WGU C845 Information Systems Security
Exam UPDATED QUESTIONS AND
CORRECT ANSWERS
AAA, Triple A - CORRECT ANSWER Referred to as the AAA of access control:
authentication, authorization, and accounting
algorithm - CORRECT ANSWER A mathematical function cryptographic algorithm that
encrypts or decrypts text
authentication - CORRECT ANSWER Method used to verify the identity claim of a user
authorization - CORRECT ANSWER The act of defining the network resources, applications,
and data that may be accessed by a user
availability - CORRECT ANSWER One of the central principles of the AIC triad. A core goal
of a security professional is to ensure that data and hardware are available when the user requires
them
confidentiality - CORRECT ANSWER One of the central principles of the AIC triad;
represents a core goal of the security professional to ensure, possibly through encryption, that
sensitive information is protected from exposure
due care - CORRECT ANSWER The taking of actions that a reasonable and prudent person
would take in a given situation
due diligence - CORRECT ANSWER Refers to taking actions that prevent harm to persons or
their property
identification - CORRECT ANSWER A unique designation assigned to a member of a group.
A claim presented when desiring access
,integrity - CORRECT ANSWER One of the central principles of the AIC triad; represents a
core goal of a security professional, to ensure that no changes have occurred to data or a system, thus
ensuring the data's integrity
job rotation - CORRECT ANSWER The act of shifting individuals between roles and
responsibilities to prohibit security violations
least privilege - CORRECT ANSWER Security principle that individuals are provided with the
least amount of information required to perform their jobs or duties
mandatory vacation - CORRECT ANSWER A security control that allows the monitoring of
business functions without the availability of a principal or responsible individual
separation of duties - CORRECT ANSWER A security program in which two or more people
are required to independently perform activities to complete an action
user ID - CORRECT ANSWER An assigned identification. Every user of the system should
have a unique user ID. Its use must still be authenticated
certification - CORRECT ANSWER The successful conclusion after a system or application
has been tested against preestablished standards
vulnerability assessment - CORRECT ANSWER The organized set of steps used to identify
and analyse threats and vulnerabilities to determine an organization's overall risk
access control list (ACL) - CORRECT ANSWER A list of subjects and assigned rights used in
access control.
administrative controls - CORRECT ANSWER Controls put in place to enforce policies and
directives as dictated by the organization
biometrics - CORRECT ANSWER Hardware or software used to measure human
characteristics as part of an authentication system
, data at rest - CORRECT ANSWER Any data in a storage location and not moving between
locations or being processed by an application.
defense diversity - CORRECT ANSWER The use of two devices from separate vendors. For
instance, the use of two firewalls that provide slightly different services or rules in order to support the
defense in-depth strategy
defense in depth - CORRECT ANSWER A layered approach to defense. The placement of
several controls in a series in an effort to slow down, discourage, or eliminate an attacker
false acceptance rate (FAR) - CORRECT ANSWER An authentication error rate in which an
unknown user is identified as a known user and is mistakenly allowed access. Also referred to as a
Type II biometric error
false rejection rate (FRR) - CORRECT ANSWER An authentication error rate in which a
known user is identified as an unknown user and is mistakenly denied access. Also referred to as a
Type I biometric error
Kerberos - CORRECT ANSWER A single sign-on technology that includes a ticket-granting
server, ticket-granting tickets, and session tickets. It provides users access to authorized resources
based upon the one-time authentication of their credentials
logical access control - CORRECT ANSWER Electronic hardware or software that limits
users' access to only the resources to which they have been given authorization
logical/technical controls - CORRECT ANSWER Electronic hardware or software controls that
are placed in a network to mitigate risk
mandatory access control - CORRECT ANSWER An access control methodology that requires
the subject as well as the object to be assigned a label. During an access process the labels are
"mediated," or compared by an application, device, or system that determines access. For instance, a
subject with a top-secret label wanting to access an object with a top-secret label must be mediated or
allowed access by a system, usually referred to as a trusted computing base. In less critical systems an
access control list may be used
Exam UPDATED QUESTIONS AND
CORRECT ANSWERS
AAA, Triple A - CORRECT ANSWER Referred to as the AAA of access control:
authentication, authorization, and accounting
algorithm - CORRECT ANSWER A mathematical function cryptographic algorithm that
encrypts or decrypts text
authentication - CORRECT ANSWER Method used to verify the identity claim of a user
authorization - CORRECT ANSWER The act of defining the network resources, applications,
and data that may be accessed by a user
availability - CORRECT ANSWER One of the central principles of the AIC triad. A core goal
of a security professional is to ensure that data and hardware are available when the user requires
them
confidentiality - CORRECT ANSWER One of the central principles of the AIC triad;
represents a core goal of the security professional to ensure, possibly through encryption, that
sensitive information is protected from exposure
due care - CORRECT ANSWER The taking of actions that a reasonable and prudent person
would take in a given situation
due diligence - CORRECT ANSWER Refers to taking actions that prevent harm to persons or
their property
identification - CORRECT ANSWER A unique designation assigned to a member of a group.
A claim presented when desiring access
,integrity - CORRECT ANSWER One of the central principles of the AIC triad; represents a
core goal of a security professional, to ensure that no changes have occurred to data or a system, thus
ensuring the data's integrity
job rotation - CORRECT ANSWER The act of shifting individuals between roles and
responsibilities to prohibit security violations
least privilege - CORRECT ANSWER Security principle that individuals are provided with the
least amount of information required to perform their jobs or duties
mandatory vacation - CORRECT ANSWER A security control that allows the monitoring of
business functions without the availability of a principal or responsible individual
separation of duties - CORRECT ANSWER A security program in which two or more people
are required to independently perform activities to complete an action
user ID - CORRECT ANSWER An assigned identification. Every user of the system should
have a unique user ID. Its use must still be authenticated
certification - CORRECT ANSWER The successful conclusion after a system or application
has been tested against preestablished standards
vulnerability assessment - CORRECT ANSWER The organized set of steps used to identify
and analyse threats and vulnerabilities to determine an organization's overall risk
access control list (ACL) - CORRECT ANSWER A list of subjects and assigned rights used in
access control.
administrative controls - CORRECT ANSWER Controls put in place to enforce policies and
directives as dictated by the organization
biometrics - CORRECT ANSWER Hardware or software used to measure human
characteristics as part of an authentication system
, data at rest - CORRECT ANSWER Any data in a storage location and not moving between
locations or being processed by an application.
defense diversity - CORRECT ANSWER The use of two devices from separate vendors. For
instance, the use of two firewalls that provide slightly different services or rules in order to support the
defense in-depth strategy
defense in depth - CORRECT ANSWER A layered approach to defense. The placement of
several controls in a series in an effort to slow down, discourage, or eliminate an attacker
false acceptance rate (FAR) - CORRECT ANSWER An authentication error rate in which an
unknown user is identified as a known user and is mistakenly allowed access. Also referred to as a
Type II biometric error
false rejection rate (FRR) - CORRECT ANSWER An authentication error rate in which a
known user is identified as an unknown user and is mistakenly denied access. Also referred to as a
Type I biometric error
Kerberos - CORRECT ANSWER A single sign-on technology that includes a ticket-granting
server, ticket-granting tickets, and session tickets. It provides users access to authorized resources
based upon the one-time authentication of their credentials
logical access control - CORRECT ANSWER Electronic hardware or software that limits
users' access to only the resources to which they have been given authorization
logical/technical controls - CORRECT ANSWER Electronic hardware or software controls that
are placed in a network to mitigate risk
mandatory access control - CORRECT ANSWER An access control methodology that requires
the subject as well as the object to be assigned a label. During an access process the labels are
"mediated," or compared by an application, device, or system that determines access. For instance, a
subject with a top-secret label wanting to access an object with a top-secret label must be mediated or
allowed access by a system, usually referred to as a trusted computing base. In less critical systems an
access control list may be used
