(Test Bank) Wgu C845 - Information Systems Security (Sscp)

Unknown, 1

Computer Science & Engineering

Test Bank

1st Edition

• $15.00 $50.00

---

Description

Test Bank for Wgu C845 - Information Systems Security (Sscp), The downloadable file consists of 586 pages, and the total size of the file is 1.49 MB. Purchase now only for highly discounted price.

---

---

Study Note Preview

WGU C845 - Information Systems Security (SSCP) Testbank Which of the following is a symmetric algorithm? A Diffie -Hellman B RSA C AES D HMAC - ✔✔C How can a user be given the power to set privileges on an object for other users when within a DAC operating system ? A Remove special permissions for the user on the object. B Grant the user full control over the object. C Give the user the modify privilege on the object. D Issue an administrative job label to the user. - ✔✔B Your company adopts a new end -user security awareness program. This training includes malware introduction, social media issues, password guidelines, data exposure, and lost devices. How often should end users receive this training? A once a year and upon termination B upon new hire and once a year thereafter C upon termination D twice a year E upon new hire F once a year - ✔✔B What type of event is more likely to trigger the business continuity plan (BCP) rather than the disaster recovery plan (DRP)? A A port -scanning event against your public servers in the DMZ B A security breach of an administrator account C Several users failing to remember their logon credentials D A level 5 hurricane - ✔✔B What is the IEEE standard known as port -based network acce ss control which is used to leverage authentication already present in a network to validate clients connecting over hardware devices, such as wireless access points or VPN concentrators? A IEEE 802.1x B IEEE 802.15 C IEEE 802.3 D IEEE 802.11 - ✔✔A Why i s change control and management used as a component of software asset management? A To stop changes from being implemented into an environment B To oversee the asset procurement process C To prevent or reduce unintended reduction in security D To restrict the privileges assigned to compartmentalized administrators - ✔✔C What is the cost benefit equation? A [ALE1 - ALE2] - CCM B AES - CCMP C total initial risk - countermeasure benefit D AV x EF x ARO - ✔✔A What is the best means to restore t he most current form of data when a backup strategy is based on starting each week off with a full backup followed by a daily differential? A Restore the initial week's full backup and then the last differential backup before the failure. B Restore only the last differential backup. C Restore the initial week's full backup and then each differential backup up to the failure. D Restore the last differential backup and then the week's full backup. - ✔✔A Which of the following is not considered an example of a non -discretionary access control system? A MAC B ACL C ABAC D RBAC - ✔✔B How should countermeasures be implemented as part of the recovery phase of incident response? A During next year's security review B Based on the lowest cost among available options C As defined by the current security policy D As determined by the violation that occurred - ✔✔D Remote control malware was found on a client device, and an unknown attacker was manipulating the network f rom afar. The attack resulted in the network switches reverting to flooding mode, thereby enabling the attacker to eavesdrop on a significant portion of network communications. After reviewing IDS and traffic logs, you determine that this was accomplished by an attack utility which generated a constant Ethernet frames with random source MAC addresses. What can be done to prevent this attack from occurring in the future? A Restrict access to DHCP. B Use a static HOSTS file. C Use MAC limiting on the switch ports. D Implement an ARP monitor. - ✔✔C How is quantitative risk analysis performed? A Through the Delphi technique B With scenario -based assessments C Using calculations D Via employee interviews - ✔✔C What special component on a motherboard can be us ed to securely store the encryption key for whole drive encryption? A CMOS B RAM C TPM D CPU - ✔✔C When is it appropriate to contact law enforcement when an organization experiences a security breach? A If a violation is more severe than just breaking c ompany policy rules B If a breach of security occurs C If a tolerable or accepted risk is realized D If an insider uses another employee's credentials - ✔✔A What is the name of a cryptographic attack based on a database of pre -computed hash values and the original plaintext values? A Brute force attack B Rainbow table attack C Frequency analysis D Chosen plaintext attack - ✔✔B What is the purpose of a Securi ty Information and Event Management (SIEM) product? A To provide real -time logging and analysis of security events B To define the requirements of security procedures C To provide event planning guidance for holding industry conferences D To improve emplo yee security training - ✔✔A How does salting passwords reduce the likelihood that a password cracking attack will be successful? A It prevents automated attacks. B It forces the attacker to focus on one account at a time. C It triggers an account lockout after a fixed number of false attempts. D It increases the work load required to become successful. - ✔✔D Which of the following clearance levels or classification labels is not generally used in a government - or military -based MAC scheme? A Unclassifie d B Confidential C Top Secret D Proprietary - ✔✔D You are starting a new website. You want to quickly allow users to begin using your site without having the hassle of creating a new user account. You set up a one -way trust federated access link from your website to the three major social networks. Why sh ould you use a one -way trust in this configuration rather than a two -way trust in this scenario? A A one -way trust allows your website to trust the user accounts of the social networks without requiring the social networks to trust your website. B Two -way trusts are only valid in private networks and cannot be used across the Internet. C A one -way trust allows your website to access the file storage of the social networks. D A two -way trust would grant the social network administrators full access to yo ur backend database. - ✔✔A Why should the risks of an organization be reported as defined by enterprise risk management (ERM)? A It is a means to predict loss, select countermeasures, and reduce downtime. B It is a government regulation. C It helps with internal transparency, risk assessment, risk response, and risk monitoring. D It assists with strategic planning, compliance, and training. - ✔✔C A common attack against wireless networks is to guess the static password needed to authenticate to the base station. Which technology can be used to minimize this risk? A IEEE 802.1x B IEEE 802.15 C IEEE 802.11n D IEEE 802.1q - ✔✔A John works in an organization. He is trying to insert a password to log in his account on the organization's login website. Which of the following best describes the use of passwords for access control? A Authorization B Authentication C Identification D Auditing - ✔✔B How can skilled IT workers evaluate new software without exposing their systems to infection or malware compromise? A Test using a sandbox. B Implement an IDS. C Use anti -malware scanners. D Use an administrator account. - ✔✔A How can account provisionin g be configured so that the assignment of rights and privileges is nearly automatic once the account is created? A Trigger a random number generator to assign privileges on various resources. B Enable new users to set their own privileges. C Use an RBAC mechanism where a new user's role is set by an HR admin. D Follow a strict procedure where granular access is set on a per -object basis for each user by an administrator. - ✔✔C How are the access control schemes of MAC and RBAC distinguished from DAC? A They are based on user identity. B They are not based on assigned labels. C They are based on object hosted ACLs. D They are not based on user decisions. - ✔✔D What is the company security policy that allows workers to use their own personal equipment t o interact with company resources? A BYOD B MOU C AUP D CPS - ✔✔A What is the purpose of a business continuity plan (BCP)? A To maintain the ability to perform mission critical work tasks while dealing with harmful events B To define performance requirements and consequences if providers fail to meet quality expectations C To restore mission critical tasks D To train replacement personnel in the event of a senior executive leaving the organization - ✔✔A Selecting a cloud provider can be a challenge. Often, it is not possible to determine whether a provider's services are sufficient for your needs until you have started using its service. If you determine that an initial cloud system is insufficient and you need to move yo ur data and custom code to a different cloud provider, what is needed as a feature of the initial cloud provider that did not work out for you? A Storage encryption B VPN connectivity C Activity auditing D Data portability - ✔✔D How can the burden of han dling a specific security risk be transferred to the shoulders of another organization? A More thorough user training B Outsourcing C Decommissioning equipment D Implementing market leading countermeasure - ✔✔B When working with big data, the storage location where all of the raw data is housed until it is needed for mining or processing is known as? A Data lake B Data warehouse C Database D Data mart - ✔✔A How can non -repudiation be achieved by the typical use r when communicating over e -mail? A Employ encryption and a digital envelope. B Obtain a digital certificate. C Use a digital signature. D Ask for proof of receipt. - ✔✔C What is the primary concern for any situation involving the triggering of a disaste r recovery plan (DRP)? A Avoiding downtime B Reducing asset loss C Preservation of human life D Minimizing costs - ✔✔C Which type of network segment is created by a switch, but requires a routing function to be present to interact between network segment s? A Community B Domain C Subnet D VLAN - ✔✔D Why do many security monitoring systems produce a visualization of the collected results? A Security tools do not support spreadsheet presentations. B The lists of text and numbers takes up too much screen space. C It represents complex or bulky data in an easy to understand format. D It is the only way to represent passively monitored systems. - ✔✔C How can multiple distinct physical network topologi es be combined into a single network structure? A Deploy a star topology. B Deploy a ring topology. C Deploy a tree topology. D Deploy a bus topology. - ✔✔C What is the term used to refer to an activity, occurrence, or event which could cause damage or harm to an organization? A Incident B Alarm C Baseline D Clipping level - ✔✔A How can files be easily exchanged between systems whether local or remote, when various operating systems are involved, and when all systems support the TCP/IP protocol stack? A SMB B NFS C FTP D Telnet - ✔✔C How does a Trojan horse get past security mechanisms to harm a victim? A By attaching itself to an existing file B By displaying advertisements for intriguing applications C By seeming to be a benign item D By using system resources to distribute itself to other networked devices - ✔✔C Which term refers to the virtualization of networking which grants more control and flexibility over networking than using the traditional hardware -only means of network man agement? A iSCSI B Software -defined network C Bridging D Hypervisor - ✔✔B What is the most appropriate use of IPSec? A Processing encryption B Storage encryption C Data transmission protection D Database protection - ✔✔C Why are initialization vectors used as common components of encryption algorithms? A They determine the range of values into which a block can resolve. B They increase the chaos in encrypted output.