set of credentials.

D. that uses smart cards, hardware tokens, and biometrics to authenticate users; also known as three-factor authentication

E. that requires users to re-authenticate for every resource accessed

Why does the (ISC)2 access-control systems and methodology functional domain address both the confidentiality and integrity aspects of the Information Security Triad? Access-control systems and methodologies:

A. are required standards in health care and banking.

B. provide redundant systems and data backups.

C. control who is allowed to view and modify information.

D. are academic models not suitable for implementation.

E. set standards for acceptable media-storage devices.

Internal intrusions are loosely divided into which categories? (Choose TWO.)

A. Attempts by insiders to perform appropriate acts, on information assets to which they have been given rights or permissions.

B. Attempts by insiders to access resources, without proper access rights.

C. Attempts by insiders to access external resources, without proper access rights.

D. Attempts by insiders to perform inappropriate acts, on external information assets to which they have been given rights or permissions.

E. Attempts by insiders to perform inappropriate acts, on information assets to which they have been given rights or permissions.

Which of the following is likely in a small-business environment?

A. Most small businesses employ a full-time information-technology staff.

B. Resources are available as needed.

C. Small businesses have security personnel on staff.

D. Most employees have experience with information security.

E. Security budgets are very small.

Which encryption algorithm has the highest bit strength?

A. AES

B. Blowfish

C. DES

D. CAST

E. Triple DES

Why should user populations be segmented?

A. To allow resources to be shared among employees

B. To allow appropriate collaboration, and prevent inappropriate resource sharing

C. To prevent appropriate collaboration

D. To provide authentication services

E. To prevent the generation of audit trails from gateway devices