CS205 Grand Quiz Solution and Discussion

[zaasmi]

Please share you Grand Quiz

[zaasmi]

The verizon and symantec reports show that_______________.
Web is the most vulnerable vector
Email is the most attacked vector
IOT is more secure than other technologies
Malicious internal users or disgruntled employees cause most damage

[zaasmi]

If account lockout feature value is set to “0” on a ms 2012 member server than?
The account will never be locked despite of several failed login attempts
The account will be locked and system will have to be rebooting
Will require administrator to unlock the account
Will have to disconnect from network

[zaasmi]

Which of the following statement is correct?
CVE is superset of NVD
NVD is an open standard for assigning vulnerability impacts
NVD is superset of CVSS
NVD is superset of CVE

[zaasmi]

_________________is the part of Information Security Awareness.
Procedure
Standard
Policy
Training

[zaasmi]

What does check content explain about rule in DISA STIG?
Describes the control
Describes the benefit of implementing control
Tells how to check whether control is implemented or not
Tells how to apply control

[zaasmi]

One of the challenges in effective implementation of a security transformation project in a small-sized organization is_______________.
Adhoc culture and lack of discipline
Old and outdated IT environment
Multiple data center sites
Lack of a disaster recovery (DR) site

[zaasmi]

The purpose of the information security lifecycle is to ensure that___________________.
Project management is conducted adequately
The sequence is documented
There is a completion date to security projects
All security projects & activities consistently follow the same sequence and steps

[zaasmi]

For effective information security implementation, the security journey should start with___________.
Developing comprehensive policies and procedures
Management commitment
Security hardening and vulnerability management of IT assets
A penetration test

[zaasmi]

A policy is___________________.
Mandatory and limited in scope to a department
Mandatory and applies to entire organization; signed off by senior management
Not mandatory but a guideline only
Signed off by information security department

[zaasmi]

In an enterprise which software should be allowed to install and execute?
Softwares included in white-list.
Any freely available software.
Only paid software.
Softwares displayed on notice board.

[zaasmi]

Which activity is carried out in security hardening layer?
Address security configuration of all it assets
Scanning to inspect patching of all it assets
Aggregative controls involving people, process, and technology
Ensure the proper utilization, ROI and audits of purchased devices

[zaasmi]

What are the three types of redundant site models in an enterprise network?
Hot site, cold site and warm site
Primary site, secondary site and DR site
Highly available site, fault tolerant site and DR site
Both a & b

[zaasmi]

Anthem insurance breach 2014 was initiated through?
Windows vulnerability
Phishing email
Man in the middle attack
Sql injection attack

[zaasmi]

What do you mean by RTO in a business continuity plan?
Minimum frequency of backups
Maximum downtime an organization can handle
Maximum age of files that an organization must recover from backup storage for normal operations to resume after disaster
Both a & b

[zaasmi]

The 4 layer security transformation model and isms requirements and controls__________________.
Are both separate security programs
Are both separate security projects
May form essential elements of the security program
None of the given