WGU C836 OA STUDY GUIDE (OVERLY INFORMATIVE)
FREQUENTLY TESTED ACTUAL EXAM QUESTIONS
WITH CORRECT ANSWERS
Question 1.
Something you do
ANSWER
An authentication factor indicating action, such as gestures on a touch screen.
Question 2.
Insecure Protocols
ANSWER
i. Secure Shell (SSH)
ii. File Transfer Protocols (FTP)
iii. Post Office Protocol (POP)
Question 3.
Multilevel Access Control
ANSWER
An access control model that includes many tiers of security and is used extensively by military
and government organizations and those that handle data of a very sensitive nature
Question 4.
Tcpdump
ANSWER
This command-line packet sniffing tool runs on Linux and UNIX operating systems
,Question 5.
Haas's Laws of Operation Security
ANSWER
First - "If you don't know the threat, how do you know what to protect?" -- develop an
awareness of both the actual and potential threats
Second - "If you don't know what to protect, how do you know you are protecting it?" --
evaluate our information assets and determine what exactly we might consider to be our
critical information. Same as identification of critical information in SecOpt Process #1
Third - "If you are not protecting it (the information), ... THE DRAGON WINS!" -- necessity of the
operations security process
Question 6.
Business Continuity Planning (BCP)
ANSWER
The plans we put in place to ensure that critical business functions can continue operations
through the state of emergency.
Question 7.
Confidentiality
ANSWER
Refers to our ability to protect our data from those who are not authorized to view it.
Confidentiality can be compromised by the loss of a laptop containing data, a person looking
over our shoulder while we type a password, an e-mail attachment being sent to the wrong
person, an attacker penetrating our systems, or similar issues.
Question 8.
Authorization Attacks
ANSWER
An attack that exploit the vulnerability of client-side authentication.
,Question 9.
Secure Protocols
ANSWER
SFTP
Question 10.
Competitive Intelligence
ANSWER
The process of intelligence gathering and analysis to support business decisions.
Question 11.
Fuzzers
ANSWER
Work by bombarding our applications with all manner of data and inputs from a wide variety of
sources, in the hope that we can cause the application to fail or to perform in unexpected ways.
Question 12.
RAID
ANSWER
Data storage virtualization technology that combines multiple physical disk drive components
into a single logical unit for the purposes of data redundancy, performance improvement, or
both
Question 13.
Biometric: Collectability
ANSWER
How easy it is to acquire a characteristic with which we can later authenticate a user
Question 14.
Deep Packet Inspection
ANSWER
Analyzing the actual content of the traffic that is flowing through them.
, Question 15.
network intrusion detection system (NIDS)
ANSWER
A type of IDS that attempts to detect malicious network activities—for example, port scans and
DoS attacks—by constantly monitoring network traffic.
Anti-threat software is installed only at specific points such as servers that interface between
the outside environment and the network segment to be protected.
Question 16.
Federal Information Security Management Act or Federal Information Security Modernization Act
(FISMA)
ANSWER
Ensures the protection of information, operations, and assets in the federal government.
Requires each federal agency to develop, document, and implement an information security
program to protect its information and information systems. Annual reviews of these
programs are required to maintain compliance and keep security risks to an acceptable level.
Question 17.
Block Cipher
ANSWER
Takes a predetermined number of bits, known as a block, in the plaintext message and
encrypts that block
Question 18.
Risk Management Process
ANSWER
1. Identify Asset
2. Identify Threats
3. Assess Vulnerabilities
4. Assess Risk
5. Mitigate Risk
FREQUENTLY TESTED ACTUAL EXAM QUESTIONS
WITH CORRECT ANSWERS
Question 1.
Something you do
ANSWER
An authentication factor indicating action, such as gestures on a touch screen.
Question 2.
Insecure Protocols
ANSWER
i. Secure Shell (SSH)
ii. File Transfer Protocols (FTP)
iii. Post Office Protocol (POP)
Question 3.
Multilevel Access Control
ANSWER
An access control model that includes many tiers of security and is used extensively by military
and government organizations and those that handle data of a very sensitive nature
Question 4.
Tcpdump
ANSWER
This command-line packet sniffing tool runs on Linux and UNIX operating systems
,Question 5.
Haas's Laws of Operation Security
ANSWER
First - "If you don't know the threat, how do you know what to protect?" -- develop an
awareness of both the actual and potential threats
Second - "If you don't know what to protect, how do you know you are protecting it?" --
evaluate our information assets and determine what exactly we might consider to be our
critical information. Same as identification of critical information in SecOpt Process #1
Third - "If you are not protecting it (the information), ... THE DRAGON WINS!" -- necessity of the
operations security process
Question 6.
Business Continuity Planning (BCP)
ANSWER
The plans we put in place to ensure that critical business functions can continue operations
through the state of emergency.
Question 7.
Confidentiality
ANSWER
Refers to our ability to protect our data from those who are not authorized to view it.
Confidentiality can be compromised by the loss of a laptop containing data, a person looking
over our shoulder while we type a password, an e-mail attachment being sent to the wrong
person, an attacker penetrating our systems, or similar issues.
Question 8.
Authorization Attacks
ANSWER
An attack that exploit the vulnerability of client-side authentication.
,Question 9.
Secure Protocols
ANSWER
SFTP
Question 10.
Competitive Intelligence
ANSWER
The process of intelligence gathering and analysis to support business decisions.
Question 11.
Fuzzers
ANSWER
Work by bombarding our applications with all manner of data and inputs from a wide variety of
sources, in the hope that we can cause the application to fail or to perform in unexpected ways.
Question 12.
RAID
ANSWER
Data storage virtualization technology that combines multiple physical disk drive components
into a single logical unit for the purposes of data redundancy, performance improvement, or
both
Question 13.
Biometric: Collectability
ANSWER
How easy it is to acquire a characteristic with which we can later authenticate a user
Question 14.
Deep Packet Inspection
ANSWER
Analyzing the actual content of the traffic that is flowing through them.
, Question 15.
network intrusion detection system (NIDS)
ANSWER
A type of IDS that attempts to detect malicious network activities—for example, port scans and
DoS attacks—by constantly monitoring network traffic.
Anti-threat software is installed only at specific points such as servers that interface between
the outside environment and the network segment to be protected.
Question 16.
Federal Information Security Management Act or Federal Information Security Modernization Act
(FISMA)
ANSWER
Ensures the protection of information, operations, and assets in the federal government.
Requires each federal agency to develop, document, and implement an information security
program to protect its information and information systems. Annual reviews of these
programs are required to maintain compliance and keep security risks to an acceptable level.
Question 17.
Block Cipher
ANSWER
Takes a predetermined number of bits, known as a block, in the plaintext message and
encrypts that block
Question 18.
Risk Management Process
ANSWER
1. Identify Asset
2. Identify Threats
3. Assess Vulnerabilities
4. Assess Risk
5. Mitigate Risk
