Question 1

Match the following terms to the appropriate definitions.
-A comparison of the present state of a system to its baseline.​

Accepted Answer

A)  asset
B)  cyberterrorism
C)  hactivist
D)  exploit kit
E)  computer spyF) riskG) threatH) threat agentI) vulnerabilityJ) threat vectorK) C) and F)
L) A) and H)

Question 2

Describe the purpose of a honeypot.

Accepted Answer

A honeypot can also direct an attacker's attention away from legitimate servers. A honeypot encourages attackers to spend their time and energy on the decoy server while distracting their attention from the data on the real server.

Question 3

Most vulnerability scanners maintain a(n) ____________________ that categorizes and describes the vulnerabilities that it can detect.

Accepted Answer

The answer of Most vulnerability scanners maintain a(n) ____________________ that...

Question 4

List four things that a vulnerability scanner can do.

Accepted Answer

Alert when new systems are added to the ...

Question 5

A healthy security posture results from a sound and workable strategy toward managing risks.

Accepted Answer

A) True 
 B)False

Question 6

Discuss the purpose of OVAL.

Accepted Answer

OVAL is designed to promote open and pub...

Question 7

A(n) ____________________ box test is one in which some limited information has been provided to the tester.

Accepted Answer

gray

Question 8

Match the following terms to the appropriate definitions.
-​In software development, the process of defining a collection of hardware and software components along with their interfaces in order to create the framework for software development.

Accepted Answer

A)  asset
B)  cyberterrorism
C)  hactivist
D)  exploit kit
E)  computer spyF) riskG) threatH) threat agentI) vulnerabilityJ) threat vectorK) A) and B)
L) H) and I)

Question 9

The first step in a vulnerability assessment is to determine the assets that need to be protected.

Accepted Answer

A) True 
 B)False

Question 10

List and describe the three categories that TCP/IP divides port numbers into.

Accepted Answer

Well-known port numbers (0-1023). Reserv...

Question 11

When using a black box test, many testers use ____________________ tricks to learn about the network infrastructure from inside employees.

Accepted Answer

The answer of When using a black box test, many...

Question 12

A port scanner can be used to search a system for port vulnerabilities. The RADMIN port scanner is an example of this type of software.

Accepted Answer

A) True 
 B)False  True

Question 13

What is the name of the process that takes a snapshot of the current security of an organization?

Accepted Answer

A)  threat analysis
B)  vulnerability appraisal
C)  risk assessment
D)  threat assessmentE) All of the above
F) B) and C)

Question 14

An administrator needs to view packets and decode and analyze their contents. What type of application should the administrator use?

Accepted Answer

A)  application analyzer
B)  protocol analyzer
C)  threat profiler
D)  system analyzerE) B) and D)
F) A) and B)

Question 15

Discuss one type of asset that an organization might have.

Accepted Answer

An organization has many different types...

Question 16

Match the following terms to the appropriate definitions.
-In software development, presenting the code to multiple reviewers in order to reach agreement about its security.​

Accepted Answer

A)  asset
B)  cyberterrorism
C)  hactivist
D)  exploit kit
E)  computer spyF) riskG) threatH) threat agentI) vulnerabilityJ) threat vectorK) B) and H)
L) C) and F)

Question 17

Match the following terms to the appropriate definitions.
-​A computer typically located in an area with limited security and loaded with software and data files that appear to be authentic, but are actually imitations of real data files, to trick attackers into revealing their attack techniques.

Accepted Answer

A)  asset
B)  cyberterrorism
C)  hactivist
D)  exploit kit
E)  computer spyF) riskG) threatH) threat agentI) vulnerabilityJ) threat vectorK) F) and G)
L) C) and E)

Question 18

What is the end result of a penetration test?

Accepted Answer

A)  penetration test profile
B)  penetration test report
C)  penetration test system
D)  penetration test viewE) All of the above
F) B) and C)

Question 19

​What term below describes a prearranged purchase or sale agreement between a government agency and a business?

Accepted Answer

A)  ​Service Level Agreement (SL
A)  
B)  ​Memorandum of Understanding (MOU) 
C)  ​Blanket Purchase Agreement (BP
A)  
D)  ​Interconnection Security Agreement (IS
A)  E) A) and D)
F) B) and C)

Question 20

If TCP port 20 is open, then an attacker can assume that FTP is being used.

Accepted Answer

A) True 
 B)False

Exam 15: Vulnerability Assessment and Third Party Integration

Match the following terms to the appropriate definitions. -A comparison of the present state of a system to its baseline.​

Correct AnswerverifiedShow Answer

Describe the purpose of a honeypot.

Correct AnswerverifiedA honeypot can also direct an attacker's attention away from legitimate servers. A honeypot encourages attackers to spend their time and energy on the decoy server while distracting their attention from the data on the real server.

Most vulnerability scanners maintain a(n) ____________________ that categorizes and describes the vulnerabilities that it can detect.

Correct AnswerverifiedShow Answer

List four things that a vulnerability scanner can do.

Correct AnswerverifiedAlert when new systems are added to the ...View AnswerShow Answer

A healthy security posture results from a sound and workable strategy toward managing risks.

Correct AnswerverifiedShow Answer

Discuss the purpose of OVAL.

Correct AnswerverifiedOVAL is designed to promote open and pub...View AnswerShow Answer

A(n) ____________________ box test is one in which some limited information has been provided to the tester.

Correct Answerverifiedgray

Match the following terms to the appropriate definitions. -​In software development, the process of defining a collection of hardware and software components along with their interfaces in order to create the framework for software development.

Correct AnswerverifiedShow Answer

The first step in a vulnerability assessment is to determine the assets that need to be protected.

Correct AnswerverifiedShow Answer

List and describe the three categories that TCP/IP divides port numbers into.

Correct AnswerverifiedWell-known port numbers (0-1023). Reserv...View AnswerShow Answer

When using a black box test, many testers use ____________________ tricks to learn about the network infrastructure from inside employees.

Correct AnswerverifiedShow Answer

A port scanner can be used to search a system for port vulnerabilities. The RADMIN port scanner is an example of this type of software.

Correct AnswerverifiedTrue

What is the name of the process that takes a snapshot of the current security of an organization?

Correct AnswerverifiedShow Answer

An administrator needs to view packets and decode and analyze their contents. What type of application should the administrator use?

Correct AnswerverifiedShow Answer

Discuss one type of asset that an organization might have.

Correct AnswerverifiedAn organization has many different types...View AnswerShow Answer

Match the following terms to the appropriate definitions. -In software development, presenting the code to multiple reviewers in order to reach agreement about its security.​

Correct AnswerverifiedShow Answer

Match the following terms to the appropriate definitions. -​A computer typically located in an area with limited security and loaded with software and data files that appear to be authentic, but are actually imitations of real data files, to trick attackers into revealing their attack techniques.

Correct AnswerverifiedShow Answer

What is the end result of a penetration test?

Correct AnswerverifiedShow Answer

​What term below describes a prearranged purchase or sale agreement between a government agency and a business?

Correct AnswerverifiedShow Answer

If TCP port 20 is open, then an attacker can assume that FTP is being used.

Correct AnswerverifiedShow Answer

Match the following terms to the appropriate definitions. -A comparison of the present state of a system to its baseline.

Correct Answer
verified

Correct Answer
verified
A honeypot can also direct an attacker's attention away from legitimate servers. A honeypot encourages attackers to spend their time and energy on the decoy server while distracting their attention from the data on the real server.

Correct Answer
verified

Correct Answer
verified
Alert when new systems are added to the ...
View Answer

Correct Answer
verified

Correct Answer
verified
OVAL is designed to promote open and pub...
View Answer

Correct Answer
verified
gray

Match the following terms to the appropriate definitions. -In software development, the process of defining a collection of hardware and software components along with their interfaces in order to create the framework for software development.

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified
Well-known port numbers (0-1023). Reserv...
View Answer

Correct Answer
verified

Correct Answer
verified
True

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified
An organization has many different types...
View Answer

Match the following terms to the appropriate definitions. -In software development, presenting the code to multiple reviewers in order to reach agreement about its security.

Correct Answer
verified

Match the following terms to the appropriate definitions. -A computer typically located in an area with limited security and loaded with software and data files that appear to be authentic, but are actually imitations of real data files, to trick attackers into revealing their attack techniques.

Correct Answer
verified

Correct Answer
verified

What term below describes a prearranged purchase or sale agreement between a government agency and a business?

Correct Answer
verified

Correct Answer
verified