Читаем CISSP Practice полностью

Mirroring, shadowing, and duplexing provide application system redundancy, not network redundancy. Mirroring refers to copying data as it is written from one device or machine to another. Shadowing is where information is written in two places, one shadowing the other, for extra protection. Any changes made will be reflected in both places. Journaling is a chronological description of transactions that have taken place, either locally, centrally, or remotely.

120. Which of the following controls prevents a loss of data integrity in a local-area-network (LAN) environment?

a. Data mirroring and archiving

b. Data correction

c. Data vaulting

d. Data backup

120. a. Data mirroring refers to copying data as it is written from one device or machine to another. It prevents data loss. Data archiving is where files are removed from network online storage by copying them to long-term storage media such as optical disks, tapes, or cartridges. It prevents accidental deletion of files.

Data correction is incorrect because it is an example of a corrective control where bad data is fixed. Data vaulting is incorrect because it is an example of corrective control. It is a way of storing critical data offsite either electronically or manually. Data backup is incorrect because it is an example of corrective control where a compromised system can be restored.

121. In general, a fail-over mechanism is an example of which of the following?

a. Corrective control

b. Preventive control

c. Recovery control

d. Detective control

121. c. Fail-over mechanism is a backup concept in that when the primary system fails, the backup system is activated. This helps in recovering the system from a failure or disaster.

122. Which of the following does not trigger zero-day attacks?

a. Malware

b. Web browsers

c. Zombie programs

d. E-mail attachments

122. c. A zombie is a computer program that is installed on a personal computer to cause it to attack other computers. Attackers organize zombies as botnets to launch denial-of-server (DoS) attacks and distributed DoS attacks, not zero-day attacks. The other three choices trigger zero-day attacks.

With zero-day (zero-hour) attacks, attackers try to exploit computer application vulnerabilities that are unknown to system owners and system administrators, undisclosed to software vendors, or for which no security fix is available. Malware writers can exploit zero-day vulnerabilities through several different attack vectors to compromise attacked systems or steal confidential data. Web browsers are a major target because of their widespread distribution and usage. Hackers send e-mail attachments to exploit vulnerabilities in the application opening the attachment and send other exploits to take advantage of weaknesses in common file types.

123. TEMPEST is used for which of the following?

a. To detect electromagnetic disclosures

b. To detect electronic dependencies

c. To detect electronic destructions

d. To detect electromagnetic emanations

123. d. TEMPEST is a short name, and not an acronym. It is the study and control of spurious electronic signals emitted by electrical equipment. It is the unclassified name for the studies and investigations of compromising electromagnetic emanations from equipment. It is suggested that TEMPEST shielded equipment is used to prevent compromising emanations.

124. Which of the following is an example of directive controls?

a. Passwords and firewalls

b. Key escrow and software escrow

c. Intrusion detection systems and antivirus software

d. Policies and standards

124. d. Policies and standards are an example of directive controls. Passwords and firewalls are an example of preventive controls. Key escrow and software escrow are an example of recovery controls. Intrusion detection systems and antivirus software are an example of detective controls.

125. Which of the following control terms can be used in a broad sense?

a. Administrative controls

b. Operational controls

c. Technical controls

d. Management controls

125. d. Management controls are actions taken to manage the development, maintenance, and use of the system, including system-specific policies, procedures, and rules of behavior, individual roles and responsibilities, individual accountability, and personnel security decisions.