Correct answer:

Data in motion (sometimes called data in transit) is any data being transmitted over a network.

Incorrect answers:

Data in motion is being actively used.

Data at rest is any data that is in computer storage, such as on system hard drives, portable USB drives, flash drives, storage area networks, backup tapes, and so on.

Data in motion may be encrypted with an encryption protocol such as Transport Layer Security (TLS) or Internet Protocol security (IPsec), but unencrypted data can also be data in motion.

Correct answer:

You should recommend this control because the cost of the control is less than the savings provided by the control. The control will reduce the annual rate of occurrence (ARO) to two. With the single loss expectancy (SLE) at $3,500, this results in a new annual loss expectancy (ALE) of $7,000 (ARO of 2 × SLE of $3,500). The original ALE without the control is $24,500 (ARO of 7 × SLE of $3,500). In other words, the control provides a savings of $17,500 ($24,500 – $7,000). Even after paying $10,000 for the control, the organization saves $7,500.

Incorrect answers:

The ALE is reduced by $17,500, not by $24,500. Even though the risk is not eliminated, the control still provides cost benefits. The cost of the control is not greater than the savings provided by the control.

Correct answer:

The Common Vulnerability Scoring System (CVSS) is an open standard that organizations can use to assess the severity of computer system security vulnerabilities.

Incorrect answers:

The National Institute of Standards and Technology (NIST) publishes many documents that are freely available, but NIST is an organization, not an open standard.

The International Organization for Standardization (ISO) is an organization that publishes standards.

A business impact analysis (BIA) identifies critical functions as part of a business continuity plan (BCP).

Correct answer:

Because zombies check in with a botnet’s command and control center, checking the firewall logs on the network may show these connections.

Incorrect answers:

If antivirus software detected the botnet activity, the software should report the activity without taking any additional action.

Although it’s possible to check the firewall logs on each individual computer, that would be much more time-consuming than checking the firewall logs on the network firewall.

Correct answer;

The Discretionary Access Control (DAC) model allows users to assign permissions at the granular level.

Incorrect answers:

The Mandatory Access Control (MAC) model uses labels and the Role-based Access Control (Role-BAC) model uses roles or groups, but neither allows the users to assign permissions at the granular level.

Kerberos is a network authentication protocol that uses tickets.

Correct answer:

The False Reject Rate (FRR, also called type 1 error) refers to the percentage of times that a biometric system falsely rejects a known user and instead indicates that the user is unknown.

Incorrect answers:

The False Accept Rate (FAR, also called type 2 error) refers to the percentage of times a biometric system falsely identifies an unknown user as a known user.

The Crossover Error Rate (CER) identifies the point where the FAR and FRR of a biometric system are equal or cross over each other on the chart.

A lower CER indicates a better performing biometric system. Mandatory Access Control (MAC) is an access control model.

Correct answer:

Policies are high-level documents, are authoritative in nature, and provide overall direction.

Incorrect answers:

Procedures and guidelines are derived from policies.

Guidelines provide recommendations but are not authoritative.

Rules can be derived from policies.

Correct answer:

This indicates a remote access Trojan (RAT) has been installed on the server, granting the attacker access to the server from a remote location.

Incorrect answers:

The unauthorized accounts with administrative privileges are likely backdoors created by the attacker, but the backdoors didn’t allow the original remote access.

A virus may have infected the system and installed the RAT, but the scenario doesn’t give enough information to make this determination.

Sandboxing runs computer programs in isolated areas of memory as a security control, and is unlikely to install a RAT.

Correct answer:

Administrative security controls include user training and written documents such as security policies.

Incorrect answers:

A technical control is a control that uses technical means within computer systems to reduce risk.

A physical control is a control that you can touch.

Administrative, technical, and physical controls can all be preventive in nature.

Correct answer:

Drive-by downloads are any downloads that occur without the user’s knowledge, and many phishing e-mails have links to sites that attempt a drive-by download. A drive-by download will typically attempt to install malware on the user’s system.

Incorrect answers:

The website probably shouldn’t be trusted, but that’s not what caused the problem.

A masked e-mail shows a different URL than the actual link, but there’s no indication that was the case.

If a virus was in an attachment, the user would need to open the attachment.