a. Functional
b. Technical
c. Physical
d. Mechanical
132. d. A system’s architecture defines the critical attributes of an organization’s collection of information systems in both business/functional and technical/physical terms. Mechanical is not included.
133. Which of the following can represent a single point-of-failure for host applications?
a. Cloud computing
b. Smart grid computing
c. Utility computing
d. Quantum computing
133. a. Cloud computing, which is a form of distributed computing, can become a single point-of-failure due to failure of cloud storage services, network devices, database clusters, and network upgrades for the applications hosted there. In such situations, the services of a second cloud provider could be used to back up data processed by the primary (first) provider to ensure that during a prolonged disruption or serious disaster at the primary site, the data remains available for immediate resumption of critical operations. Note that both the user’s data and essential security services may reside in and be managed within the network cloud.
Smart grid computing consists of interoperable standards and protocols that facilitate in providing centralized electric power generation, including distributed renewable energy resources and energy storage. Ensuring cyber security of the smart grid is essential because it improves power reliability, quality, and resilience. The goal is to build a safe and secure smart grid that is interoperable, end-to-end. Smart grid computing needs cyber security measures because it uses cyber computing.
Utility computing means allowing functional users (end-users) to access technology-based services to perform specific and simple tasks (for example, to run a storage backup program and a disk/file recovery program) without requiring much of the technical knowledge. Quantum computing deals with computers with large word sizes.
134. In a public cloud computing environment, which of the following provides client-side protection?
a. Encrypted network exchanges
b. Plug-ins and add-ins
c. Keystroke loggers
d. Virtual firewalls
134. a. Cloud clients can be browser-based or applications-based. Some organizations deploy hardened browser environments that encrypt network exchanges and protect against keystroke logging.
Plug-ins, add-ins, backdoor Trojan viruses, and keystroke loggers are examples of client-side risks or threats to be protected from. An add-in is a hardware device, such as an expansion board or chip, which can be added to a computer to expand its capabilities. An add-in can also be a supplemental program that can extend the capabilities of an application program. A plug-in is a small software program that plugs into a larger application to provide added functionality (such as graphic, video, and audio files). A keystroke logger is a program designed to record which keys are pressed on a computer keyboard and is used to obtain passwords or encryption keys and thus bypass other security measures.
135. If website owners want to protect data from unauthorized access, what should they do?
a. Create encrypted cookies
b. Create session cookies
c. Create persistent cookies
d. Create tracking cookies
135. a. A cookie is a small data file that holds information about the use of a particular website. Cookies often store data in plain text, which could allow an unauthorized party that accesses a cookie to use or alter the data stored in it. Some websites create encrypted cookies, which protect the data from unauthorized access during a user’s Web browsing session.
Session cookies are incorrect because they are temporary cookies that are valid only for a single website session. Persistent cookies are incorrect because they are stored on a computer indefinitely so that a website can identify the user during subsequent visits. These cookies can help websites serve their users more effectively. Unfortunately, persistent cookies also can be misused as spyware to track a user’s Web browsing activities for questionable reasons without the user’s knowledge or consent. Tracking cookies are incorrect because they are placed on a user’s computer to track the user’s activity on different websites, creating a detailed profile of the user’s behavior.
136. The detect-and-respond infrastructure for information assurance requires which of the following?
1. Intrusion detection
2. Cryptographic key management infrastructure
3. Monitoring software
4. Public key infrastructure
a. 1 and 2
b. 1 and 3
c. 2 and 3
d. 3 and 4
136. b. The detect-and-respond infrastructure enables rapid detection of, and reaction to, intrusions. The infrastructure required includes technical solutions such as intrusion detection, monitoring software, and skilled specialists often referred to as a computer emergency response team (CERT). The cryptographic key management infrastructure (KMI), which includes public key infrastructure (PKI), provides a common unified process for the secure creation, distribution, and management of the public key certificates and traditional symmetric keys. KMI and PKI are not directly related to detect and respond; although, they are all part of supporting infrastructure addressing information assurance.
137. Which of the following are the main approaches to mitigate risks in using active content?
1. Principles
2. Practices
3. Avoidance
4. Harm reduction
a. 1 only
b. 2 only
c. 1 and 2
d. 3 and 4
137. d. Two main approaches to mitigate the risks in using active content include avoidance, which is staying completely clear of known and potential vulnerabilities and harm reduction, which is applying measures to limit the potential loss due to exposure. The other three choices are incorrect because principles and practices are a part of security policy, which is a part of safeguards or controls.
138. Implementing layered and diverse defenses to an information system means:
1. Attacks are progressively weakened.
2. Attacks are eventually defeated.
3. Placing identical controls in succession.
4. Placing different controls that complement each other.
a. 1 and 2
b. 1 and 3
c. 2 and 4
d. 1, 2, 3, and 4
138. d. Defending an information system requires safeguards applied not only at points of entry, but also throughout the system. Ideally, selecting and placing security controls are done in such a way that all attacks are progressively weakened and eventually defeated. Having an identical control in succession tends to lengthen the duration of the attack. Applying different types of controls that complement each other and are mutually supportive is a much more effective approach (i.e., defense-in-depth strategy).
139. Structured Query Language (SQL) security threats include which of the following?
a. Data retrieval and manipulation