CS450

Encryption is a failsafe—even if security configurations fail and the data falls into the hands of an unauthorized party, the data can't be read or used without the keys.

_______________ is a distributed form of cloud computing, where the workload is performed on a distributed, decentralized architecture.

Specifying compute requirements in terms of resources needed (for example, processing power and storage) is an example of _______________.

Which cloud computing service model describes cloud-based systems that are delivered as a virtual solution for computing that allows firms to contract for utility computing as needed rather than build data centers?

Which cloud computing service model involves the offering of software to end users from within the cloud?

Which computing service model is used for the outsourcing of security functions to a vendor that has advantages in scale, costs, or speed?

With the growth of cloud services, applications, storage, and processing, the scale provided by cloud vendors has opened up new offerings that are collectively called ________.

When software, either malware or an attacker, escapes from one VM to the underlying OS, this is referred to as _______________.

Which term refers to a network connection used to interconnect virtual private clouds and on-premises networks?

When an infrastructure is established "on premises," the unit of computing power is a server.

Zones can be used for replication and provide load balancing as well as high availability.

Type II hypervisors run directly on the system hardware.

Private cloud services will separate users with security restrictions, but the depth and level of these restrictions will be significantly greater than in a public cloud.

Which marketing term is used to describe the offering of a computing platform combining multiple sets of software in the cloud?

One of the characteristics of cloud computing is transparency to the end user.

Cloud-based data storage was one of the first uses of cloud computing.

Which term describes the hosting of a desktop environment on a central server?

Which term denotes the policies and procedures employed to connect the IAM systems of the enterprise and the cloud to enable communication with the data?

_______________ is the term used to describe the offering of a computing platform in the cloud.

The term "_______________ cloud" refers to a cloud service rendered over a system that is open for public use.

Which capability must be enabled on firewalls, secure web gateways, and cloud access security brokers to determine if the next system in a communication chain is legitimate or not?

Which process involves implementing security tools and policies to ensure your container is running as intended?

Which term is used for an integrated suite of tools or services offered as Security as a Service, or a third-party managed security service provider (MSSP), focused on cloud security?

Which type of computing brings processing closer to the edge of the network, which optimizes web applications and IoT (Internet of Things) devices?

Platform as a Service (PaaS) offerings generally focus on security and scalability.

Clouds can be created by many entities, but must be internal to an organization.

Which cloud system is defined as one where several organizations with a common interest share a cloud environment for the specific purposes of the shared endeavor?

________ are a form of operating system virtualization; they are a packaged-up combination of code and dependencies that help applications run quickly in different computing environments.

The network process of separating network elements into segments and regulating traffic between the segments is called ________.

If your organization is highly sensitive to sharing resources, you might want to consider the use of a public cloud to reduce exposure and increase your control over security, processing, and handling of data.

A(n) ________ is a low-level program that allows multiple operating systems to run concurrently on a single host computer.

A(n) ________ is a company that remotely manages security services for customers based on a contractual arrangement.

A(n) _______________ structure is one where elements are combined from private, public, and community cloud structures.

A(n) _______________ allows connections to and from a virtual private cloud instance.

A virtual private cloud ________ allows connections to and from a virtual private cloud instance.

The technology used to enable a computer to have more than one OS present and, in many cases, operating at the same time is ________.

The ________ network in a cloud environment can be used and manipulated by users, whereas the actual network underneath cannot.

The ________ model is an iterative model designed to enable the construction of increasingly complex versions of a project.

Which phase of the secure development lifecycle model is concerned with minimizing the attack surface area?

What does the term waterfall reference?

The ________ phase of software development should define the specific security requirements if there is any expectation of them being designed into the project.

________ is a combination of development and operations—in other words, a blending of tasks performed by a company's application development and systems operations teams.

Nearly half of all exploits of computer programs stem historically from some form of buffer overflow.

A(n) ________ is any characteristic of an asset that can be exploited by a threat to cause harm.

Least privilege refers to removing all controls from a system.

The spiral model is an iterative model designed to enable the construction of increasingly complex versions of a project.

Secure coding refers to adding security functionality into a piece of software.

The generation of a real random number is a trivial task.

Cryptography is the universal solution to all security problems.

Which software engineering process model is characterized by iterative development, where requirements and solutions evolve through an ongoing collaboration between self-organizing cross-functional teams?

A(n) ________ system is a system that, once deployed, is never modified, patched, or upgraded.

Using the ________ analysis information, penetration testers can emulate adversaries and attempt a wide range of known attack vectors in order to verify that the known methods of attack are all mitigated.

Baselining is the process of determining a standard set of functionality and performance.

Testing for security requires a much broader series of tests than functional testing does.

Unvalidated input that changes the code's functioning in an unintended way is which type of application attack?

Which technique uses random inputs to check for exploitable buffer overflows?

________ is a term for the execution of computer code in an environment designed to isolate the code from direct contact with the target system.

Developing and maintaining a series of ________ and prohibiting their use in new code, while removing them from old code when possible, is a proven path toward more secure code.

The design of use cases to test specific functional requirements occurs based on the requirements determined in which phase of the secure development lifecycle?

Which proven method of testing software involves comparing program responses to known inputs and the resulting program output to the desired output?

Which type of attack can be used to execute arbitrary commands in a database?

The use of legacy code in current projects should exempt that code from security reviews.

Final code can be subjected to ________ tests, designed specifically to test configuration, security controls, and common defenses such as input and output validation and error handling.

Which type of testing involves running the system under a controlled speed environment?

Which of the OWASP Top 10 Vulnerabilities describes applies to user-supplied data that is not validated, filtered, or sanitized by the application.

Which of the following OWASP Top 10 web application vulnerabilities is most related to the protection needs of data in transit and at rest?

Which of the following is a defense most related to Security Logging and Monitoring Failures?

Which of the following is an appropriate defense against Identification and Authentication Failures?

Which of the following is a critical first step in testing web applications?

Which of the following tools would be most appropriate for penetration testing a web application by manipulating headers?

Which of the following is an important defense against Software and Data Integrity Failures?

A ______________ occurs whenever a web application is fetching a remote resource without validating the user-supplied URL.

A(n) ________ is any resource or information an organization needs to conduct its business.

Which of the following is a popular open-source tool that can perform and automated vulnerability scan of a web application?

What is the number of findings discovered by Nikto?

Which of the following process did Nikto find to be out of date?

How many high risk alerts were found by ZAP?

Which of the following is a high risk alert found by ZAP?

Which of the following is required before you begin vulnerability testing of a web application?

Which of the following is an appropriate defense against security misconfigurations?

The Python-based program designed to assist penetration testers in the gathering of information during the reconnaissance portion of a penetration test is called ________.

Which command is used to monitor network connections to and from a system?

Which command in Linux is used to show and manipulate routing, devices, policy routing, and tunnels?

To examine a DNS query for a specific address, you can use the ________ command.

________ is a cryptographically secured means of communicating to and managing a network over an unsecured connection.

Which testing technique requires that the testers have no knowledge of the internal workings of the software being tested?

Which is the correct syntax for the ping command?

The ________ command sends echo requests to a designated machine to determine if communication is possible.

The movement to an account that enables root or higher-level privilege is known as ________.

Which testing technique is performed by testers who have detailed knowledge of the application and can thus test the internal structures within an application for bugs, vulnerabilities, and so on?

During penetration testing, zero-day vulnerabilities will be established.

In an "old school" attack, which step is a listing of the systems and vulnerabilities to build an attack game plan?

Tools that do not interact with the system in a manner that would permit detection through sending packets or altering traffic are called ________ tools.

The ________ is a set of tools that can be used to target attacks at the people using systems; it has applets that can be used to create phishing e-mails, Java attack code, and other social engineering-type attacks.

The ________ command is the Linux command used to change access permissions of a file.

When the nmap tool is used, the sending of packets cannot be detected.

What term is used for a situation where a scanner fails to report a vulnerability that actually does exist—that is, where the scanner simply missed the problem or didn't report it as a problem?

The ________ is a list of known vulnerabilities in software systems.

The ________ command provides a list of the hosts, switches, and routers in the order in which a packet passes through them, providing a trace of the network route from source to target.

The logger command works from the command line, from scripts, or from other files, thus providing a versatile means of making log entries.

The ________ is the element that connects all the computing systems together, carrying data between the systems and users.

After a penetration test is planned, ________ is the first step in performing that test; the objective is to obtain an understanding of the system and its components that someone wants to attack.

Detecting that a security event is occurring or has occurred is an easy matter.

In the computer security world, ________ is a process of assessing the security state of an organization compared against an established standard.

Which term is used to define vulnerabilities that are newly discovered and not yet addressed by a patch?

What command is used to discover what systems are on a network and the open ports and services on those systems?

________ is an iterative process of proactively searching out threats inside the network.

If you test something and it comes back negative, but it was in fact positive, then the result is a false positive.

________ is the name for both a tool and a suite of tools: as a suite, it is a group of free, open-source utilities for editing and replaying previously captured network traffic; as a tool, it specifically replays a PCAP file on a network.

Vulnerabilities are known entities; otherwise, the scanners would not have the ability to scan for them.

Which infection method involves planting malware on a website that the victim employees will likely visit?

How do most advanced persistent threats (APTs) begin?

What is the first rule of incident response investigation?

A common technical mistake during the initial response to an incident is "killing" rogue processes.

To ________ means to take action to reduce the likelihood of a threat occurring and/or to reduce the impact if a threat does occur.

What is a key guideline to follow when designing incident response procedures?

Which indicator of compromise (IOC) standard is a method of information sharing developed by MITRE?

A(n) ________ is a measure of the magnitude of loss of an asset.

Which statistical term is a representation of the frequency of the event, measured in a standard year?

Which term refers to a risk that remains after implementing controls?

________ is the chance of loss that is predictable under relatively stable circumstances.

Which term describes a circumstance that increases the likelihood or probable severity of a loss?

What are the two components comprising information criticality?

All data is equally important, and thus equally damaging in the event of loss.

A(n) ________ is any event in an information system or network where the results are different than normal.

________ is a structured language for cyberthreat intelligence information.

Which indicator of compromise (IOC) standard is an open-source initiative established by Mandiant that is designed to facilitate rapid communication of specific threat information associated with known threats?

Recovery is the returning of the asset into the business function.

What is the first step in the general risk management model?

Tangible objects that prove or disprove facts are what type of evidence?

Evidence that is material to the case or has bearing on the matter at hand is known as ________.

From a forensics perspective, Linux systems have the same artifacts as Windows systems.

A physical hard disk drive will persist data longer than a solid state drive.

Business records, printouts, and manuals are which type of evidence?

A(n) ________ is calculated by measuring system time with an external clock such as a Network Time Protocol (NTP) server.

Changing a file's extension will alter the contents of a file.

Oral testimony that proves a specific fact with no inferences or presumptions is which type of evidence?

Evidence that is convincing or measures up without question is known as ________.

Usually risk management includes both qualitative and quantitative elements.

What is a software bomb?

Major legal awards have been decided based on failure to retain information.

The term ________ relates to the application of scientific knowledge to legal problems.

________ refers to the analysis of a specific system, including the analysis of file systems and artifacts of the operating system.

When analyzing computer storage components, a system specially designed for forensic examination, known as a forensic ________, can be used.

There is no recovery from data that has been changed.

The term "________" describes a series of digits near the beginning of the file that provides information about the file format.

________ consists of the documents, verbal statements, and material objects that are admissible in a court of law.

Always analyze a seized system directly on the device.

Which rule applies to evidence obtained in violation of the Fourth Amendment of the Constitution?

When performing forensics on a computer system, you should use the utilities provided by that system.

The most common cause of digital evidence from an investigation being excluded from court proceedings is ________, the unauthorized alteration of that evidence.

It is possible to conduct risk management that is purely quantitative.

A qualitative risk assessment relies on judgment and experience.

What tool is the protocol/standard for the collection of network metadata on the flows of network traffic?

Large organizations typically have the resources to protect everything against all threats.

The ________ process involves isolating an object from its surroundings, preventing normal access methods.

How is quarantine accomplished?

Information criticality is defined as the relative importance of specific information to the business.

What is the primary factor to assess in determining the level of incident response?

The determination of the boundaries of a target space is called ________.

Blocking lateral movement can defeat APT-style attacks from spreading through a network and can limit their stealth.

A(n) ________ is an attack that always maintains a primary focus on remaining in the network, operating undetected, and having multiple ways in and out.

What should an incident response team do when they are notified of a potential incident?

Which security model is designed to avoid conflicts of interest by prohibiting one person, such as a consultant, from accessing multiple conflict of interest (Col) categories?

Which of the following is provided by a Trusted Platform Module?

A Reference Monitor enforces which of the following security design principles

Who operates the Common Criteria Evaluation and Validation Scheme in the U.S.?

Which of the following is provided by the Common Criteria for Information Technology Security Evaluation?

This type of analysis attempts to identify any potential means for bypassing security policy and ways to reduce or eliminate such possibilities.

In which of the following processes does TC hardware check that valid software has been brought in by verifying a digital signature associated with the software?

Which of the following is provided by a Trusted Platform Module?

Which of the following security models is focused primarily on data integrity in commercial applications?

Which of the following prevents the leaking/transfer of classified info to less secure clearance levels?

Which of the following runs program code to execute the TPM commands received from the I/O port?

What is the purpose of Trusted System Certification Service?

Which term refers to the process of controlling changes to items that have been baselined?

A control classified as preventative has to be known by a person in order to be effective.

What risk mitigation step can be taken to prevent data theft?

Which term refers to the possibility of suffering harm or loss?

Which action is an example of transferring risk?

Physical memory storage devices can be divided into a series of containers; each of these containers is called a(n) ________.

Which of the following best defines Trusted computing base (TCB)?

In a DBMS using Multilevel Security, what would be the primary reason for allowing polyinstantiation?

What is polyinstantiation?

The rule that a subject can only write into an object of greater or equal security level is known as

The presence of risks in a system is an absolute—they cannot be removed or eliminated.

Which term refers to the process of subjectively determining the impact of an event that affects a project, program, or business?

Which term refers to ensuring proper procedures are followed when modifying the IT infrastructure?

All risks need to be mitigated or controlled.

Cloud-based systems are made up of machines connected using a network. Typically, this network is under the control of the ________.

In ________ testing, the test team has access to the design and coding elements.

Persistence is one of the key elements of a whole class of attacks referred to as ________; they place two elements at the forefront of all activity: invisibility from defenders and persistence.

Both ipconfig and ifconfig are command-line tools to manipulate the network interfaces on a system.

A(n) ________ is an artifact left behind from computer intrusion activity.

Which term refers to the examination of machines to determine what operating systems, services, and vulnerabilities exist?

When analyzing computer storage components, the original system should be analyzed.

Minor procedural missteps have no legal consequences provided the overall investigation is properly conducted.

The hashing algorithm applies mathematical operations to a data stream (or file) to calculate some number, the ________, that is unique based on the information contained in the data stream (or file).

The ________ Amendment to the U.S. Constitution precludes illegal search and seizure.