Fundamentals of Information Security
test questions with correct answers
acceptability (biometrics) - CORRECT ANSWERS-a measure of how tolerable the characteristic
is to the users of the system.
ex; systems that are slow, difficult or awkward to use are less likely to be tolerable by users.
access control lists (ACLs) - CORRECT ANSWERS-lists containing information about what kind
of access certain parties are allowed to have to a given system.
access control model - CORRECT ANSWERS-a way of determining who should be allowed
access to what resources.
the most common of THESE are: discretionary access control, mandatory access control, rule-
based access control, role-based access control, attribute-based access control, and multilevel
access control.
access controls - CORRECT ANSWERS-the tools and systems you use to deny or allow
access; implementing authorization.
ex; a key to lock or unlock doors, badge for entry at work, password to use a computer.
m; THIS has four basic tasks: allowing access, denying access, limiting access, and revoking
access.
accountability - CORRECT ANSWERS-making sure individuals are responsible for their actions.
,THIS is done by using identification, authentication, and authorization processes so you can
know who a given event is associated with and what permissions allowed them to carry it out.
address space layout randomization (ASLR) - CORRECT ANSWERS-a technique that shifts the
contents of the memory in use around so that tampering with it is even more difficult.
administrative controls/measures (mitigate risks) - CORRECT ANSWERS-THIS dictates how
the users of your environment should behave; the rules, laws, policies, procedures, guidelines,
and other items that are "paper" in nature.
m; an important aspect of THIS is the ability to enforce it. can cause threats and vulnerabilities if
left unchecked.
AES (symmetric algorithm) - CORRECT ANSWERS-a set of symmetric block ciphers that uses
three different ciphers: one with a 128-bit key, one with a 192-bit key, and one with a 256-bit
key, all of which encrypt blocks of 128 bits.
agented scans - CORRECT ANSWERS-allows the scanning of a host as though it were an
authenticated user on the system by having a small piece of software, called an agent, installed
on the specific host.
air-gapped networks - CORRECT ANSWERS-networks with no direct connections to the
outside.
allowing access (access controls) - CORRECT ANSWERS-giving a party access to a given
resource.
ex; permitting the use of a file or permitting someone into your home.
alter default accounts (attack surface) - CORRECT ANSWERS-os hardening requires the
changing or removal unneeded accounts, especially default accounts if possible.
m; many default and guest accounts come with more unnecessary permissions than expected
and often with no password.
,analysis of threats (operations security) - CORRECT ANSWERS-the second step is to analyze
any threats related to the critical information you identified.
m; repeat this step for each item of critical information, for each party that might take advantage
of it if it were exposed, and for each use they might make of the information.
analysis of vulnerabilities (operations security) - CORRECT ANSWERS-the third step is
analyzing the vulnerabilities in the protections you've put in place to secure your information
assets.
anomaly-based detection (IDS) - CORRECT ANSWERS-works by determining the normal kinds
of traffic and activity taking place on the network, then measures the present traffic against that
baseline in order to detect patterns that aren't present in the traffic normally.
application of countermeasures (operations security) - CORRECT ANSWERS-the fifth and final
step is putting measures in place to mitigate the risks to your critical information.
m; must mitigate either the threat or the vulnerability at the bare minimum. removing either will
make sure you no longer have a serious risk.
application penetration testing - CORRECT ANSWERS-a type of pentesting that focuses
directly on an application or application environment.
m; requires a more specialized set of tools and skills on the part of the tester and involves two
approaches: static analysis and dynamic analysis.
application scanning - CORRECT ANSWERS-a scanning tool specific to web technologies and
vulnerabilities.
m; can search more deeply in the application for issues than a scanner intended strictly for
hosts would be able to find.
, arbitrary code execution (or 'remote code execution' when conducted over the network) -
CORRECT ANSWERS-the ability for attackers to execute any command on a system that they
choose, without restriction.
m; security flaws related to the languages used to talk to databases allows this to happen.
assess risks (risk management process) - CORRECT ANSWERS-once the threats and
vulnerabilities are identified, THIS is done to have an overall idea of the risk so you can start to
mitigate them.
m; a vulnerability with no matching threat or a threat with no matching vulnerability does not
constitute a risk.
assess vulnerabilities (risk management process) - CORRECT ANSWERS-assets can have
millions of threats, but only a fraction will be relevant; THIS is done to see if those relevant
threats pose a risk.
ex; if data is exposed, it could lead to a breach. if your data is encrypted, this is not a risk.
ex; if the system goes down, business operations will also go down, this is a risk.
assessment of risks (operations security) - CORRECT ANSWERS-the fourth step is deciding
what issues you need to address in the rest of the operations security process.
assessments (audit) - CORRECT ANSWERS-the tests used to find and fix vulnerabilities before
attackers discover them.
ex; vulnerability assessments, penetration testing.
asset - CORRECT ANSWERS-THIS is anything of value within an organization, composed of;
the people, property, and information.
asymmetric algorithm (also asymmetric key cryptography or public key cryptography) -
CORRECT ANSWERS-uses two keys: a public key and a private key.
test questions with correct answers
acceptability (biometrics) - CORRECT ANSWERS-a measure of how tolerable the characteristic
is to the users of the system.
ex; systems that are slow, difficult or awkward to use are less likely to be tolerable by users.
access control lists (ACLs) - CORRECT ANSWERS-lists containing information about what kind
of access certain parties are allowed to have to a given system.
access control model - CORRECT ANSWERS-a way of determining who should be allowed
access to what resources.
the most common of THESE are: discretionary access control, mandatory access control, rule-
based access control, role-based access control, attribute-based access control, and multilevel
access control.
access controls - CORRECT ANSWERS-the tools and systems you use to deny or allow
access; implementing authorization.
ex; a key to lock or unlock doors, badge for entry at work, password to use a computer.
m; THIS has four basic tasks: allowing access, denying access, limiting access, and revoking
access.
accountability - CORRECT ANSWERS-making sure individuals are responsible for their actions.
,THIS is done by using identification, authentication, and authorization processes so you can
know who a given event is associated with and what permissions allowed them to carry it out.
address space layout randomization (ASLR) - CORRECT ANSWERS-a technique that shifts the
contents of the memory in use around so that tampering with it is even more difficult.
administrative controls/measures (mitigate risks) - CORRECT ANSWERS-THIS dictates how
the users of your environment should behave; the rules, laws, policies, procedures, guidelines,
and other items that are "paper" in nature.
m; an important aspect of THIS is the ability to enforce it. can cause threats and vulnerabilities if
left unchecked.
AES (symmetric algorithm) - CORRECT ANSWERS-a set of symmetric block ciphers that uses
three different ciphers: one with a 128-bit key, one with a 192-bit key, and one with a 256-bit
key, all of which encrypt blocks of 128 bits.
agented scans - CORRECT ANSWERS-allows the scanning of a host as though it were an
authenticated user on the system by having a small piece of software, called an agent, installed
on the specific host.
air-gapped networks - CORRECT ANSWERS-networks with no direct connections to the
outside.
allowing access (access controls) - CORRECT ANSWERS-giving a party access to a given
resource.
ex; permitting the use of a file or permitting someone into your home.
alter default accounts (attack surface) - CORRECT ANSWERS-os hardening requires the
changing or removal unneeded accounts, especially default accounts if possible.
m; many default and guest accounts come with more unnecessary permissions than expected
and often with no password.
,analysis of threats (operations security) - CORRECT ANSWERS-the second step is to analyze
any threats related to the critical information you identified.
m; repeat this step for each item of critical information, for each party that might take advantage
of it if it were exposed, and for each use they might make of the information.
analysis of vulnerabilities (operations security) - CORRECT ANSWERS-the third step is
analyzing the vulnerabilities in the protections you've put in place to secure your information
assets.
anomaly-based detection (IDS) - CORRECT ANSWERS-works by determining the normal kinds
of traffic and activity taking place on the network, then measures the present traffic against that
baseline in order to detect patterns that aren't present in the traffic normally.
application of countermeasures (operations security) - CORRECT ANSWERS-the fifth and final
step is putting measures in place to mitigate the risks to your critical information.
m; must mitigate either the threat or the vulnerability at the bare minimum. removing either will
make sure you no longer have a serious risk.
application penetration testing - CORRECT ANSWERS-a type of pentesting that focuses
directly on an application or application environment.
m; requires a more specialized set of tools and skills on the part of the tester and involves two
approaches: static analysis and dynamic analysis.
application scanning - CORRECT ANSWERS-a scanning tool specific to web technologies and
vulnerabilities.
m; can search more deeply in the application for issues than a scanner intended strictly for
hosts would be able to find.
, arbitrary code execution (or 'remote code execution' when conducted over the network) -
CORRECT ANSWERS-the ability for attackers to execute any command on a system that they
choose, without restriction.
m; security flaws related to the languages used to talk to databases allows this to happen.
assess risks (risk management process) - CORRECT ANSWERS-once the threats and
vulnerabilities are identified, THIS is done to have an overall idea of the risk so you can start to
mitigate them.
m; a vulnerability with no matching threat or a threat with no matching vulnerability does not
constitute a risk.
assess vulnerabilities (risk management process) - CORRECT ANSWERS-assets can have
millions of threats, but only a fraction will be relevant; THIS is done to see if those relevant
threats pose a risk.
ex; if data is exposed, it could lead to a breach. if your data is encrypted, this is not a risk.
ex; if the system goes down, business operations will also go down, this is a risk.
assessment of risks (operations security) - CORRECT ANSWERS-the fourth step is deciding
what issues you need to address in the rest of the operations security process.
assessments (audit) - CORRECT ANSWERS-the tests used to find and fix vulnerabilities before
attackers discover them.
ex; vulnerability assessments, penetration testing.
asset - CORRECT ANSWERS-THIS is anything of value within an organization, composed of;
the people, property, and information.
asymmetric algorithm (also asymmetric key cryptography or public key cryptography) -
CORRECT ANSWERS-uses two keys: a public key and a private key.
