Appendix A Answers to Assessment Questions

2017-11-03 09:05:02

1.	Which of the following choices is an incorrect description of a control? Detective controls discover attacks and trigger preventative or corrective controls. Corrective controls reduce the likelihood of a deliberate attack. Corrective controls reduce the effect of an attack. Controls are the countermeasures for vulnerabilities.
2.	Which of the following statements is accurate about the reasons to implement a layered security architecture? A layered security approach is not necessary when using COTS products. A good packet-filtering router will eliminate the need to implement a layered security architecture. A layered security approach is intended to increase the work-factor for an attacker. A layered approach doesn’t really improve the security posture of the organization.
3.	Which of the following choices represents an application or system demonstrating a need for a high level of confidentiality protection and controls? Unavailability of the system could result in inability to meet payroll obligations and could cause work stoppage and failure of user organizations to meet critical mission requirements. The system requires 24-hour access. The application contains proprietary business information and other financial information, which, if disclosed to unauthorized sources, could cause an unfair advantage for vendors, contractors, or individuals and could result in financial loss or adverse legal action to user organizations. Destruction of the information would require significant expenditures of time and effort to replace. Although corrupted information would present an inconvenience to the staff, most information, and all vital information, is backed up either by paper documentation or on disk. The mission of this system is to produce local weather forecast information that is made available to the news media forecasters and the general public at all times. None of the information requires protection against disclosure.
4.	Which of the following choices is not a concern of policy development at the high level? Identifying the key business resources Identifying the type of firewalls to be used for perimeter security Defining roles in the organization Determining the capability and functionality of each role
5.	Which of the following choices is not an accurate statement about the visibility of IT security policy? The IT security policy should not be afforded high visibility. The IT security policy could be visible through panel discussions with guest speakers. The IT security policy should be afforded high visibility. The IT security policy should be included as a regular topic at staff meetings at all levels of the organization.
6.	Which of the following statements is not accurate regarding the process of risk assessment? The likelihood of a threat must be determined as an element of the risk assessment. The level of impact of a threat must be determined as an element of the risk assessment. Risk assessment is the first process in the risk management methodology. Risk assessment is the final result of the risk management methodology.
7.	Which of the following choices would not be considered an element of proper user account management? Users should never be rotated out of their current duties. The users’ accounts should be reviewed periodically. A process for tracking access authorizations should be implemented. Periodically rescreen personnel in sensitive positions.
8.	Which of the following choices is not one of NIST’s 33 IT security principles? Implement least privilege. Assume that external systems are insecure. Totally eliminate any level of risk. Minimize the system elements to be trusted.
9.	How often should an independent review of the security controls be performed, according to OMB Circular A-130? Every year Every three years Every five years Never
10.	Which of the following choices best describes the difference between the System Owner and the Information Owner? There is a one-to-one relationship between system owners and information owners. One system could have multiple information owners. The Information Owner is responsible for defining the system’s operating parameters. The System Owner is responsible for establishing the rules for appropriate use of the information.
11.	Which of the following choices is not a generally accepted benefit of security awareness, training, and education? A security awareness program can help operators understand the value of the information. A security education program can help system administrators recognize unauthorized intrusion attempts. A security awareness and training program will help prevent natural disasters from occurring. A security awareness and training program can help an organization reduce the number and severity of errors and omissions.
12.	Who has the final responsibility for the preservation of the organization’s information? Technology providers Senior management Users Application owners
13.	Which of the following choices is not an example of an issue-specific policy? E-mail privacy policy Virus-checking disk policy Defined router ACLs Unfriendly employee termination policy
14.	Which of the following statements is not true about security awareness, training, and educational programs? Awareness and training help users become more accountable for their actions. Security education assists management in determining who should be promoted. Security improves the users’ awareness of the need to protect information resources. Security education assists management in developing the in-house expertise to manage security programs.
15.	Which of the following choices is an accurate statement about standards? Standards are the high-level statements made by senior management in support of information systems security. Standards are the first element created in an effective security policy program. Standards are used to describe how policies will be implemented within an organization. Standards are senior management’s directives to create a computer security program.
16.	Which of the following choices is a role of the Information Systems Security Officer? The ISO establishes the overall goals of the organization’s computer security program. The ISO is responsible for day-to-day security administration. The ISO is responsible for examining systems to see whether they are meeting stated security requirements. The ISO is responsible for following security procedures and reporting security problems.
17.	Which of the following statements is not correct about safeguard selection in the risk analysis process? Maintenance costs need to be included in determining the total cost of the safeguard. The best possible safeguard should always be implemented, regardless of cost. The most commonly considered criterion is the cost effectiveness of the safeguard. Many elements need to be considered in determining the total cost of the safeguard.
18.	Which of the following choices is usually the number-one used criterion to determine the classification of an information object? Value Useful life Age Personal association
19.	What are high-level policies? They are recommendations for procedural controls. They are the instructions on how to perform a Quantitative Risk Analysis. They are statements that indicate a senior management’s intention to support InfoSec. They are step-by-step procedures to implement a safeguard.
20.	Which policy type is most likely to contain mandatory or compulsory standards? Guidelines Advisory Regulatory Informative
21.	What does an Exposure Factor (EF) describe? A dollar figure that is assigned to a single event A number that represents the estimated frequency of the occurrence of an expected threat The percentage of loss that a realized threat event would have on a specific asset The annual expected financial loss to an organization from a threat
22.	What is the most accurate definition of a safeguard? A guideline for policy recommendations A step-by-step instructional procedure A control designed to counteract a threat A control designed to counteract an asset
23.	Which choice most accurately describes the differences between standards, guidelines, and procedures? Standards are recommended policies, whereas guidelines are mandatory policies. Procedures are step-by-step recommendations for complying with mandatory guidelines. Procedures are the general recommendations for compliance with mandatory guidelines. Procedures are step-by-step instructions for compliance with mandatory standards.
24.	What are the detailed instructions on how to perform or implement a control called? Procedures Policies Guidelines Standards
25.	How is an SLE derived? (Cost – benefit) × (% of Asset Value) AV × EF ARO × EF % of AV – implementation cost
26.	What are noncompulsory recommendations on how to achieve compliance with published standards called? Procedures Policies Guidelines Standards
27.	Which group represents the most likely source of an asset loss through inappropriate computer use? Crackers Hackers Employees Saboteurs
28.	Which choice most accurately describes the difference between the role of a data owner and the role of a data custodian? The custodian implements the information classification scheme after the initial assignment by the owner. The data owner implements the information classification scheme after the initial assignment by the custodian. The custodian makes the initial information classification assignments, whereas the operations manager implements the scheme. The custodian implements the information classification scheme after the initial assignment by the operations manager.
29.	What is an ARO? A dollar figure assigned to a single event The annual expected financial loss to an organization from a threat A number that represents the estimated frequency of an occurrence of an expected threat The percentage of loss that a realized threat event would have on a specific asset
30.	Which formula accurately represents an Annualized Loss Expectancy (ALE) calculation? SLE × ARO Asset Value (AV) × EF ARO × EF – SLE % of ARO × AV
31.	Which of the following assessment methodologies below is a self-guided assessment implemented in a series of short workshops focusing on key organizational areas and conducted in three phases? Federal Information Technology Security Assessment Framework (FITSAF) Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) Office of Management and Budget (OMB) Circular A-130 INFOSEC Assessment Methodology (IAM)
32.	Which of the following assessment methodologies was developed by the National Security Agency to assist both assessment suppliers and consumers? Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) Federal Information Processing Standard (FIPS) 102 Federal Information Technology Security Assessment Framework (FITSAF) INFOSEC Assessment Methodology (IAM)

Answers

1.	Answer: b The other three answers are correct descriptions of controls.
2.	Answer: c Security designs should consider a layered approach to increase the work-factor an attacker must expend to successfully attack the system.
3.	Answer: b Although elements of all the systems described could require specific controls for confidentiality, given the descriptions above, system b fits the definition most closely of a system requiring a very high level of confidentiality. Answer a is an example of a system requiring high availability. Answer c is an example of a system that requires medium integrity controls. Answer d is a system that requires only a low level of confidentiality.
4.	Answer: b Answers a, c, and d are elements of policy development at the highest level. Key business resources would have been identified during the risk assessment process. The various roles are then defined to determine the various levels of access to those resources. Answer d is the final step in the policy creation process and combines steps a and c. It determines which group gets access to each resource and what access privileges its members are assigned. Access to resources should be based on roles, not on individual identity.
5.	Answer: a The other three answers are correct statements about the visibility of IT security policy.
6.	Answer: d Risk assessment is the first process in the risk management methodology.
7.	Answer: a The other answers are elements of proper user account management.
8.	Answer: c Risk can never be totally eliminated. NIST IT security principle 4 states: “Reduce risk to an acceptable level.”
9.	Answer: b OMB Circular A-130 requires that a review of the security controls for each major government application be performed at least every three years.
10.	Answer: b A single system may utilize information from multiple Information Owners.
11.	Answer: c The other answers are generally accepted benefits of security awareness, training, and education.
12.	Answer: b Senior management has the final responsibility through due care and due diligence to preserve the capital of the organization and further its business model through the implementation of a security program. Although senior management does not have the functional role of managing security procedures, it has the ultimate responsibility to see that business continuity is preserved.
13.	Answer: c Answer c is an example of a system-specific policy - in this case the router’s access control lists. The other three answers are examples of issue-specific policy, as defined by NIST.
14.	Answer: b The other answers are correct statements about security awareness, training, and educational programs.
15.	Answer: c Answers a, b, and d describe policies. Procedures, standards, and guidelines are used to describe how these policies will be implemented within an organization.
16.	Answer: b Answer a is a responsibility of senior management. Answer c is a description of the role of auditing. Answer d is the role of the user, or consumer, of security in an organization.
17.	Answer: b Performing a cost-benefit analysis of the proposed safeguard before implementation is vital. The level of security afforded could easily fail to outweigh the cost of a proposed safeguard. Other factors need to be considered in the safeguard selection process, such as accountability, auditability, and the level of manual operations needed to maintain or operate the safeguard.
18.	Answer: a Value of the information asset to the organization is usually the first and foremost criterion used in determining its classification.
19.	Answer: c. High-level policies are senior management statements of recognition of the importance of security controls to the mission of the organization.
20.	Answer: c Answer b (advisory policies) might specify penalties for noncompliance, but regulatory policies are required to be followed by the organization. Answers a and d are informational or recommended policies only.
21.	Answer: c Answer a is an SLE, b is an ARO, and d is an ALE.
22.	Answer: c Answer a is a guideline, b is a procedure, and d is a distracter.
23.	Answer: d The other answers are incorrect.
24.	Answer: a
25.	Answer: b. A Single Loss Expectancy is derived by multiplying the Asset Value by its Exposure Factor. The other answers do not exist.
26.	Answer: c
27.	Answer: c Internal personnel far and away constitute the largest amount of dollar loss due to unauthorized or inappropriate computer use.
28.	Answer: a
29.	Answer: c Answer a is the definition of SLE, b is an ALE, and d is an EF.
30.	Answer: a Answer b is the formula for an SLE, and answers c and d are nonsense.
31.	Answer: b Carnegie Mellon University’s Software Engineering Institute (SEI) created the Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE). OCTAVE is a self-guided assessment implemented in a series of short workshops focusing on key organizational areas. It is conducted in three phases: Identify critical assets and the threats to those assets Identify the vulnerabilities that expose those threats Develop an appropriate protection strategy for the organization’s mission and priorities
32.	Answer: d The INFOSEC Assessment Methodology (IAM) is a detailed and systematic way of examining cyber vulnerabilities that was developed by the National Security Agency to assist both INFOSEC assessment suppliers and consumers requiring assessments. The IAM examines the mission, organization, security policies and programs, and information systems and the threat to these systems.

1.	The goals of integrity do not include: Accountability of responsible individuals Prevention of the modification of information by unauthorized users Prevention of the unauthorized or unintentional modification of information by authorized users Preservation of internal and external consistency
2.	Kerberos is an authentication scheme that can be used to implement: Public-key cryptography Digital signatures Hash functions Single Sign-On (SSO)
3.	The fundamental entity in a relational database is the: Domain Relation Pointer Cost
4.	In a relational database, security is provided to the access of data through: Candidate keys Views Joins Attributes
5.	In biometrics, a one-to-one search to verify an individual’s claim of an identity is called: Audit trail review Authentication Accountability Aggregation
6.	Biometrics is used for identification in the physical controls and for authentication in the: Detective controls Preventive controls Logical controls Corrective controls
7.	Referential integrity requires that for any foreign key attribute, the referenced relation must have: A tuple with the same value for its primary key A tuple with the same value for its secondary key An attribute with the same value for its secondary key An attribute with the same value for its other foreign key
8.	A password that is the same for each logon is called a: Dynamic password Static password Passphrase One-time pad
9.	Which one of the following is not an access attack? Spoofing Back door Dictionary Penetration test
10.	An attack that uses a detailed listing of common passwords and words in general to gain unauthorized access to an information system is best described as: Password guessing Software exploitation Dictionary attack Spoofing
11.	A statistical anomaly–based intrusion detection system: Acquires data to establish a normal system operating profile Refers to a database of known attack signatures Will detect an attack that does not significantly change the system’s operating characteristics Does not report an event that caused a momentary anomaly in the system
12.	Which one of the following definitions best describes system scanning? An attack that uses dial-up modems or asynchronous external connections to an information system in order to bypass information security control mechanisms An attack that is perpetrated by intercepting and saving old messages and then sending them later, impersonating one of the communicating parties Acquisition of information that is discarded by an individual or organization A process used to collect information about a device or network to facilitate an attack on an information system
13.	In which type of penetration test does the testing team have access to internal system code? Closed-box Transparent-box Open-box Coding-box
14.	A standard data manipulation and relational database definition language is: OOD SQL SLL Script
15.	An attack that can be perpetrated against a remote user’s callback access control is: Call forwarding A Trojan horse A maintenance hook Redialing
16.	The definition of CHAP is: Confidential Hash Authentication Protocol Challenge Handshake Authentication Protocol Challenge Handshake Approval Protocol Confidential Handshake Approval Protocol
17.	Using symmetric-key cryptography, Kerberos authenticates clients to other entities on a network and facilitates communications through the assignment of: Public keys Session keys Passwords Tokens
18.	Three things that must be considered for the planning and implementation of access control mechanisms are: Threats, assets, and objectives Threats, vulnerabilities, and risks Vulnerabilities, secret keys, and exposures Exposures, threats, and countermeasures
19.	In mandatory access control, the authorization of a subject to have access to an object is dependent upon: Labels Roles Tasks Identity
20.	The type of access control that is used in local, dynamic situations where subjects have the ability to specify what resources certain users can access is called: Mandatory access control Rule-based access control Sensitivity-based access control Discretionary access control
21.	Role-based access control is useful when: Access must be determined by the labels on the data. There are frequent personnel changes in an organization. Rules are needed to determine clearances. Security clearances must be used.
22.	Clipping levels are used to: Limit the number of letters in a password Set thresholds for voltage variations Reduce the amount of data to be evaluated in audit logs Limit errors in callback systems
23.	Identification is: A user being authenticated by the system A user providing a password to the system A user providing a shared secret to the system A user professing an identity to the system
24.	Authentication is: The verification that the claimed identity is valid The presentation of a user’s ID to the system Not accomplished through the use of a password Applied only to remote users
25.	An example of two-factor authentication is: A password and an ID An ID and a PIN A PIN and an ATM card A fingerprint
26.	In biometrics, a good measure of the performance of a system is the: False detection Crossover error rate (CER) Positive acceptance rate Sensitivity
27.	In finger scan technology: The full fingerprint is stored. Features extracted from the fingerprint are stored. More storage is required than in fingerprint technology. The technology is applicable to large, one-to-many database searches.
28.	An acceptable biometric throughput rate is: One subject per two minutes Two subjects per minute Ten subjects per minute Five subjects per minute
29.	Which one of the following is not a type of penetration test? Sparse-knowledge test Full-knowledge test Partial-knowledge test Zero-knowledge test
30.	Object-Oriented Database (OODB) systems: Are ideally suited for text-only information Require minimal learning time for programmers Are useful in storing and manipulating complex data, such as images and graphics Consume minimal system resources
31.	A minimally configured information entry and retrieval device that relies on a remote server for its primary processing, security, storage, and printing functions is called a: Workstation Server Thin client Remote storage station

Answers

1.	Answer: a Accountability is holding individuals responsible for their actions. Answers b, c, and d are the three goals of integrity.
2.	Answer: d Kerberos is a third-party authentication protocol that can be used to implement SSO. Answer a is incorrect because public-key cryptography is not used in the basic Kerberos protocol. Answer b is a public-key-based capability, and answer c is a one-way transformation used to disguise passwords or to implement digital signatures.
3.	Answer: b The fundamental entity in a relational database is the relation, in the form of a table. Answer a is the set of allowable attribute values, and answers c and d are distracters.
4.	Answer: b Views enable access to data in their underlying tables to be controlled. Candidate keys (answer a) are the set of unique keys from which the primary key is selected. Answer c Joins (answer c) are operations that can be performed on the database, and the attributes (answer d) denote the columns in the relational table.
5.	Answer: b Answer b is correct. Answer a is a review of audit system data, usually done after the fact. Answer c is holding individuals responsible for their actions, and answer d is obtaining higher-sensitivity information from a number of pieces of information of lower sensitivity.
6.	Answer: c The correct answer is c (logical controls). The other answers are different categories of controls where preventive controls attempt to eliminate or reduce vulnerabilities before an attack occurs; detective controls attempt to determine that an attack is taking place or has taken place; and corrective controls involve taking action to restore the system to normal operation after a successful attack.
7.	Answer: a The correct answer is a. Answers b and c are incorrect because a secondary key is not a valid term. Answer d is a distracter because referential integrity has a foreign key referring to a primary key in another relation.
8.	Answer: b The correct answer is b. In answer a, the password changes at each logon. A passphrase (answer c) is a long word or phrase that is converted by the system to a password. A one-time pad (answer d) consists of using a random key only once when sending a cryptographic message.
9.	Answer: d The correct answer is d, a distracter. A penetration test is conducted to obtain a high level evaluation of a system’s defense or to perform a detailed analysis of the information system’s weaknesses. A penetration test can determine how a system reacts to an attack, whether or not a system’s defenses can be breached, and what information can be acquired from the system. It is performed with the approval of the target organization.
10.	Answer: c In a dictionary attack (answer c), a dictionary of common words and passwords are applied to attempt to gain unauthorized access to an information system. In password guessing (answer a), the attacker guesses passwords derived from sources such as notes on the user’s desk, the user’s birthday, a pet’s name, applying social engineering techniques, and so on. Answer b refers to exploiting software vulnerabilities, and answer d, spoofing, is a method used by an attacker to convince an information system that it is communicating with a known, trusted entity.
11.	Answer: a A statistical anomaly–based intrusion detection system acquires data to establish a normal system operating profile. Answer b is incorrect because it is used in signature-based intrusion detection. Answer c is incorrect because a statistical anomaly–based intrusion detection system will not detect an attack that does not significantly change the system operating characteristics. Similarly, answer d is incorrect because the statistical anomaly–based IDS is susceptible to reporting an event that caused a momentary anomaly in the system.
12.	Answer: d Answer d is correct. Answer a describes a back door attack, answer b is a replay attack, and answer c refers to dumpster diving.
13.	Answer: c The correct answer is c, open-box testing. In closed-box testing (answer a), the testing team does not have access to internal system code. The other answers are distracters.
14.	Answer: b All answers other than SQL (b) do not apply.
15.	Answer: a The correct answer is a. A cracker can have a person’s call forwarded to another number to foil the callback system. Answer b is incorrect because it is an example of malicious code embedded in useful code. Answer c is incorrect because it might enable bypassing controls of a system through a means used for debugging or maintenance. Answer d is incorrect because it is a distracter.
16.	Answer: b
17.	Answer: b Session keys are temporary keys assigned by the KDC and used for an allotted period of time as the secret key between two entities. Answer a is incorrect because it refers to asymmetric encryption, which is not used in the basic Kerberos protocol. Answer c is incorrect because it is not a key, and answer d is incorrect because a token generates dynamic passwords.
18.	Answer: b Threats define the possible source of security policy violations; vulnerabilities describe weaknesses in the system that might be exploited by the threats; and the risk determines the probability of threats being realized. All three items must be present to meaningfully apply access control. Therefore, the other answers are incorrect.
19.	Answer: a Mandatory access controls use labels to determine whether subjects can have access to objects, depending on the subjects’ clearances. Answer b, roles, is applied in nondiscretionary access control, as is answer c, tasks. Answer d, identity, is used in discretionary access control.
20.	Answer: d Answer d is correct. Answers a and b require strict adherence to labels and clearances. Answer c is a made-up distracter.
21.	Answer: b Role-based access control is part of nondiscretionary access control. Answers a, c, and d relate to mandatory access control.
22.	Answer: c Clipping levels are used for reducing the amount of data to be evaluated by definition. Answer a is incorrect because clipping levels do not relate to letters in a password. Answer b is incorrect because clipping levels in this context have nothing to do with controlling voltage levels. Answer d is incorrect because they are not used to limit callback errors.
23.	Answer: d A user presents an ID to the system as identification. Answer a is incorrect because presenting an ID is not an authentication act. Answer b is incorrect because a password is an authentication mechanism. Answer c is incorrect because it refers to cryptography or authentication.
24.	Answer: a Answer a is correct. Answer b is incorrect because it is an identification act. Answer c is incorrect because authentication can be accomplished through the use of a password. Answer d is incorrect because authentication is applied to local and remote users.
25.	Answer: c The correct answer is c. These items are something you know and something you have. Answer a is incorrect because essentially, only one factor is being used - something you know (password). Answer b is incorrect for the same reason. Answer d is incorrect because only one biometric factor is being used.
26.	Answer: b Answer b is correct. The other items are made-up distracters.
27.	Answer: b In finger scan technology, the features extracted from the fingerprint are stored. Answer a is incorrect because the equivalent of the full finger-print is not stored in finger scan technology. Answers c and d are incorrect because the opposite is true of finger scan technology.
28.	Answer: c
29.	Answer: a The correct answer is a, a distracter.
30.	Answer: c Answer c is correct. The other answers are false because for answer a, relational databases are ideally suited to text-only information. For b and d, OODB systems have a steep learning curve and consume a large amount of system resources.
31.	Answer: c Answer c is correct. Answers a and b are computing systems with extensive storage and processing capabilities. Answer d is a made up distracter.

1.	Which of the following is not an element of a fiber-optic cable? Core BNC Jacket Cladding
2.	To what does 10Base5 refer? 10 Mbps thinnet coax cabling rated to 185 meters maximum length 10 Mbps thicknet coax cabling rated to 500 meters maximum length 10 Mbps baseband optical fiber 100 Mbps unshielded twisted pair cabling
3.	Which of the following LAN transmission methods describes a packet sent from a single source to multiple specific destinations? Unicast Multicast Broadcast Anycast
4.	Which part of the 48-bit, 12-digit hexadecimal number known as the Media Access Control (MAC) address identifies the manufacturer of the network device? The first three bytes The first two bytes The second half of the MAC address The last three bytes
5.	Which of the following best describes coaxial cable? Coax consists of two insulated wires wrapped around each other in a regular spiral pattern. Coax consists of a hollow outer cylindrical conductor surrounding a single, inner conductor. Coax does not require the fixed spacing between connections that UTP requires. Coax carries signals as light waves.
6.	Which of the following is not one of the legal IP address ranges specified by RFC1976 and reserved by the Internet Assigned Numbers Authority (IANA) for nonroutable private addresses? 10.0.0.0–10.255.255.255 127.0.0.0–127.0.255.255 172.16.0.0–172.31.255.255 192.168.0.0–192.168.255.255
7.	Which of the following statements about the difference between analog and digital signals is incorrect? An analog signal produces an infinite waveform. Analog signals cannot be used for data communications. An analog signal can be varied by amplification. A digital signal produces a square waveform.
8.	Which of the following most accurately describes SSL? It’s a widely used standard of securing e-mail at the Application level. It gives a user remote access to a command prompt across a secure, encrypted session. It uses two protocols, the Authentication Header and the Encapsulating Security Payload. It allows an application to have authenticated, encrypted communications across a network.
9.	Which IEEE protocol defines wireless transmission in the 5 GHz band with data rates up to 54 Mbps? IEEE 802.11a IEEE 802.11b IEEE 802.11g IEEE 802.15
10.	Which protocol is used to resolve a known IP address to an unknown MAC address? ARP RARP ICMP TFTP
11.	Which TCP/IP protocol operates at the OSI Network Layer? FTP IP TCP UDP
12.	Which statement accurately describes the difference between 802.11b WLAN ad hoc and infrastructure modes? The ad hoc mode requires an Access Point to communicate to the wired network. Wireless nodes can communicate peer-to-peer in the infrastructure mode. Wireless nodes can communicate peer-to-peer in the ad hoc mode. Access points are rarely used in 802.11b WLANs.
13.	Which of the following is true about the difference between TCP and UDP? UDP is considered a connectionless protocol, and TCP is connection-oriented. TCP is considered a connectionless protocol, and UDP is connection oriented. UDP acknowledges the receipt of packets, and TCP does not. TCP is sometimes referred to as an unreliable protocol.
14.	Which of the following denotes a packet-switched connectionless wide area network (WAN) technology? X.25 Frame Relay SMDS ATM
15.	Which of the following answers is true about the difference between FTP and TFTP? FTP does not have a directory-browsing capability, whereas TFTP does. FTP enables print job spooling, whereas TFTP does not. TFTP is less secure because session authentication does not occur. FTP is less secure because session authentication does not occur.
16.	Which of the following statements is correct regarding VLANs? A VLAN restricts flooding to only those ports included in the VLAN. A VLAN is a network segmented physically, not logically. A VLAN is less secure when implemented in conjunction with private port switching. A closed VLAN configuration is the least secure VLAN configuration.
17.	Which of the following statements about a VPN tunnel is incorrect? It can be created by implementing only IPSec devices. It can be created by installing software or hardware agents on the client or network. It can be created by implementing key and certificate exchange systems. It can be created by implementing node authentication systems.
18.	Which of the following can create a server-spoofing attack? DNS poisoning C2MYAZZ Snort BO2K
19.	What is a server cluster? A primary server that mirrors its data to a secondary server A group of independent servers that are managed as a single system A tape array backup implementation A group of WORM optical jukeboxes
20.	Which of the following attack types does not exploit TCP vulnerabilities? Sequence Number attack SYN attack Ping of Death land.c attack
21.	What is probing used for? To induce a user into taking an incorrect action To give an attacker a road map of the network To use up all of a target’s resources To covertly listen to transmissions
22.	Which of the following firewall types uses a dynamic state table to inspect the content of packets? A packet-filtering firewall An application-level firewall A circuit-level firewall A stateful-inspection firewall
23.	To what does logon abuse refer? Breaking into a network primarily from an external source Legitimate users accessing networked services that would normally be restricted to them Nonbusiness or personal use of the Internet Intrusions via dial-up or asynchronous external network connections
24.	What type of firewall architecture employs two network cards and a single screening router? A screened-host firewall A dual-homed host firewall A screened-subnet firewall An application-level proxy server
25.	To what does covert channel eavesdropping refer? Using a hidden, unauthorized network connection to communicate unauthorized information Nonbusiness or personal use of the Internet Socially engineering passwords from an ISP The use of two-factor passwords
26.	What is one of the most common drawbacks to using a dual-homed host firewall? The examination of the packet at the Network Layer introduces latency. The examination of the packet at the Application Layer introduces latency. The ACLs must be manually maintained on the host. Internal routing may accidentally become enabled.
27.	Which is not a property of a bridge? It forwards the data to all other segments if the destination is not on the local segment. It operates at Layer 2, the Data Link Layer. It operates at Layer 3, the Network Layer. It can create a broadcast storm.
28.	Which IEEE protocol defines the Spanning Tree protocol? IEEE 802.5 IEEE 802.3 IEEE 802.11 IEEE 802.1D
29.	What does the Data Encapsulation in the OSI model do? It creates seven distinct layers. It wraps data from one layer around a data packet from an adjoining layer. It provides best-effort delivery of a data packet. It makes the network transmission deterministic.
30.	Which of the following choices is not an element of IPSec? Authentication Header Layer Two Tunneling Protocol Security Association Encapsulating Security Payload
31.	Which of the following network attacks would not be considered a Denial of Service attack? Ping of Death Smurf Brute Force TCP SYN
32.	Which statement is not true about the SOCKS protocol? It is sometimes referred to as an application-level proxy. It uses an ESP for authentication and encryption. It operates in the Transport Layer of the OSI model. Network applications need to be SOCKS-ified to operate.
33.	Which of the following choices is not a way to get Windows NT passwords? Obtain the backup SAM from the repair directory. Boot the NT server with a floppy containing an alternate operating system. Obtain root access to the /etc/passwd file. Use pwdump2 to dump the password hashes directly from the registry.
34.	Which type of routing commonly broadcasts its routing table information to all other routers every minute? Static Distance Vector Link State Dynamic Control Protocol
35.	A back door into a network refers to what? Socially engineering passwords from a subject Mechanisms created by hackers to gain network access at a later time Undocumented instructions used by programmers to debug applications Monitoring programs implemented on dummy applications to lure intruders
36.	What is the protocol that supports sending and receiving e-mail? SNMP SMTP ICMP RARP
37.	Which of the following protocols does not pertain to e-mail? SMTP POP CHAP IMAP
38.	Which of the following does not relate to analog dial-up hacking? War dialing War walking Demon dialing ToneLoc
39.	Which of the following is the earliest and the most commonly found Interior Gateway Protocol? RIP OSPF IGRP EAP
40.	What is the Network Layer of the OSI reference model primarily responsible for? Internetwork packet routing LAN bridging SMTP Gateway services Signal regeneration and repeating
41.	Which of the following is not a true statement about Network Address Translation (NAT)? NAT is used when corporations want to use private addressing ranges for internal networks. NAT is designed to mask the true IP addresses of internal systems. Private addresses can easily be routed globally. NAT translates private IP addresses to registered “real” IP addresses.
42.	In the DoD reference model, which layer conforms to the OSI Transport Layer? Process/Application Layer Host-to-Host Layer Internet Layer Network Access Layer
43.	The IP address 178.22.90.1 is considered to be in which class of address? Class A Class B Class C Class D
44.	What does TFTP stand for? Trivial File Transport Protocol Transport for TCP/IP Trivial File Transfer Protocol Transport File Transfer Protocol
45.	Which IEEE protocol offers two different protocols to address security issues with 802.11 products? IEEE 802.11e IEEE 802.11f IEEE 802.11g IEEE 802.11i
46.	Which new wireless IEEE protocol combines multiple input, multiple output (MIMO) technology with multiple antennas to achieve raw data rates from 100 Mbps to 600 Mbps? IEEE 802.11h IEEE 802.11i IEEE 802.11n IEEE 802.16
47.	Which of the following choices is the best description of bluejacking? A shareware program for locating WLAN SSIDs A hacker determining an AP’s broadcast SSID A Bluetooth wireless hack that exploits BT’s discover mode HTML tailored to the small screens and limited resources of a wireless handheld
48.	Which choice is not a common ability of a keylogger? Log all Web sites visited Interact with potential hackers in such a way as to capture the details of their attacks Record all keystrokes Log every application executed
49.	Which choice is the best description of a spambot? A program designed to collect e-mail addresses from the Internet in order to send advertising messages A pop-up window that asks users to download a program to their computer’s hard drive A program in which malicious code is contained inside apparently harmless programming A program that surreptitiously allows access to a computer’s resources via a network connection

Answers

1.	Answer: b A BNC refers to a Bayonet Neil Concelman RG58 connector for 10Base2. Fiber-optic cable has three basic physical elements: the core, the cladding, and the jacket. The core is the innermost transmission medium, which can be glass or plastic. The next outer layer, the cladding, is also made of glass or plastic, but it has different properties and helps to reflect the light back into the core. The outermost layer, the jacket, provides protection from heat, moisture, and other environmental elements.
2.	Answer: b Answer a refers to 10Base2; answer c refers to 10BaseF; and answer d refers to 100BaseT.
3.	Answer: b Unicast (answer a) describes a packet sent from a single source to a single destination. Answer c (broadcast) describes a packet sent to all nodes on the network segment. Answer d (anycast) refers to communication between any sender and the nearest of a group of receivers in a network.
4.	Answer: a The first three bytes (or first half) of the six-byte MAC address is the manufacturer’s identifier. This can be a good troubleshooting aid if a network device is acting up, because it will isolate the brand of the failing device. The other answers are distracters.
5.	Answer: b Coax consists of a hollow outer cylindrical conductor surrounding a single, inner wire conductor. Answer a describes UTP. Answer c is false because coax requires fixed spacing between connections, and answer d describes fiber-optic cable.
6.	Answer: b The other three address ranges can be used for Network Address Translation (NAT). Although NAT is, in itself, not a very effective security measure, a large network can benefit from using NAT with Dynamic Host Configuration Protocol (DHCP) to help prevent certain internal routing information from being exposed. The address 127.0.0.1 is called the loopback address.
7.	Answer: b The other answers are all properties of analog or digital signals.
8.	Answer: d The Secure Sockets Layer (SSL) sits between higher-level application functions and the TCP/IP stack and provides security to applications. It includes a variety of encryption algorithms to secure transmitted data, but the functionality must be integrated into the application. Answer a refers to the Secure/Multipurpose Internet Mail Extension (S/MIME). Most major email clients support S/MIME today. Answer b describes Secure Shell (SSH). Answer c refers to IPSec. IPSec enables security to be built directly into the TCP/IP stack, without requiring application modification.
9.	Answer: a IEEE 802.11a specifies high-speed wireless connectivity in the 5 GHz band using Orthogonal Frequency Division Multiplexing with data rates up to 54 Mbps. Answer b, IEEE 802.11b, specifies high-speed wireless connectivity in the 2.4 GHz ISM band up to 11 Mbps. Answer c, IEEE 802.11g, is a proposed standard that offers wireless transmission over relatively short distances at speeds from 20 Mbps up to 54 Mbps and operates in the 2.4 GHz range (and is therefore expected to be backward-compatible with existing 802.11b-based networks). Answer d, IEEE 802.15, defines Wireless Personal Area Networks (WPAN), such as Bluetooth, in the 2.4-2.5 GHz band.
10.	Answer: a The Address Resolution Protocol (ARP) sends a broadcast asking for the host with a specified IP address to reply with its MAC, or hardware address. This information is kept in the ARP Cache. The Reverse Address Resolution Protocol (RARP), answer b, is commonly used on diskless machines when the MAC is known but not the IP address. It asks a RARP server to provide a valid IP address, which is somewhat the reverse of ARP. The Internet Control Message Protocol (ICMP), answer c, is a management protocol for IP. The Trivial File Transfer Protocol (TFTP), answer d, is a stripped-down version of the File Transfer Protocol (FTP).
11.	Answer: b IP operates at the Network Layer of the OSI model and at the Internet layer of the TCP/IP model. FTP operates at the Application layer of the TCP/IP model, which is roughly similar to the top three layers of the OSI model: the Application, Presentation, and Session Layers. TCP and UDP both operate at the OSI Transport Layer, which is similar to the TCP/IP host-to-host layer.
12.	Answer: c Nodes on an IEEE 802.11b wireless LANs can communicate in one of two modes: ad hoc or infrastructure. In ad hoc mode, the wireless nodes communicate directly with each other, without establishing a connection to an access point on a wired LAN. In infrastructure mode, the wireless nodes communicate to an access point, which operates similarly to a bridge or router and manages traffic between the wireless network and the wired network.
13.	Answer: a As opposed to the Transmission Control Protocol (TCP), the User Datagram Protocol (UDP) is a connectionless protocol. It does not sequence the packets or acknowledge the receipt of packets and is referred to as an unreliable protocol.
14.	Answer: c Switched Multimegabit Data Service (SMDS) is a high-speed, connectionless, packet-switching public network service that extends LAN-like performance to a metropolitan area network (MAN) or a wide area network (WAN). It’s generally delivered over a SONET ring with a maximum effective service radius of around 30 miles. X.25, answer a, defines an interface to the first commercially successful connection-oriented packet-switching network, in which the packets travel over virtual circuits. Frame Relay, answer b, was a successor to X.25 and offers a connection-oriented packet-switching network. Asynchronous Transfer Mode (ATM), answer d, was developed from an outgrowth of ISDN standards and is a fast-packet, connection-oriented, cell-switching technology.
15.	Answer: c The Trivial File Transfer Protocol (TFTP) is considered less secure than the File Transfer Protocol (FTP) because authentication does not occur during session establishment.
16.	Answer: a A virtual local area network (VLAN) allows ports on the same or different switches to be grouped so that traffic is confined to members of that group only, and it restricts broadcast, unicast, and multicast traffic. Answer b is incorrect because a VLAN is segmented logically, rather than physically. Answer c is incorrect; when a VLAN is implemented with private port, or single-user, switching, it provides fairly stringent security because broadcast vulnerabilities are minimized. Answer d is incorrect, as a closed VLAN authenticates a user to an access control list on a central authentication server, where they are assigned authorization parameters to determine their level of network access.
17.	Answer: a IPSec-compatible and non-IPSec compatible devices are used to create VPNs. The other three answers are all ways in which VPNs can be created.
18.	Answer: b C2MYAZZ is a utility that enables server spoofing to implement a session hijacking or man-in-the-middle exploit. It intercepts a client LANMAN authentication logon and obtains the session’s logon credentials and password combination transparently to the user. DNS poisoning (answer a) is also known as cache poisoning. It is the process of distributing incorrect IP address information for a specific host with the intent to divert traffic from its true destination. Snort (answer c) is a utility used for network sniffing, is the process of gathering traffic from a network by capturing the data as it passes and storing it to analyze later. Back Orifice 2000 (BO2K), answer d, is an application-level Trojan horse used to give an attacker backdoor network access.
19.	Answer: b A server cluster is a group of servers that appears to be a single server to the user. Answer a refers to redundant servers.
20.	Answer: c The Ping of Death exploits the fragmentation vulnerability of large ICMP ECHO request packets by sending an illegal packet with more than 65K of data, creating a buffer overflow. A TCP sequence number attack (answer a) exploits the nonrandom predictable pattern of TCP connection sequence numbers to spoof a session. A TCP SYN attack (answer b) is a DoS attack that exploits the TCP three-way handshake. The attacker rapidly generates randomly sourced SYN packets filling the target’s connection queue before the connection can timeout. A land.c attack (answer d) is also a DoS attack that exploits TCP SYN packets. The attacker sends a packet that gives both the source and destination as the target’s address and uses the same source and destination port.
21.	Answer: b Probing is a procedure whereby the intruder runs programs that scan the network to create a network map for later intrusion. Answer a is spoofing, answer c is the objective of a DoS attack, and answer d describes passive eavesdropping.
22.	Answer: d A stateful-inspection firewall intercepts incoming packets at the Network level and then uses an Inspection Engine to extract state-related information from upper layers. It maintains the information in a dynamic state table and evaluates subsequent connection attempts. A packet-filtering firewall (answer a) is the simplest type of firewall commonly implemented on routers. It operates at the Network layer and offers good performance but is the least secure. An application-level firewall or application-layer gateway (answer b) is more secure because it examines the packet at the Application layer but at the expense of performance. A circuit-level firewall (answer c) is similar to the application-level firewall in that it functions as a proxy server, but it differs in that special proxy application software is not needed.
23.	Answer: b Logon abuse entails an otherwise proper user attempting to access areas of the network that are deemed off-limits. Answer a is called network intrusion, and d refers to backdoor remote access.
24.	Answer: a Like a dual-homed host, a screened-host firewall uses two network cards to connect to the trusted and untrusted networks, but it adds a screening router between the host and the untrusted network. A dualhomed host (answer b) has two NICs but not necessarily a screening router. A screened-subnet firewall, (answer c) also uses two NICs but has two screening routers with the host acting as a proxy server on its own network segment. One screening router controls traffic local to the network while the second monitors and controls incoming and outgoing Internet traffic. Answer d, application-level proxy, is unrelated to this question.
25.	Answer: a A covert channel is a connection intentionally created to transmit unauthorized information from inside a trusted network to a partner at an outside, untrusted node. Answer c is called masquerading.
26.	Answer: d A dual-homed host uses two NICs to attach to two separate networks, commonly a trusted network and an untrusted network. It’s important that the internal routing function of the host be disabled to create an Application-layer chokepoint and filter packets. Many systems come with routing enabled by default, such as IP forwarding, which makes the firewall useless. The other answers are distracters.
27.	Answer: c A bridge operates at Layer 2 and therefore does not use IP addressing to make routing decisions.
28.	Answer: d The 802.1D spanning tree protocol is an Ethernet link-management protocol that provides link redundancy while preventing routing loops. Because only one active path can exist for an Ethernet network to route properly, the STP algorithm calculates and manages the best loop-free path through the network. IEEE 802.5 (answer a) specifies a token-passing ring access method for LANs. IEEE 802.3 (answer b) specifies an Ethernet bus topology using Carrier Sense Multiple Access Control/ Carrier Detect (CSMA/CD). IEEE 802.11 (answer c) is the IEEE standard that specifies 1 Mbps and 2 Mbps wireless connectivity in the 2.4 MHz ISM (Industrial, Scientific, Medical) band.
29.	Answer: b Data Encapsulation attaches information from one layer to the packet as it travels from an adjoining layer. The OSI-layered architecture model creates seven layers. The TCP/IP protocol UDP provides best effort packet delivery, and a token-passing transmission scheme creates a deterministic network because it is possible to compute the maximum predictable delay.
30.	Answer: b The Layer Two Tunneling Protocol (L2TP) is a protocol that allows a host to establish a virtual connection. Although L2TP - an enhancement to Layer Two Forwarding Protocol (L2F), which supports some features of the Point to Point Tunneling Protocol (PPTP) - may coexist with IPSec, it is not natively an IPSec component. The Authentication Header (AH), answer a, is an authenticating protocol that uses a hash signature in the packet header to validate the integrity of the packet data and the authenticity of the sender. The Security Association (SA), answer c, is a component of the IPSec architecture that contains the information the IPSec device needs to process incoming and outbound IPSec packets. IPSec devices embed a value called the Security Parameter Index (SPI) in the header to associate a datagram with its SA and to store SAs in a Security Association Database (SAD). The Encapsulating Security Payload (ESP), answer d, is an authenticating and encrypting protocol that provides integrity, source authentication, and confidentiality services.
31.	Answer: c A brute force attack is an attempt to use all combinations of key patterns to decipher a message. The other three attacks are commonly used to create a Denial of Service (DoS). Ping of Death (answer a) exploits ICMP by sending an illegal ECHO packet of >65K octets of data, which can cause an overflow of system variables and lead to a system crash. SMURF (answer b) is a type of attack using spoofed ICMP ECHO requests to broadcast addresses, which the routers attempt to propagate, congesting the network. Three participants are required for a SMURF attack: the attacker, the amplifying network, and the victim. A TCP SYN flood attack (answer d) generates phony TCP SYN packets from random IP addresses at a rapid rate to fill up the connection queue and stop the system from accepting legitimate users.
32.	Answer: b The Encapsulating Security Payload (ESP) is a component of IPSec. Socket Security (SOCKS) is a Transport-layer, secure networking proxy protocol. SOCKS replaces the standard network systems calls with its own calls. These calls open connections to a SOCKS proxy server for client authentication, transparently to the user. Common network utilities, like Telnet or FTP, need to be SOCKS-ified or have their network calls altered to recognize SOCKS proxy calls.
33.	Answer: c The /etc/passwd file is a Unix system file. The NT Security Accounts Manager, SAM, contains the usernames and encrypted passwords of all local (and domain, if the server is a domain controller) users. The SAM uses an older, weaker LanManager hash that can be broken easily by tools like L0phtcrack. Physical access to the NT server and the rdisks must be controlled. The “Sam._” file in the repair directory must be deleted after creation of an rdisk. Pwdump and pwdump2 are utilities that allow someone with Administrator rights to target the Local Security Authority Subsystem, isass.exe, from a remote system.
34.	Answer: b Distance vector routing uses the Routing Information Protocol (RIP) to maintain a dynamic table of routing information that is updated regularly. It is the oldest and most common type of dynamic routing. Static routing (answer a) defines a specific route in a configuration file on the router and does not require the routers to exchange route information dynamically. Link state routers (answer c) function like distance vector routers but use first-hand information when building routing tables only by maintaining a copy of every other router’s Link State Protocol (LSP) frame. This helps to eliminate routing errors and considerably lessens convergence time. Answer d is a distracter.
35.	Answer: b Back doors are very hard to trace, as an intruder will often create several avenues into a network to be exploited later. The only real way to be sure these avenues are closed after an attack is to restore the operating system from the original media, apply the patches, and restore all data and applications. Social engineering (answer a) is a technique used to manipulate users into revealing information like passwords. An undocumented hook into an application to assist programmers with debugging (answer c) is known as a trap door. It serves as a back door into an application rather than a network. Although intended innocently, these can be exploited by intruders. Answer d is a “honey pot” or “padded cell.” A honey pot uses a dummy server with bogus applications as a decoy for intruders.
36.	Answer: b Simple Mail Transport Protocol (SMTP) queues and transfers e-mail. SNMP stands for Simple Network Management Protocol. ICMP stands for Internet Control Message Protocol. RARP stands for Reverse Address Resolution Protocol.
37.	Answer: c The Challenge Handshake Authentication Protocol (CHAP) is used at the startup of a remote link to verify the identity of a remote node. The Simple Mail Transfer Protocol (RFCs 821 and 1869), answer a, is used by a server to deliver email over the Internet. The Post Office Protocol (RFC 1939), answer b, enables users to read their email by downloading it from a remote server onto their local computer. The Internet Message Access Protocol (RFC 2060), answer d, allows users to read their email on a remote server without downloading the mail locally.
38.	Answer: b War walking (or war driving) refers to scanning for 802.11-based wireless network information by either driving or walking with a laptop, a wireless adapter in promiscuous mode, some type of scanning software such as NetStumbler or AiroPeek, and a Global Positioning System (GPS). War dialing (answer a) is a method used to hack into computers by using a software program to automatically call a large pool of telephone numbers to search for those that have a modem attached. Demon dialing, similar to war dialing (answer c) is a tool used to attack one modem using brute force to guess the password and gain access. Tone-Loc (answer d) was one of the first war-dialing tools used by phone phreakers.
39.	Answer: a The Routing Information Protocol (RIP) bases its routing path on the distance (number of hops) to the destination. RIP maintains optimum routing paths by sending out routing update messages if the network topology changes. For example, if a router finds that a particular link is faulty, it will update its routing table and then send a copy of the modified table to each of its neighbors. Open Shortest Path First (OSPF), answer b, is a link-state hierarchical routing algorithm intended as a successor to RIP. It features least-cost routing, multipath routing, and load balancing. The Internet Gateway Routing Protocol (IGRP), answer c, is a Cisco protocol that uses a composite metric as its routing metric, including bandwidth, delay, reliability, loading, and maximum transmission unit. The Extensible Authentication Protocol (EAP), answer d, is a general protocol for PPP authentication that supports multiple remote authentication mechanisms.
40.	Answer: a Although many routers can perform most of the functions above, the OSI Network Layer is primarily responsible for routing. Bridging (answer b) is a Data Link Layer function. Gateways (answer c) most commonly function at the higher layers. Signal regeneration and repeating (Answer d) are primarily Physical Layer functions.
41.	Answer: c Private addresses are not easily routable.
42.	Answer: b In the DoD reference model, the Host-to-Host layer parallels the function of the OSI’s Transport Layer. This layer contains the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP). The DoD Process/Application layer, (answer a) corresponds to the OSI’s top three layers: the Application, Presentation, and Session Layers. The DoD Internet layer (answer c) corresponds to the OSI’s Network Layer, and the DoD Network Access layer (answer d) is the equivalent of the Data Link and Physical Layers of the OSI model.
43.	Answer: b The class A address range is 1.0.0.0 to 126.255.255.255. The class B address range is 128.0.0.0 to 191.255.255.255. The class C address range is from 192.0.0.0 to 223.255.255.255. The class D address range is 244.0.0.0 to 239.255.255.255 and is used for multicast packets.
44.	Answer: c The other acronyms do not exist.
45.	Answer: d The 802.11i standard addresses security flaws in 802.11 products and presents an approach offering two different protocols: the TKIP protocol and the CCM protocol (CCMP).
46.	Answer: c 802.11n is a new standard operating in the 5GHz range, combining multiple antennas, faster encoding, and an optional doubling of spectrum to achieve raw data rates from 100 Mbps up to 600 Mbps. The standard employs multiple input, multiple output (MIMO) technology to achieve this speed.
47.	Answer: c. Bluejacking is a Bluetooth wireless hack that exploits BT’s discover mode to drop code unnoticed on the victim’s unit.
48.	Answer: b. A honey pot is configured to interact with potential hackers in such a way as to capture the details of their attacks. The other answers are all common uses for a keylogger.
49.	Answer: a A spambot is a program designed to collect, or harvest, e-mail addresses from the Internet in order to build mailing lists for sending spam. Choice b describes a pop-up download. Choice c describes a Trojan horse, and choice d describes a remote access Trojan.

1.	The Secure Hash Algorithm (SHA) is specified in the: Data Encryption Standard Digital Signature Standard Digital Encryption Standard Advanced Encryption Standard
2.	What does Secure Sockets Layer (SSL)/Transaction Security Layer (TSL) do? Implements confidentiality, authentication, and integrity above the Transport Layer Implements confidentiality, authentication, and integrity below the Transport Layer Implements only confidentiality above the Transport Layer Implements only confidentiality below the Transport Layer
3.	What are MD4 and MD5? Symmetric encryption algorithms Asymmetric encryption algorithms Hashing algorithms Digital certificates
4.	Elliptic curves, which are applied to public-key cryptography, employ modular exponentiation, which characterizes the: Elliptic curve discrete logarithm problem Prime factors of very large numbers Elliptic curve modular addition Knapsack problem
5.	Which algorithm is used in the Clipper Chip? IDEA DES Skipjack 3 DES
6.	The hashing algorithm in the Digital Signature Standard (DSS) generates a message digest of: 120 bits 160 bits 56 bits 130 bits
7.	The protocol of the Wireless Application Protocol (WAP), which performs functions similar to SSL in the TCP/IP protocol stack, is called the: Wireless Application Environment (WAE) Wireless Session Protocol (WSP) Wireless Transaction Protocol (WTP) Wireless Transport Layer Security Protocol (WTLS)
8.	A Security Parameter Index (SPI) and the identity of the security protocol (AH or ESP) are the components of: SSL IPSec S-HTTP SSH-1
9.	When two different keys encrypt a plaintext message into the same ciphertext, this situation is known as: Public-key cryptography Cryptanalysis Key clustering Hashing
10.	What is the result of the Exclusive Or operation, 1 XOR 0? 1 0 Indeterminate 10
11.	A block cipher: Encrypts by operating on a continuous data stream Is an asymmetric-key algorithm Converts variable-length plaintext into fixed-length ciphertext Breaks a message into fixed length units for encryption
12.	In most security protocols that support confidentiality, integrity, and authentication: Public-key cryptography is used to create digital signatures. Private-key cryptography is used to create digital signatures. DES is used to create digital signatures. Digital signatures are not implemented.
13.	Which of the following is an example of a symmetric-key algorithm? Rijndael RSA Diffie-Hellman Knapsack
14.	Which of the following is a problem with symmetric-key encryption? It is slower than asymmetric-key encryption. Most algorithms are kept proprietary. Work factor is not a function of the key size. It provides secure distribution of the secret key.
15.	Which of the following is an example of an asymmetric-key algorithm? IDEA DES 3 DES Elliptic Curve
16.	In public-key cryptography: Only the private key can encrypt, and only the public key can decrypt. Only the public key can encrypt, and only the private key can decrypt. The public key is used to encrypt and decrypt. If the public key encrypts, only the private key can decrypt.
17.	In a hybrid cryptographic system, usually: Public-key cryptography is used for the encryption of the message. Private-key cryptography is used for the encryption of the message. Neither public-key nor private-key cryptography is used. Digital certificates cannot be used.
18.	What is the block length of the Rijndael Cipher? 64 bits 128 bits Variable 256 bits
19.	A polyalphabetic cipher is also known as: One-time pad Vigenère cipher Steganography Vernam cipher
20.	The classic Caesar cipher is a: Polyalphabetic cipher Monoalphabetic cipher Transposition cipher Code group
21.	In steganography: Private-key algorithms are used. Public-key algorithms are used. Both public- and private-key algorithms are used. The fact that the message exists is not known.
22.	What is the key length of the Rijndael Block Cipher? 56 or 64 bits 512 bits 128, 192, or 256 bits 512 or 1024 bits
23.	In a block cipher, diffusion: Conceals the connection between the ciphertext and plaintext Spreads the influence of a plaintext character over many ciphertext characters Is usually implemented by nonlinear S-boxes Cannot be accomplished
24.	The NIST Advanced Encryption Standard uses the: 3 DES algorithm Rijndael algorithm DES algorithm IDEA algorithm
25.	The modes of DES do not include: Electronic Code Book Cipher Block Chaining Variable Block Feedback Output Feedback
26.	Which of the following is true? The work factor of triple DES is the same as for double DES. The work factor of single DES is the same as for triple DES. The work factor of double DES is the same as for single DES. No successful attacks have been reported against double DES.
27.	The Rijndael Cipher employs a round transformation that is composed of three layers of distinct, invertible transformations. These transformations are also defined as uniform, which means that every bit of the State is treated the same. Which of the following is not one of these layers? The nonlinear layer, which is the parallel application of S-boxes that have the optimum worst-case nonlinearity properties The linear mixing layer, which provides a guarantee of the high diffusion of multiple rounds The key addition layer, which is an Exclusive OR of the Round Key to the intermediate State The key inversion layer, which provides confusion through the multiple rounds
28.	The Escrowed Encryption Standard describes the: Rijndael Cipher Clipper Chip Fair Public Key Cryptosystem Digital certificates
29.	Theoretically, quantum computing offers the possibility of factoring the products of large prime numbers and calculating discrete logarithms in polynomial time. These calculations can be accomplished in such a compressed time frame because: Information can be transformed into quantum light waves that travel through fiber optic channels. Computations can be performed on the associated data by passing the light waves through various types of optical filters and solid-state materials with varying indices of refraction, thus drastically increasing the throughput over conventional computations. A quantum bit in a quantum computer is actually a linear superposition of both the one and zero states and, therefore, can theoretically represent both values in parallel. This phenomenon allows computation that usually takes exponential time to be accomplished in polynomial time because different values of the binary pattern of the solution can be calculated simultaneously. A quantum computer takes advantage of quantum tunneling in molecular scale transistors. This mode permits ultrahigh-speed switching to take place, thus exponentially increasing the speed of computations. A quantum computer exploits the time-space relationship that changes as particles approach the speed of light. At that interface, the resistance of conducting materials effectively is zero and exponential-speed computations are possible.
30.	Which of the following characteristics does a one-time pad have if used properly? It can be used more than once. The key does not have to be random. It is unbreakable. The key has to be of greater length than the message to be encrypted.
31.	The DES key is: 128 bits 64 bits 56 bits 512 bits
32.	In a digitally signed message transmission using a hash function: The message digest is encrypted in the private key of the sender. The message digest is encrypted in the public key of the sender. The message is encrypted in the private key of the sender. The message is encrypted in the public key of the sender.
33.	The strength of RSA public-key encryption is based on the: Difficulty in finding logarithms in a finite field Difficulty of multiplying two large prime numbers Fact that only one key is used Difficulty in finding the prime factors of very large numbers
34.	Elliptic curve cryptosystems: Have a higher strength per bit than RSA. Have a lower strength per bit than RSA. Cannot be used to implement digital signatures. Cannot be used to implement encryption.
35.	Which of the following is not a fundamental component of Identity-Based Encryption (IBE)? Bilinear mapping Weil Pairing Multiplication of points on an elliptic curve A symmetrical session key

Answers

1.	Answer: b The correct answer is b. Answer a refers to DES, a symmetric encryption algorithm; answer c is a distracter - there is no such term; answer d is the Advanced Encryption Standard, which has replaced DES and is now the Rijndael algorithm.
2.	Answer: a The correct answer is a by definition. Answer b is incorrect because SSL/TLS operates above the Transport Layer; answer c is incorrect because authentication and integrity are provided also, and answer d is incorrect because it cites only confidentiality and SSL/TLS operates above the Transport Layer.
3.	Answer: c The correct answer is c. Answers a and b are incorrect because they are general types of encryption systems, and answer d is incorrect because hashing algorithms are not digital certificates.
4.	Answer: a The correct answer is a. Modular exponentiation in elliptic curves is the analog of the modular discrete logarithm problem. Answer b is incorrect because prime factors are involved with RSA public-key systems; answer c is incorrect because modular addition in elliptic curves is the analog of modular multiplication; and answer d is incorrect because the knapsack problem is not an elliptic curve problem.
5.	Answer: c The correct answer is c. Answers a, b, and d are other symmetric-key algorithms.
6.	Answer: b
7.	Answer: d The answer d is correct. SSL performs security functions in TCP/IP. The other answers refer to protocols in the WAP protocol stack also, but their primary functions are not security.
8.	Answer: b The correct answer is b. The SPI, AH and/or ESP, and the destination IP address are components of an IPSec Security Association (SA). The other answers describe protocols other than IPSec.
9.	Answer: c The answer c is correct. Answer a describes a type of cryptographic system using a public and a private key; answer b is the art/science of breaking ciphers; answer d is the conversion of a message of variable length into a fixed-length message digest.
10.	Answer: a An XOR operation results in a 0 if the two input bits are identical and a 1 if one of the bits is a 1 and the other is a 0.
11.	Answer: d The answer d is correct. Answer a describes a stream cipher; answer b is incorrect because a block cipher applies to symmetric-key algorithms; and answer c describes a hashing operation.
12.	Answer: a The answer a is correct. Answer b is incorrect because private-key cryptography does not create digital signatures; answer c is incorrect because DES is a private-key system and, therefore, follows the same logic as in b; and answer d is incorrect because digital signatures are implemented to obtain authentication and integrity.
13.	Answer: a The correct answer is a. The other answers are examples of asymmetric-key systems.
14.	Answer: d The answer d is correct. Answer a is incorrect because the opposite is true; answer b is incorrect because most symmetric-key algorithms are published; and answer c is incorrect because work factor is a function of key size. The larger the key is, the larger the work factor.
15.	Answer: d The answer d is correct. All the other answers refer to symmetric-key algorithms.
16.	Answer: d The answer d is correct. Answers a and b are incorrect because if one key encrypts, the other can decrypt. Answer c is incorrect because if the public key encrypts, it cannot decrypt.
17.	Answer: b The answer b is correct. Answer a is incorrect because public-key cryptography is usually used for the encryption and transmission of the secret session key. Answer c is incorrect because both public- and private-key encryption are used, and answer d is incorrect because digital certificates can be used (and normally are used).
18.	Answer: c The correct answer is c. The other answers with fixed numbers are incorrect.
19.	Answer: b The answer b is correct. Answer a is incorrect because a one-time pad uses a random key with length equal to the plaintext message and is used only once. Answer c is the process of sending a message with no indication that a message even exists. Answer d is incorrect because it applies to stream ciphers that are XORed with a random key string.
20.	Answer: b The answer b is correct. The Caesar cipher uses one alphabet shifted three places. Answers a and c are incorrect because in a polyalphabetic cipher (answer a), multiple alphabets are used, and in a transposition cipher (answer c), the letters of the message are transposed. Answer d is incorrect because code groups deal with words and phrases and ciphers deal with bits or letters.
21.	Answer: d The correct answer is d. The other answers are incorrect because neither algorithm is used.
22.	Answer: c
23.	Answer: b The answer b is correct. Answer a defines confusion; answer c defines how confusion is accomplished; and answer d is incorrect because it can be accomplished.
24.	Answer: b The correct answer is b. By definition, the others are incorrect.
25.	Answer: c The correct answer is c. There is no such encipherment mode.
26.	Answer: c The answer c is correct. The Meet-in-the-Middle attack has been successfully applied to double DES, and the work factor is equivalent to that of single DES. Thus, answer d is incorrect. Answer a is false because the work factor of triple DES is greater than that for double DES. In triple DES, three levels of encryption and/or decryption are applied to the message. The work factor of double DES is equivalent to the work factor of single DES. Answer b is false because the work factor of single DES is less than for triple DES.
27.	Answer: d The answer d is correct. This answer is a distracter and does not exist.
28.	Answer: b
29.	Answer: b In digital computers, a bit is in either a one or a zero state. In a quantum computer, through linear superposition, a quantum bit can be in both states, essentially simultaneously. Thus, computations consisting of trial evaluations of binary patterns can take place simultaneously in exponential time. The probability of obtaining a correct result is increased through a phenomenon called constructive interference of light, while the probability of obtaining an incorrect result is decreased through destructive interference. Answer a describes optical computing that is effective in applying Fourier and other transformations to data to perform high-speed computations. Light representing large volumes of data passing through properly shaped physical objects can be subjected to mathematical transformations and recombined to provide the appropriate results. However, this mode of computation is not defined as quantum computing. Answers c and d are diversionary answers that do not describe quantum computing.
30.	Answer: c If the one-time-pad is used only once and its corresponding key is truly random and does not have repeating characters, it is unbreakable. Answer a is incorrect because if used properly, the one-time-pad should be used only once. Answer b is incorrect because the key should be random. Answer d is incorrect because the key has to be of the same length as the message.
31.	Answer: c
32.	Answer: a The hash function generates a message digest. The message digest is encrypted with the private key of the sender. Thus, if the message can be opened with the sender’s public key, which is known to all, the message must have come from the sender. The message is not encrypted with the public key because the message is usually longer than the message digest and would take more computing resources to encrypt and decrypt. Because the message digest uniquely characterizes the message, it can be used to verify the identity of the sender. Answers b and d will not work because a message encrypted in the public key of the sender can be read only by using the private key of the sender. Because the sender is the only one who knows this key, no one else can read the message. Answer c is incorrect because the message is not encrypted; the message digest is encrypted.
33.	Answer: d The correct answer is d. Answer a applies to public-key algorithms such as Diffie-Hellman and Elliptic Curve. Answer b is incorrect because it is easy to multiply two large prime numbers. Answer c refers to symmetric-key encryption.
34.	Answer: a It is more difficult to compute elliptic curve discrete logarithms than conventional discrete logarithms or factoring. Smaller key sizes in the elliptic curve implementation can yield higher levels of security. Therefore, answer b is incorrect. Answers c and d are incorrect because elliptic curve cryptosystems can be used for digital signatures and encryption.
35.	Answer: d IBE is based on using an arbitrary string as an individual’s public key. It is based on public-key cryptography; therefore, a symmetric key is not involved in the process.

1.	What does the Bell-LaPadula model not allow? Subjects to read from a higher level of security relative to their level of security Subjects to read from a lower level of security relative to their level of security Subjects to write to a higher level of security relative to their level of security Subjects to read at their same level of security
2.	In the * (star) security property of the Bell-LaPadula model: Subjects cannot read from a higher level of security relative to their level of security. Subjects cannot read from a lower level of security relative to their level of security. Subjects cannot write to a lower level of security relative to their level of security. Subjects cannot read from their same level of security.
3.	The Clark-Wilson model focuses on data’s: Integrity Confidentiality Availability Format
4.	The * (star) property of the Biba model states that: Subjects cannot write to a lower level of integrity relative to their level of integrity. Subjects cannot write to a higher level of integrity relative to their level of integrity. Subjects cannot read from a lower level of integrity relative to their level of integrity. Subjects cannot read from a higher level of integrity relative to their level of integrity.
5.	Which of the following does the Clark-Wilson model not involve? Constrained data items Transformational procedures Confidentiality items Well-formed transactions
6.	The Take-Grant model: Focuses on confidentiality Specifies the rights that a subject can transfer to an object Specifies the levels of integrity Specifies the levels of availability
7.	The Biba model addresses: Data disclosure Transformation procedures Constrained data items Unauthorized modification of data
8.	Mandatory access controls first appear in the Trusted Computer System Evaluation Criteria (TCSEC) at the rating of: D C B A
9.	In the access control matrix, the rows are: Access Control Lists (ACLs) Tuples Domains Capability lists
10.	What information security model formalizes the U.S. Department of Defense multilevel security policy? Clark-Wilson Stark-Wilson Biba Bell-LaPadula
11.	A Trusted Computing Base (TCB) is defined as: The total combination of protection mechanisms within a computer system that is trusted to enforce a security policy The boundary separating the trusted mechanisms from the remainder of the system A trusted path that permits a user to access resources A system that employs the necessary hardware and software assurance measures to enable the processing of multiple levels of classified or sensitive information to occur
12.	Memory space insulated from other running processes in a multiprocessing system is part of a: Protection domain Security perimeter Least upper bound Constrained data item
13.	The boundary separating the TCB from the remainder of the system is called the: Star property Simple security property Discretionary control boundary Security perimeter
14.	The system component that enforces access controls on an object is the: Security perimeter Trusted domain Reference monitor Access control matrix
15.	Which one the following is not one of the three major parts of the Common Criteria (CC)? Introduction and General Model Security Evaluation Requirements Security Functional Requirements Security Assurance Requirements
16.	A computer system that employs the necessary hardware and software assurance measures to enable it to process multiple levels of classified or sensitive information is called a: Closed system Open system Trusted system Safe system
17.	For fault tolerance to operate, a system must be: Capable of detecting and correcting the fault Capable only of detecting the fault Capable of terminating operations in a safe mode Capable of a cold start
18.	Which of the following choices describes the four phases of the National Information Assurance Certification and Accreditation Process (NIACAP)? Definition, Verification, Validation, and Confirmation Definition, Verification, Validation, and Post Accreditation Verification, Validation, Authentication, and Post Accreditation Definition, Authentication, Verification, and Post Accreditation
19.	In the Common Criteria, an implementation-independent statement of security needs for a set of IT security products that could be built is called a: Security Target (ST) Package Protection Profile (PP) Target of Evaluation (TOE)
20.	The termination of selected, noncritical processing when a hardware or software failure occurs and is detected is referred to as: Fail-safe Fault-tolerant Fail-soft An exception
21.	Which one of the following is not a component of a CC Protection Profile? Target of Evaluation (TOE) description Threats against the product that must be addressed Product-specific security requirements Security objectives
22.	Content-dependent control makes access decisions based on: The object’s data The object’s environment The object’s owner The object’s view
23.	The term failover refers to: Switching to a duplicate, “hot” backup component Terminating processing in a controlled fashion Resiliency A fail-soft system
24.	Primary storage is: Memory directly addressable by the CPU for storage of instructions and data that are associated with the program being executed Memory, such as magnetic disks, that provides nonvolatile storage Memory used in conjunction with real memory to present a CPU with a larger, apparent address space Memory in which information must be obtained by sequentially searching from the beginning of the memory space
25.	In the Common Criteria, a Protection Profile: Specifies the mandatory protection in the product to be evaluated Is also known as the Target of Evaluation (TOE) Is also known as the Orange Book Specifies the security requirements and protections of the products to be evaluated
26.	Context-dependent control uses which of the following to make decisions? Subject or object attributes or environmental characteristics Data Formal models Operating system characteristics
27.	The secure path between a user and the Trusted Computing Base (TCB) is called: Trusted distribution Trusted path Trusted facility management The security perimeter
28.	In a ring protection system, where is the security kernel usually located? Highest ring number Arbitrarily placed Lowest ring number Middle ring number
29.	Increasing performance in a computer by overlapping the steps of different instructions is called: A reduced instruction set computer A complex instruction set computer Vector processing Pipelining
30.	Random-access memory is: Nonvolatile Sequentially addressable Programmed by using fusible links Volatile
31.	In the National Information Assurance Certification and Accreditation Process (NIACAP), a type accreditation performs which one of the following functions? Evaluates a major application or general support system Verifies the evolving or modified system’s compliance with the information agreed on in the System Security Authorization Agreement (SSAA) Evaluates an application or system that is distributed to a number of different locations Evaluates the applications and systems at a specific, self-contained location
32.	Processes are placed in a ring structure according to: Least privilege Separation of duty Owner classification First in, first out
33.	The MULTICS operating system is a classic example of: An open system Object orientation Database security Ring protection system
34.	What are the hardware, firmware, and software elements of a Trusted Computing Base (TCB) that implement the reference monitor concept called? The trusted path A security kernel An Operating System (OS) A trusted computing system

Answers

1.	Answer: a The answer a is correct. The other options are not prohibited by the model.
2.	Answer: c The correct answer is c by definition of the star property.
3.	Answer: a The answer a is correct. The Clark-Wilson model is an integrity model.
4.	Answer: b
5.	Answer: c The answer c is correct. Answers a, b, and d are parts of the Clark-Wilson model.
6.	Answer: b
7.	Answer: d The answer d is correct. The Biba model is an integrity model. Answer a is associated with confidentiality. Answers b and c are specific to the Clark-Wilson model.
8.	Answer: c
9.	Answer: d The answer d is correct. Answer a is incorrect because the access control list is not a row in the access control matrix. Answer b is incorrect because a tuple is a row in the table of a relational database. Answer c is incorrect because a domain is the set of allowable values a column or attribute can take in a relational database.
10.	Answer: d The answer d is correct. The Bell-LaPadula model addresses the confidentiality of classified material. Answers a and c are integrity models, and answer b is a distracter.
11.	Answer: a The answer a is correct. Answer b is the security perimeter. Answer c is the definition of a trusted path. Answer d is the definition of a trusted computer system.
12.	Answer: a
13.	Answer: d The answer d is correct. Answers a and b deal with security models, and answer c is a distracter.
14.	Answer: c
15.	Answer: b The correct answer is b, a distracter. Answer a is Part 1 of the CC. It defines general concepts and principles of information security and defines the contents of the Protection Profile (PP), Security Target (ST), and the Package. The Security Functional Requirements, answer c, are Part 2 of the CC, which contains a catalog of well-defined standard means of expressing security requirements of IT products and systems. Answer d is Part 3 of the CC and comprises a catalog of a set of standard assurance components.
16.	Answer: c The correct answer is c, by definition of a trusted system. Answers a and b refer to open, standard information on a product as opposed to a closed or proprietary product. Answer d is a distracter.
17.	Answer: a The correct answer is a, the two conditions required for a fault-tolerant system. Answer b is a distracter. Answer c is the definition of fail-safe, and answer d refers to starting after a system shutdown.
18.	Answer: b
19.	Answer: c The answer c is correct. Answer a, ST, is a statement of security claims for a particular IT product or system. A Package, answer b, is defined in the CC as “an intermediate combination of security requirement compo-nents.” A TOE, answer d, is “an IT product or system to be evaluated.”
20.	Answer: c
21.	Answer: c The answer c is correct. Product-specific security requirements for the product or system are contained in the Security Target (ST). Additional items in the PP are: TOE security environment description Assumptions about the security aspects of the product’s expected use Organizational security policies or rules Application notes Rationale
22.	Answer: a The answer a is correct. Answer b is context-dependent control. Answers c and d are distracters.
23.	Answer: a Failover means switching to a “hot” backup system that maintains duplicate states with the primary system. Answer b refers to fail-safe, and answers c and d refer to fail-soft.
24.	Answer: a The answer a is correct. Answer b refers to secondary storage. Answer c refers to virtual memory, and answer d refers to sequential memory.
25.	Answer: d The answer d is correct. Answer a is a distracter. Answer b is the product to be evaluated. Answer c refers to TCSEC.
26.	Answer: a The answer a is correct. Answer b refers to content-dependent characteristics, and answers c and d are distracters.
27.	Answer: b Answer a, trusted distribution, ensures that valid and secure versions of software have been received correctly. Trusted facility management, answer c, is concerned with the proper operation of trusted facilities as well as system administration and configuration. Answer d, the security perimeter, is the boundary that separates the TCB from the remainder of the system. Recall that the TCB is the totality of protection mechanisms within a computer system that are trusted to enforce a security policy.
28.	Answer: c
29.	Answer: d
30.	Answer: d RAM is volatile. The other answers are incorrect because RAM is volatile, randomly accessible, and not programmed by fusible links.
31.	Answer: c Answer a is the NIACAP system accreditation. Answer b is the Phase 2 or Verification phase of the Defense Information Technology Security Certification and Accreditation Process (DITSCAP). The objective is to use the SSAA to establish an evolving yet binding agreement on the level of security required before the system development begins or changes to a system are made. After accreditation, the SSAA becomes the baseline security configuration document. Answer d is the NIACAP site accreditation.
32.	Answer: a The correct answer is a. A process is placed in the ring that gives it the minimum privileges necessary to perform its functions.
33.	Answer: d MULTICS is based on the ring protection architecture.
34.	Answer: b

1.	Which of the following places the four systems security modes of operation in order, from the most secure to the least? System-High Mode, Dedicated Mode, Compartmented Mode, and Multilevel Mode Dedicated Mode, System-High Mode, Compartmented Mode, and Multilevel Mode Dedicated Mode, System-High Mode, Multilevel Mode, and Compartmented Mode System-High Mode, Compartmented Mode, Dedicated Mode, and Multilevel Mode
2.	Why is security an issue when a system is booted into single-user mode? The operating system is started without the security front-end loaded. The users cannot log in to the system, and they will complain. Proper forensics cannot be executed while in single-user mode. Backup tapes cannot be restored while in single-user mode.
3.	An audit trail is an example of what type of control? Deterrent control Preventative control Detective control Application control
4.	Which of the following media controls is the best choice to prevent data remanence on magnetic tapes or floppy disks? Overwriting the media with new application data Degaussing the media Applying a concentration of hydroiodic acid (55% to 58% solution) to the gamma ferric oxide disk surface Making sure the disk is recirculated as quickly as possible to prevent object reuse
5.	Which of the following choices is not a security goal of an audit mechanism? To deter perpetrators’ attempts to bypass the system protection mechanisms To review employee production output records To review patterns of access to individual objects To discover when a user assumes a functionality with privileges greater than his own
6.	Which of the following tasks would normally be a function of the security administrator, not the system administrator? Installing system software Adding and removing system users Reviewing audit data Managing print queues
7.	Which of the following is a reason to institute output controls? To preserve the integrity of the data in the system while changes are being made to the configuration To protect the output’s confidentiality To detect irregularities in the software’s operation To recover damage after an identified system failure
8.	Which of the following statements is not correct about reviewing user accounts? User account reviews cannot be conducted by outside auditors. User account reviews can examine conformity with the concept of least privilege. User account reviews may be conducted on a systemwide basis. User account reviews may be conducted on an application-by-application basis.
9.	Which of the following terms most accurately describes the trusted computing base (TCB)? A computer that controls all access to objects by subjects A piece of information that represents the security level of an object Formal proofs used to demonstrate the consistency between a system’s specification and a security model The totality of protection mechanisms within a computer system
10.	Which of the following statements is accurate about the concept of object reuse? Object reuse protects against physical attacks on the storage medium. Object reuse ensures that users do not obtain residual information from system resources. Object reuse applies to removable media only. Object reuse controls the granting of access rights to objects.
11.	Using prenumbered forms to initiate a transaction is an example of what type of control? Deterrent control Preventative control Detective control Application control
12.	Which of the following choices is the best description of operational assurance? Operational assurance is the process of examining audit logs to reveal usage that identifies misuse. Operational assurance has the benefit of containing and repairing damage from incidents. Operational assurance is the process of reviewing an operational system to see that security controls are functioning correctly. Operational assurance is the process of performing pre-employment background screening.
13.	Which of the following is not a proper media control? The data media should be logged to provide a physical inventory control. All data storage media should be accurately marked. A proper storage environment should be provided for the media. The media that is reused in a sensitive environment does not need sanitization.
14.	Which of the following choices is considered the highest level of operator privilege? Read/Write Read Only Access Change Write Only
15.	Which of the following choices below most accurately describes a covert storage channel? A process that manipulates observable system resources in a way that affects response time An information transfer path within a system A communication channel that allows a process to transfer information in a manner that violates the system’s security policy An information transfer that involves the direct or indirect writing of a storage location by one process and the direct or indirect reading of the storage location by another process
16.	Which of the following would not be a common element of a transaction trail? The date and time of the transaction Who processed the transaction Why the transaction was processed At which terminal the transaction was processed
17.	Which of the following would not be considered a benefit of employing incident-handling capability? An individual acting alone would not be able to subvert a security process or control. It enhances internal communications and the readiness of the organization to respond to incidents. It assists an organization in preventing damage from future incidents. Security training personnel would have a better understanding of users’ knowledge of security issues.
18.	Which of the following is the best description of an audit trail? Audit trails are used to detect penetration of a computer system and to reveal usage that identifies misuse. An audit trail is a device that permits simultaneous data processing of two or more security levels without risk of compromise. An audit trail mediates all access to objects within the network by subjects within the network. Audit trails are used to prevent access to sensitive systems by unauthorized personnel.
19.	Which of the following best describes the function of change control? To ensure that system changes are implemented in an orderly manner To guarantee that an operator is given only the privileges needed for the task To guarantee that transaction records are retained IAW compliance requirements To assign parts of security-sensitive tasks to more than one individual
20.	Which of the following is not an example of intentionally inappropriate operator activity? Making errors when manually inputting transactions Using the company’s system to store pornography Conducting private business on the company system Using unauthorized access levels to violate information confidentiality
21.	Which book of the Rainbow Series addresses the Trusted Computer System Evaluation Criteria (TCSEC)? Red Book Orange Book Green Book Purple Book
22.	Which term best describes the concept of least privilege? Each user is granted the lowest clearance required for his or her tasks. A formal separation of command, program, and interface functions. A combination of classification and categories that represents the sensitivity of information. Active monitoring of facility entry access points.
23.	Which of the following best describes a threat as defined in the Operations Security domain? A potential incident that could cause harm A weakness in a system that could be exploited A company resource that could be lost due to an incident The minimization of loss associated with an incident
24.	Which of the following is not a common element of user account administration? Periodically verifying the legitimacy of current accounts and access authorizations Authorizing the request for a user’s system account Tracking users and their respective access authorizations Establishing, issuing, and closing user accounts
25.	Which of the following is not an example of using a social engineering technique to gain physical access to a secure facility? Asserting authority or pulling rank Intimidating or threatening Praising or flattering Employing the salami fraud (see Appendix A)
26.	Which statement about covert channel analysis is not true? It is an operational assurance requirement that is specified in the Orange Book. It is required for B2 class systems in order to protect against covert storage channels. It is required for B2 class systems to protect against covert timing channels. It is required for B3 class systems to protect against both covert storage and covert timing channels.
27.	“Separation of duties” embodies what principle? An operator does not know more about the system than the minimum required to do the job. Two operators are required to work in tandem to perform a task. The operators’ duties are frequently rotated. The operators have different duties to prevent one person from compromising the system.
28.	Convert Channel Analysis, Trusted Facility Management, and Trusted Recovery are parts of which book in the TCSEC Rainbow Series? Red Book Orange Book Green Book Dark Green Book
29.	How do covert timing channels convey information? By changing a system’s stored data characteristics By generating noise and traffic with the data By performing a covert channel analysis By modifying the timing of a system resource in some measurable way
30.	Which of the following would be the best description of a clipping level? A baseline of user errors above which violations will be recorded A listing of every error made by users to initiate violation processing Variance detection of too many people with unrestricted access Changes a system’s stored data characteristics
31.	Which of the following backup methods will probably require the backup operator to use the most number of tapes for a complete system restoration if a different tape is used every night in a five-day rotation? Full Differential Incremental Ad hoc
32.	Which level of RAID is commonly referred to as disk mirroring? RAID 0 RAID 1 RAID 3 RAID 5
33.	Which is not a common element of an e-mail? Header Content VBScript Attachment(s)
34.	Which of the following choices is the best description of a fax encryptor? An individual user who encrypts fax documents A encryption mechanism that encrypts all fax transmissions at the Data Link Layer An application that encrypts all printed output An application that encrypts faxes at the desktop
35.	Which of the following statements is true about e-mail headers? E-mail headers can never be spoofed. Fraudulent e-mail is easily identified by the headers. The header may point back to the hijacked spambot. The header will always point back to the original spammer.

Answers

1.	Answer: b Dedicated Mode, System-High Mode, Compartmented Mode, and Multilevel Mode
2.	Answer: a When the operator boots the system in single-user mode, the user front-end security controls are not loaded. This mode should be used only for recovery and maintenance procedures, and all operations should be logged and audited.
3.	Answer: c An audit trail is a record of events to piece together what has happened and allow enforcement of individual accountability by creating a reconstruction of events. They can be used to assist in the proper implementation of the other controls, however.
4.	Answer: b Degaussing is recommended as the best method for purging most magnetic media. Answer a is not recommended because the application may not completely overwrite the old data properly. Answer c is a rarely used method of media destruction, and acid solutions should be used in a well-ventilated area only by qualified personnel. Answer d is wrong.
5.	Answer: b Answer b is a distracter; the other answers reflect proper security goals of an audit mechanism.
6.	Answer: c Reviewing audit data should be a function separate from the day-to-day administration of the system.
7.	Answer: b In addition to being used as a transaction control verification mechanism, output controls are used to ensure that output, such as printed reports, is distributed securely. Answer a is an example of change control, c is an example of application controls, and d is an example of recovery controls.
8.	Answer: a Reviews can be conducted by, among others, in-house systems personnel (a self-audit), the organization’s internal audit staff, or external auditors.
9.	Answer: d The Trusted Computing Base (TCB) represents totality of protection mechanisms within a computer system, including hardware, firmware, and software, the combination of which is responsible for enforcing a security policy. Answer a describes the reference monitor concept, answer b refers to a sensitivity label, and answer c describes formal verification.
10.	Answer: b Object reuse mechanisms ensure system resources are allocated and assigned among authorized users in a way that prevents the leak of sensitive information, and they ensure that the authorized user of the system does not obtain residual information from system resources. Answer a is incorrect, answer c is incorrect, and answer d refers to authorization: the granting of access rights to a user, program, or process.
11.	Answer: b Prenumbered forms are an example of preventative controls. They can also be considered a transaction control and input control.
12.	Answer: c Operational assurance is the process of reviewing an operational system to see that security controls, both automated and manual, are functioning correctly and effectively. Operational assurance addresses whether the system’s technical features are being bypassed or have vulnerabilities and whether required procedures are being followed. Answer a is a description of an audit trail review, answer b is a description of a benefit of incident handling, and answer d describes a personnel control.
13.	Answer: d Sanitization is the process of removing information from used data media to prevent data remanence. Different media require different types of sanitization. All the others are examples of proper media controls.
14.	Answer: c The three common levels of operator privileges, based on the concept of “least privilege,” are: Read Only - Lowest level, view data only Read/Write - View and modify data Access Change - Highest level, right to change data/operator permissions Answer d is a distracter.
15.	Answer: d A covert storage channel typically involves a finite resource (e.g., sectors on a disk) that is shared by two subjects at different security levels. Answer a is a partial description of a covert timing channel, and answer b is a generic definition of a channel. A channel may also refer to the mechanism by which the path is affected. Answer c is a higher-level definition of a covert channel. While a covert storage channel fits this definition generically, answer d is the proper specific definition.
16.	Answer: c Why the transaction was processed is not initially a concern of the audit log, but it will be investigated later. The other three elements are all important information that the audit log of the transaction should record.
17.	Answer: a The primary benefits of employing an incident-handling capability are containing and repairing damage from incidents and preventing future damage. Answer a is a benefit of employing “separation of duties” controls.
18.	Answer: a An audit trail is a set of records that collectively provide documentary evidence of processing used to aid in tracing from original transactions forward to related records and reports and/or backward from records and reports to their component source transactions. Answer b is a description of a multilevel device, and answer c refers to a network reference monitor. Answer d is incorrect because audit trails are detective, and answer d describes a preventative process - access control.
19.	Answer: a Answer b describes least privilege, answer c describes record retention, and answer d describes separation of duties.
20.	Answer: a Although operator error (answer a) is most certainly an example of a threat to a system’s integrity, it is considered unintentional loss, not an intentional activity.
21.	Answer: b
22.	Answer: a The least privilege principle requires that each subject in a system be granted the most restrictive set of privileges (or lowest clearance) needed for the performance of authorized tasks. Answer b describes separation of privilege, answer c describes a security level, and answer d is a distracter.
23.	Answer: a Answer b describes a vulnerability, answer c describes an asset, and answer d describes risk management.
24.	Answer: b For proper separation of duties, the function of user account establishment and maintenance should be separated from the function of initiating and authorizing the creation of the account. User account management focuses on identification, authentication, and access authorizations.
25.	Answer: d Answers a, b, and c denote common tactics used by an intruder to gain either physical access or system access. The salami fraud is an automated fraud technique. In the salami fraud, a programmer will create or alter a program to move small amounts of money into his personal bank account. The amounts are intended to be so small as to be unnoticed, such as rounding in foreign currency exchange transactions; hence the name, a reference to slicing a salami.
26.	Answer: c Orange Book B2 class systems do not need to be protected from covert timing channels. Covert channel analysis must be performed for B2-level class systems to protect against only covert storage channels. B3 class systems need to be protected from both covert storage channels and covert timing channels.
27.	Answer: d Separation of duties means that the operators are prevented from generating and verifying transactions alone, for example. A task might be divided into different smaller tasks to accomplish this, or in the case of an operator with multiple duties, the operator makes a logical, functional job change when performing such conflicting duties. Answer a is need-to-know, answer b is dual-control, and c is job rotation.
28.	Answer: b The Red Book (answer a) is the Trusted Network Interpretation (TNI) summary of network requirements (described in the Telecommunications and Network Security domain); the Green Book (answer c) is the Department of Defense (DoD) Password Management Guideline; and the Dark Green Book (answer d) is The Guide to Understanding Data Remanence in Automated Information Systems.
29.	Answer: d A covert timing channel alters the timing of parts of the system to enable it to be used to communicate information covertly (outside the normal security function). Answer a is the description of the use of a covert storage channel, answer b is a technique to combat the use of covert channels, and answer c is the Orange Book requirement for B3, B2, and A1 evaluated systems.
30.	Answer: a This description of a clipping level is the best. Answer b is not correct because one reason to create clipping levels is to prevent auditors from having to examine every error. Answer c is a common use for clipping levels but is not a definition. Answer d is a distracter.
31.	Answer: c Most backup methods use the Archive file attribute to determine whether the file should be backed up. The backup software determines which files need to be backed up by checking to see whether the Archive file attribute has been set and then resets the Archive bit value to null after the backup procedure. The Incremental backup method backs up only files that have been created or modified since the last backup was made because the Archive file attribute is reset. This can result in the backup operator needing several tapes to do a complete restoration, because every tape with changed files as well as the last full backup tape will need to be restored. A full or complete backup (answer a) backs up all files in all directories stored on the server regardless of when the last backup was made and whether the files have already been backed up. The Archive file attribute is changed to mark that the files have been backed up, and the tape or tapes will have all data and applications on it. This is an incorrect answer for this question, however, as it’s assumed that answers b and c will additionally require differential or incremental tapes. The Differential backup method (answer b) backs up only files that have been created or modified since the last backup was made, like an incremental backup. However, the difference between an incremental backup and a differential backup is that the Archive file attribute is not reset after the differential backup is completed; therefore, the changed file is backed up every time the differential backup is run. The backup set grows in size until the next full backup as these files continue to be backed up during each subsequent differential backup. The advantage of this backup method is that the backup operator should need only the full backup and the one differential backup to restore the system. Answer d is a distracter.
32.	Answer: b Redundant Array of Inexpensive Disks (RAID) is a method of enhancing hard disk fault tolerance, which can improve performance. RAID 1 maintains a complete copy of all data by duplicating each hard drive. Performance can suffer in some implementations of RAID 1, and twice as many drives are required. Novell developed a type of disk mirroring called disk duplexing, which uses multiple disk controller cards, increasing both performance and reliability. RAID 0 (answer a) gives some performance gains by striping the data across multiple drives but reduces fault tolerance, because the failure of any single drive disables the whole volume. RAID 3 (answer c) uses a dedicated error-correction disk called a parity drive, and it stripes the data across the other data drives. RAID 5 (answer d) uses all disks in the array for both data and error correction, increasing both storage capacity and performance.
33.	Answer: c E-mails have three basic parts: attachments, contents, and headers. Both the contents and attachments are areas of vulnerability.
34.	Answer: b A fax encryptor is a encryption mechanism that encrypts all fax transmissions at the Data Link layer and helps ensure that all incoming and outgoing fax data is encrypted at its source.
35.	Answer: c The header may point back to the hijacked spambot’s mail server. Email headers can be spoofed, fraudulent e-mail not always identified by the headers, and the header doesn’t always point back to the original spammer.

1.	What is a data warehouse? A remote facility used for storing backup tapes A repository of information from heterogeneous databases A table in a relational database system A hot backup building
2.	What does normalizing data in a data warehouse mean? Redundant data is removed. Numerical data is divided by a common factor. Data is converted to a symbolic representation. Data is restricted to a range of values.
3.	What is a neural network? A hardware or software system that emulates the reasoning of a human expert A collection of computers that are focused on medical applications A series of networked PCs performing artificial intelligence tasks A hardware or software system that emulates the functioning of biological neurons
4.	A neural network learns by using various algorithms to: Adjust the weights applied to the data Fire the rules in the knowledge base Emulate an inference engine Emulate the thinking of an expert
5.	The SEI Software Capability Maturity Model is based on the premise that: Good software development is a function of the number of expert programmers in the organization. The maturity of an organization’s software processes cannot be measured. The quality of a software product is a direct function of the quality of its associated software development and maintenance processes. Software development is an art that cannot be measured by conventional means.
6.	In configuration management, a configuration item is: The version of the operating system that is operating on the workstation that provides information security services A component whose state is to be recorded and against which changes are to be progressed The network architecture used by the organization A series of files that contain sensitive information
7.	In an object-oriented system, polymorphism denotes: Objects of many different classes that are related by some common superclass; thus, any object denoted by this name can respond to some common set of operations in a different way. Objects of many different classes that are related by some common superclass; thus, all objects denoted by this name can respond to some common set of operations in identical fashion. Objects of the same class; thus, any object denoted by this name can respond to some common set of operations in the same way. Objects of many different classes that are unrelated but respond to some common set of operations in the same way.
8.	The simplistic model of software life cycle development assumes that: Iteration will be required among the steps in the process. Each step can be completed and finalized without any effect from the later stages that may require rework. Each phase is identical to a completed milestone. Software development requires reworking and repeating some of the phases.
9.	What is a method in an object-oriented system? The means of communication among objects A guide to the programming of objects The code defining the actions that the object performs in response to a message The situation where a class inherits the behavioral characteristics of more than one parent class
10.	What does the Spiral model depict? A spiral that incorporates various phases of software development A spiral that models the behavior of biological neurons The operation of expert systems Information security checklists
11.	In the software life cycle, verification: Evaluates the product in development against real-world requirements Evaluates the product in development against similar products Evaluates the product in development against general baselines Evaluates the product in development against the specification
12.	In the software life cycle, validation: Refers to the work product satisfying the real-world requirements and concepts Refers to the work product satisfying derived specifications Refers to the work product satisfying software maturity levels Refers to the work product satisfying generally accepted principles
13.	In the modified Waterfall model: Unlimited backward iteration is permitted. The model was reinterpreted to have phases end at project milestones. The model was reinterpreted to have phases begin at project milestones. Product verification and validation are not included.
14.	Cyclic redundancy checks, structured walk-throughs, and hash totals are examples of what type of application controls? Preventive security controls Preventive consistency controls Detective accuracy controls Corrective consistency controls
15.	In a system life cycle, information security controls should be: Designed during the product implementation phase Implemented prior to validation Part of the feasibility phase Specified after the coding phase
16.	The software maintenance phase controls consist of: Request control, change control, and release control Request control, configuration control, and change control Change control, security control, and access control Request control, release control, and access control
17.	In configuration management, what is a software library? A set of versions of the component configuration items A controlled area accessible only to approved users who are restricted to the use of an approved procedure A repository of backup tapes A collection of software build lists
18.	What is configuration control? Identifying and documenting the functional and physical characteristics of each configuration item Controlling changes to the configuration items and issuing versions of configuration items from the software library Recording the processing of changes Controlling the quality of the configuration management procedures
19.	What is searching for data correlations in the data warehouse called? Data warehousing Data mining A data dictionary Configuration management
20.	The security term that is concerned with the same primary key existing at different classification levels in the same database is: Polymorphism Normalization Inheritance Polyinstantiation
21.	What is a data dictionary? A database for system developers A database of security terms A library of objects A validation reference source
22.	Which of the following is an example of mobile code? Embedded code in control systems Embedded code in PCs Java and ActiveX code downloaded into a Web browser from the World Wide Web (WWW) Code derived following the Spiral model
23.	Which of the following is not true regarding software unit testing? The test data is part of the specifications. Correct test output results should be developed and known beforehand. Live or actual field data is recommended for use in the testing procedures. Testing should check for out-of-range values and other bounds conditions.
24.	The definition “the science and art of specifying, designing, implementing, and evolving programs, documentation, and operating procedures whereby computers can be made useful to people” is that of: Structured analysis/structured design (SA/SD) Software engineering An object-oriented system Functional programming
25.	In software engineering, the term verification is defined as: Establishing the truth of correspondence between a software product and its specification A complete, validated specification of the required functions, interfaces, and performance for the software product Establishing the fitness or worth of a software product for its operational mission A complete, verified specification of the overall hardware-software architecture, control structure, and data structure for the product
26.	The discipline of identifying the components of a continually evolving system for the purposes of controlling changes to those components and maintaining integrity and traceability throughout the life cycle is called: Change control Request control Release control Configuration management
27.	The basic version of the Construction Cost Model (COCOMO), which proposes quantitative life cycle relationships, performs what function? It estimates software development effort based on user function categories. It estimates software development effort and cost as a function of the size of the software product in source instructions. It estimates software development effort and cost as a function of the size of the software product in source instructions modified by manpower buildup and productivity factors. It estimates software development effort and cost as a function of the size of the software product in source instructions modified by hardware and input functions.
28.	A refinement to the basic Waterfall model that states that software should be developed in increments of functional capability is called: Functional refinement Functional development Incremental refinement Incremental development
29.	The Spiral model of the software development process uses which of the following metrics relative to the spiral? The radial dimension represents the cost of each phase. The radial dimension represents progress made in completing each cycle. The angular dimension represents cumulative cost. The radial dimension represents cumulative cost.
30.	In the Capability Maturity Model (CMM) for software, the definition “describes the range of expected results that can be achieved by following a software process” is that of: Structured analysis/structured design (SA/SD) Software process capability Software process performance Software process maturity

Answers

1.	Answer: b A data warehouse is a repository of information from heterogeneous databases. Answers a and d describe physical facilities for backup and recovery of information systems, and answer c describes a relation in a relational database.
2.	Answer: a The correct answer is a, removing redundant data.
3.	Answer: d A neural network is a hardware or software system that emulates the functioning of biological neurons. Answer a refers to an expert system, and answers b and c are distracters.
4.	Answer: a A neural network learns by using various algorithms to adjust the weights applied to the data. Answers b, c, and d are terminology referenced in expert systems.
5.	Answer: c The quality of a software product is a direct function of the quality of its associated software development and maintenance processes. Answer a is false because the SEI Software CMM relates the production of good software to having the proper processes in place in an organization and not to expert programs or heroes. Answer b is false because the Software CMM provides means to measure the maturity of an organization’s software processes. Answer d is false for the same reason as answer b.
6.	Answer: b A configuration item is a component whose state is to be recorded and against which changes are to be progressed. Answers a, c, and d are incorrect by the definition of a configuration item.
7.	Answer: a Polymorphism refers to objects of many different classes that are related by some common superclass that are able to respond to some common set of operations, defined for the superclass, in different ways depending on their particular subclasses. Answers b, c, and d are incorrect by the definition of polymorphism.
8.	Answer: b The simplistic model assumes that each step can be completed and finalized without any effect from the later stages that might require rework. Answer a is incorrect because no iteration is allowed for in the model. Answer c is incorrect because it applies to the modified Waterfall model. Answer d is incorrect because no iteration or reworking is considered in the model.
9.	Answer: c A method in an object-oriented system is the code that defines the actions that the object performs in response to a message. Answer a is incorrect because it defines a message. Answer b is a distracter, and answer d refers to multiple inheritance.
10.	Answer: a The spiral in the Spiral model incorporates various phases of software development. The other answers are distracters.
11.	Answer: d In the software life cycle, verification evaluates the product in development against the specification. Answer a defines validation. Answers b and c are distracters.
12.	Answer: a In the software life cycle, validation is the work product satisfying the real-world requirements and concepts. The other answers are distracters.
13.	Answer: b The modified Waterfall model was reinterpreted to have phases end at project milestones. Answer a is false because unlimited backward iteration is not permitted in the modified Waterfall model. Answer c is a distracter, and answer d is false because verification and validation are included.
14.	Answer: c Cyclic redundancy checks, structured walkthroughs, and hash totals are examples of detective accuracy controls. The other answers do not apply by the definition of the types of controls.
15.	Answer: c In the system life cycle, information security controls should be part of the feasibility phase. The other answers are incorrect because the basic premise of information system security is that controls should be included in the earliest phases of the software life cycle and not added later in the cycle or as an afterthought.
16.	Answer: a The software maintenance phase controls consist of request control, change control, and release control, by definition. The other answers are, therefore, incorrect.
17.	Answer: b In configuration management, a software library is a controlled area, accessible only to approved users who are restricted to the use of approved procedure. Answer a is incorrect because it defines a build list. Answer c is incorrect because it defines a backup storage facility. Answer d is a distracter.
18.	Answer: b Configuration control consists of controlling changes to the configuration items and issuing versions of configuration items from the software library. Answer a is the definition of configuration identification. Answer c is the definition of configuration status accounting, and answer d is the definition of configuration audit.
19.	Answer: b Searching for data correlations in the data warehouse is called data mining. Answer a is incorrect because data warehousing is creating a repository of information from heterogeneous databases that is available to users for making queries. Answer c is incorrect because a data dictionary is a database for system developers. Answer d is incorrect because configuration management is the discipline of identifying the components of a continually evolving system for the purposes of controlling changes to those components and maintaining integrity and traceability throughout the life cycle.
20.	Answer: d The security term that is concerned with the same primary key existing at different classification levels in the same database is polyinstantiation. Answer a is incorrect because polymorphism is defined as objects of many different classes that are related by some common superclass so that any object denoted by this name is able to respond in its own way to some common set of operations. Answer b is incorrect because normalization refers to removing redundant or incorrect data from a database. Answer c is incorrect because inheritance refers to methods from a class inherited by a subclass.
21.	Answer: a A data dictionary is a database for system developers. Answers b, c, and d are distracters.
22.	Answer: c Examples of mobile code are Java applets and ActiveX controls downloaded into a Web browser from the World Wide Web. Answers a, b, and d are incorrect because they are types of code that are not related to mobile code.
23.	Answer: c Live or actual field data are not recommended for use in testing, because they do not thoroughly test all normal and abnormal situations, and the test results are not known beforehand. Answers a, b, and d are true of testing.
24.	Answer: b The definition of software engineering in answer b is a combination of popular definitions of engineering and software. One definition of engineering is “the application of science and mathematics to the design and construction of artifacts that are useful to people.” A definition of software is that it “consists of the programs, documentation and operating procedures by which computers can be made useful to people.” Answer a, SA/SD, deals with developing specifications that are abstractions of the problem to be solved and are not tied to any specific programming languages. Thus, SA/SD, through data flow diagrams (DFDs), shows the main processing entities and the data flow between them without any connection to a specific programming language implementation. An object-oriented system (answer c) is a group of independent objects that can be requested to perform certain operations or exhibit specific behaviors. These objects cooperate to provide the system’s required functionality. The objects have an identity and can be created as the program executes (dynamic lifetime). To provide the desired characteristics of object-oriented systems, the objects are encapsulated (i.e., they can be accessed only through messages sent to them to request performance of their defined operations). The object can be viewed as a black box whose internal details are hidden from outside observation and cannot normally be modified. Objects also exhibit the substitution property, which means that objects providing compatible operations can be substituted for each other. In summary, an object-oriented system contains objects that exhibit the following properties: Identity - Each object has a name that is used to designate that object. Encapsulation - An object can be accessed only through messages to perform its defined operations. Substitution - Objects that perform compatible operations can be substituted for each other. Dynamic lifetimes - Objects can be created as the program executes. Answer d, functional programming, uses only mathematical functions to perform computations and solve problems. This approach is based on the assumption that any algorithm can be described as a mathematical function. Functional languages have the characteristics that: They support functions and allow them to be manipulated by being passed as arguments and stored in data structures. Functional abstraction is the only method of procedural abstraction.
25.	Answer: a In the Waterfall model (W. W. Royce, “Managing the Development of Large Software Systems: Concepts and Techniques,” Proceedings, WESCON, August 1970), answer b defines the term requirements. Similarly, answer c defines the term validation, and answer d is the definition of product design. In summary, the steps of the Waterfall model are: System feasibility Software plans and requirements Product design Detailed design Code Integration Implementation Operations and maintenance In this model, each phase finishes with a verification and validation (V&V) task that is designed to eliminate as many problems as possible in the results of that phase.
26.	Answer: d Answer d is correct, as is demonstrated in Configuration Management of Computer-Based Systems (British Standards Institution, 1984). Answers a, b, and c are components of the maintenance activity of software life cycle models. In general, one can look at the maintenance phase as the progression from request control, through change control, to release control. Request control (answer b) is involved with the users’ requests for changes to the software. Change control (answer a) involves the analysis and understanding of the existing code, the design of changes, and the corresponding test procedures. Release control (answer c) involves deciding which requests are to be implemented in the new release, performing the changes, and conducting testing.
27.	Answer: b The Basic COCOMO Model, set forth in Software Engineering Economics, B. W. Boehm (Prentice-Hall, 1981), proposes two equations that compute the number of man-months and the development schedule in months needed to develop a software product, given the number of thousands of delivered source instructions (KDSI) in the product. In addition, Boehm has developed an intermediate COCOMO Model that takes into account hardware constraints, personnel quality, use of modern tools, and other attributes and their aggregate impact on overall project costs. A detailed COCOMO Model, also by Boehm, accounts for the effects of the additional factors used in the intermediate model on the costs of individual project phases. Answer b describes a function point measurement model that does not require the user to estimate the number of delivered source instructions. The software development effort is determined using the follow-ing five user functions: External input types External output types Logical internal file types External interface file types External inquiry types These functions are tallied and weighted according to complexity and used to determine the software development effort. Answer c describes the Rayleigh curve applied to software development cost and effort estimation. A prominent model using this approach is the Software Life Cycle Model (SLIM) estimating method. In this method, estimates based on the number of lines of source code are modified by the following two factors: The manpower buildup index (MBI), which estimates the rate of buildup of staff on the project A productivity factor (PF), which is based on the technology used Answer d is a distracter.
28.	Answer: d The advantages of incremental development include the ease of testing increments of functional capability and the opportunity to incorporate user experience into a successively refined product. Answers a, b, and c are distracters.
29.	Answer: d The radial dimension represents cumulative cost, and the angular dimension represents progress made in completing each cycle of the spiral. The Spiral model is actually a meta-model for software development processes. A summary of the stages in the spiral is as follows: The spiral begins in the top, left-hand quadrant by determining the objectives of the portion of the product being developed, the alternative means of implementing this portion of the product, and the constraints imposed on the application of the alternatives. Next, the risks of the alternatives are evaluated based on the objectives and constraints. Following this step, the relative balances of the perceived risks are determined. The spiral then proceeds to the lower right-hand quadrant where the development phases of the projects begin. A major review completes each cycle, and then the process begins anew for succeeding phases of the project. Typical succeeding phases are software product design, integration and test plan development, additional risk analyses, operational prototype, detailed design, code, unit test, acceptance test, and implementation. Answers a, b, and c are distracters.
30.	Answer: b A software process is a set of activities, methods, and practices that are used to develop and maintain software and associated products. Software process capability is a means of predicting the outcome of the next software project conducted by an organization. Software process performance (answer c) is the result achieved by following a software process. Thus, software capability is aimed at expected results while software performance is focused on results that have been achieved. Software process maturity (answer d) is the extent to which a software process is: Defined Managed Measured Controlled Effective Software process maturity, then, provides for the potential for growth in capability of an organization. An immature organization develops software in a crisis mode, usually exceeds budgets and time schedules, and develops software processes in an ad hoc fashion during the project. In a mature organization, the software process is effectively communicated to staff, the required processes are documented and consistent, software quality is evaluated, and roles and responsibilities are understood for the project. Answer a is a distracter, but it is discussed in question 24.

1.	Which of the following choices is the first priority in an emergency? Communicating to employees’ families the status of the emergency Notifying external support resources for recovery and restoration Protecting the health and safety of everyone in the facility Warning customers and contractors of a potential interruption of service
2.	Which of the following choices is not considered an appropriate role for senior management in the business continuity and disaster recovery process? Delegate recovery roles Publicly praise successes Closely control media and analyst communications Assess the adequacy of information security during the disaster recovery
3.	Why is it so important to test disaster recovery plans frequently? The businesses that provide subscription services may have changed ownership. A plan is not considered viable until a test has been performed. Employees may get bored with the planning process. Natural disasters can change frequently.
4.	Which of the following types of tests of disaster recovery/emergency management plans is considered the most cost-effective and efficient way to identify areas of overlap in the plan before conducting more demanding training exercises? Full-scale exercise Walk-through drill Table-top exercise test Evacuation drill
5.	Which type of backup subscription service will allow a business to recover quickest? A hot site A mobile or rolling backup service A cold site A warm site
6.	Which of the following represents the most important first step in creating a business resumption plan? Performing a risk analysis Obtaining senior management support Analyzing the business impact Planning recovery strategies
7.	What could be a major disadvantage to a mutual aid or reciprocal type of backup service agreement? It is free or at a low cost to the organization. The use of prefabricated buildings makes recovery easier. In a major emergency, the site may not have the capacity to handle the operations required. Annual testing by the Info Tech department is required to maintain the site.
8.	In developing an emergency or recovery plan, which of the following would not be considered a short-term objective? Priorities for restoration Acceptable downtime before restoration Minimum resources needed to accomplish the restoration The organization’s strategic plan
9.	When is the disaster considered to be officially over? When the danger has passed and the disaster has been contained When the organization has processing up and running at the alternate site When all the elements of the business have returned to normal functioning at the original site When all employees have been financially reimbursed for their expenses
10.	When should the public and media be informed about a disaster? Whenever site emergencies extend beyond the facility When any emergency occurs at the facility, internally or externally When the public’s health or safety is in danger When the disaster has been contained
11.	What is the number one priority of disaster response? Resuming transaction processing Personnel safety Protecting the hardware Protecting the software
12.	Which of the following is the best description of the criticality prioritization goal of the Business Impact Assessment (BIA) process? The identification and prioritization of every critical business unit process The identification of the resource requirements of the critical business unit processes The estimation of the maximum downtime the business can tolerate The presentation of the documentation of the results of the BIA
13.	Which of the following most accurately describes a business impact analysis (BIA)? A program that implements the strategic goals of the organization A management-level analysis that identifies the impact of losing an entity’s resources A prearranged agreement between two or more entities to provide assistance Activities designed to return an organization to an acceptable operating condition
14.	What is considered the major disadvantage to employing a hot site for disaster recovery? Exclusivity is assured for processing at the site. Maintaining the site is expensive. The site is immediately available for recovery. Annual testing is required to maintain the site.
15.	Which of the following is not considered an appropriate role for Financial Management in the business continuity and disaster recovery process? Tracking the recovery costs Monitoring employee morale and guarding against employee burnout Formally notifying insurers of claims Reassessing cash flow projections
16.	Which of the following is the most accurate description of a warm site? A backup processing facility with adequate electrical wiring and air conditioning but no hardware or software installed A backup processing facility with most hardware and software installed, which can be operational within a matter of days A backup processing facility with all hardware and software installed and 100 percent compatible with the original site, operational within hours A mobile trailer with portable generators and air conditioning
17.	Which of the following is not one of the five disaster recovery plan testing types? Simulation Checklist Mobile Full Interruption
18.	Which of the following choices is an example of a potential hazard due to a technological event, rather than a human event? Sabotage Financial collapse Mass hysteria Enemy attack
19.	Which of the following is not considered an element of a backup alternative? Electronic vaulting Remote journaling Warm site Checklist
20.	Which of the following choices refers to a business asset? Events or situations that could cause a financial or operational impact to the organization Protection devices or procedures in place that reduce the effects of threats Competitive advantage, credibility, or goodwill Personnel compensation and retirement programs
21.	Which of the following statements is not correct regarding the role of the recovery team during the disaster? The recovery team must be the same as the salvage team, because they perform the same function. The recovery team is often separate from the salvage team, because they perform different duties. The recovery team’s primary task is to get predefined critical business functions operating at the alternate processing site. The recovery team will need full access to all backup media.
22.	Which of the following choices is incorrect regarding when a BCP, DRP, or emergency management plan should be evaluated and modified? Never; once it has been fully tested, it should not be changed. Annually, in a scheduled review. After training drills, tests, or exercises. After an emergency or disaster response.
23.	When should security isolation of the incident scene start? Immediately after the emergency is discovered As soon as the disaster plan is implemented After all personnel have been evacuated When hazardous materials have been discovered at the site
24.	Which of the following is not a recommended step to take when resuming normal operations after an emergency? Reoccupy the damaged building as soon as possible. Account for all damage-related costs. Protect undamaged property. Conduct an investigation.
25.	Which of the following would not be a good reason to test the disaster recovery plan? Testing verifies the processing capability of the alternate backup site. Testing allows processing to continue at the database shadowing facility. Testing prepares and trains the personnel to execute their emergency duties. Testing identifies deficiencies in the recovery procedures.
26.	Which of the following statements is not true about the post-disaster salvage team? The salvage team must return to the site as soon as possible regardless of the residual physical danger. The salvage team manages the cleaning of equipment after smoke damage. The salvage team identifies sources of expertise to employ in the recovery of equipment or supplies. The salvage team may be given the authority to declare when operations can resume at the disaster site.
27.	Which of the following is the most accurate statement about the results of the disaster recovery plan test? If no deficiencies were found during the test, then the plan is probably perfect. The results of the test should be kept secret. If no deficiencies were found during the test, then the test was probably flawed. The plan should not be changed no matter what the results of the test.
28.	Which statement is true regarding the disbursement of funds during and after a disruptive event? Because access to funds is rarely an issue during a disaster, no special arrangements need to be made. No one but the finance department should ever disburse funds during or after a disruptive event. In the event senior-level or financial management is unable to disburse funds normally, the company will need to file for bankruptcy. Authorized, signed checks should be stored securely off-site for access by lower-level managers in the event senior-level or financial management is unable to disburse funds normally.
29.	Which statement is true regarding company/employee relations during and after a disaster? The organization has a responsibility to continue salaries or other funding to the employees and families affected by the disaster. The organization’s responsibility to the employee’s families ends when the disaster stops the business from functioning. Employees should seek any means of obtaining compensation after a disaster, including fraudulent ones. Senior-level executives are the only employees who should receive continuing salaries during the disruptive event.
30.	Which of the following choices is the correct definition of a Mutual Aid Agreement? A management-level analysis that identifies the impact of losing an entity’s resources An appraisal or determination of the effects of a disaster on human, physical, economic, and natural resources A prearranged agreement to render assistance to the parties of the agreement Activities taken to eliminate or reduce the degree of risk to life and property
31.	Which of the following most accurately describes a business continuity program? An ongoing process to ensure that the necessary steps are taken to identify the impact of potential losses and maintain viable recovery A program that implements the mission, vision, and strategic goals of the organization A determination of the effects of a disaster on human, physical, economic, and natural resources A standard that allows for rapid recovery during system interruption and data loss
32.	Which of the following would best describe a cold backup site? A computer facility with electrical power and HVAC, all needed applications installed and configured on the file/print servers, and enough workstations present to begin processing A computer facility with electrical power and HVAC but with no workstations or servers on-site prior to the event and no applications installed A computer facility with no electrical power or HVAC A computer facility available with electrical power and HVAC and some file/print servers, although the applications are not installed or configured, and all the needed workstations may not be on site or ready to begin processing
33.	Which of the following would best describe a tertiary site? A computer facility with no electrical power A secondary backup site Remote journaling A mobile trailer with portable generators

Answers

1.	Answer: c Life safety, or protecting the health and safety of everyone in the facility, is the first priority in an emergency or disaster.
2.	Answer: d The tactical assessment of information security is a role of information management or technology management, not senior management.
3.	Answer: b A plan is not considered functioning and viable until a test has been performed. An untested plan sitting on a shelf is useless and might even have the reverse effect of creating a false sense of security. Although the other answers, especially a, are good reasons to test, b is the primary reason.
4.	Answer: c In a table-top exercise, members of the emergency management group meet in a conference room setting to discuss their responsibilities and how they would react to emergency scenarios.
5.	Answer: a Warm and cold sites require more work after the event occurs to get them to full operating functionality. A mobile backup site might be useful for specific types of minor outages, but a hot site is still the main choice of backup processing site.
6.	Answer: b The business resumption, or business continuity plan, must have total, highly visible senior management support.
7.	Answer: c The site might not have the capacity to handle the operations required during a major disruptive event. Mutual aid might be a good system for sharing resources during a small or isolated outage, but a major natural or other type of disaster can create serious resource contention between the two organizations, both of which may be affected simultaneously.
8.	Answer: d The organization’s strategic plan is considered a long-term goal.
9.	Answer: c The disaster is officially over when all the elements of the business have returned to normal functioning at the original site. It’s important to remember that a threat to continuity exists when processing is being returned to its original site after salvage and cleanup has been done.
10.	Answer: a When an emergency occurs that could potentially have an impact outside the facility, the public must be informed, regardless of whether there is any immediate threat to public safety.
11.	Answer: b The number one function of all disaster response and recovery is the protection of the safety of people; all other concerns are vital to business continuity but are secondary to personnel safety.
12.	Answer: a The three primary goals of a BIA are criticality prioritization, maximum downtime estimation, and identification of critical resource requirements. Answer d is a distracter.
13.	Answer: b A business impact analysis (BIA) measures the effect of resource loss and escalating losses over time in order to provide the entity with reliable data upon which to base decisions on hazard mitigation and continuity planning. Answer a is a definition of a disaster/emergency management program. Answer c describes a mutual aid agreement. Answer d is the definition of a recovery program.
14.	Answer: b A hot site is commonly used for those extremely time-critical functions that the business must have up and running to continue operating, but the expense of duplicating and maintaining all the hardware, software, and application elements is a serious resource drain to most organizations.
15.	Answer: b Monitoring employee morale and guarding against employee burnout during a disaster recovery event is the proper role of human resources.
16.	Answer: b
17.	Answer: c
18.	Answer: b A financial collapse is considered a technological potential hazard, whereas the other three are human events.
19.	Answer: d A checklist is a type of disaster recovery plan test. Electronic vaulting is the batch transfer of backup data to an offsite location. Remote journaling is the parallel processing of transactions to an alternate site. A warm site is a backup processing alternative.
20.	Answer: c Answer a is a definition for a threat. Answer b is a description of mitigating factors that reduce the effect of a threat, such as an uninterruptible power supply (UPS), sprinkler systems, or generators. Answer d is a distracter.
21.	Answer: a The recovery team performs different functions from the salvage team. The recovery team’s primary mandate is to get critical processing reestablished at an alternate site. The salvage team’s primary mandate is to return the original processing site to normal processing environmental conditions.
22.	Answer: a Emergency management plans, business continuity plans, and disaster recovery plans should be regularly reviewed, evaluated, modified, and updated. At a minimum, the plan should be reviewed at an annual audit.
23.	Answer: a Isolation of the incident scene should begin as soon as the emergency has been discovered.
24.	Answer: a Reoccupying the site of a disaster or emergency should not be undertaken until a full safety inspection has been done, an investigation into the cause of the emergency has been completed, and all damaged property has been salvaged and restored.
25.	Answer: b The other three answers are good reasons to test the disaster recovery plan.
26.	Answer: a Salvage cannot begin until all physical danger has been removed or mitigated and emergency personnel have returned control of the site to the organization.
27.	Answer: c The purpose of the test is to find weaknesses in the plan. Every plan has weaknesses. After the test, all parties should be advised of the results, and the plan should be updated to reflect the new information.
28.	Answer: d Authorized, signed checks should be stored securely off-site for access by lower-level managers in the event senior-level or financial management is unable to disburse funds normally.
29.	Answer: a The organization has an inherent responsibility to its employees and their families during and after a disaster or other disruptive event. The company must be insured to the extent it can properly compensate its employees and families. Alternatively, employees do not have the right to obtain compensatory damages fraudulently if the organization cannot compensate.
30.	Answer: c A mutual aid agreement is used by two or more parties to provide for assistance if one of the parties experiences an emergency. Answer a describes a business continuity plan. Answer b describes a damage assessment, and answer d describes risk mitigation.
31.	Answer: a A business continuity program is an ongoing process supported by senior management and funded to ensure that the necessary steps are taken to identify the impact of potential losses, maintain viable recovery strategies and recovery plans, and ensure continuity of services through personnel training, plan testing, and maintenance. Answer b describes a disaster/emergency management program. Answer c describes a damage assessment. Answer d is a distracter.
32.	Answer: b A computer facility with electrical power and HVAC, with workstations and servers not present (but available to be brought on-site when the event begins) and no applications installed, is a cold site. Answer a is a hot site, and d is a warm site. Answer c is just an empty room.
33.	Answer: b A “tertiary site” is a secondary backup site that can be used in case the primary backup site is not available.

1.	According to the Internet Architecture Board (IAB), an activity that causes which of the following is considered a violation of ethical behavior on the Internet? Wasting resources Appropriating other people’s intellectual output Using a computer to steal Using a computer to bear false witness
2.	Which of the following best defines social engineering? Illegal copying of software Gathering information from discarded manuals and printouts Using people skills to obtain proprietary information Destruction or alteration of data
3.	Because the development of new technology usually outpaces the law, law enforcement uses which traditional laws to prosecute computer criminals? Malicious mischief Embezzlement, fraud, and wiretapping Immigration Conspiracy and elimination of competition
4.	Which of the following is not a category of law under the Common Law System? Criminal law Civil law Administrative/regulatory law Derived law
5.	A trade secret: Provides the owner with a legally enforceable right to exclude others from practicing the art covered for a specified time period Protects original works of authorship Secures and maintains the confidentiality of proprietary technical or business-related information that is adequately protected from disclosure by the owner Is a word, name, symbol, color, sound, product shape, or device used to identify goods and to distinguish them from those made or sold by others
6.	Which of the following is not a European Union (EU) principle? Data should be collected in accordance with the law. Transmission of personal information to locations where equivalent personal data protection cannot be ensured is permissible. Data should be used only for the purposes for which it was collected and should be used only for a reasonable period of time. Information collected about an individual cannot be disclosed to other organizations or individuals unless authorized by law or by consent of the individual.
7.	The Federal Sentencing Guidelines: Hold senior corporate officers personally liable if their organizations do not comply with the law Prohibit altering, damaging, or destroying information in a federal interest computer Prohibit eavesdropping or the interception of message contents Established a category of sensitive information called Sensitive But Unclassified (SBU)
8.	What does the prudent-man rule require? Senior officials to post performance bonds for their actions Senior officials to perform their duties with the care that ordinary, prudent people would exercise under similar circumstances Senior officials to guarantee that all precautions have been taken and that no breaches of security can occur Senior officials to follow specified government standards
9.	Information Warfare is: Attacking the information infrastructure of a nation to gain military or economic advantages Developing weapons systems based on artificial intelligence technology Generating and disseminating propaganda material Signal intelligence
10.	The chain of evidence relates to: Securing laptops to desks during an investigation DNA testing Handling and controlling evidence Making a disk image
11.	The Kennedy-Kassebaum Act is also known as: RICO OECD HIPAA EU Directive
12.	Which of the following refers to a U.S. government program that reduces or eliminates emanations from electronic equipment? CLIPPER ECHELON ECHO TEMPEST
13.	Imprisonment is a possible sentence under: Civil (tort) law Criminal law Both civil and criminal law Neither civil nor criminal law
14.	Which one of the following conditions must be met if legal electronic monitoring of employees is conducted by an organization? Employees must be unaware of the monitoring activity. All employees must agree with the monitoring policy. Results of the monitoring cannot be used against the employee. The organization must have a policy stating that all employees are regularly notified that monitoring is being conducted.
15.	Which of the following is a key principle in the evolution of computer crime laws in many countries? All members of the United Nations have agreed to uniformly define and prosecute computer crime. Existing laws against embezzlement, fraud, and wiretapping cannot be applied to computer crime. The definition of property is extended to include electronic information. Unauthorized acquisition of computer-based information without the intent to resell is not a crime.
16.	The concept of due care states that senior organizational management must ensure that: All risks to an information system are eliminated. Certain requirements must be fulfilled in carrying out their responsibilities to the organization. Other management personnel are delegated the responsibility for information system security. The cost of implementing safeguards is greater than the potential resultant losses resulting from information security breaches.
17.	Liability of senior organizational officials relative to the protection of the organization’s information systems is prosecutable under: Criminal law Civil law International law Financial law
18.	Responsibility for handling computer crimes in the United States is assigned to: The Federal Bureau of Investigation (FBI) and the Secret Service The FBI only The National Security Agency (NSA) The Central Intelligence Agency (CIA)
19.	In general, computer-based evidence is considered: Conclusive Circumstantial Secondary Hearsay
20.	Investigating and prosecuting computer crimes is made more difficult because: Backups may be difficult to find. Evidence is mostly intangible. Evidence cannot be preserved. Evidence is hearsay and can never be introduced into a court of law.
21.	Which of the following criteria are used to evaluate suspects in the commission of a crime? Motive, Intent, and Ability Means, Object, and Motive Means, Intent, and Motive Motive, Means, and Opportunity
22.	Which one of the following U.S. government entities was assigned the responsibility for improving government efficiency through the application of new technologies and for developing guidance on information security for government agencies by the Paperwork Reduction Act of 1980, 1995? The National Institute for Standards and Technology (NIST) The General Services Administration (GSA) The Office of Management and Budget (OMB) The National Security Agency (NSA)
23.	What is enticement? Encouraging the commission of a crime when there was initially no intent to commit a crime Assisting in the commission of a crime Luring the perpetrator to an attractive area or presenting the perpetrator with a lucrative target after the crime has already been initiated Encouraging the commission of one crime over another
24.	Which of the following is not a computer investigation issue? Evidence is easy to obtain. The time frame for investigation is compressed. An expert may be required to assist. The information is intangible.
25.	Conducting a search without the delay of obtaining a warrant if destruction of evidence seems imminent is possible under: Federal Sentencing Guidelines Proximate Causation Exigent Circumstances Prudent-Man Rule
26.	Which one of the following items is not true concerning the Platform for Privacy Preferences (P3P) developed by the World Wide Web Consortium (W3C)? It allows Web sites to express their privacy practices in a standard format that can be retrieved automatically and interpreted easily by user agents. It allows users to be informed of site practices in human-readable format. It does not provide the site privacy practices to users in machine-readable format. It automates decision making based on the site’s privacy practices when appropriate.
27.	The 1996 Information Technology Management Reform Act (ITMRA), or Clinger-Cohen Act, did which one of the following? Relieved the General Services Administration of responsibility for procurement of automated systems and contract appeals and charged the Office of Management and Budget with providing guidance on information technology procurement Relieved the General Services Administration of responsibility for procurement of automated systems and contract appeals and charged the National Institute for Standards and Technology with providing guidance on information technology procurement Relieved the Office of Management and Budget of responsibility for procurement of automated systems and contract appeals and charged the General Services Administration with providing guidance on information technology procurement Relieved the General Services Administration of responsibility for procurement of automated systems and contract appeals and charged the National Security Agency with providing guidance on information technology procurement
28.	Which one of the following U.S. Acts prohibits trading, manufacturing, or selling in any way that is intended to bypass copyright protection mechanisms? The 1999 Uniform Information Transactions Act (UCITA) The 1998 Digital Millennium Copyright Act (DMCA) The 1998 Sonny Bono Copyright Term Extension Act The 1987 U.S. Computer Security Act
29.	Which of the following actions by the U.S. government is not permitted or required by the U.S. PATRIOT Act, signed into law on October 26, 2001? Subpoena of electronic records Monitoring of Internet communications Search and seizure of information on live systems (including routers and servers), backups, and archives Reporting of cash and wire transfers of $5,000 or more
30.	Which Act required U.S. government agencies to do the following? Manage information resources to protect privacy and security Designate a senior official, reporting directly to the Secretary of the Treasury, to ensure that the responsibilities assigned by the Act are accomplished Identify and afford security protections in conformance with the Computer Security Act of 1987 commensurate with the magnitude of harm and risk that may result from the misuse, loss, or unauthorized access relative to information collected by an agency or maintained on behalf of an agency Implement and enforce applicable policies, procedures, standards, and guidelines on privacy, confidentiality, security, disclosures, and sharing of information collected or maintained by or for the agency 1994 U.S. Computer Abuse Amendments Act 1996, Title I, Economic Espionage Act 1987 U.S. Computer Security Act Paperwork Reduction Act of 1980, 1995

Answers

1.	Answer: a The correct answer is a. Answers b, c, and d are ethical considerations of other organizations.
2.	Answer: c The correct answer is c: using people skills to obtain proprietary information. Answer a is software piracy, answer b is dumpster diving, and answer d is a violation of integrity.
3.	Answer: b The answer b is correct. Answer a is not a law, answer c is not applicable because it applies to obtaining visas and so on, and answer d is not correct because the laws in answer b are more commonly used to prosecute computer crimes.
4.	Answer: d The correct answer, d, is a distracter. All the other answers are categories under common law.
5.	Answer: c Answer c defines a trade secret. Answer a refers to a patent. Answer b refers to a copyright. Answer d refers to a trademark.
6.	Answer: b The transmission of data to locations where equivalent personal data protection cannot be ensured is not permissible for the EU. The other answers are EU principles.
7.	Answer: a The answer a is correct. Answer b is part of the U.S. Computer Fraud and Abuse Act. Answer c is part of the U.S. Electronic Communications Privacy Act. Answer d is part of the U.S. Computer Security Act.
8.	Answer: b The answer b is correct. Answer a is a distracter and is not part of the prudent man rule. Answer c is incorrect because it is not possible to guarantee that breaches of security can never occur. Answer d is incorrect because the prudent-man rule does not refer to a specific government standard but relates to what other prudent persons would do.
9.	Answer: a The answer a is correct. Answer b is a distracter and has to do with weapon systems development. Answer c is not applicable. Answer d is the conventional acquisition of information from radio signals.
10.	Answer: c The answer c is correct. Answer a relates to physical security, answer b is a type of biological testing, and answer d is part of the act of gathering evidence.
11.	Answer: c The answer c is correct. The others refer to other laws or guidelines.
12.	Answer: d The answer d is correct. Answer a refers to the U.S. government Escrow Encryption Standard. Answer b refers to the large-scale monitoring of RF transmissions. Answer c is a distracter.
13.	Answer: b Answer b is the only one of the choices in which imprisonment is possible.
14.	Answer: d The answer d is correct. Answer a is incorrect because employees must be made aware of the monitoring if it is to be legal; answer b is incorrect because employees do not have to agree with the policy; and answer c is incorrect because the results of monitoring may be used against the employee if the corporate policy is violated.
15.	Answer: c The answer c is correct. Answer a is incorrect because all nations do not agree on the definition of computer crime and corresponding punishments. Answer b is incorrect because the existing laws can be applied against computer crime. Answer d is incorrect because in some countries, possession without intent to sell is considered a crime.
16.	Answer: b The answer b is correct. Answer a is incorrect because all risks to information systems cannot be eliminated; answer c is incorrect because senior management cannot delegate its responsibility for information system security under due care; and answer d is incorrect because the cost of implementing safeguards should be less than or equal to the potential resulting losses relative to the exercise of due care.
17.	Answer: b
18.	Answer: a The correct answer is a, making the other answers incorrect.
19.	Answer: d The answer d is correct. Answer a refers to incontrovertible evidence; answer b refers to inference from other, intermediate facts; and answer c refers to a copy of evidence or oral description of its content.
20.	Answer: b The answer b is correct. Answer a is incorrect because if backups are done, they usually can be located. Answer c is incorrect because evidence can be preserved using the proper procedures. Answer d is incorrect because there are exceptions to the hearsay rule.
21.	Answer: d
22.	Answer: c
23.	Answer: c Answer c is the definition of enticement. Answer a is the definition of entrapment. Answers b and d are distracters.
24.	Answer: a The correct answer is a. In many instances, evidence is difficult to obtain in computer crime investigations. Answers b, c, and d are computer investigation issues.
25.	Answer: c The answer c is correct. The other answers refer to other principles, guidelines, or rules.
26.	Answer: c In addition to the capabilities in answers a, b, and d, P3P does provide the site privacy practices to users in machine-readable format.
27.	Answer: a The answer a is correct. The other answers are distracters.
28.	Answer: b Answers a and d are distracters. Answer c, the 1998 Sonny Bono Copyright Term Extension Act, amends the provisions concerning duration of copyright protection. The Act states that the terms of copyright are generally extended for an additional 20 years.
29.	Answer: d Wire and cash transfers of $10,000 or more in a single transaction must be reported to government officials. Actions in answers a, b, and c are permitted under the PATRIOT Act. In answers a and b, the government has new powers to subpoena electronic records and to monitor Internet traffic. In monitoring information, the government can require the assistance of ISPs and network operators. This monitoring can extend even into individual organizations. In the PATRIOT Act, Congress permits investigators to gather information about electronic mail without having to show probable cause that the person to be monitored had committed a crime or was intending to commit a crime. In answer c, the items cited now fall under existing search and seizure laws. A new twist is delayed notification of a search warrant. Under the PATRIOT Act, if it is suspected that notification of a search warrant would cause a suspect to flee, a search can be conducted before notification of a search warrant is given. In a related matter, the United States and numerous other nations have signed the Council of Europe’s Cybercrime Convention. In the United States, participation in the Convention has to be ratified by the Senate. In essence, the Convention requires the signatory nations to spy on their own residents, even if the action being monitored is illegal in the country in which the monitoring is taking place.
30.	Answer: d

1.	Which of the following is not a type of motion-detection system? Ultrasonic-detection system Microwave-detection system Host-based intrusion-detection system Sonic-detection system
2.	Which of the following is a type of personnel control that helps prevent piggybacking? Mantraps Back doors Brute force Maintenance hooks
3.	Which of the following choices most accurately describes the prime benefit of using guards? Human guards are less expensive than guard dogs. Guards can exercise discretionary judgment in a way that automated systems can’t. Automated systems have a greater reliability rate than guards. Guard dogs cannot discern an intruder’s intent.
4.	The recommended optimal relative humidity range for computer operations is: 10%–30% 30%–40% 40%–60% 60%–80%
5.	How many times should a diskette be formatted to comply with TCSEC Orange Book object reuse recommendations? Three Five Seven Nine
6.	Which of the following more closely describes the combustibles in a Class B-rated fire? Paper Gas Liquid Electrical
7.	Which of the following is not the proper suppression medium for a Class B fire? CO2 Soda Acid Halon Water
8.	What does an audit trail or access log usually not record? How often a diskette was formatted Who attempted access The date and time of the access attempt Whether the attempt was successful
9.	A brownout can be defined as a: Prolonged power loss Momentary low voltage Prolonged low voltage Momentary high voltage
10.	Which of the following statements is not accurate about smoke damage to electronic equipment? Smoke exposure during a fire for a relatively short period does little immediate damage. Continuing power to the smoke-exposed equipment can increase the damage. Moisture and oxygen corrosion constitute the main damage to the equipment. The primary damage done by smoke exposure is immediate.
11.	A surge can be defined as a(n): Prolonged high voltage Initial surge of power at start Momentary power loss Steady interfering disturbance
12.	Which is not a type of a fire detector? Heat-sensing Gas-discharge Flame-actuated Smoke-actuated
13.	Which of the following is not considered an acceptable replacement for Halon discharge systems? FA200 Inergen (IG541) Halon 1301 Argon (IG55)
14.	Which type of fire extinguishing method contains standing water in the pipe and therefore generally does not enable a manual shutdown of systems before discharge? Dry pipe Wet pipe Preaction Deluge
15.	Which of the following types of control is not an example of a physical security access control? Retinal scanner Guard dog Five-key programmable lock Audit trail
16.	Which is not a recommended way to dispose of unwanted used data media? Destroying CD-ROMs Formatting diskettes seven or more times Shredding paper reports by cleared personnel Copying new data over existing data on diskettes
17.	According to the NFPA, which of the following choices is not a recommended risk factor to consider when determining the need for protecting the computing environment from fire? Life safety aspects of the computing function or process Fire threat of the installation to occupants or exposed property Distance of the computing facility from a fire station Economic loss of the equipment’s value
18.	Which of the following choices is not an example of a halocarbon agent? HFC-23 FC-3-1-10 IG-541 HCFC-22
19.	Which of the following statements most accurately describes a dry pipe sprinkler system? Dry pipe is the most commonly used sprinkler system. Dry pipe contains air pressure. Dry pipe sounds an alarm and delays water release. Dry pipe may contain carbon dioxide.
20.	The theft of a laptop poses a threat to which tenet of the C.I.A. triad? Confidentiality Integrity Availability All of the above
21.	Which is a benefit of a guard over an automated control? Guards can use discriminating judgment. Guards are cheaper. Guards do not need training. Guards do not need pre-employment screening.
22.	Which is not considered a preventative security measure? Fences Guards Audit trails Preset locks
23.	Which is not a PC security control device? A cable lock A switch control A port control A file cabinet lock
24.	Which of the following is not an example of a clean fire-extinguishing agent? CO2 IG-55 IG-01 HCFC-22
25.	What is the recommended height of perimeter fencing to keep out casual trespassers? 1′ to 2′ high 3′ to 4′ high 6′ to 7′ high 8′ to 12′ high
26.	Why should extensive exterior perimeter lighting of entrances or parking areas be installed? To enable programmable locks to be used To create two-factor authentication To discourage prowlers or casual intruders To prevent data remanence
27.	Which of the following is not a form of data erasure? Clearing Remanence Purging Destruction
28.	Which is not considered a physical intrusion detection method? Audio motion detector Photoelectric sensor Wave pattern motion detector Line supervision
29.	Which of the following statements represents the best reason to control the humidity in computer operations areas? Computer operators do not perform at their peak if the humidity is too high. Electrostatic discharges can harm electronic equipment. Static electricity destroys the electrical efficiency of the circuits. If the air is too dry, electroplating of conductors may occur.
30.	Which of the following terms refers to a standard used in determining the fire safety of a computer room? Noncombustible Fire-resistant Fire retardant Nonflammable
31.	Which of the following choices is not a common use for a proximity smart card? Verifying on-line purchases Vehicle identification Public transportation Airline ticketing
32.	Which of the following is the best description of PIDAS fencing? PIDAS fencing must be at least 6 feet high. PIDAS fencing often has a high rate of false alarms. PIDAS fencing employs bright Fresnel lighting. PIDAS fencing is impossible to cut through.
33.	Which of the following statements about bollards is incorrect? Bollards sometimes house exterior lighting. Bollards are primarily designed to deter vehicles being driven into a building. Bollards are used to authenticate users via smart cards. Bollards are small concrete pillars.

Answers

1.	Answer: c Host-based intrusion-detection systems are used to detect unauthorized logical access to network resources, not the physical presence of an intruder.
2.	Answer: a The other three answers are not personnel or physical controls but are technical threats or vulnerabilities. Back doors (answer b) commonly refers to Trojan horses used covertly to give an attacker backdoor network access. Hackers install back doors to gain network access at a later time. Brute force (answer c) is a cryptographic attack attempting to use all combinations of key patterns to decipher a message. Maintenance hooks (answer d) are undocumented openings into an application to assist programmers with debugging. Although intended innocently, these can be exploited by intruders.
3.	Answer: b The prime advantage to using human guards is that they can exercise discretionary judgment when the need arises. For example, during an emergency guards can switch roles from access control to evacuation support, something guard dogs or automated systems cannot.
4.	Answer: c 40% to 60% relative humidity is recommended for safe computer operations. Too low humidity can create static discharge problems, and too high humidity can create condensation and electrical contact problems.
5.	Answer: c Most computer certification and accreditation standards recommend that diskettes be formatted seven times to prevent any possibility of data remanence.
6.	Answer: c Paper is described as a common combustible and is therefore rated a class A fire. An electrical fire is rated Class C. Gas is not defined as a combustible.
7.	Answer: d Water is not a proper suppression medium for a class B fire. The other three are commonly used.
8.	Answer: a The other three answers are common elements of an access log or audit trail.
9.	Answer: c Answer a, prolonged power loss, is a blackout; answer b, momentary low voltage, is a sag; and d, momentary high voltage, is a spike.
10.	Answer: d Immediate smoke exposure to electronic equipment does little damage. However, the particulate residue left after the smoke has dissipated contains active by-products that corrode metal contact surfaces in the presence of moisture and oxygen.
11.	Answer: a Answer b, initial surge of power at start or power on, is called an inrush; c, momentary power loss, is a fault; and d, a steady interfering disturbance, is called noise.
12.	Answer: b Gas-discharge is a type of fire extinguishing system, not a fire detection system.
13.	Answer: c Existing installations are encouraged to replace Halon 1301 with one of the substitutes listed.
14.	Answer: b The other three are variations on a dry pipe discharge method with the water not standing in the pipe until a fire is detected.
15.	Answer: d
16.	Answer: d While this method might overwrite the older files, recoverable data might exist past the file end marker of the new file if the new data file is smaller than the older data file.
17.	Answer: c Although the distance of the computing facility from a fire station should be considered when initially determining the physical location of a computing facility (as should police and hospital proximity), it is not considered a primary factor in determining the need for internal fire suppression systems.
18.	Answer: c IG-541 is an inert gas agent, not a halocarbon agent.
19.	Answer: b In a dry pipe system, air pressure is maintained until the sprinkler head seal is ruptured. Answer a is incorrect because wet pipe is the most commonly used sprinkler system, dry pipe is second. Answer c describes a preaction pipe, which sounds an alarm and delays the water release. A preaction pipe may or may not be a dry pipe, but not all dry pipes are preaction. Answer d is incorrect because a dry pipe is a water release system.
20.	Answer: d Confidentiality, because the data can now be read by someone outside of a monitored environment; availability, because the user has lost the computing ability provided by the unit; and integrity, because the data residing on and any telecommunications from the portable are now suspect.
21.	Answer: a Guards can use discriminating judgment. Guards are typically more expensive than automated controls, need training as to the protection requirements of the specific site, and need to be screened and bonded.
22.	Answer: c Audit trails are detective rather than preventative, because they are used to piece together the information of an intrusion or intrusion attempt after the fact.
23.	Answer: d A cable lock is used to attach the PC to a desk; a switch control is used to prevent powering a unit off; and a port control (such as a diskette drive lock) is used to prevent data from being downloaded from the PC.
24.	Answer: a CO2, carbon dioxide, leaves a corrosive residue and is therefore not recommended for computer facility fire suppression systems.
25.	Answer: b 3′ to 4′-high fencing is considered minimal protection, for restricting only casual trespassers. Answers c and d are better protection against intentional intruders.
26.	Answer: c The other answers have nothing to do with lighting.
27.	Answer: b Remanance is what data erasure is intended to prevent. Clearing (answer a) refers to the overwriting of data media intended to be reused in the same organization. Purging (answer c) refers to degaussing or overwriting media intended to be removed from the organization. Destruction (answer d) refers to completely destroying the media.
28.	Answer: d Line supervision is the monitoring of the alarm signaling transmission medium to detect tampering. Audio detectors (answer a) monitor a room for any abnormal soundwave generation. Photoelectric sensors (answer b) receive a beam of light from a light-emitting device. Wave pattern motion detectors (answer c) generate a wave pattern and send an alarm if the pattern is disturbed.
29.	Answer: b Electrostatic discharges from static electricity can damage sensitive electronic equipment, even in small amounts.
30.	Answer: b Answer a, noncombustible, means material that will not aid or add appreciable heat to an ambient fire. Answer c, fire retardant, describes material that lessens or prevents the spread of a fire. Fire retardant coatings are designed to protect materials from fire exposure damage. Answer d, nonflammable, describes material that will not burn.
31.	Answer: a A proximity smart card is not commonly used for verifying on-line pur-chases. The other answers are all common uses of a proximity smart card.
32.	Answer: b Perimeter Intrusion Detection and Assessment System (PIDAS) fencing has intrusion detection sensors on the fence and attempts to detect an intruder scaling the fence or cutting through it. By initiating an alarm when the cable vibrates, however, PIDAS’s sensitivity can cause a high rate of false alarms, as the alarm is often triggered by animals or weather elements such as high wind.
33.	Answer: c Bollards are concrete pillars designed to deter drivers from driving vehicles into a building, and may contain exterior lighting to make them more functional and decorative.

1.	Which of the following is not a standard phase in the System Authorization Process? Pre-certification Post-Authorization Post-Certification Certification
2.	Which of the following would be an accurate description of the role of the ISSO in the C&A process? The ISSO determines whether a system is ready for certification and conducts the certification process. The operational interests of system users are vested in the ISSO. The ISSO coordinates all aspects of the system from initial concept, through development, to implementation and system maintenance. The ISSO is responsible to the DAA for ensuring that security is provided for and implemented throughout the life cycle.
3.	The British Standard BS7799 was the basis for which of the following standards? ISO/IEC 154508 ISO/IEC 17799 ICO/ICE 17799 Executive Order (E.O.) 13231
4.	How many phases are defined in the DIACAP process? Three Four Five Six
5.	Which is not a common responsibility of the user representative? The user representative is responsible for the secure operation of a certified and accredited IS. The user representative represents the user community. The user representative determines whether a system is ready for certification and conducts the certification process. The user representative functions as the liaison for the user community throughout the life cycle of the system.
6.	Which statement is not true about the SAA? The SSAA is used throughout the entire process. The SSAA is a formal agreement among the DAA(s), certifier, user representative, and program manager. The SSAA is used only during Phase 3, Validation. The SSAA documents the conditions of the C&A for an IS.
7.	Which C&A role is also referred to as the accreditor? IS program manager Designated Approving Authority (DAA) Certification agent User representative
8.	Which is not a C&A role? IS program manager Certifier Vendor representative User representative
9.	Which is not a NIACAP accreditation type? Site accreditation Process accreditation Type accreditation System accreditation
10.	Which statement is not true about the Designated Approving Authority (DAA)? The DAA determines the existing level of residual risk and makes an accreditation recommendation. The DAA is the primary government official responsible for implementing system security. The DAA is an executive with the authority and ability to balance the needs of the system with the security risks. The DAA can grant an accreditation or an Interim Approval to Operate (IATO) or may determine that the system’s risks are not at an acceptable level and it is not ready to be operational.
11.	Which statement is not true about the certification agent? The certifier provides the technical expertise to conduct the certification throughout the system’s life cycle based on the security requirements documented in the SSAA. The certifier determines the acceptable level of residual risk for a system. The certifier determines whether a system is ready for certification and conducts the certification process. The certifier should be independent from the organization responsible for the system development or operation.
12.	What is the task of the certifier at the completion of the certification effort? To recommend to the DAA whether or not to accredit the system based on documented residual risk To provide details of the system and its life cycle management to the DAA To ensures that the security requirements are integrated in a way that will result in an acceptable level of risk To keep all NIACAP participants informed of life cycle actions, security requirements, and documented user needs
13.	Which choice most accurately defines a user representative? The user representative is an executive with the authority and ability to balance the needs of the system with the security risks. The user representative is concerned with system availability, access, integrity, functionality, performance, and confidentiality as they relate to the mission environment. The user representative determines the acceptable level of residual risk for a system. The user representative is the primary government official responsible for implementing system security.
14.	Which statement about certification and accreditation (C&A) is not correct? Certification is the comprehensive evaluation of the technical and nontechnical security features of an information system. C&A is optional for most federal agencies’ security systems. Accreditation is the formal declaration by a DAA approving an information system to operate. C&A consists of formal methods applied to ensure that the appropriate information system security safeguards are in place and that they are functioning per the specifications.
15.	The DAA accreditation decision is made at the last step of which phase? Phase 1 Phase 2 Phase 3 Phase 4
16.	If the DAA does not accredit the system, what happens? The C&A process reverts to Phase 1. The C&A process moves on to Phase 4. The C&A project is ended. The C&A stays in Phase 3 until the system is accredited.
17.	What is the main purpose of the post-accreditation phase? To initiate the risk management agreement process among the four principals: the DAA, certifier, program manager, and user representative To continue to operate and manage the system so that it will maintain an acceptable level of residual risk To ensure that the SSAA properly and clearly defines the approach and level of effort To collect information and documentation about the system, such as capabilities and functions the system will perform
18.	How long does Phase 4 last? Until the initial certification analysis determines whether the IS is ready to be evaluated and tested Until the DAA reviews the SSAA and makes an accreditation determination Until the information system is removed from service, a major change is planned for the system, or a periodic compliance validation is required Until the responsible organizations adopt the SSAA and concur that those objectives have been reached
19.	Which policy document determines that all federal government departments and agencies establish and implement programs mandating the certification and accreditation (C&A) of national security systems under their operational control? DoD 8510.1-M, “Department of Defense Information Technology Security Certification and Accreditation Process (DITSCAP) Application Manual,” July 31, 2000 FIPS PUB102, “Guidelines for Computer Security Certification and Accreditation,” September 27, 1983 NSTISS Instruction (NSTISSI) No. 1000, “National Information Assurance Certification and Accreditation Process (NIACAP),” April 2000 NSTISS Policy (NSTISSP) No. 6, “National Policy on Certification and Accreditation of National Security Telecommunications and Information Systems,” April 8, 1994
20.	Which of the following assessment methodologies defines a six-step comprehensive C&A? Federal Information Processing Standard (FIPS) 102 Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) Federal Information Technology Security Assessment Framework (FITSAF) INFOSEC Assessment Methodology (IAM)
21.	What is the order of phases in a DITSCAP assessment? Verification, Definition, Validation, and Post Accreditation Definition, Verification, Validation, and Post Accreditation Definition, Validation, Verification, and Post Accreditation Validation, Definition, Verification, and Post Accreditation

Answers

1.	Answer: c The correct answer is c, Post-Certification. The SAP comprises four phases: Phase 1: Pre-certification Phase 2: Certification Phase 3: Authorization Phase 4: Post-Authorization
2.	Answer: d The ISSO is responsible to the DAA for ensuring that security is provided for and implemented throughout the life cycle of an AS from the beginning of the system concept development phase through its design, development, operation, maintenance, and secure disposal.
3.	Answer: b The correct answer is b, ISO/IEC 17799. ISO/IEC 154508 defines the Common Criteria; ICO/ICE 17799 is nonexistent.
4.	Answer: c The DIACAP process is expected to consist of five phases: Initiate and Plan IA C&A; Implement and Validate Assigned IA Controls; Make Certification Determination and Accreditation Decisions; Maintain Authority to Operate and Conduct Reviews; Decommission System.
5.	Answer: c Determining whether a system is ready for certification and conducting the certification process are tasks for the certifier. As noted in the SSAA, the user representative: Is responsible for the identification of operational requirements Is responsible for the secure operation of a certified and accredited IS (answer a) Represents the user community (answer b) Assists in the C&A process Functions as the liaison for the user community throughout the life cycle of the system (answer d) Defines the system’s operations and functional requirements Is responsible for ensuring that the user’s operational interests are maintained throughout system development, modification, integration, acquisition, and deployment
6.	Answer: c The SSAA is used throughout the entire C&A process. After accreditation, the SSAA becomes the baseline security configuration document and is maintained during Phase 4.
7.	Answer: b The Designated Approving Authority (DAA) is also referred to as the accreditor.
8.	Answer: c Answer c is a distracter; the other answers are all C&A roles.
9.	Answer: b Answer c is a distracter; the NIACAP applies to each of the other three accreditation types and may be tailored to meet the specific needs of the organization and IS. A site accreditation (answer a) evaluates the applications and systems at a specific, self-contained location. A type accreditation (answer b) evaluates an application or system that is distributed to multiple locations. A system accreditation (answer c) evaluates a major application or general support system.
10.	Answer: a The certifier, not the DAA, determines the existing level of residual risk and makes the accreditation recommendation. The DAA determines the acceptable, not existing, level of risk for a system. The other answers about the DAA are true.
11.	Answer: b The DAA, not the certifier, determines the acceptable level of residual risk for a system and must have the authority to oversee the budget and IS business operations of systems under his or her purview. The other statements about the certifier are true.
12.	Answer: a At the completion of the certification effort, the certifier reports the status of certification and makes a recommendation to the DAA. The other answers are tasks assigned to the program manager.
13.	Answer: b The operational interests of system users are vested in the user representative. In the C&A process, the user representative is concerned with system availability, access, integrity, functionality, performance, and confidentiality as they relate to the mission environment. Users and their representative are found at all levels of an agency. The other answers are qualities of the DAA.
14.	Answer: b NSTISSP No. 6 establishes the requirement for federal departments and agencies to implement a C&A process for national security systems. The requirements of the NSTISSI No. 6 apply to all U.S. government executive branch departments, agencies, and their contractors and consultants. The other three answers are correct statements about C&A.
15.	Answer: c, Phase 3. After receipt of the certifier’s recommendation, the DAA reviews the SSAA and makes an accreditation determination. This determination is added to the SSAA. The final SSAA accreditation package includes the certifier’s recommendation, the DAA authorization to operate, and supporting documentation. The SSAA must contain all information necessary to support the certifier’s recommended decision, including security findings, deficiencies, risks to operation, and actions to resolve any deficiencies.
16.	Answer: a If the decision is made to not authorize the system to operate, the NIACAP process reverts to Phase 1, and the DAA, certifier, program manager, and user representative must agree to proposed solutions to meet an acceptable level of risk. The decision must state the specific reasons for denial and, if possible, provide suggested solutions.
17.	Answer: b Phase 4, post-accreditation, contains activities required to continue to operate and manage the system so that it will maintain an acceptable level of residual risk. Post-accreditation activities must include ongoing maintenance of the SSAA, system operations, security operations, change management, and compliance validation. The other answers relate to Phase 1.
18.	Answer: c Phase 4 continues until the information system is removed from service (decommissioned), undergoes major revisions, or requires a periodic compliance validation. The other answers are distracters.
19.	Answer: d NSTISSP No. 6 determines that all federal government departments and agencies establish and implement programs mandating the certification and accreditation (C&A) of national security systems under their operational control. These C&A programs must ensure that information processed, stored, or transmitted by national security systems is adequately protected for confidentiality, integrity, and availability.
20.	Answer: a The Federal Information Processing Standard (FIPS) 102, the Guideline for Computer Security Certification and Accreditation, is a comprehensive guide explaining how to establish a C&A program and execute a complete C&A. FIPS 102 details a 6-step approach: Planning Data collection Basic evaluation Detailed evaluation Report of findings Accreditation
21.	Answer: b The DITSCAP phases are: Phase 1, Definition Phase 2, Verification Phase 3, Validation Phase 4, Post Accreditation

1.	Which one of the following documents requires the development and maintenance of minimum controls to protect Federal information and information systems? NIST SP 800-30, “Risk Management Guide for Information Technology Systems” SP 800-37, “Guide for the Security Certification and Accreditation of Federal Information Systems” The Federal Information Security Management Act (FISMA) FIPS Publication 199, “Standards for Security Categorization of Federal Information and Information Systems”
2.	FISMA charges which one of the following agencies with the responsibility of overseeing the security policies and practices of all agencies of the executive branch of the Federal government? Office of Management and Budget (OMB) National Institute of Standards and Technology (NIST) National Security Agency (NSA) Department of Justice
3.	NIST Special Publication (SP) 800-53, “Recommended Security Controls for Federal Information Systems,” defines the term assurance as: The requirement that information and programs are changed only in a specified and authorized manner The measure designed to establish the validity of a transmission, message, or originator, or a means of verifying an individual’s authorization to receive specific categories of information The grounds for confidence that the security controls implemented within an information system are effective in their application The requirement that private or confidential information not be disclosed to unauthorized individuals
4.	Which one of the following publications requires Federal agencies to review the security controls in their information systems and perform security accreditation? FIPS –199, “Standard for Security Categorization of Federal Information and Information Systems” OMB Circular A-130, Appendix III NIST SP 800-53, “Recommended Security Controls for Federal Information Systems” NIST SP 800-30, “Risk Management Guide for Information Technology Systems”
5.	Which one of the following publications provides direction for each government agency in developing and implementing an agencywide information security program according to the FISMA requirements? NIST SP 800-37, “Guide for the Security Certification and Accreditation of Federal Information Systems” NIST SP 800-53, “Recommended Security Controls for Federal Information Systems” NIST SP 800-30, “Risk Management Guide for Information Technology Systems” DoD Directive 8500.2, “Information Assurance (IA) Implementation,” February 6, 2003
6.	FISMA assigned the responsibility for developing standards to be used by all Federal agencies to categorize all information and information systems to which one of the following organizations? OMB NIST NSA DoD
7.	Which publication categorizes information and information systems as part of the FISMA mandate? OMB Circular A-130, Appendix III NIST SP 800-53, “Recommended Security Controls for Federal Information Systems” NIST SP 800-30 “Risk Management Guide for Information Technology Systems” FIPS Publication 199, “Standards for Security Categorization of Federal Information and Information Systems”
8.	FIPS Publication 199 defines three levels of potential impact to the compromise of confidentiality, integrity, and availability. These levels are: Minimum, Normal, Maximum Low, Moderate, High Unclassified, Confidential, Secret Confidential, Secret, Top Secret
9.	Which one of the following best describes FIPS 199 security categories? A function of the potential strength of an information system when proper information assurance controls are applied A function of the potential weakness of an information system when proper information assurance controls are applied A function of the potential flexibility of an information system when different IT operations are performed A function of the potential impact on information or information systems as a result of threat realized exploiting a system vulnerability.
10.	The general formula for categorization of an information type developed in FIPS Publication 199, “Standards for Security Categorization of Federal Information and Information Systems,” is which one of the following? SC information type = {(confidentiality, risk), (integrity, risk), (availability, risk)} SC information type = {(confidentiality, controls), (integrity, controls), (availability, controls)} SC information type = {(assurance, impact), (integrity, impact), (authentication, impact)} SC information type = {(confidentiality, impact), (integrity, impact), (availability, impact)}
11.	In order to determine the security category (SC) for an information system, the potential impact values assigned to the security objectives of confidential, integrity, and availability must be which one of the following? The maximum values assigned among the security categories that have been assigned to the different types of information residing on the system The minimum values assigned among the security categories that have been assigned to the different types of information residing on the system The average of the values assigned among the security categories that have been assigned to the different types of information residing on the system None of the above
12.	NIST SP 800-30, “Risk Management Guide for Information Technology Systems,” defines a term as “either (1) intent and method targeted at the intentional exploitation of a vulnerability or (2) a situation and method that may accidentally trigger a vulnerability.” Which one of the following items is the term in the definition? Risk Impact Threat source Assurance
13.	Impact is defined by NIST SP 800-30 as which one of the following? The magnitude of the vulnerability The magnitude of harm that could be caused by a threat’s exercise of vulnerability The magnitude of the risk The quality of the security controls on the system
14.	NIST SP 800-30 includes threat identification, control analysis, likelihood determination, impact analysis, and control recommendations as components of which one of the following activities? Penetration testing Intrusion detection Risk assessment Vulnerability assessment
15.	Hackers, computer criminals, terrorists, floods, tornadoes, and strikes are examples of: Threat-sources Vulnerabilities Risks Intrusions
16.	What NIST document provides a questionnaire and checklist through which systems can be evaluated for compliance against specific control objectives? SP 800-30, “Risk Management Guide for Information Technology Systems” SP 800-37, “Guide for the Security Certification and Accreditation of Federal Information Systems” SP 800-26, “Security Self-Assessment Guide for Information Technology Systems” FIPS Publication 199, “Standards for Security Categorization of Federal Information and Information Systems”
17.	Initiation, development and acquisition, implementation and installation, operational maintenance, and disposal are components of what activity? The system development life cycle (SDLC) The system engineering life cycle The capability maturity model (CMM) Risk management life cycle
18.	The term ST&E stands for: System test and evaluation Security, timing, and evaluation Security, test, and evaluation System timing and evaluation
19.	Which one of the following lists describes different types of penetration tests? Zero-knowledge test, partial-knowledge test, full-knowledge test Hard test, soft test, moderate test Complete test, partial test, minimal test Technical test, cursory test, partial-knowledge test
20.	FIPS Publication 199 defines three levels of potential impact to the compromise of confidentiality, integrity, and availability. Which one of the following statements taken from FIPS 199 describes a moderate level of impact on confidentiality? The unauthorized disclosure of information could be expected to have a serious adverse affect on organizational operations, organizational assets, or individuals. The unauthorized modification or destruction of information could be expected to have a limited adverse affect on organizational operations, organizational assets, or individuals. The disruption of access to or the use of information or an information system could be expected to have a serious adverse affect on organizational operations, organizational assets, or individuals. The unauthorized disclosure of information could be expected to have a severe or catastrophic adverse affect on organizational operations, organizational assets, or individuals.
21.	The definition “All components of an information system to be accredited by an authorizing official and excludes separately accredited systems, to which the information system is connected” taken from NIST SP 800-37 refers to which one of the following terms? Assurance boundary Assurance perimeter Testing perimeter Accreditation boundary
22.	Which activity referred to in OMB Circular A-130 has to consider legal liability issues resulting from omissions and errors, failure to exercise due care in the operation of an information system, and unauthorized disclosure, modification, or destruction of data? Risk avoidance Risk management Testing Dry run
23.	What NIST Special Publication provides guidance in the selection and configuration of security controls for Federal information systems? NIST SP 800-42 NIST SP 800-30 NIST SP 800-53 NIST SP 800-57
24.	Which one of the following NIST publications links to SP 800-53 and specifies minimum security requirements for information systems, including access control, awareness and training, configuration management, and personnel security? NIST SP 800-30, “Risk Management Guide for Information Technology Systems” NIST SP 800-53, “Recommended Security Controls for Federal Information Systems” NIST SP 800-37, “Guide for the Security Certification and Accreditation of Federal Information Systems” FIPS 200 standard, “Minimum Security Requirements for Federal Information and Federal Information Systems”
25.	The Security Controls of NIST SP 800-53 are organized into which three classes? Physical, operational, technical Management, operational, technical Personnel, operational, technical Management, physical, technical
26.	If AC represents the Access Control family in NIST SP 800-53, what does AC-15 denote? The 15th control of the Access Control Family The 15th class of the Access Control Family The 15th field of the Access Control Family None of the above
27.	The control structure in NIST SP 800-53 comprises three parts. Which one of the following is the correct listing of the three parts? Management section, supplemental guidance section, control enhancements section Management section, technical section, control enhancements section Control section, technical section, control enhancements section Control section, supplemental guidance section, control enhancements section
28.	A description of one element of the access control family listed in NIST SP 800-53 is LOW AC-17, MOD AC-17 (1) (2) (3), HIGH AC-17 (1) (2) (3) for low-impact, moderate-impact, and high-impact information systems, based on FIPS 199. What do the terms in parentheses represent? Basic controls implementing access control in the family Control enhancements adding to the functionality or increasing the strength of a basic control Basic controls implementing access control in the class The quality of the security controls on the system
29.	The security certification and accreditation process comprises which one of the following sets of phases? Establishment, security certification, security accreditation, and continuous monitoring Initiation, security certification, security accreditation, and maintenance Initiation, security certification, security accreditation, and continuous monitoring Initiation, security certification, security accreditation, and operation
30.	NIST SP 800-53 defines a term as “the grounds for confidence that the security controls implemented within an information system are effective in their application.” Which one of the following is that term? Threat source Vulnerability Assurance Evaluation
31.	A set of security controls that is applicable to a number of information systems in an organization is called: Common security controls System-specific security controls Hybrid security controls Special security controls
32.	In the certification and accreditation process, a plan must be developed that outlines the information system security requirements and associated planned and existing controls. This plan is called: Common security control plan The general project plan The system security plan The special control plan
33.	The security accreditation package comprises which one of the following sets of items? The general project plan, security assessment report, plan of action, and milestones The system security plan, security assessment report, plan of action, and milestones The special security plan, security assessment report, plan of action, and milestones System security plan, technical operations report, plan of action, and milestones

Answers

1.	Answer: c Development and maintenance of these controls is one of the four prime directives of FISMA, Title III of the E-Government Act of 2002.
2.	Answer: a FISMA charges the Director of OMB with those responsibilities.
3.	Answer: c Answer c addresses how well security controls function.
4.	Answer: b OMB Circular A-130, Appendix III, imposes this requirement.
5.	Answer: a NIST SP 800-37 provides this direction.
6.	Answer: b The correct answer is b, NIST. FISMA also assigned to NIST the responsibility for developing guidelines recommending the types of information and information systems to be included in each security category and the minimum information security requirements.
7.	Answer: d
8.	Answer: b
9.	Answer: d
10.	Answer: d
11.	Answer: a
12.	Answer: c
13.	Answer: b
14.	Answer: c
15.	Answer: a
16.	Answer: c
17.	Answer: a
18.	Answer: c
19.	Answer: a The answer a is correct. The other answers are made-up distracters.
20.	Answer: a The answer a is correct. Answer b refers to a low impact on integrity, answer c refers to moderate impact on availability, and answer d refers to a high impact on confidentiality.
21.	Answer: d The correct answer is d, accreditation boundary. The other answers are made-up distracters.
22.	Answer: b
23.	Answer: c The correct answer is c, “Recommended Security Controls for Federal Information Systems”
24.	Answer: d
25.	Answer: b
26.	Answer: a
27.	Answer: d
28.	Answer: b
29.	Answer: c
30.	Answer: c
31.	Answer: a The correct answer is a, common security controls. Controls that are not defined as common to a number of information systems are defined as system-specific.
32.	Answer: c
33.	Answer: b

1.	Which choice best describes DITSCAP Phase 1, Definition? The objective of Phase 1 is to ensure the fully integrated system will be ready for certification testing. The objective of Phase 1 is to produce the required evidence to support the DAA in making an informed decision to grant approval to operate the system (accreditation or Interim Approval to Operate [IATO]). The objective of Phase 1 is to agree on the security requirements, C&A boundary, schedule, level of effort, and resources required. The objective of Phase 1 is to ensure secure system management, operation, and maintenance to preserve an acceptable level of residual risk.
2.	Which is not an activity in DITSCAP Phase 2? System Development and Integration Initial Certification Analysis Refine the SSAA Negotiation
3.	Which is not an activity in DITSCAP Phase 1? Preparation Initial Certification Analysis Registration Negotiation
4.	According to NIST 800-37, which of the following subtasks does not belong to the Security Certification Phase? Present the accreditation recommendation to the DAA Prepare the security certification documentation Gather the documentation Perform the security control assessment
5.	Which of the following is not a good description of the goal of the C&A Certification Phase? To determine how well the information system security controls are implemented To determine whether the information system security controls are meeting the security requirements for the system To produce the required evidence to support the DAA in making an informed decision to grant approval to operate the system To determine whether the information system security controls are operating as intended
6.	Which choice is not an objective of the security control assessment task? Document the results of the assessment Organize and track the security requirements of the target system to be accredited Prepare for the assessment of the security controls in the information system Conduct the assessment of the security controls
7.	The acronym RTM refers to what? Resource Tracking Method Requirements Traceability Matrix Requirements Testing Matrix Requirements Testing Milestone
8.	The SSAA is the product of which DITSCAP phase? Phase 1 Phase 2 Phase 3 Phase 4
9.	What is the primary purpose of the RTM? To establish an evolving yet binding agreement on the level of security required To organize and track the security requirements of the target system to be accredited To produce the required evidence to support the DAA in making an informed decision to grant approval to operate the system To determine whether the information system security controls are operating as intended
10.	In which DITSCAP phase is the RTM developed? Phase 1 Phase 2 Phase 3 Phase 4
11.	What is the primary purpose of the SSAA? To determine whether the information system security controls are operating as intended To organize and track the security requirements of the target system to be accredited To determine how well the information system security controls are implemented To establish an evolving yet binding agreement on the level of security required before the system development begins or changes to a system are made
12.	In which DITSCAP phase is the SSAA developed? Phase 1 Phase 2 Phase 3 Phase 4
13.	What is the overall goal of the DITSCAP Phase 2? To track whether and how all security requirements are being met by the system To prepare the Plan of Action and Milestones document To obtain a fully integrated system for certification testing and accreditation To assist in the development of test scripts for the ST&E
14.	Which of the following is not an example of a DITSCAP Phase 2 process activity? Certification analysis System development Document Mission Need Continuing refinement of the SSAA
15.	Which choice is not an example of an Initial Certification Analysis task? Verify that the system architecture complies with the architecture description in the SSAA Verify that change control and configuration management practices are in place Evaluate the integration of COTS or GOTS software Assist in the development of test scripts for the System Test and Evaluation (ST&E)
16.	What is the purpose of the Initial Certification Analysis? To organize and track the security requirements of the target system to be accredited To support the documentation that all system security requirements have been met in the accreditation phase of the C&A To assist in the development of test scripts for the System Test and Evaluation (ST&E) To determine whether the system is ready to be evaluated and tested under Phase 3 of the Accreditation Phase
17.	What role would commonly be in charge of preparing the Action Plan? The DAA The Information System Owner The Certification Agent The User Representative
18.	What choice is the best description of the DAA? The interests of the system’s users are vested in the DAA. The DAA defines the system level security requirements. The DAA provides the technical expertise to conduct the certification. The DAA is responsible for carrying out the Chief Information Officer responsibilities under FISMA.
19.	In what role resides the final accreditation decision? The DAA The Information System Owner The Certification Agent The User Representative
20.	Which choice is not a use for the SSAA? To document the formal agreement among the DAA(s), the CA, the user representative, and the program manager To document a commander’s assumptions or intent in regard to an IS and how it relates to the concept of operations embodied in campaign plans and operational plans To document all requirements necessary for accreditation To document the DITSCAP plan

Answers

1.	Answer: c Phase 1, Definition, is focused on understanding the IS business case, environment, and architecture to determine the security requirements and level of effort necessary to achieve certification and accreditation. The objective of Phase 1 is to agree on the security requirements, C&A boundary, schedule, level of effort, and resources required. Answer a describes the objectives of Phase 2. Answer b describes the objectives of Phase 3. Answer d describes the objectives of Phase 4.
2.	Answer: d Negotiation is a Phase 1 activity. The other three are the Phase 2 activities.
3.	Answer: b Initial Certification Analysis is a Phase 2 activity. The other three are the Phase 1 activities.
4.	Answer: a Presenting the accreditation recommendation to the DAA is a function of the Accreditation Phase.
5.	Answer: c Answer c describes the goal of the Accreditation Phase. The goal of the Certification Phase is to determine how well the information system security controls are implemented, if they are operating as intended, and if the controls are meeting the security requirements for the system.
6.	Answer: b The RTM is used to organize and track the security requirements of the target system to be accredited. The other three choices are all objectives of the security control assessment task.
7.	Answer: b The acronym RTM refers to Requirements Traceability Matrix.
8.	Answer: a The product of the DITSCAP Phase 1 is the System Security Authorization Agreement.
9.	Answer: b The RTM is used to organize and track the security requirements of the target system to be accredited. It is commonly part of the SSAA as an addendum.
10.	Answer: a In DITSCAP, the RTM is developed in the requirements gathering phase, which is a subtask of Phase 1.
11.	Answer: d The objective of the SSAA is to establish an evolving yet binding agreement on the level of security required before the system development begins or changes to a system are made. It’s a formal agreement between the DAA, the CA, the user representative, and the program manager.
12.	Answer: a The SSAA is developed in Phase 1 and updated in each phase as new information becomes available.
13.	Answer: c The goal of Phase 2 is to obtain a fully integrated system for certification testing and accreditation, to allow the process to proceed to Phase 3.
14.	Answer: c Phase 2 consists of those process activities that occur between the signing of the initial version of the SSAA and the formal C&A of the system. Document Mission Need is the first subtask of DITSCAP Phase 1.
15.	Answer: d “Assist in the development of test scripts for the System Test and Evaluation (ST&E)” is one of the purposes of the RTM.
16.	Answer: d The initial certification analysis determines whether the IS is ready to be evaluated and tested under Phase 3. The other three choices are uses for the RTM.
17.	Answer: b The Information System Owner prepares the Plan of Action and Milestones Document.
18.	Answer: b The DAA represents the interests of mission need, controls the operating environment, and defines the system level security requirements. Choice a describes the User Representative; choice c, the Certification Agent; and choice d, the Information Security Officer.
19.	Answer: a Only the DAA (or Authorizing Official) can grant the accreditation, grant an Interim Approval to Operate (IATO), or determine that the system’s risks are not at an acceptable level and it is not ready to be operational.
20.	Answer: b Answer b is a description of the concept of CONOPS.

1.	What happens to the SSAA after the DITSCAP accreditation? The SSAA becomes the baseline security configuration document. The SSAA is discarded as the project is finished. The SSAA cannot be reviewed or changed. The ISSO can revise the SSAA independently.
2.	Which choice best describes DITSCAP Phase 3, Accreditation? The objective of Phase 3 is to ensure that the fully integrated system will be ready for certification testing. The objective of Phase 3 is to agree on the security requirements, C&A boundary, schedule, level of effort, and resources required. The objective of Phase 3 is to ensure secure system management, operation, and maintenance to preserve an acceptable level of residual risk. The objective of Phase 3 is to produce the required evidence to support the DAA in making an informed decision to grant approval to operate the system (accreditation or Interim Approval to Operate [IATO]).
3.	During which DITSCAP phase does the Security Test and Evaluation (ST&E) occur? Phase 1 Phase 2 Phase 3 Phase 4
4.	What does DATO refer to? The information system is accredited without any restrictions or limitations. A determination that a DoD information system cannot operate. A limited authorization under specific terms and conditions. A temporary approval to conduct system testing.
5.	Which of the following choices is the best description of IATO? A determination that a DoD information system cannot operate. The agency-level risk is unacceptably high for accreditation. The information system is accredited without any restrictions or limitations on its operation. A limited authorization under specific terms and conditions, which include corrective actions to be taken and a required timeframe for completion of those actions.
6.	Which choice is the best description of the objective of the Security Accreditation Decision task? To accredit the information system without any restrictions or limitations on its operation To indicate the DAA’s accreditation decision To determine whether the agency-level risk is acceptable To approve revisions to the SSAA
7.	Which choice is not a responsibility of the ISSO during DITSCAP Phase 4? Obtaining approval of security-relevant changes Documenting the implementation of security-relevant changes in the SSAA Approving revisions to the SSAA Determining the extent that a change affects the security posture of the information system
8.	Which choice best describes the final security accreditation decision letter? The accreditation decision letter documents the implementation of security-relevant changes in the SSAA. The accreditation decision letter deems that the agency-level risk is unacceptably high. The accreditation decision letter indicates to the information system owner the DAA’s accreditation decision. The accreditation decision letter determines whether the remaining known vulnerabilities in the information system pose an acceptable level of risk.
9.	Change management is initiated under which phase? Phase 1 Phase 2 Phase 3 Phase 4
10.	Why would the DAA issue an accreditation determination of Not Authorized (NA)? If the system requires more testing to determine the level of risk. If the DAA deems that the agency-level risk is unacceptably high. If the system is mission-critical and requires an interim authority to operate. The information system is always accredited without any restrictions or limitations on its operation.
11.	Which choice is the best definition of the DIACAP Interim Approval to Test (IATT) accreditation determination? It’s a temporary approval to conduct system testing. It’s a temporary approval to operate. It’s a denial of approval to operate. No such accreditation determination exists.
12.	Which of the following best describes the objective of the Security Test and Evaluation (ST&E)? The objective of the ST&E is to update the SSAA to include changes made during system development and the results of the certification analysis. The objective of the ST&E is to evaluate the integration of COTS software, hardware, and firmware. The objective of the ST&E is to verify that change control and configuration management practices are in place. The objective of the ST&E is to assess the technical implementation of the security design.
13.	Who makes the final accreditation decision? ISSO CA Information System Owner DAA
14.	Penetration Testing is part of which DITSCAP phase? Phase 1 Phase 2 Phase 3 Phase 4
15.	Which choice is the best description of the purpose of the Security Accreditation Phase? To assesses the system’s ability to withstand intentional attempts to circumvent system security features by exploiting technical security vulnerabilities To determine whether the remaining known vulnerabilities in the information system pose an acceptable level of risk To conduct a final risk assessment by the Information System Owner To help prepare the final security accreditation decision letter
16.	SSAA maintenance continues under which phase? Phase 1 Phase 2 Phase 3 Phase 4
17.	How many determination options does the authorizing official have in a DIACAP process? 2 3 4 5
18.	How many levels of certification does NIACAP specify to ensure that the appropriate C&A is performed for varying schedule and budget limitations? Two Three Four Five
19.	Which choice is the best description of DIACAP residual risk? The remaining risk to the information system after risk mitigation has occurred. To assess the technical implementation of the security design. The information system is not authorized for operation and is not accredited. Authorization to operate the information system.
20.	Which choice is not an accreditation decision the DITSCAP DAA can make? ATO IATO NCO NA
21.	When does the DAA make the accreditation determination? After reviewing all the relevant information and consulting with key agency officials Before determining the acceptability of the risk to the agency After preparing the final security accreditation decision letter After the Information System Owner updates the system security plan

Answers

1.	Answer: a After accreditation, the SSAA becomes the baseline security configuration document. Phase 4 involves ongoing review of the SSAA to ensure it remains current. The user representative, DAA, certifier, and program manager must approve revisions to the SSAA. On approval, the necessary changes to the mission, environment, and architecture are documented in the SSAA.
2.	Answer: d Phase 3, Validation, validates compliance of the fully integrated system with the security policy and requirements stated in the SSAA. The objective of Phase 3 is to produce the required evidence to support the DAA in making an informed decision to grant approval to operate the system. Answer a describes the objectives of Phase 2. Answer b describes the objectives of Phase 1. Answer c describes the objectives of Phase 4.
3.	Answer: c The Security Test and Evaluation (ST&E) is a major activity in Phase 3.
4.	Answer: b DIACAP’s Denial of Approval to Operate (DATO) is a determination that a DoD information system cannot operate because of an inadequate IA design or failure to implement assigned IA controls.
5.	Answer: d If the DAA deems that the agency-level risk is unacceptable, but there is an important mission-related need to place the information system into operation, an Interim Authorization to Operate (IATO) may be issued. The IATO is a limited authorization under specific terms and conditions, which include corrective actions to be taken by the information system owner and a required time frame for completion of those actions.
6.	Answer: c The objective of the Security Accreditation Decision task is to determine the risk to agency operations, agency assets, or individuals and determine whether the agency-level risk is acceptable.
7.	Answer: c The user representative, DAA, certifier, and program manager must approve revisions to the SSAA. The ISSO is responsible for: Determining the extent that a change affects the security posture of either the information system or the computing environment Obtaining approval of security-relevant changes Documenting the implementation of that change in the SSAA and site operating procedures Forwarding changes that significantly affect the system security posture to the DAA, certifier, user representative, and program manager
8.	Answer: c The accreditation decision letter indicates to the information system owner whether the system is authorized to operate (ATO), authorized to operate on an interim basis under strict terms and conditions (IATO), or not authorized to operate (NA).
9.	Answer: d After an IS is approved for operation in a specific computing environment, changes to the IS and the computing environment must be controlled. Although changes may adversely affect the overall security posture of the infrastructure and the IS, change is ongoing as it responds to the needs of the user and new technology developments. As the threats become more sophisticated or focused on a particular asset, countermeasures must be strengthened or added to provide adequate protection. Therefore, change management is required to maintain an acceptable level of residual risk.
10.	Answer: b If the DAA deems that the agency-level risk is unacceptable, the information system is not authorized for operation and is not accredited. The DAA must consider many factors when deciding whether the risk is acceptable, such as balancing security considerations with mission and operational needs.
11.	Answer: a In DIACAP, the Interim Approval to Test (IATT) accreditation determination is temporary approval to conduct system testing based on an assessment of the implementation status of the assigned IA controls. Choice b describes IATO, and choice c describes DATO.
12.	Answer: d The objective of the ST&E is to assess the technical implementation of the security design; to ascertain that security software, hardware, and firmware features affecting confidentiality, integrity, availability, and accountability have been implemented as documented in the SSAA; and that the features perform properly. ST&E validates the correct implementation of identification and authentication, audit capabilities, access controls, object reuse, trusted recovery, and network connection rule compliance. The other answers are distracters.
13.	Answer: d. The DAA renders his or her accreditation decision after reviewing all the relevant information and consulting with key agency officials.
14.	Answer: c Penetration testing assesses the system’s ability to withstand intentional attempts to circumvent system security features by exploiting technical security vulnerabilities. Penetration testing may include insider and outsider penetration attempts based on common vulnerabilities for the technology being used.
15.	Answer: b The purpose of the Security Accreditation Phase is to determine whether the remaining known vulnerabilities in the information system pose an acceptable level of risk to agency operations, agency assets, or individuals.
16.	Answer: d Phase 4 involves ongoing review of the SSAA to ensure that it remains current. The user representative, DAA, certifier, and program manager must approve revisions to the SSAA. On approval, the necessary changes to the mission, environment, and architecture are documented in the SSAA.
17.	Answer: c In DIACAP, the DAA or other authorizing official issues one of four accreditation determinations: Approval to Operate (ATO) Interim Approval to Operate (IATO) Interim Approval to Test (IATT) Denial of Approval to Operate (DATO)
18.	Answer: c NIACAP has four levels of certification to ensure that the appropriate C&A is performed for varying schedule and budget limitations. To determine the appropriate level of certification, the certifier must analyze the system’s business functions; national, departmental, and agency security requirements; criticality of the system to the organizational mission; software products; computer infrastructure; the types of data processed by the system, and types of users. The levels are as follows: Level 1 - Basic Security Review Level 2 - Minimum Analysis Level 3 - Detailed Analysis Level 4 - Comprehensive Analysis
19.	Answer: a DIACAP describes residual risk as the risk remaining after risk mitigation has occurred (i.e., application of countermeasures, security controls, or the implementation of corrective actions).
20.	Answer: c The DITSCAP DAA issues one of three accreditation determinations: Authorization to Operate (ATO), Interim Authorization to Operate (IATO), or Not Authorized (NA).
21.	Answer: a The DAA renders the accreditation decision after reviewing all the relevant information and consulting with key agency officials.

1.	“Continuously observing and evaluating the information system security controls during the system life cycle to determine whether changes have occurred that will negatively impact the system security” best describes which process in the certification and accreditation methodology? Continuous monitoring Continuous improvement Continuous management Continuous development
2.	Which one of the following activities is not a component of the continuous monitoring process? Operation and maintenance Security control monitoring and impact analyses Status reporting and documentation Configuration management and control
3.	Which one of the following publications provides details of the continuous monitoring process? NIST SP 800-14 NIST SP 800-42 NIST SP 800-37 NIST SP 800-41
4.	Which one of the following best describes when continuous monitoring takes place? Before the initial system certification After the initial system security accreditation Before and after the initial system security accreditation During the system design phase
5.	Which one of the following questions is not asked as part of the continuous monitoring process? Could any of the changes to the information system affect the current, identified vulnerabilities in the system or introduce new vulnerabilities into the system? If new vulnerabilities are introduced into an information system, would the resulting risk to agency operations, agency assets, or individuals be unacceptable? What maintenance schedule should be followed during the operation/maintenance phase of the information system? When will the information system need to be reaccredited in accordance with federal or agency policy?
6.	In configuration management and control, if necessary, updates have to be made to which of the following documents? System security plan System security plan and plan of action and milestones Plan of action and milestones System deficiency report and plan of action and milestones
7.	Which one of the following documents should report progress made on the current outstanding items and address vulnerabilities in the information system discovered during the security impact analysis or security control monitoring? Plan of action and milestones System security plan System security plan and plan of action and milestones System deficiency plan
8.	What process should be initiated when changes to the information system negatively impact the security of the system or when a period of time has elapsed as specified by agency or federal policy? Incident response Systems engineering Reaccreditation Reclassification of data
9.	What course of action is recommended when it is not feasible or possible to continuously monitor the entirety of security controls in an information system? Begin the reaccreditation process Begin the recertification process Enter the system development life cycle (SDLC) Select subsets of controls and monitor them at intervals
10.	Selecting controls to be monitored can be best aided by what document? FIPS 199 NIST SP 800-37 FISMA NIST SP 800-18
11.	What document provides a standard approach to the assessment of NIST SP 800-53 security controls? FIPS 199 NIST SP 800-53A NIST SP 800-30 NIST SP 800-66
12.	Appendix D of NIST SP 800-53A describes what three basic types of assessment methods? The interview, the examination, and testing The interview, the validation, and testing The interview, the examination, and remediation The interview, the verification, and testing
13.	NIST SP 800-53A defines which of the following three types of interviews, depending on the level of assessment conducted? Initial, substantial, comprehensive Abbreviated, substantial, comprehensive Abbreviated, moderate, comprehensive Abbreviated, substantial, detailed
14.	What NIST SP 800-53A assessment method is used to review, inspect, and analyze assessment objects such as polices, plans, requirements, designs, hardware, firmware, and security activities to determine the effectiveness of information system security controls? Verification Interview Examination Validation
15.	Observing or conducting the operation of physical devices, hardware, software, and firmware and determining whether they exhibit the desired and expected behavior describes what type of SP 800-53A assessment method? Examination Testing Validation Remediation
16.	In continuous monitoring, tracking of proposed or actual changes to the information system, including operating system patches, hardware, software, and firmware is called: Systems engineering The system development life cycle (SDLC) Configuration management and controls Security categorization
17.	Determination of the effect of changes to the information system on the security of the information system is called: Validation analysis Verification Impact analysis Continuous improvement
18.	Who is responsible for monitoring the information system environment for factors that can potentially negatively impact the security of the system and its accreditation? The information system owner Chief information officer (CIO) The user Accrediting officer
19.	Which of the following items are types of factors that can potentially negatively impact the security of the system and its accreditation? Legal Human-initiated Weather-related All the above
20.	What guidance document is useful in determining the impact level of a particular threat on agency systems? FIPS 199 NIST SP 800-53 NIST SP 800-14 NIST SP 800-41
21.	Documentation is an important part of continuous monitoring. In this context, documentation comprises which of the following activities? Making changes to the security plan that address any changes or proposed changes to the information system Updating the plan of action and milestones Establishing the accreditation boundary a and b
22.	As part of the documentation process, reports are usually sent to which of the following personnel in the agency? Authorizing official Authorizing official and senior agency information security officer Senior agency information security officer User
23.	In continuous monitoring, what personnel will normally be using the updated plans in the documentation report to guide future assessment activities? The senior agency information security officer The authorizing official The information system owner and security assessor All the above
24.	The frequency of generating the system security plan and the plan of action and milestones is at the discretion of which of the following personnel? The authorizing official The information system owner The agency information system security officer All the above
25.	Generating the system security plan and plan of action and milestones should be done at what frequency? Every three months Reasonable intervals to ensure that significant changes to the security posture of the information system are reported At the discretion of the authorizing official Every three years
26.	Who determines whether a security reaccreditation is required after reviewing the plan of actions and milestones? The senior information system security officer The authorizing official The senior information security officer and the authorizing official The information system owner
27.	The following events are used to determine whether which activity has to be initiated? Modifications to the information system have negatively impacted the system security controls. Modifications to the information system have introduced new vulnerabilities into the system. A specified time period has elapsed, requiring the information system to be reauthorized in accordance with federal or agency policy (typically 3 years). The risk to agency operations, agency assets, or individuals has been increased. Reaccreditation Maintenance Peer review Security categorization
28.	Continuous monitoring documentation reports are also used to meet which one of the following reporting requirements? NIST FISMA HIPAA FBI
29.	Power failures, floods, earthquakes, and sabotage are examples of what types of events? Events that can potentially negatively impact the security of the system and its accreditation Events that cannot be taken into consideration during the impact analysis process Events that are out of one’s control and, therefore, cannot be accounted for in risk analysis Events for which the associated risk can be reduced to zero if proper precautions are taken
30.	NIST SP 800-53A defines a form of testing as one that “assumes (some) explicit knowledge of the internal structure of the item under assessment (e.g., low-level design, source code implementation representation).” Which one of the following items is that form of testing? Validation Black-box Structural Evaluation
31.	What are the types of assessment tests addressed in NIST SP 800-53A? Functional, structural, penetration Functional, evaluation, penetration Validation, structural, black-box Validation, structural, penetration
32.	A test methodology in which assessors, using all available documentation (e.g., system design, source code, manuals) and working under no constraints, attempt to circumvent the security features of an information system is defined in NIST SP 800-53A as what type of test? Validation test Functional test Structural test Penetration test
33.	In the continuous monitoring examination assessment method, three examination depth levels are defined in NIST SP 800-53A. The definition “examinations that consist of brief, high-level reviews, observations, or inspections of selected specifications, mechanisms, or activities associated with the security control being assessed using a limited body of evidence or documentation” refers to which one of the following examination assessment types? Functional Abbreviated Substantial Comprehensive

Answers

1.	Answer: a The answer a is correct. The other answers are distracters.
2.	Answer: a Operation/maintenance is a component of the system development life cycle (SDLC) and is not one of the elements of continuous monitoring.
3.	Answer: c Answer c, NIST SP 80-37 “Guide for the Security Certification and Accreditation of Federal Information Systems,” is correct. NIST 800-14, “Generally Accepted Principles and Practices for Securing Information Technology” (answer a) lists eight principles for securing information technology systems and 14 security practices. NIST SP 800-42 (answer b) is the “Guideline on Network Security Testing,” and NIST SP 800-41 (answer d) provides “Guidelines on Firewalls and Firewall Policy.”
4.	Answer: b Continuous monitoring is aimed at determining whether any changes have occurred to the information system security posture following the initial system certification.
5.	Answer: c Answers a, b, and d are the three questions asked in NIST SP 800-37.
6.	Answer: b The system security plan and the plan of action and milestones are the documents that may have to be updated. Answer d is a made up distracter.
7.	Answer: a
8.	Answer: c The information system should be reaccredited because new vulnerabilities have been found that are not adequately protected by existing security control mechanisms.
9.	Answer: d The answer d is correct. Answers a and b are incorrect because, at this stage, it has not yet been determined whether new vulnerabilities have been exposed. The controls have to be monitored first. Answer c is a made-up distracter.
10.	Answer: a FIPS 199 security categories can be used to identify elements that are most critical to the organization and the corresponding security controls that, if compromised, would result in the most damage to the system.
11.	Answer: b NIST SP 800-53A (answer b) is the “ Guide for Assessing the Security Controls in Federal Information Systems.” FIPS 199 (answer a) provides guidelines for security categorizations; SP 800-30 (answer c) delineates guidelines for risk management; and NIST SP 800-66 (answer d,) is the “Introductory Resource Guide for Implementing the HIPAA Security Rule.”
12.	Answer: a The answer a is correct. The other answers are made-up distracters.
13.	Answer: b The answer b is correct. The other answers are made-up distracters.
14.	Answer: c The correct answer is c, examination, by definition.
15.	Answer: b The answer b, testing, is correct. Answer a, examination, is another SP 800-53A assessment method, and answers c and d are made-up distracters.
16.	Answer: c The correct answer is c, by definition.
17.	Answer: c The correct answer is c, by definition.
18.	Answer: a The correct answer is a, the information system owner.
19.	Answer: d
20.	Answer: a FIPS 199, (answer is a) is the “Standard for Security Categorization of Federal Information Systems.” The categories of FIPS 199 provide the framework for determining the impact level of specific threats. NIST SP 800-53 (answer b) is the “Recommended Security Controls for Federal Information Systems; NIST 800-14 (answer c) is “Generally Accepted Principles and Practices for Securing Information Technology,” which lists eight principles for securing information technology systems and 14 security practices. NIST SP 800-41 (answer d) which provides “Guidelines on Firewalls and Firewall Policy.”
21.	Answer: d Documentation includes both making changes to the security plan that address any changes or proposed changes to the information system and updating the plan of action and milestones.
22.	Answer: b The documentation report should be sent to the authorizing official and senior agency information security officer on a regular basis.
23.	Answer: d All these personnel will be involved in planning future assessment activities.
24.	Answer: b The information system owner has discretion over how frequently these documents are generated.
25.	Answer: b The frequency of plan generation is at the discretion of the information system owner.
26.	Answer: c If the decision is that reaccreditation is necessary, the authorizing official will inform the information system owner of the decision.
27.	Answer: a Any of these events makes reaccredidation necessary.
28.	Answer: b
29.	Answer: a The answer a is correct. Relative to answers b and c, these types of events are taken into account during impact analysis and risk analysis. Answer d is incorrect because risk can never be completely eliminated.
30.	Answer: c
31.	Answer: a The answer a is correct. In the other answers, evaluation and validation types are made-up distracters. Black-box testing is another word for functional testing.
32.	Answer: d
33.	Answer: b

Appendix C

1.	Which one of the following is not one of the types of information comprised in requirements? Environmental description Functionality Security constraints Design architecture
2.	What are the two major problem categories in the requirements analysis process? Essence and accidents Essence and system properties System properties and essence Maintainability and accidents
3.	Which one of the high-level design processes includes verified design specifications, requirements traceability, control structures, and data structures? Design architecture Communications protocols Design constraints Functional descriptions
4.	Which one of the following requirements categories stipulates customer-driven constraints such as hardware and software compatibility issues, operating systems, and protocols? Functional constraints Functionality Design constraints Project management
5.	Which one of the following activities is not an approach to developing design architecture? Functional decomposition Traceable decomposition Process-driven decomposition Object-oriented decomposition
6.	Which one of the following processes provides the necessary and sufficient information for the correct design and valid implementation of a system? Requirements analysis Design analysis Functional analysis Design architecture generation
7.	The design architecture derives from which one of the following: High-level design processes Control analysis Impact analysis System specifications
8.	Requirements analysis addresses which of the following issues? Functional requirements Functional and security requirements Security requirements Effectiveness
9.	Which one of the following requirements addresses issues such as budget control, delivery schedules, training, and acceptance testing? Environmental descriptions Project management constraints Communications protocols Functional constraints
10.	What is a critical component in verifying and validating the completed system? Requirements System architecture Design analyses Decomposition

Answers

1.	Answer: d The design architecture derives from the system specifications.
2.	Answer: a Answers b, c, and d are distracters.
3.	Answer: a Answers b, c, and d are distracters.
4.	Answer: c The answer is c, by definition.
5.	Answer: b Answer b is a made-up distracter.
6.	Answer: a Answers b, c, and d are distracters.
7.	Answer: d
8.	Answer: b
9.	Answer: b
10.	Answer: a

Appendix D

1.	Which one of the following is not one of the five system life cycle planning phases as defined in NIST SP 800-14? Initiation phase Requirements phase Implementation phase Disposal phase
2.	Which one of the following sets of activities best describes a subset of the Acquisition Cycle phases as given in NIST SP 800-64, “Security Considerations in the Information System Development Life Cycle”? Mission and business planning, acquisition planning, contract performance, disposal and contract closeout Initiation, mission and business planning, acquisition planning, contract performance Initiation, acquisition/development, contract performance, disposal and contract closeout Mission and business planning, acquisition/development, contract performance, disposal and contract closeout
3.	The IATF document 3.1 stresses that information assurance relies on three critical components. Which one of the following answers correctly lists these components? People, documentation, technology People, Defense in Depth, technology People, evaluation, certification People, operations, technology
4.	In the 14 Common IT Security Practices listed in NIST SP 800-14, one of the practices addresses having three types of policies in place. Which one of the following items is not one of these types of policies? A program policy An issue-specific policy A system-specific policy An enclave-specific policy
5.	Risk management, as defined in NIST SP 800-30, comprises which three processes? Risk assessment, risk mitigation, and evaluation and assessment Risk identification, risk mitigation, and evaluation and assessment Risk assessment, risk impacts, and risk mitigation Risk assessment, risk mitigation, and risk identification
6.	In the system development life cycle (SDLC), or system life cycle as it is sometimes called, in which one of the of the five phases are the system security features configured, enabled, tested, and verified? Operation/maintenance Development/acquisition Implementation Initiation
7.	Which one of he following activities is performed in the Development/Acquisition phase of the SDLC? The scope of the IT system is documented. The IT system is developed, programmed, or otherwise constructed. The system performs its function. Information, hardware, or software is disposed of.
8.	In NIST SP 800-30, risk is defined as a function of which set of the following items? Threat likelihood, vulnerabilities, and impact Threat likelihood, mission, and impact Vulnerabilities, mission and impact Threat likelihood, sensitivity, and impact
9.	The risk assessment methodology described in NIST SP 800-30 comprises nine primary steps. Which one of the following is not one of these steps? System characterization Control analysis Impact analysis Accreditation boundaries
10.	The Engineering Principles for Information Technology Security (EPITS), described in NIST SP 800-27, are which one of the following? A list of 33 system-level security principles to be considered in the design, development, and operation of an information system A list of eight principles and 14 practices derived from OECD guidelines Part of the Common Criteria (CC) Component of the Defense in Depth strategy
11.	Which one of the following items is not one of the activities of the generic systems engineering (SE) process? Discover needs Define system requirements Obtain accreditation Assess effectiveness
12.	The elements Discover information protection needs, Develop detailed security design, and Assess information protection effectiveness are part of what process? The systems engineering (SE) process The information systems security engineering process (ISSE) The system development life cycle (SDLC) The risk management process
13.	In the ISSE process, information domains are defined under the Discover Information Protection Needs process. Which one of the following tasks is not associated the information domain? Identify the members of the domain. List the information entities that are under control in the domain. Identify the applicable privileges, roles, rules, and responsibilities of the users in the domain. Map security mechanisms to security design elements in the domain.
14.	In the Discover Information Protection Needs activity of the ISSE process, the information systems security engineer must document the elements of this activity, including roles, responsibilities, threats, strengths, security services, and priorities. These items form the basis of which one of the following? Threat matrix Functional analysis Synthesis Information protection policy (IPP)
15.	As part of the Define System Security Requirements activity of the ISSE process, the information systems security engineer identifies and selects a solution set that can satisfy the requirements of the IPP. Which one of the following elements is not a component of the solution set? Functional decomposition Preliminary security concept of operations (CONOPS) System context System requirements
16.	The information systems security engineer’s tasks of cataloging candidate commercial off-the-shelf (COTS) products, government off-the-shelf (GOTS) products, and custom security products are performed in which one of the following ISSE process activities? Define System Security Requirements Develop Detailed Security Design Implement System Security Design System Security Architecture
17.	Which ISSE activity includes conducting unit testing of components, integration testing, and developing installation and operational procedures? Assess Information Protection Effectiveness Develop Detailed Security Design Implement System Security Design System Security Architecture
18.	Security certification is performed in which phase of the SDLC? Implementation phase Validation phase Development/Acquisition phase Operations/Maintenance phase
19.	The certification and accreditation process receives inputs from the ISSE process. These inputs are which one of the following items? Certification documentation Certification recommendations Accreditation decision Evidence and documentation
20.	Which one of the following items is not part of an implementation-independent protection profile (PP) of the Common Criteria (CC)? Security objectives Information assurance requirements Security-related functional requirements Defense of the enclave boundary
21.	Which one of the following is not one of the technology focus areas of the Defense in Depth strategy? Defend the certificate management Defend the network and infrastructure Defend the computing environment Defend the supporting infrastructure
22.	Security categorization is part of which phase of the SDLC? Initiation Acquisition/Development Implementation Requirements
23.	The Defense in Depth strategy identifies five types of attacks on information systems as listed in IATF document 3.1. Which one of the following types of attacks is not one of these five types? Passive Active Close-in Outsider
24.	Which one of the following items is not an activity under the Acquisition/Development phase of the SDLC? Preliminary risk assessment Security functional requirements analysis Cost considerations and reporting Developmental security evaluation
25.	Which one of the following types of enclaves is not one of those categorized in the U.S. federal and defense computing environments? Private Public Classified Secure
26.	According to NIST SP 800-64, which phase of the SDLC includes the activities of functional statement of need, market research, cost-benefit analysis, and a cost analysis? Initiation Acquisition/Development Implementation Operations/Maintenance
27.	Which one of the following models is an evolutionary model used to represent the acquisition management process? The acquisition process model The spiral model The waterfall model The acquisition/development model
28.	In NIST SP 800-30, a threat is defined as which one of the following items? Intent and method targeted at the intentional exploit of a vulnerability The likelihood that a given threat source will exercise a particular potential vulnerability, and the resulting impact of that adverse event on the organization The potential for a threat source to exercise a specific vulnerability A flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised and result in a security breach or a violation of the system’s security policy
29.	Questionnaires, on-site interviews, review of documents, and automated scanning tools are primarily used to gather information for which one of the following steps of the risk assessment process? System characterization Risk determination Vulnerability identification Control analysis
30.	In performing an impact analysis as part of the risk assessment process, three important factors should be considered in calculating the negative impact. Which one of the following items is not one of these factors? The sensitivity of the system and its data The management of the system The mission of the system The criticality of the system, determined by its value and the value of the data to the organization Technical Management
31.	Which statement about the SSE-CMM is incorrect? The SSE-CMM defines two dimensions that are used to measure the capability of an organization to perform specific activities. The domain dimension consists of all the practices that collectively define security engineering. The domain dimension represents practices that indicate process management and institutionalization capability. The capability dimension represents practices that indicate process management and institutionalization capability.
32.	Which description of the SSE-CMM Level 5 Generic Practice is correct? Planned and Tracked Continuously Improving Quantitatively Controlled Performed Informally
33.	Which statement about testing and evaluation is not true? A TEMP is required for most large programs. A DT&E is equivalent to Analytical, Type 1, and Type 2 testing. An OT&E is equivalent to Type 5 and Type 6 testing. An OT&E is equivalent to Type 3 and Type 4 testing.
34.	Which attribute about the Level 1 SSE-CMM Generic Practice is correct? Performed Informally Planned and Tracked Well Defined Continuously Improving
35.	Which of the following is not a true statement about good cost control? Cost control starts with the initiation of corrective action. Cost control requires good overall cost management. Cost control requires immediate initiation of corrective action. Cost control starts with the initial development of cost estimates for the program.
36.	Which statement about the SE-CMM is not correct? The SE-CMM describes the essential elements of an organization’s systems engineering process that must exist in order to ensure good systems engineering. The SE-CMM provides a reference to compare existing systems engineering practices against the essential systems engineering elements described in the model. The SE-CMM goal is to improve the system or product engineering process. The SE-CMM was created to define, improve, and assess security engineering capability.
37.	Which statement about system security testing and evaluation (ST&E) categories is correct? Type 1 testing is performed during the latter stages of the detail design and development phase. Type 2 testing is design evaluation conducted early in the system life cycle. Type 3 testing is performed during the latter stages of the detail design and development phase. Type 4 testing is conducted during the system operational use and life cycle support phase.
38.	Which choice is not an activity in the cost control process? Identifying potential suppliers Developing a functional cost data collection capability Developing the costs as estimated for each task Creating a procedure for cost evaluation
39.	Which choice does not describe a common outsourcing activity? Review of proposals Develop a functional cost reporting capability Contract negotiation Development of an RFP
40.	Which choice is not an accurate description of an activity level of the WBS? Level 1 may be used as the basis for the authorization of the program work. Program budgets are usually prepared at Level 1. Level 2 identifies the various projects that must be completed. Program schedules are generally prepared at Level 3.
41.	Which of the following is not a phase in the IDEAL model? Authorizing Learning Diagnosing Establishing
42.	Which choice best describes systems engineering, as defined in the SSE-CMM? An integrated composite of people, products, and processes that provides a capability to satisfy a need or objective The selective application of scientific and engineering efforts to integrate the efforts of all engineering disciplines and specialties into the total engineering effort A narrative description of the work required for a given project The contracting with one or more outside suppliers for the procurement and acquisition of materials and services
43.	Which of the following choices is not a benefit of the WBS? The WBS facilitates the initial allocation of budgets. The WBS facilitates the collection and reporting of costs. The system can easily be described through the logical breakout of its elements into work packages. The WBS integrates the efforts of all engineering disciplines and specialties into the total engineering effort.
44.	Which choice is not an element of the Statement of Work (SOW)? An identification of the input requirements from other tasks A description of specific results to be achieved Management of security awareness, training, and education programs A proposed schedule for delivery of the product
45.	Which of the following statements best describes the difference between a Type 1 testing and evaluation category and a Type 2 category? Type 1 testing is the evaluation of system components in the laboratory, designed to verify performance and physical characteristics. Type 2 testing is the evaluation of system components in the laboratory, designed to verify performance and physical characteristics. Type 1 testing establishes design evaluations conducted early in the system life cycle. Type 2 testing is conducted after initial system qualification and prior to the completion of the production or construction phase.
46.	Which choice has the outsourcing activities listed in their proper order? Review and evaluation of supplier proposals, supplier monitoring and control, development of a Request for Proposal (RFP), and selection of suppliers Development of a Request for Proposal (RFP), review and evaluation of supplier proposals, supplier monitoring and control, and selection of suppliers Development of a Request for Proposal (RFP), review and evaluation of supplier proposals, selection of suppliers, and supplier monitoring and control Review and evaluation of supplier proposals, selection of suppliers, development of a Request for Proposal (RFP), and supplier monitoring and control
47.	Which answer best describes a Statement of Work (SOW)? A narrative description of the work required for a given project An integrated composite of people, products, and processes that provides a capability to satisfy a need or objective The contracting with one or more outside suppliers for the procurement and acquisition of materials and services The development of a functional cost reporting capability
48.	Which statement about SSE-CMM Base Practices is correct? BPs are mandatory characteristics that must exist within an implemented security engineering process before an organization can claim satisfaction in a given PA. BPs are ordered in degrees of maturity and are grouped to form and distinguish among five levels of security engineering maturity. BPs are ordered in degrees of maturity and are grouped to form and distinguish among 22 levels of security engineering maturity. BPs are optional characteristics that must exist within an implemented security engineering process before an organization can claim satisfaction in a given PA.
49.	As per the SE-CMM, which definition of a system is incorrect? An interacting combination of elements that are viewed in relation to function A continuous cycle of evaluating the current status of an organization, making improvements, and repeating the cycle An assembly of things or parts forming a complex or unitary whole An integrated composite of people, products, and processes that provides a capability to satisfy a need or objective
50.	Which of the following choices best describes the purpose of the Learning phase of the IDEAL model? The Learning phase is the implementation phase and requires the greatest level of effort of all the phases, in terms of both resources and time. The Learning phase is both the final stage of the initial process improvement cycle and the initial phase of the next process improvement effort. In the Learning phase, it is imperative that an understanding of the organization’s current and desired future state of process maturity be established. In the Learning phase, a detailed plan of action based on the goals of the effort and the recommendations developed during the Diagnosing phase is developed.
51.	Which statement about the System Engineering Management Plan (SEMP) is not true? Development program planning and control is a SEMP element. The goal of SEMP is to establish a continuous cycle of evaluating the current status of the organization. The SEMP contains detailed statements of how the systems security engineering functions are to be carried out during development. The security systems engineering process is a SEMP element.
52.	Which choice has the correct order of activities in the IDEAL model? Learning, Initiating, Diagnosing, Establishing, and Acting Initiating, Learning, Diagnosing, Establishing, and Acting Learning, Diagnosing, Initiating, Establishing, and Acting Initiating, Diagnosing, Establishing, Acting, and Learning
53.	Which choice is an incorrect statement regarding the Systems Engineering Management Plan (SEMP)? The SEMP covers all management functions associated with the performance of security systems engineering activities for a given program. It starts as an outline and is updated as the security system development process goes on. It contains detailed statements of how the systems security engineering functions are to be carried out during development. The SEMP is a static document, intended to remain unchanged.
54.	Which choice best describes an outsourced supplier? A broad class of external organizations that provide products, components, materials, and/or services to a producer or prime contractor An interacting combination of elements that are viewed in relation to function An integrated composite of people, products, and processes that provides a capability to satisfy a need or objective Practices that indicate process management and institutionalization capability
55.	Which of the following statements best describes the main premise of process improvement? Major changes must be sponsored by senior management. The quality of services produced is a direct function of the quality of the associated development and maintenance processes. Focus on fixing the process, not assigning blame. All suppliers must be security vetted prior to contracting.
56.	What is the main purpose of the Work Breakdown Structure (WBS)? It creates a hierarchical tree of work packages. It may be a contractual requirement in competitive bid system developments. It ensures the authorization for the program work. It ensures that all essential tasks are properly defined, assigned, scheduled, and controlled.
57.	Which choice is not an activity in the Development Program Planning and Control element of the SEMP? System Test and Evaluation Strategy Scheduling and Cost Estimation Technical Performance Measurement Statement of Work
58.	At what point in the project is the Work Breakdown Structure (WBS) usually created? After the generation of the SOW and the identification of the organizational structure After the development of a functional cost data collection and reporting capability After the costs for each task are estimated After the development of an RFP but before the identification of the organizational structure
59.	Which choice accurately lists the five levels of security engineering maturity as defined by the SSE-CMM? Planned and Tracked, Well Defined, Performed Informally, Quantitatively Controlled, and Continuously Improving Planned and Tracked, Performed Informally, Well Defined, Quantitatively Controlled, and Continuously Improving Performed Informally, Planned and Tracked, Well Defined, Quantitatively Controlled, and Continuously Improving Performed Informally, Planned and Tracked, Quantitatively Controlled, Well Defined, and Continuously Improving
60.	Which choice has the correct order of activities in the security system design testing process? Acquisition, Testing, Analysis, Planning, and Correction Acquisition, Planning, Testing, Analysis, and Correction Planning, Analysis, Testing, Acquisition, and Correction Planning, Acquisition, Testing, Analysis, and Correction Certification and Accreditation See Chapter 11 Assessment Questions. U.S. Government Information Assurance Regulations
61.	Techniques and concerns that are normally addressed by management in the organization’s computer security program are defined in NIST SP 800-12 as: Administrative controls Management controls Operational controls Technical controls
62.	The National Research Council publication Computers at Risk defines an element of computer security as a “requirement intended to assure that systems work properly and service is not denied to authorized users.” Which one of the following elements best fits this definition? Availability Assurance Integrity Authentication
63.	NSTISSI Publication No. 4009, “National Information Systems Security (INFOSEC) Glossary,” defines the term assurance as: Requirement that information and programs are changed only in a specified and authorized manner Measure designed to establish the validity of a transmission, message, or originator, or a means of verifying an individual’s authorization to receive specific categories of information Measure of confidence that the security features, practices, procedures, and architecture of an IS accurately mediate and enforce the security policy Requirement that private or confidential information not be disclosed to unauthorized individuals
64.	The “National Information Systems Security (INFOSEC) Glossary” defines an information system security term as a “formal determination by an authorized adjudicative office that an individual is authorized access, on a need to know basis, to a specific level of collateral classified information.” This definition refers to which one of the following terms? Sensitivity of information Classification of information Clearance Compartmentalization
65.	In NSTISSI Publication No. 4009, what term is defined as a “document detailing the method, act, process, or effect of using an information system (IS)”? QUADRANT Concept of Operations (CONOPS) Evaluation Assurance Level (EAL) Information Assurance (IA) architecture
66.	Which one of the following definitions best describes the National Information Assurance Partnership (NIAP) according to NSTISSI Publication No. 4009? Nationwide interconnection of communications networks, computers, databases, and consumer electronics that makes vast amounts of information available to users Worldwide interconnections of the information systems of all countries, international and multinational organizations, and international commercial communications Joint initiative between NSA and NIST responsible for security testing needs of both IT consumers and producers, promoting the development of technically sound security requirements for IT products First level of the PKI Certification Management Authority that approves the security policy of each Policy Certification Authority (PCA)
67.	TEMPEST refers to which one of the following definitions? Property whereby the security level of an object cannot change while the object is being processed by an IS Investigation, study, and control of compromising emanations from IS equipment Program established for a specific class of classified information that imposes safeguarding and access requirements that exceed those normally required for information at the same classified level Unclassified cryptographic equipment
68.	Executive Order (E.O.) 13231, issued on October 16, 2001, renamed the National Security Telecommunications and Information Systems Security Committee (NSTISSC) as which one of the following committees? Committee for Information Systems Security (CISS) Committee on National Security Systems (CNSS) Committee on National Infrastructure Protection (CNIP) Committee for the Protection of National Information Systems (CPNIS)
69.	In addressing the security of systems with national security information, E.O. 13231 assigned the responsibilities of developing government-wide policies and overseeing the implementation of governmentwide policies, procedures, standards, and guidelines to the: U.S. Secretary of Defense and the Director of the FBI FBI and the Director of Central Intelligence NIST and the U.S. Secretary of Defense U.S. Secretary of Defense and the Director of Central Intelligence
70.	Which one of the following characteristics is not associated with the definition of a national security system? Contains classified information Involved in industrial commerce Supports intelligence activities Involved with the command and control of military forces
71.	In 2002, the U.S. Congress enacted the E-Government Act (Public Law 107-347). Title III of the E-Government Act was written to provide for a number of protections of Federal information systems, including to “provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support Federal operations and assets.” Title III of the E-Government Act is also known as the: Computer Security Act (CSA) Computer Fraud and Abuse Act (CFAA) Federal Information Security Management Act (FISMA) Cyber Security Enhancement Act
72.	FISMA assigned which one of the following entities the responsibility of overseeing the security policies and practices of U.S. government agencies? The FBI The U.S. Secretary of Defense The Director of the Office of Management and Budget (OMB) The Director of Central Intelligence
73.	Which information system security–related Act requires government agencies to perform periodic assessments of risk, develop policies and procedures that are based on risk assessments, conduct security awareness training, perform periodic testing and evaluation of the effectiveness of information security policies, and implement procedures for detecting, reporting, and responding to security incidents? Computer Security Act (CSA) Federal Information Security Management Act (FISMA) Computer Fraud and Abuse Act (CFAA) Cyber Security Enhancement Act
74.	FISMA charged which one of the following entities to develop information system security standards and guidelines for federal agencies? FBI DoD NSA NIST
75.	The general formula for categorization of an information type developed in FIPS Publication 199, “Standards for Security Categorization of Federal Information and Information Systems,” is which one of the following? SC information type = {(confidentiality, risk), (integrity, risk), (availability, risk)} SC information type = {(confidentiality, impact), (integrity, impact), (availability, impact)} SC information type = {(assurance, impact), (integrity, impact), (authentication, impact)} SC information type = {(confidentiality, controls), (integrity, controls), (availability, controls)}
76.	Circular A-130 directs that an oversight function should be performed consisting of the use of information technology planning reviews, fiscal budget reviews, information collection budget reviews, management reviews, and such other measures as deemed necessary to evaluate the adequacy and efficiency of each agency’s information resources management and compliance with the circular. Which one of the following individuals does the circular designate as being responsible for this oversight function? The Secretary of Commerce The Director of the Office of Management and Budget The U.S. Secretary of Defense The Director of NSA
77.	The National Computer Security Center Publication NCSC-TG-004-88 includes a definition that refers to the characteristic of a system that “performs its intended function in an unimpaired manner, free from deliberate, inadvertent, or unauthorized manipulation of the system.” This characteristic defines which one of the following terms? Data integrity System integrity Enterprise integrity Risk integrity
78.	Which one of the following terms best describes a secure telecommunications or associated cryptographic component that is unclassified but governed by a special set of control requirements, as defined in NSTISSI Publication 4009? Controlled cryptographic item (CCI) assembly Controlled cryptographic item (CCI) component Controlled cryptographic item (CCI) Crypto-ignition key (CIK)
79.	What is a definable perimeter encompassing all hardware, firmware, and software components performing critical COMSEC functions, such as key generation and key handling and storage? COMSEC area COMSEC compartment COMSEC partition COMSEC boundary
80.	What process involves the five steps of identification of critical information, analysis of threats, analysis of vulnerabilities, assessment of risks, and application of appropriate countermeasures? Operations security Application security Administrative security Management security
81.	Information that has been determined pursuant to Executive Order 12958 or any predecessor order to require protection against unauthorized disclosures is known as: Protected information (PI) National security information (NSI) Personally identifiable information (PII) Secure information (SI)
82.	An area that, when staffed, must be occupied by two or more appropriately cleared individuals who remain within sight of each other is referred to as which one of the following terms? No-lone zone Restricted area Protected occupancy zone Cleared area
83.	According to NSTISSI Publication 4009, the process of identifying and applying countermeasures commensurate with the value of the assets protected based on a risk assessment is called a: Vulnerability assessment Continuity planning Risk management Risk control
84.	In the context of information systems security, the abbreviation ST&E stands for which one of the following terms? Security training and evaluation Security test and evaluation Security test and engineering Sensitivity test and evaluation
85.	Which one of the following designations refers to a product that is a classified or controlled cryptographic item endorsed by the NSA for securing classified and sensitive U.S. government information when appropriately keyed? Cleared product Type 3 product Type 1 product Type 2 product
86.	Which one of the following items is not one of the responsibilities of the Committee on National Security Systems (CNSS) for the security of national security systems? Providing a forum for the discussion of policy issues Setting national policy Providing operational procedures, direction, and guidance. Requiring agencies to identify and provide information security protections commensurate with the risk and magnitude of the harm to information or information systems of government agencies
87.	FISMA, Title III of the E-Government Act of 2002, reserves the responsibility for standards associated with the national defense establishment to which of the following entities? DoD and NSA DoD and CIA CIA and NSA CIA and NIST
88.	FIPS Publication 199, “Standards for Security Characterization of Federal Information and Information Systems, NIST Pre-Publication Final Draft,” December 2003, characterizes three levels of potential impact on organizations or individuals based on the objectives of confidentiality, integrity, and availability. What is the level of impact specified in Publication 199 for the following description of integrity: “The unauthorized modification or destruction of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals”? High Moderate Low Severe
89.	Referring to question 88, the following impact description refers to which one of the three security objectives and which corresponding level of impact: “The disruption of access to or use of information or an information system could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals”? Confidentiality - Low Availability - Moderate Availability - Low Availability - High
90.	DoD Directive 8500.1, “Information Assurance (IA),” October 4, 2002, specifies a defense-in-depth approach that integrates the capabilities of which set of the following entities? Personnel, operations, and technology Personnel, research and development, and technology Operations, resources, and technology Personnel, operations, and resources

Answers

1.	Answer: b The requirements phase is not one of the five system life cycle planning phases. The other two phases of the system life cycle are the Development/Acquisition phase and the Operations phase.
2.	Answer: a Answers b, c, and d are distracters comprising components of the SDLC and the Acquisition Cycle.
3.	Answer: d Answers a, b, and c are distracters.
4.	Answer: d A program policy is used to create and define a computer security program, an issue specific policy addresses specific areas and issues, and a system specific policy focuses on decisions made by management.
5.	Answer: a Answers b, c, and d are distracters.
6.	Answer: c
7.	Answer: b Answer a refers to the Initiation phase, answer c refers to the Operation/Maintenance phase, and answer d refers to the Disposal phase.
8.	Answer: a Answers b, c, and d are distracters.
9.	Answer: d Delineating accreditation boundaries is a subset of system characterization (answer a).
10.	Answer: a Answer b describes the principles and practices found in NIST SP 800-14. Answers c and d are distracters.
11.	Answer: c Obtaining accreditation is not one of the SE process activities. The other SE process activities are to design system architecture, develop detailed design, and implement system.
12.	Answer: b
13.	Answer: d This task is performed under the Develop Detailed Security Design activity.
14.	Answer: d Answers a through c are distracters.
15.	Answer: a Functional decomposition is part of the Design System Security Architecture activity of the ISSE process.
16.	Answer: b
17.	Answer: c
18.	Answer: a Security certification is performed in the Implementation phase. Validation (answer b) is not a phase of the SDLC. Answers c and d are additional phases of the SDLC. This activity has tasks that should be performed throughout the ISSE process.
19.	Answer: d Answers A, B, and C are outputs of the Certification and Accreditation process.
20.	Answer: d Defense of the enclave boundary is addressed in the Defense-In-Depth strategy.
21.	Answer: a
22.	Answer: a Security categorization, performed in the Initiation phase, defines low, moderate, or high levels of potential impact on organizations in the event of a security breach. Answers b and c are other phases of the SDLC. Answer d is not a phase of the SDLC.
23.	Answer: d Answer d is a distracter. The other two types of attacks, in addition to passive attacks (answer a), active attacks (answer b), and close-in attacks (answer c), are insider and distribution attacks.
24.	Answer: a Preliminary risk assessment is performed in the Initiation phase of the SDLC. Additional activities under the Acquisition/Development phase of the SDLC are risk assessment, assurance requirements analysis security, security planning, and security control development.
25.	Answer: d
26.	Answer: b Additional activities under the Acquisition/Development phase include requirements analysis, alternatives analysis, and a software conversion study.
27.	Answer: b The spiral model depicts the acquisition management process as a set of phases and decision points in a circular representation. The other answers are distracters.
28.	Answer: c Answer a is a threat source, answer b defines risk, and answer d is the definition of vulnerability.
29.	Answer: a
30.	Answer: b Technical Management
31.	Answer: c The SSE-CMM defines two dimensions that are used to measure the capability of an organization to perform specific activities, the domain dimension and the capability dimension. The domain dimension consists of all the practices that collectively define security engineering. The capability dimension represents practices that indicate process management and institutionalization capability.
32.	Answer: b Level 5, “Continuously Improving,” is the highest level. A statement characterizing this level would be: “A culture of continuous improvement requires a foundation of sound management practice, defined processes, and measurable goals.”
33.	Answer: c In the Defense sector, a TEMP is required for most large programs and includes the planning and implementation of procedures for the Development Test and Evaluation (DT&E) and Operational Test and Evaluation (OT&E). DT&E basically equates to the Analytical, Type 1, and Type 2 testing, and OT&E is equivalent to Type 3 and Type 4 testing.
34.	Answer: a The lowest level, Level 1, “Performed Informally,” focuses on whether an organization or project performs a process that incorporates the BPs. The attribute of this level simply requires that the BPs are performed.
35.	Answer: a Cost control starts with the initial development of cost estimates for the program and continues with the functions of cost, monitoring, and the collection of cost data, the analysis of the data, and the immediate initiation of corrective action. Cost control requires good overall cost management, including: Cost estimating Cost accounting Cost monitoring Cost analysis and reporting Control functions
36.	Answer: d The SSE-CMM, not the SE-CMM, goal is to define, improve, and assess security engineering capability. The SE-CMM goal is to improve the system or product engineering process. The SE-CMM describes the essential elements of an organization’s systems engineering process that must exist in order to ensure good systems engineering. It also provides a reference to compare existing systems engineering practices against the essential systems engineering elements described in the model.
37.	Answer: d Testing and evaluation processes often involves several stages of testing categories or phases, such as: Analytical - Design evaluations conducted early in the system life cycle using computerized techniques such as CAD, CAM, CALS, simulation, rapid prototyping, and other related approaches Type 1 testing - The evaluation of system components in the laboratory using bench test models and service test models, designed to verify performance and physical characteristics Type 2 testing - Testing performed during the latter stages of the detail design and development phase, when preproduction prototype equipment and software are available Type 3 testing - Tests conducted after initial system qualification and prior to the completion of the production or construction phase, the first time that all elements of the system are operated and evaluated on an integrated basis Type 4 testing - Testing conducted during the system operational use and life-cycle support phase, intended to gain further knowledge of the system in the user environment
38.	Answer: a Answer a is an activity of outsourcing. The cost control process includes: Define the elements of work, as extracted from the SOW Integrate the tasks defined in the WBS Develop the costs as estimated for each task Develop a functional cost data collection and reporting capability Develop a procedure for evaluation and quick corrective action
39.	Answer: b Developing a functional cost reporting capability is a function of Cost Control. The order of activities for the outsourcing process are: Identification of Potential Suppliers Development of a Request for Proposal (RFP) Review and Evaluation of Supplier Proposals Selection of Suppliers and Contract Negotiation Supplier Monitoring and Control
40.	Answer: b The WBS structure generally includes three levels of activity: Level 1 identifies the entire program scope of work to be produced and delivered. Level 1 may be used as the basis for the authorization for the program work. Level 2 identifies the various projects, or categories of activity, that must be completed in response to program requirements. Program budgets are usually prepared at this level. Level 3 identifies the activities, functions, major tasks, and/or components of the system that are directly subordinate to the Level 2 items. Program schedules are generally prepared at this level.
41.	Answer: a The five phases of the IDEAL model are: Initiating - Laying the groundwork for a successful improvement effort Diagnosing - Determining where you are relative to where you want to be Establishing - Planning the specifics of how you will reach your destination Acting - Doing the work according to the plan Learning - Learning from the experience and improving your ability
42.	Answer: b The definition of systems engineering on which the SE-CMM is based is defined as the selective application of scientific and engineering efforts to: Transform an operational need into a description of the system configuration that best satisfies the operational need according to the measures of effectiveness Integrate related technical parameters and ensure compatibility of all physical, functional, and technical program interfaces in a manner that optimizes the total system definition and design Integrate the efforts of all engineering disciplines and specialties into the total engineering effort Answer a describes a system, answer c describes the SOW, and answer d describes outsourcing.
43.	Answer: d The WBS provides many benefits, such as: It provides for the reporting of system technical performance measures (TPMs). The entire security system can be easily defined by the breakout of its elements in to discrete work packages. The WBS aids in linking objectives and activities with available resources. The WBS facilitates budgeting and cost reporting. Responsibility assignments can be readily identified through the assignment of tasks. The WBS provides a greater probability that every activity will be accounted for. Answer d describes a benefit of systems engineering.
44.	Answer: c The Statement of Work (SOW) is a narrative description of the work required for a given project. It includes: Summary statement of the tasks to be accomplished Identification of the input requirements from other tasks, including tasks accomplished by the customer and supplier References to applicable specifications, standards, procedures, and related documentation Description of specific results to be achieved and proposed schedule of delivery Answer c is an example of a SSE-CMM Best Practice.
45.	Answer: a Testing and evaluation processes often involve several stages of testing categories or phases, such as: Analytical - Design evaluations conducted early in the system life cycle using computerized techniques such as CAD, CAM, CALS, simulation, rapid prototyping, and other related approaches Type 1 testing - The evaluation of system components in the laboratory using bench test models and service test models, designed to verify performance and physical characteristics Type 2 testing - Testing performed during the latter stages of the detail design and development phase, when preproduction prototype equipment and software are available Type 3 testing - Tests conducted after initial system qualification and prior to the completion of the production or construction phase, the first time that all elements of the system are operated and evaluated on an integrated basis Type 4 testing - Testing conducted during the system operational use and life-cycle support phase, intended to gain further knowledge of the system in the user environment
46.	Answer: c
47.	Answer: a The Statement of Work is a narrative description of the work required for a given project. Answer b describes a “system” as defined by the SECMM, answer c describes outsourcing, and answer d describes a function of Cost Control.
48.	Answer: a BPs are mandatory characteristics that must exist within an implemented security engineering process before an organization can claim satisfaction in a given PA. The GPs are ordered in degrees of maturity and are grouped to form and distinguish among five levels of security engineering maturity. The other answers are distracters.
49.	Answer: b In the SE-CMM, a system is defined as: An integrated composite of people, products, and processes that provide a capability to satisfy a need or objective An assembly of things or parts forming a complex or unitary whole; a collection of components organized to accomplish a specific function or set of functions An interacting combination of elements that are viewed in relation to function Answer b describes process improvement.
50.	Answer: b The Learning phase is both the final stage of the initial process improvement cycle and the initial phase of the next process improvement effort. Based on the analysis of the improvement effort itself, the lessons learned are translated into recommendations for improving subsequent improvement efforts. Answer a describes the Acting phase, answer c describes the Diagnosing phase, and answer d describes the Establishing phase.
51.	Answer: b The SEMP contains detailed statements of how the systems security engineering functions are to be carried out during development. Two elements of the SEMP are: Development program planning and control Security systems engineering process Answer b describes a goal of process improvement.
52.	Answer: d The order of activities in the IDEAL model is Initiating, Diagnosing, Establishing, Acting, and Learning.
53.	Answer: d The SEMP is intended to be a dynamic document. It starts as an outline and is updated as the security system development process goes on, and contains detailed statements of how the systems security engineering functions are to be carried out during development. The SEMP covers all management functions associated with the performance of security systems engineering activities for a given program.
54.	Answer: a The term suppliers is defined here as a broad class of external organizations that provide products, components, materials, and/or services to a producer or prime contractor. Answers b and c describe a system, and answer d is a distracter.
55.	Answer: b The basic premise of process improvement is that the quality of services produced is a direct function of the quality of the associated development and maintenance processes. Answers a and c describe knowledge or assumptions required to implement a successful security engineering process improvement activity, but not the main premise. Answer d is a distracter.
56.	Answer: d The Work Breakdown Structure (WBS) is an important technique to ensure that all essential tasks are properly defined, assigned, scheduled, and controlled. It contains a hierarchical structure of the tasks to be accomplished during the project. The WBS may be a contractual requirement in competitive bid system developments. Answers a, c, and d are attributes of the WBS, not its main purpose.
57.	Answer: a Development Program Planning and Control describes the security systems security engineering tasks that must be implemented to manage the development phase of the security program, including: Statement of Work Organizational Structure Scheduling and Cost Estimation Technical Performance Measurement Answer a is an activity of the Security Systems Engineering Process element of the SEMP.
58.	Answer: a After the generation of the SOW and the identification of the organizational structure, one of the initial steps in program planning is the development of the Work Breakdown Structure (WBS). The other answers are distracters.
59.	Answer: c The five levels are: Level 1, Performed Informally; Level 2, Planned and Tracked; Level 3, Well Defined; Level 4, Quantitatively Controlled; and Level 5, Continuously Improving.
60.	Answer: d The correct order of activities in the security system design testing process is Planning, Acquisition, Testing, Analysis, and Correction. Certification and Accreditation See Chapter 11 Assessment Questions. U.S. Government Information Assurance Regulations
61.	Answer: b. Answer a is a distracter. Operational controls (answer c) are security controls that are usually implemented by people instead of systems, and technical controls (answer d) are security controls that the computer system executes.
62.	Answer: a
63.	Answer: c Answer a is a definition of data integrity, answer b defines authentication, and answer d describes confidentiality.
64.	Answer: c Answers a and b are distracters. Answer d refers to a “nonhierarchical grouping of sensitive information used to control access to data more finely than with hierarchical security classification alone,” as defined in NSTISSI Publication No. 4009.
65.	Answer: b, Concept of Operations Answer a, QUADRANT, refers to technology that provides tamper-proof protection to cryptographic equipment. Answer c defines “a set of assurance requirements that represent a point on the Common Criteria predefined assurance scale,” and answer d is a “framework that assigns and portrays IA roles and behavior among all IT assets, and prescribes rules for interaction and connection.”
66.	Answer: c Answer a refers to the National Information Infrastructure (NII), answer b defines the Global Information Infrastructure (GII), and answer d defines a Policy Approving Authority (PAA).
67.	Answer: b Answer a refers to the concept of Tranquility, answer c refers to a Special Access Program (SAP), and answer d is distracter.
68.	Answer: b The other answers are distracters.
69.	Answer: d
70.	Answer: b Additional characteristics of a national information system include employing cryptographic activities related to national security, associated with equipment that is an integral part of a weapon or weapons system(s), and critical to the direct fulfillment of military or intelligence missions.
71.	Answer: c
72.	Answer: c The Director of the Office of Management and Budget (OMB) has the responsibility of overseeing government agency security policies and practices. Standards associated with national defense are still the responsibility of the DoD and NSA.
73.	Answer: b
74.	Answer: d
75.	Answer: b The other answers are distracters.
76.	Answer: b
77.	Answer: b
78.	Answer: c Answer a refers to a device embodying a communications security (COMSEC) design that NSA has approved as a CCI. Answer b is part of a CCI that does not perform the entire COMSEC function but depends upon the host equipment, or assembly, to complete and operate the COMSEC function. Answer d is a device or electronic key used to unlock the secure mode of crypto-equipment.
79.	Answer: d Answers a, b, and c are distracters.
80.	Answer: a The other answers are distracters.
81.	Answer: b Answers a and d are distracters. PII (answer c) is usually associated with privacy. An example of PII is a person’s health care information.
82.	Answer: a Answers b, c, and d are distracters.
83.	Answer: c
84.	Answer: b Answers a, c, and d are distracters.
85.	Answer: c Answers a and b are distracters. Answer d, a Type 2 product, defines unclassified cryptographic equipment, assembly, or component endorsed by the NSA for use in national security systems as defined in Title 40 U.S.C. § 1452.
86.	Answer: d This responsibility is assigned to the OMB.
87.	Answer: a
88.	Answer: b
89.	Answer: c
90.	Answer: a Answers b, c, and d are distracters.

Appendix E

1.	Which one of the following is not one of the five system life cycle planning phases as defined in NIST SP 800-14? Initiation phase Requirements phase Implementation phase Disposal phase
2.	The IATF document 3.1 stresses that information assurance relies on three critical components. Which one of the following answers correctly lists these components? People, documentation, technology People, Defense in Depth, technology People, evaluation, certification People, operations, technology
3.	Risk management, as defined in NIST SP 800-30, comprises which three processes? Risk assessment, risk mitigation, and evaluation and assessment Risk identification, risk mitigation, and evaluation and assessment Risk assessment, risk impacts, and risk mitigation Risk assessment, risk mitigation, and risk identification
4.	In the system development life cycle, SDLC, or system life cycle as it is sometimes called, in which one of the of the five phases are the system security features configured, enabled, tested, and verified? Operation/maintenance Development/acquisition Implementation Initiation
5.	Which one of he following activities is performed in the Development/Acquisition phase of the SDLC? The scope of the IT system is documented. The IT system is developed, programmed, or otherwise constructed. The system performs its function. Disposition of information, hardware, or software.
6.	In NIST SP 800-30, risk is defined as a function of which set of the following items? Threat likelihood, vulnerabilities, and impact Threat likelihood, mission, and impact Vulnerabilities, mission and impact Threat likelihood, sensitivity, and impact
7.	The risk assessment methodology described in NIST SP 800-30 comprises nine primary steps. Which one of the following is not one of these steps? System characterization Control analysis Impact analysis Accreditation boundaries
8.	Which one of the following items is not one of the activities of the generic systems engineering (SE) process? Discover needs Define system requirements Obtain accreditation Assess effectiveness
9.	The elements of Discover Information Protection Needs, Develop Detailed Security Design, and Assess Information Protection Effectiveness are part of what process? The systems engineering (SE) process The information systems security engineering process (ISSE) The system development life cycle (SDLC) The risk management process
10.	In the ISSE process, information domains are defined under the Discover Information Protection Needs process. Which one of the following tasks is not associated with the information domain? Identify the members of the domain List the information entities that are under control in the domain Identify the applicable privileges, roles, rules, and responsibilities of the users in the domain Map security mechanisms to security design elements in the domain
11.	As part of the Define System Security Requirements activity of the ISSE process, the information systems security engineer identifies and selects a solution set that can satisfy the requirements of the IPP. Which one of the following elements is not a component of the solution set? Functional decomposition Preliminary security concept of operations (CONOPS) System context System requirements
12.	The information systems security engineer’s tasks of cataloging candidate commercial off-the-shelf (COTS) products, government off-the-shelf (GOTS) products, and custom security products are performed in which one of the following ISSE process activities? Define System Security Requirements Develop Detailed Security Design Implement System Security Design System Security Architecture
13.	Which ISSE activity includes conducting unit testing of components, integration testing, and developing installation and operational procedures? Assess Information Protection Effectiveness Develop Detailed Security Design Implement System Security Design System Security Architecture
14.	Security certification is performed in which phase of the SDLC? Implementation phase Validation phase Development/Acquisition phase Operations/Maintenance phase
15.	The certification and accreditation process receives inputs from the ISSE process. These inputs are which one of the following items? Certification documentation Certification recommendations Accreditation decision Evidence and documentation
16.	Security categorization is part of which phase of the SDLC? Initiation Acquisition/Development Implementation Requirements
17.	Which one of the following items is not an activity under the Acquisition/Development phase of the SDLC? Preliminary risk assessment Security functional requirements analysis Cost considerations and reporting Developmental security evaluation
18.	According to NIST SP 800-64, which phase of the SDLC includes the activities of functional statement of need, market research, cost-benefit analysis, and a cost analysis? Initiation Acquisition/Development Implementation Operations/Maintenance
19.	In NIST SP 800-30, a threat is defined as which one of the following items? Intent and method targeted at the intentional exploit of a vulnerability The likelihood that a given threat source will exercise a particular potential vulnerability, and the resulting impact of that adverse event on the organization The potential for a threat source to exercise a specific vulnerability A flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised and result in a security breach or a violation of the system’s security policy
20.	Questionnaires, on-site interviews, review of documents, and automated scanning tools are primarily used to gather information for which one of the following steps of the risk assessment process? System characterization Risk determination Vulnerability identification Control analysis
21.	In performing an impact analysis as part of the risk assessment process, three important factors should be considered in calculating the negative impact. Which one of the following items is not one of these factors? The sensitivity of the system and its data The management of the system The mission of the system The criticality of the system, determined by its value and the value of the data to the organization
22.	Which choice would not be considered an operations management task related to system maintenance? Approving, controlling, and monitoring remotely executed maintenance and diagnostic activities Scheduling, performing, and documenting routine preventative and regular maintenance on the components of the IS Prioritizing, evaluating, and implementing the controls that are an output of the risk assessment process Maintaining a list of personnel authorized to perform maintenance on the information system
23.	Which task is not a common incident reporting task? Tracking information system security incidents on an ongoing basis Employing a formal sanctions process for personnel failing to comply with established information security policies and procedures Promptly reporting incident information to appropriate authorities Providing an incident support advice and assistance to users of the information system
24.	Which choice accurately describes a task of operations security? Terminating information system access to terminated employees Incorporating security in system development models and configuration management Integrating application and network security controls Developing processes to identify system threats and vulnerabilities
25.	Which choice would not be considered an element of managing operations security compliance? Developing continuity of operations plans Managing incidents and security violations Developing help desk and maintenance programs Ensuring the availability and integrity of system processes

Answers

1.	Answer: b The requirements phase is not one of the five system life cycle planning phases. The other two phases of the system life cycle are the Development/Acquisition phase and the Operations phase.
2.	Answer: d Answers a, b, and c are distracters.
3.	Answer: a Answers b, c, and d are distracters.
4.	Answer: c
5.	Answer: b Answer a refers to the Initiation phase; answer c refers to the Operation/Maintenance phase; and answer d refers to the Disposal phase.
6.	Answer: a Answers b, c, and d are distracters.
7.	Answer: d Delineating accreditation boundaries is a subset of answer a, system characterization.
8.	Answer: c Obtaining accreditation is not one of the SE process activities. The other SE process activities are to design system architecture, to develop detailed design, and to implement the system.
9.	Answer: b
10.	Answer: d
11.	Answer: a Functional decomposition is part of the Design System Security Architecture activity of the ISSE process.
12.	Answer: b
13.	Answer: c
14.	Answer: a Answer b, Validation, is not a phase of the SDLC. Answers c and d are additional phases of the SDLC.
15.	Answer: d Answers a, b, and c are outputs of the Certification and Accreditation process.
16.	Answer: a Security categorization defines low, moderate, or high levels of potential impact on organizations as a result of a security breach. Answers b and c are other phases of the SDLC. Answer d is not a phase of the SDLC.
17.	Answer: a This activity is performed in the initiation phase of the SDLC. Additional activities under the acquisition/development phase of the SDLC are risk assessment, assurance requirements analysis security, security planning, and security control development.
18.	Answer: b Additional activities under this phase include requirements analysis, alternatives analysis, and a software conversion study.
19.	Answer: c Answer a is a threat source, answer b defines risk, and answer d is the definition of vulnerability.
20.	Answer: a
21.	Answer: b
22.	Answer: c
23.	Answer: b
24.	Answer: a
25.	Answer: a

Appendix C

Appendix D

Appendix E

Категории