CORRECT WELL DETAILED ANSWERSLATEST

1

CORRECT WELL DETAILED ANSWERS|LATEST

PASS Explain the difference between a vulnerability and a threat. - ANSWER A threat has the potential to cause harm but can only cause harm if there is a vulnerability the threat can exploit.

Without a vulnerability, the threat cannot cause harm.

A vulnerability is a flaw or weakness in an asset's design, implementation, or operation and management that could be exploited by a threat. A threat is a potential for a threat agent to exploit a vulnerability. A risk is the potential for loss when the threat happens.

What is a Threat? - ANSWER A threat is something that has the potential to cause harm. Threats tend to be specific to certain environments. i.e. a virus may be problematic on a Windows OS but the same virus will be unlikely to have any effect on a Linux OS.

What is a vulnerability? - ANSWER A vulnerability is a weakness or hole that threats can exploit to cause you harm. Might involve a specific OS or application that you're running, the physical location of your office building, a data center that is overpopulated with servers and producing more heat than its air-conditioning system can handle, a lack of backup generators, or other factors.

What are six items that might be considered logical controls? - ANSWER Passwords, encryption, logical access controls, firewalls, intrusion detection systems, access control lists.

What term might you use to describe the usefulness of data? - ANSWER Utility refers to how useful the data is to you.

• / 3

2

Which category of attack is an attack against confidentiality? - ANSWER Interception attacks allow unauthorized users to access your data, applications, or environments, and they are primarily attacks against confidentiality.

How do you know at what point you can consider your environment to be secure? - ANSWER You never really can be fully sure. You conduct regular Pen tests and vulnerability assessments while encrypting your data.

No single activity or action will make you sure in every situation.

Defining when you're not secure is easier to explain:

-Not applying security patches or application updates to your systems.-Using weak passwords such as "password" or "1234".-Downloading programs from the internet.-Opening email attachments from unknown senders.-Using wireless networks without encryption.

Using the concept of defense in depth, what layers might you use to secure yourself against someone removing confidential data from your environment on a USB flash drive? - ANSWER Data- encryptionApplication- not allowing copying of dataHost- multi-factor authenticationAll layers can use Logging and auditing as well as Pen testing and vulnerability analyses

Based on the Parkerian hexad, what principles are affected if you lose a shipment of encrypted backup tapes that contain personal and payment information for your customers?

• ANSWER Confidentiality (someone unauthorized has this data)Integrity (your

backups)Availability (you no longer have access to safe backups)Possession (obvs you don't have it anymore)Utility (payment info can be very useful to malicious threats)

• / 3

3

If the web servers in your environment are based on Microsoft's Internet Information Services (IIS) and a new worm is discovered that attacks Apache web servers, what do you not have? - ANSWER A risk

If you develop a new policy for your environment that requires you to use complex and automatically generated passwords that are unique to each system and are a minimum of 30 characters in length, such as "Qa4(j0nO$&xnl%2AL34ca#!Ps321$," what will be adversely impacted? - ANSWER unauthorized activities

Considering the CIA triad and the Parkerian hexad, what are the advantages and disadvantages of each model? - ANSWER CIA considers unauthorized access to the data. Parkerian Hexad allows more depth with the addition of possession/control, utility and authenticity.

What is the difference between verification and authentication of an identity? - ANSWER Authentication is the establishment that a claim to one's identity is true, while verification is just more support for who they are claiming to be.

How do you measure the rate at which you fail to authenticate legitimate users in a biometric system? - ANSWER This is measured through two metrics the False Rejection Rate (FRR) and False Acceptance Rate (FAR). Ideally, we want the two to equal each other.

What do you call the process in which the client authenticates to the server and the server authenticates to the client? - ANSWER Mutual authentication

A key would be described as which type of authentication factor? - ANSWER Something you have

What biometric factor describes how well a characteristic resists change over time? - ANSWER Permanence

• / 3