Review
Kerpak works in the security office of a medium-sized entertainment company. Kerpak is asked to assess a particular threat, and he suggests that the best way to counter this threat would be to purchase and implement a particular security solution.
- ❌ Avoidance
- ✅ Mitigation
Applying a security solution (a type of control) is an example of mitigation.
Which of the following is likely to be included in the business continuity plan?
- ✅ Alternate work areas for personnel affected by a natural disaster
- ❌ The organization’s strategic security approach
The business continuity plan should include provisions for alternate work sites, if the primary site is affected by an interruption, such as a natural disaster.
What is the overall objective of a disaster recovery (DR) effort?
- ❌ Preserve critical business functions during a disaster
- ✅ Return to normal, full operations
DR efforts are intended to return the organization to normal, full operations.
What is the risk associated with delaying the resumption of full normal operations after a disaster?
- ❌ Competition
- ✅ The impact of running alternate operations for extended periods
Alternate operations are typically more costly than normal operations, in terms of impact to the organization; extended alternate operations could harm the organization as much as a disaster.
Gelbi is a Technical Support analyst for Triffid, Inc. Gelbi sometimes is required to install or remove software. - Which of the following could be used to describe Gelbi’s account?
- ❌ External
- ✅ Privileged
A privileged account is an account that typically needs greater permissions than a basic user.
All of the following are typically perceived as drawbacks to biometric systems, except:
- ✅ Lack of accuracy
- ❌ Retention of physiological data past the point of employment
Biometric systems can be extremely accurate, especially when compared with other types of access controls. - I didn’t read the “except”
Prina is a database manager. Prina is allowed to add new users to the database, remove current users, and create new usage functions for the users. Prina is not allowed to read the data in the fields of the database itself. - This is an example of:
- ❌ Discretionary access controls (DAC)
- ✅ Role-based access controls (RBAC)
Role-based access controls often function in this manner, where the employee’s job responsibilities dictate exactly which kinds of access the employee has. This also enforces the concept of least privilege.
What type of tool is utilized to monitor local devices with the aim of reducing potential threats from hostile software?
- ✅ Anti-malware
- ❌ NIDS (network-based intrusion-detection systems)
This is the purpose of anti-malware solutions.
An loT (Internet of Things) device is typified by its effect on or use of the
environment.
- ❌ Internal
- ✅ Physical
IoT devices typically have some interaction with the physical realm, either by having some physical effect (a vacuum cleaner, refrigerator, light) or by monitoring the physical environment itself (a camera, sensor, etc.).
Data _____ is data left behind on systems/media after normal deletion procedures have been attempted.
- ❌ Fragments
- ✅ Remanence
Data remanence is the term used to describe data left behind on systems/media after normal deletion procedures have been attempted.
Dieter wants to send a message to Lupa and wants to be sure that Lupa knows the message has not been modified in transit. - What technique/tool could Dieter use to assist in this effort?
- ❌ Asymmetric encryption
- ✅ Hashing
Hashing is a means to provide an integrity check.
Triffid, Inc., wants to host streaming video files for the company’s remote users but wants to ensure the data is protected while it’s streaming. - Which of the following methods are probably best for this purpose?
- ✅ Symmetric encryption
- ❌ VLANS
Symmetric encryption offers confidentiality of data with the least amount of processing overhead, which makes it the preferred means of protecting streaming data.
At the airport, there are red lines painted on the ground next to the runway, which prohibits traffic from crossing it. - This is an example of a(n)_______ control.
- ✅ Physical
A red line that is painted on the ground at the airport to prohibit traffic from crossing it is a physical control, like a stop sign on the roadway is.
Which of the following would be considered a logical access control?
- ✅ A fingerprint reader that allows an employee to access a laptop computer
Logical access controls limit who can gain user access to a device/system.