1. __ deals with the ability to verify that a message has been sent and received and that the sender can be identified and verified.   Nonrepudiation
2. __ is a group-wide decision that frequently comes through rounds of group negotiation.   Consensus
3. __ is the term that has been created to refer to the special targeting of groups with something in common when launching a phishing attack.   Spear phishing
4. __ refers to the “hacking” of the systems and computers used by a telephone company to operate its telephone network.  Phreaking
5. ____ is basically spam delivered via an instant messaging application.  SPIM
6. _____ is the concept of separating items so that they cannot interfere with each other.   Isolation
7. _______ is a procedure that allows communicating parties to verify that received or stored messages are authentic.   Message authentication
8. _______ is a set of actions taken to properly utilize resources to target the actual threats an enterprise is facing.   Threat intelligence
9. A flaw or weakness in a system’s design, implementation, or operation and management that could be exploited to violate the system’s security policy is a(n) _______   Vulnerability
10. A social engineer uses various deceptive practices to convince the targeted person to divulge information they normally would not divulge or to convince the target of the attack to do something they normally wouldn’t do.   True
11. Also referred to as single-key encryption, the universal technique for providing confidentiality for transmitted or stored data is _______   Symmetric encryption
12. Another term for defense in depth is layered security.   True
13. Because of malware’s nefarious purpose, there is no criminal distinction between the writers of malware and those who release malware.   False
14. Because of the nature of trust and its high-risk opportunity, the sage advice is to develop and maintain a culture embracing trust.   False
15. Combining one byte at a time with the plaintext stream using the XOR operation, a __________ is the output of the pseudorandom bit generator.   Keystream
16. Criminal activity on the Internet, at its most basic, is quite different from criminal activity in the physical world.   False
17. Cryptanalytic attacks try every possible key on a piece of ciphertext until an intelligible translation into plaintext is obtained.  False
18. Encapsulation is the concept of separating items so that they cannot interfere with each other.   True
19. Exception handling is an important consideration during software development.   True
20. How did the Code Red worm spread?   It made use of a buffer-overflow condition in Microsoft’s IIS web servers that had been known for a month.
21. If the only form of attack that could be made on an encryption algorithm is brute-force, then the way to counter such attacks would be to   use longer keys
22. Impersonation can be employed in online attacks.   True
23. In 2014, on how many different threat actors, including criminals, hactivists, state-sponsored groups, and nation states, did CrowdStrike report?    39
24. In April 2009, Homeland Security Secretary Janet Napolitano told reporters   China and Russia made attempts to break into the US electric power grid
25. In many early cases of computer crime, the perpetrator of the crime intended to cause damage to the computer.   False
26. In most security circles, security through obscurity is considered a good approach, especially if it is the only approach to security.   False
27. In most security circles, security through obscurity is considered a good approach, especially if it is the only approach to security.   False
28. In the Biba security model, instead of security classifications, integrity levels are used.   True
29. In the Clark-Wilson security model, what are the two levels of integrity?     Constrained data items (CDIs) and unconstrained data items (UDIs)
30. In the early days of computers, security was considered to be a binary condition in which your system was either secure or not secure   True
31. Into which threat category does information warfare fall   Highly Structured
32. Into which threat category does information warfare fall?   highly structured
33. Like the MAC, a hash function also takes a secret key as input.   False
34. Melissa is the best known of the early macro-type viruses that attach themselves to documents for programs that have limited macro programming capability.   True
35. Most current ransomware attacks use a hybrid encrypting scheme, locking the files on a victim’s computer until a ransom is paid.   True
36. On average, __________ of all possible keys must be tried in order to achieve success with a brute-force attack.   Half
37. Public-key algorithms are based on simple operations on bit patterns.   False
38. The ________ threat category contains threats that are characterized by a greater amount of planning, a longer period of time to conduct the activity, more financial backing to accomplish it, and possibly corruption of, or collusion with, insiders.  Structured
39. The ________ threat category contains threats that are characterized by a much longer period of preparation (years is not uncommon), tremendous financial backing, and a large and organized group of attackers.   Highly structured
40. The act of deliberately accessing computer systems and networks without authorization is generally referred to as    hacking
41. The advantage of a stream cipher is that you can reuse keys.   False
42. The entity that implements a chosen security policy and enforces those characteristics deemed most important by the system designers is known as the __________.   Security Model
43. The most important symmetric algorithms, all of which are block ciphers, are the DES, triple DES, and the   AES
44. The principle of open design holds that the protection of an object should rely upon secrecy of the protection mechanism itself.    False
45. The purpose of a __________ is to produce a “fingerprint” of a file, message, or other block of data.   hash function
46. The purpose of the __________ algorithm is to enable two users to securely reach agreement about a shared secret that can be used as a secret key for subsequent symmetric encryption of messages.   Diffie-Hellman Key Agreement
47. The strength of a hash function against brute-force attacks depends solely on the length of the hash code produced by the algorithm.  True
48. The term “________” refers to whether a control can be verified to be functioning properly.   Auditability
49. The term “script kiddies” refers to   A hacker of low-end technical ability.
50. Time can be manipulated to drive a sense of ________ and prompt shortcuts that can lead to opportunities for interjection into processes.   Urgency
51. Today, the data stored and processed by computers is almost always more valuable than the hardware.   True
52. Transmitted data stored locally are referred to as   data at rest
53. Two of the most important applications of public-key encryption are digital signatures and key management.   True
54. What are the policies of the Biba model?   No read down, no write up, and no executing programs up
55. What are the policies of the Biba model?   Ring (no read down) and Low-Water-Mark (no write up)
56. What are the three operational tenets found in secure deployments?     Session management, exception management, and configuration management
57. What are the three types of accounting records in TACACS+?    START, STOP, and UPDATE
58. What concept allows us to understand the relationship between prevention, detection, and response?   time-based security
59. What is one of the most fundamental principles in security?   Least Privilege
60. What name was given to an intellectual property attack executed against oil, gas, and petrochemical companies in the United States?   Operation Night Dragon
61. What name was given to an intellectual property attack executed against oil, gas, and petrochemical companies in the United States?   Operation Night Dragon
62. What name was given to the advanced persistent threat (APT) style spy network responsible for bugging the Dalai Lama’s office?    GhostNet
63. What name was given to the advanced persistent threat (APT)-style spy network responsible for bugging the Dalai Lama’s office?  GhostNet
64. What security design principle states that secrecy itself cannot be relied upon as a means of protection?   open design
65. What target did the teenage hacker who went by the name “Jester” attack in March 1997?   He cut off telephone services to the FAA control tower as well as the emergency services at the Worcester Airport and the community of Rutland, Massachusetts.
66. What was the primary lesson learned from the Slammer worm?   It drove home the point that the Internet could be adversely impacted in a matter of minutes.
67. What was the primary lesson learned from the Slammer worm?   It drove home the point that internet could be adversely impacted in a matter of minutes.
68. When an attacker uses a(n) ________ technique, the attacker assumes a role that is recognized by the person being attacked, and in assuming that role, the attacker uses the potential victim’s biases against their better judgment to follow procedures.   Impersonation
69. Where do changes in trust occur?    At the trust boundary.
70. Which brand-name attack group consists of Russian hackers who have brought major issues to Ukraine via numerous attacks over the past couple of years?   Sandworm
71. Which confidentiality model is defined by controlling read and write access based on conflict of interest rules   Brewer-Nash security model
72. Which confidentiality model is defined by controlling read and write access based on conflict of interest rules?    Brewer-Nash security model
73. Which equation describes the operational model of security?   Protection = Prevention + (Detection + Response)
74. Which Internet criminal is famous for conducting his attacks using a number of different “tools” and techniques, including social engineering, sniffers, and cloned cellular telephones?
    B. Kevin Mitnick    Kevin Mitnick
75. Which Internet worm created infected systems that were part of what is known as a bot network (or botnet) and could be used to cause a DoS attack on a target or to forward spam e-mail to millions of users?    Conficker
76. Which Internet worm, released in 1988, is considered to be one of the first real Internet crime cases?    The Morris Worm
77. Which Internet worm, released in 1988, is considered to be one of the first real Internet crime cases?   The Morris Worm
78. Which of the following devices is a sophisticated countermeasure to piggybacking?   a man trap
79. Which poor security practice is one of the most common and most dangerous?   choosing poor passwords
80. Which security model uses transactions as the basis for its rules?   Clark-Wilson
81. Which security principle is characterized by the use of multiple, different defense mechanisms with a goal of improving the defensive response to an attack?   defense in depth
82. Which security principle is described as always using simple solutions when available?   economy of mechanism
83. Which security principle refers to the concept that each and every request should be verified?  Complete mediation
84. Which security principle states that if you have not specifically been allowed access, then it should be denied?   Implicit deny
85. Which statement accurately describes how pharming is accomplished?   The attacker modifies the host files, which are used to convert the URLs to the appropriate IP address, so that the user is directed to a fake website.
86. Which statement applies to viruses?    They typically are highly visible once released.
87. Which statement applies to viruses?   They are typically highly visible once released.
88. Which statement describes an example of a poor security practice?   An employee creates a strong password and then uses it for all accounts.
89. Which statement describes how dumpster diving is accomplished?   An attacker attempts to find little bits of information that could be useful for an attack in a target’s trash can.
90. Which statement describes how piggybacking is accomplished?     An attacker follows closely behind a person who has just used their own access card or PIN to gain physical access to a room or a building.
91. Which term describes a means of separating the operation of an application from the rest of the operating system?   Sandboxing
92. Which term describes an attack that changes URLs in a server’s domain name table?   DNS poisoning
93. Which term describes the process where individuals analyze the binaries for programs to discover embedded passwords or cryptographic keys?   Reverse-engineering
94. Which term is used when separation of privilege is applied to people?    separation of duties
95. Which term refers to an attack conducted against a site with software that is vulnerable to a specific exploit?    Target of opportunity
96. Which term refers to an attack conducted against a site with software that is vulnerable to a specific exploit?  Target of opportunity attack
97. Which term refers to making different layers of security dissimilar so that even if attackers know how to get through a system that comprises one layer, they may not know how to get through a different type of layer that employs a different system for security?   Diversity of defense
98. Which term refers to the design and operation of elements to ensure the proper functional environment of a system?   Configuration Management
99. Who is considered to be the ultimate insider, with his name being synonymous with the insider threat issue?   Edward Snowden

Other Links:

Statistics Quiz

Networking Quiz

See other websites for quiz:

Check on QUIZLET

Check on CHEGG