Scribd Logo
Upload

Welcome to Scribd!

  • 80 views

    Answers For Quiz Domain 1 - Chapter 1

    Uploaded by

    mendong
    The document contains 20 multiple choice questions about security principles from Chapter 1, including the goals of security (confidentiality, integrity, availability), examples of violations against these goals, the elements of STRIDE, definitions of availability, privacy, ownership, nonrepudiation, layering, data classification schemes, and their purposes. Key terms discussed include the CIA triad, STRIDE, availability, privacy, ownership, nonrepudiation, layering, data classification, and their definitions or goals in information security.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Answers For Quiz Domain 1 - Chapter 1

    Uploaded by

    mendong
    80 views1 page
    The document contains 20 multiple choice questions about security principles from Chapter 1, including the goals of security (confidentiality, integrity, availability), examples of violations against these goals, the elements of STRIDE, definitions of availability, privacy, ownership, nonrepudiation, layering, data classification schemes, and their purposes. Key terms discussed include the CIA triad, STRIDE, availability, privacy, ownership, nonrepudiation, layering, data classification, and their definitions or goals in information security.

    Original Description:

    aswekkbb abj

    Original Title

    Answers for Quiz Domain 1 - Chapter 1

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document contains 20 multiple choice questions about security principles from Chapter 1, including the goals of security (confidentiality, integrity, availability), examples of violations against these goals, the elements of STRIDE, definitions of availability, privacy, ownership, nonrepudiation, layering, data classification schemes, and their purposes. Key terms discussed include the CIA triad, STRIDE, availability, privacy, ownership, nonrepudiation, layering, data classification, and their definitions or goals in information security.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    80 views1 page

    Answers For Quiz Domain 1 - Chapter 1

    Uploaded by

    mendong
    The document contains 20 multiple choice questions about security principles from Chapter 1, including the goals of security (confidentiality, integrity, availability), examples of violations against these goals, the elements of STRIDE, definitions of availability, privacy, ownership, nonrepudiation, layering, data classification schemes, and their purposes. Key terms discussed include the CIA triad, STRIDE, availability, privacy, ownership, nonrepudiation, layering, data classification, and their definitions or goals in information security.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 1

    Answers for Quiz Domain 1: Chapter 1- Security Governance Through Principles and Policies

    1. The primary goals and objectives of security are confidentiality, integrity, and availability,
    commonly referred to as the CIA Triad.
    2. Vulnerabilities and risks are evaluated based on their threats against one or more of the CIA Triad
    principles.
    3. Availability means that authorized subjects are granted timely and uninterrupted access to objects.
    4. Hardware destruction is a violation of availability and possibly integrity. Violations of
    confidentiality include capturing network traffic, stealing password files, social engineering, port
    scanning, shoulder surfing, eavesdropping, and sniffing.
    5. Violations of confidentiality are not limited to direct intentional attacks. Many instances of
    unauthorized disclosure of sensitive or confidential information are due to human error, oversight, or
    ineptitude.
    6. Disclosure is not an element of STRIDE. The elements of STRIDE are spoofing, tampering,
    repudiation, information disclosure, denial of service, and elevation of privilege.
    7. Accessibility of data, objects, and resources is the goal of availability. If a security mechanism offers
    availability, then it is highly likely that the data, objects, and resources are accessible to authorized
    subjects.
    8. Privacy refers to keeping information confidential that is personally identifiable or that might cause
    harm, embarrassment, or disgrace to someone if revealed. Seclusion is to store something in an out-
    of-the-way location. Concealment is the act of hiding or preventing disclosure. The level to which
    information is mission critical is its measure of criticality.
    9. Users should be aware that email messages are retained, but the backup mechanism used to perform
    this operation does not need to be disclosed to them.
    10. Ownership grants an entity full capabilities and privileges over the object they own. The ability to
    take ownership is often granted to the most powerful accounts in an operating system because it can
    be used to overstep any access control limitations otherwise implemented.
    11. Nonrepudiation ensures that the subject of an activity or event cannot deny that the event occurred.
    12. Layering is the deployment of multiple security mechanisms in a series. When security
    restrictions are performed in a series, they are performed one after the other in a linear fashion.
    Therefore, a single failure of a security control does not render the entire solution ineffective.
    13. Preventing an authorized reader of an object from deleting that object is just an example of access
    control, not data hiding. If you can read an object, it is not hidden from you.
    14. The prevention of security compromises is the primary goal of change management.
    15. The primary objective of data classification schemes is to formalize and stratify the process of
    securing data based on assigned labels of importance and sensitivity.
    16. Size is not a criterion for establishing data classification. When classifying an object, you should take
    value, lifetime, and security implications into consideration.
    17. Military (or government) and private sector (or commercial business) are the two common data
    classification schemes.
    18. Of the options listed, secret is the lowest classified military data classification. Keep in
    mind that items labeled as confidential, secret, and top secret are collectively known as classified,
    and confidential is below secret in the list.
    19. The commercial business/private sector data classification of private is used to protect
    information about individuals.
    20. Layering is a core aspect of security mechanisms, but it is not a focus of data
    classifications.

    You might also like