Correct answer:

Disaster recovery and fault tolerance are not the same thing. Disaster recovery helps an organization recover after a disaster. Fault tolerance helps ensure that a system or component continues to function after a failure.

Incorrect answers:

Disaster recovery and fault tolerance are not the same.

A business continuity plan includes a disaster recovery plan (DRP), but a disaster recovery plan does not include a business continuity plan.

A business continuity plan includes a business impact analysis.

Correct answers:

RAID-1 is a mirror, RAID-5 is striping with parity, and RAID-10 combines the fault tolerance of RAID-1 with the performance improvements of RAID-0.

Incorrect answer:

RAID-0 is known as striping and does not provide fault tolerance. It does provide improvements in read and write performance.

Correct answer:

UDP resides in the Transport layer of the OSI model. It’s a connectionless protocol that doesn’t offer any error control or delivery proof. Remember the concept of ports that exist at this layer. While IP addresses are used at the Network layer (i.e., used by the IP protocol), ports are used at the Transport layer by both TCP and UDP.

Incorrect answers:

The Application layer is used to interact with any network application and protocol, like FTP, SSH, DNS and POP.

The Network layer uses IP addresses and is commonly utilized by protocols like IPSEC, RIP, EIGRP, and OSPF.

The Link layer is used in the TCP/IP model, not the OSI.

Correct answer:

A security incident can be defined as a policy violation resulting in an adverse event (i.e., a user breaching the AUP policy and browsing to a social media website where malware is hosted, resulting in execution of a malicious file on a corporate machine).

Incorrect answers:

A security alert usually refers to some type of activity that requires the attention of a security analyst or system administrator and is usually produced when a related rule is triggered within some type of security tool.

The term intrusion refers to some type of unwarranted access into a network, system, or database.

An anomaly is defined as any activity that indicates a deviation from standard behavior.

Correct answer:

Confidentiality refers to information being accessible only by authorized individuals, and in this case, Alex is not authorized to access John’s salary or his personal details. If the attached file had been encrypted and password protected (with the password sent to John only), this issue would have been avoided, as then only John would be able to access the file in question.

Incorrect answers:

Availability refers to appropriate individuals being able to access necessary resources whenever they need them, which doesn’t relate to the information disclosure issue mentioned in the question.

Integrity refers to being able to detect any unauthorized data alteration, and in this case no data alteration took place.

“separation of duties” refers to not allowing one individual full control of a critical process and aims to reduce fraud, which is not applicable to this scenario.

Correct answer:

The business continuity plan (BCP) provides the information to keep critical functions running during a disaster (such as how to move critical functions to an alternate location).

Incorrect answers:

A disaster recovery plan (DRP) is part of a BCP. A DRP has a narrower focus than a BCP and identifies how one or more individual systems can be recovered after a failure.

Correct answer:

Transport Layer Security (TLS) uses asymmetric encryption to share the session key privately, and then TLS uses symmetric encryption to encrypt session data.

Incorrect answers:

TLS doesn’t use symmetric or asymmetric encryption exclusively, but uses both.

Hashing uses a one-way function, not encryption.

Correct answers:

A warning banner will often provide a definition of an authorized user, an expectation of privacy, and a reminder about security policies.

Incorrect answer:

Personally identifiable information (PII) is any information that can be used to distinguish or trace an individual’s identity and should not be displayed in a warning banner. If an attacker gains access to a user’s account, the attacker would then be able to access the PII just by logging in if PII were included in the warning banner.

Correct answer:

A LAND attack causes a target machine to continuously send traffic to itself, since the packets have both the source and destination IP address configured to match the victim’s IP address.

Incorrect answers:

A ping of death attack changes the size of a ping packet to 64KB or more, which has been known to cause crashes (especially to machines with older operating systems).

A fraggle attack works by using UDP packets while spoofing the source IP address so it becomes the address of the victim. It targets UDP 7 (echo protocol, which will make the operation work similarly with ping) or UDP 19 (chargen protocol, which will make the target system respond with a random character when it receives traffic over that port).

A salami attack aims at taking advantage of small actions that may lead to a large outcome when combined.

Correct answers:

Policies should be easy to read, and it’s common to remind users of the contents with warning banners and to provide training to users on various elements of the policy.

Incorrect answer:

It should be no more than a single page long is incorrect. There are no specific requirements on length for security policies. It’s not uncommon for a security policy to be between 10 and 50 pages for different-sized organizations.