Exam (elaborations)
Information Security And Assurance - C725 - Final Study Set: Questions And Answers
- Course
- Institution
Information Security And Assurance - C725 - Final Study Set: Questions And Answers
[Show more]
Content preview
Information Security And Assurance - C725 - FinalStudy Set: Questions And Answers
Password strength Right Ans - use combo of letters, numbers, symbols.
Don't use common phrases.
three overall categories of security policies: Right Ans - regulatory,
advisory, and informative.
A regulatory policy is required whenever industry or legal standards are
applicable to your organization. This policy discusses the regulations that
must be followed and outlines the procedures that should be used to elicit
compliance.
An advisory policy discusses behaviors and activities that are acceptable and
defines consequences of violations. It explains senior management's desires
for security and compliance within an organization. Most policies are
advisory.
An informative policy is designed to provide information or knowledge about
a specific subject, such as company goals, mission statements, or how the
organization interacts with partners and customers. An informative policy
provides support, research, or background information relevant to the specific
elements of the overall policy.
OSI Model Layers Right Ans - Physical layer (layer 1)
transmit bit streams on a physical medium. They manage the interfaces of
physical devices with physical transmission media, such as coax cable. This
layer has the fewest tasks to perform. It sends bit streams across the network
to another device and receives a bit stream response in return. The High
Speed Serial Interface (HSSI) is one example of a standard interface working
at the Physical Layer level.
Data Link Layer (layer 2)
transfers units of information to the other end of the physical link. Protocols
at this level establish communication links between devices over a physical
,link(physical devices) or channel, converting data into bit streams for delivery
to the lowest layer, the Physical Layer. 802.11 wireless LANs operate at Layer
2 and Layer 1
Network layer (layer 3)
decides how small bundles, or packets, of data route between destination
systems on the same network or interconnected networks.
Routers and bridge routers (brouters) are among the network hardware
devices that function at layer 3
Network (Internet) Layer protocols:
Internet Protocol: The protocol of protocols, IP addresses are assigned by the
Internet Assigned Numbers Authority to each host computer on the network.
This serves as a logical ID. The IP address assists with the routing of
information across the Internet. Outgoing data packets have the originator's
IP address and the IP address of the recipient.
Address Resolution Protocol (ARP): ARP matches an IP address to an Ethernet
address, which is a physical device (network adapter) that has a unique media
access control (MAC) address assigned by the manufacturer of the device.
MAC addresses are much longer numbers than IP addresses, and humans tend
to work better with IP addresses than with MAC addresses. Thus, ARP and
RARP (covered next) exist to help with n
Understand the public key infrastructure (PKI) Right Ans - In the public
key infrastructure, certificate authorities (CAs) generate digital certificates
containing the public keys of system users. Users then distribute these
certificates to people with whom they want to communicate. Certificate
recipients verify a certificate using the CA's public key.
Defense in Depth Right Ans - A defense that uses multiple types of security
devices to protect a network. Also called layered security.
This security is implemented in overlapping layers that provide the three
elements needed to secure assets: prevention, detection, and response.
,Defense in depth also seeks to offset the weaknesses of one security layer by
the strengths of two or more layers.
Qualitative risk analysis Right Ans - A qualitative analysis assigns real
dollar figures to the loss of an asset.
includes judgment, intuition, and experience. It enables an individual to
identify the potential risks, and assets and resources which are vulnerable to
these risks. It depends more on scenarios rather than calculations. It requires
guesswork, makes use of opinions, and provides useful and meaningful
results.
risk analysis does not support automation; it is supported by quantitative risk
analysis.
Message Digest Right Ans - A small representation of a larger message.
Message digests are used to ensure the authentication and integrity of
information, not the confidentiality.
The main disadvantage of message digests is that the timestamp can be
modified. During the course of a forensic investigation, the last access time for
a file is changed when a message digest is created on the data collected.
Message digests are necessary to ensure that the evidence is not tampered
with during the course of the investigation. A logging timestamp is changed
due to a transaction taking place and overwrites the timestamp of the incident
that originally occurred.
A message digest is a fixed output created by using a one-way hash function. A
message digest is created from a variable set of input, also referred to as a
checksum. A message digest is helpful in detecting whether any change is
made to the records during the course of the chain of custody. The message
digest is expected to be smaller than the original data string.
Message digests do not provide a stringent authentication and deal with
integrity of information.
Message digests do not contribute to either a higher processing time or a
slower access time.
, digital certificate Right Ans - A digital certificate binds the identity of an
individual to a key pair. A digital certificate is an electronic credit card that
establishes an individual's credentials when doing business or other
transactions on the Web. It is issued by a certification authority (CA). It
contains the name, a serial number, expiration dates, a copy of the certificate
holder's public key (used for encrypting messages and digital signatures), and
the digital signature of the certificate-issuing authority so that a recipient can
verify that the certificate is real. Some digital certificates conform to a
standard, X.509.
A digital signature is a message digest that is encrypted using the sender's
private key.
Symmetric Encryption Right Ans - An encryption method in which the
same key is used to encrypt and decrypt a message. Also known as private-key
encryption.
symmetric algorithm generates a secret key that is used for bulk encryption
and decryption of data.
Asymmetric encryption Right Ans - two keys are used; one key encodes the
message, and the other key decodes the message
Asymmetric algorithms are slow, complex, intensive, and require added
system resources and extra time to encrypt and decrypt the data. Therefore,
asymmetric algorithms are used to generate public and private keys that
protect encryption keys, such as session keys and secret keys, and are
responsible for automated key distribution
RSA public key cryptosystems Right Ans - RSA is the most famous public
key cryptosystem; it was developed by Rivest, Shamir, and Adleman in 1977.
It depends on the difficulty of factoring the product of prime numbers.
El Gamal is an extension of the Diffie-Hellman key exchange algorithm that
depends on modular arithmetic.
The elliptic curve algorithm depends on the elliptic curve discrete logarithm
problem and provides more security than other algorithms when both are
used with keys of the same length.
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller Zendaya. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $21.99. You're not tied to anything after your purchase.
Can Stuvia be trusted?
4.6 stars on Google & Trustpilot (+1000 reviews)
67866 documents were sold in the last 30 days
Founded in 2010, the go-to place to buy study notes for 14 years now