Results
Mohammed LNU — 1st Attempt
Assessment Statistics
95%
28.5 out of 30 points
28.5
Out of 30 points
Time for this attempt: 6 minutes 8 seconds
6 minutes 8 seconds06:08
Time for this attempt
1 attempt left Take Now
Attempt History
Attempt History
Results Points Score (Highest
score is kept)
Attempt 1 28.5
of 30 95% (Highest score)
Your Answers:
Results for question 1.
1
1.5 / 1.5 points
Into which threat category does information warfare fall?
Structured
Correct answer:
Highly structured
Critical
Open-source
Results for question 2.
2
1.5 / 1.5 points
How did the Code Red worm spread?
It exploited a buffer-overflow vulnerability in computers
running Microsoft SQL Server or SQL Server Desktop Engine.
It collected key-strokes, screenshots, and network traffic
from open ports.
Correct answer:
It made use of a buffer-overflow condition in Microsoft’s
IIS web servers that had been known for a month.
It entered through the victim’s Outlook address book
software and then replicated itself by sending infected emails to the first 50
contacts.
Results for question 3.
3
1.5 / 1.5 points
How long did it take for electricity to be restored after
the Ukraine suffered the first known successful cyberattack against an electric
grid on December 23, 2015?
Full restoration of grid capabilities took minutes as the
backup generators were available and online immediately.
Correct answer:
Full restoration of grid capabilities took more than a year
as equipment was damaged.
Full restoration of grid capabilities took one week as
testing needed to be performed to ensure safety.
Full restoration of grid capabilities took 24 hours as only
a small section of the grid was affected.
Results for question 4.
4
1.5 / 1.5 points
What was the primary lesson learned from the Slammer worm?
It made security personnel aware of attacks that had been
going on for years without being noticed.
Correct answer:
It drove home the point that the Internet could be adversely
impacted in a matter of minutes.
It brought the attention of state-sponsored malware to
light.
It made security personnel aware of data breaches that had
been dominating the security landscape.
Results for question 5.
5
1.5 / 1.5 points
Which attack is an example of an advanced persistent threat
(APT) first reported by Google, that also targeted Adobe, Yahoo!, Juniper
Networks, Rackspace, Symantec, and several major U.S. financial and industrial
firms?
Correct answer:
Operation Aurora
Operation Bot Roast
Conficker
Stuxnet
Results for question 6.
6
1.5 / 1.5 points
In 2014, on how many different threat actors, including
criminals, hactivists, state-sponsored groups, and nation states, did
CrowdStrike report?
19
29
Correct answer:
39
49
Results for question 7.
7
1.5 / 1.5 points
Who is considered to be the ultimate insider, with his name
being synonymous with the insider threat issue?
Robert Morris
Correct answer:
Edward Snowden
Kevin Mitnick
Vladimir Levin
Results for question 8.
8
1.5 / 1.5 points
Because of malware’s nefarious purpose, there is no criminal
distinction between the writers of malware and those who release malware.
True
Correct answer:
False
Results for question 9.
9
1.5 / 1.5 points
In the early days of computers, security was considered to
be a binary condition in which your system was either secure or not secure.
Correct answer:
True
False
Results for question 10.
10
1.5 / 1.5 points
Which term refers to an attack conducted against a site with
software that is vulnerable to a specific exploit?
Time bombs
Advanced persistent threats
Specific target attack
Correct answer:
Target of opportunity
Results for question 11.
11
1.5 / 1.5 points
Which security principle refers to the concept that each and
every request should be verified?
Least privilege
Separation of duties
Economy of mechanism
Correct answer:
Complete mediation
Results for question 12.
12
1.5 / 1.5 points
Which security principle states that access should be based
on more than one item?
Correct answer:
Separation of privilege
Complete mediation
Fail-safe defaults
Economy of mechanism
Results for question 13.
13
0 / 1.5 points
Encapsulation is the concept of separating items so that
they cannot interfere with each other.
Incorrect answer:
True
Correct Answer:False
False
Feedback
Based on answering incorrectly
Page: 36
Difficulty: Easy
Results for question 14.
14
1.5 / 1.5 points
Where do changes in trust occur?
At the Low-Water-Mark
At the firewall
Correct answer:
At the trust boundary
At the physical layer of the OSI model
Results for question 15.
15
1.5 / 1.5 points
Which security model developed in the late 1970s addresses
integrity?
Correct answer:
Biba
Bell-LaPadula
Simple Security
Ring
Results for question 16.
16
1.5 / 1.5 points
Another term for defense in depth is layered security.
Correct answer:
True
False
Results for question 17.
17
1.5 / 1.5 points
Which term describes a means of separating the operation of
an application from the rest of the operating system?
Complete mediation
Separation of duties
Correct answer:
Sandboxing
Reverse-engineering
Results for question 18.
18
1.5 / 1.5 points
Which security model uses transactions as the basis for its
rules?
Biba
Bell-LaPadula
Simple Security
Correct answer:
Clark-Wilson
Results for question 19.
19
1.5 / 1.5 points
Because of the nature of trust and its high-risk
opportunity, the sage advice is to develop and maintain a culture embracing
trust.
True
Correct answer:
False
Results for question 20.
20
1.5 / 1.5 points
The entity that implements a chosen security policy and
enforces those characteristics deemed most important by the system designers is
known as the __________.
Correct answer:
Security model
Group policy
CIA model
NIST Cyber Security Framework
Comments
Post a Comment