156-110 Check Point Certified Security Principles Associate (CCSPA) Questions and Answers

Covert channel

Integrity axiom

Simple rule violation

Inferred fact

Aggregated data set

Eliminate the testing phase of change control.

Read the release notes.

Refuse to install the service pack.

Install the service pack on all production database servers.

Install the service pack on a database server, in a test environment.

Lock

Access control list

Background check

Token

Firewall

Role-based

Administrative

Technical

Physical

Mandatory

Encryption

Checksum

Data hashes

Redundant servers

Security by obscurity

Penetration testing

Exploitation

Baselining

A vulnerability

A countermeasure

Nothing

Do not log and drop the traffic.

Log and drop the traffic.

Log and pass the traffic.

Do not log and pass the traffic.

Centralized access management

Role-based access management

Hybrid access management

Decentralized access management

Privileged access management

Value-added network

Wide-area network

Campus-area network

Metropolitan-area network

Local-area network

Security-awareness training

Information Security (INFOSEC) briefings

Acceptable-use policies

Continuing education

Nondisclosure agreements

Annualized Rate of Occurrence

Single Loss Expectancy

Annualized Loss Expectancy

Business Impact Analysis

Business Continuity Plan

Most small businesses employ a full-time information-technology staff.

Resources are available as needed.

Small businesses have security personnel on staff.

Most employees have experience with information security.

Security budgets are very small.

Preventing modification of restricted information

Using restricted programs, to access databases and other information resources

Allowing access from any location

Preventing access to any network resource, other than those explicitly permitted

Viewing inventory levels for partner products only

Partial-knowledge test

Full-knowledge test

Zero-knowledge test

Run the sample exploit against a test server.

Run the sample exploit against a production server.

Apply the patch to all production servers.

Test the patch on a production server.

Test the patch on a non-production server.

Elevate

Assume

Deny

Transfer

Mitigate

Technologies and methods used to monitor and enforce the organization's policies

Senior management and business-unit owner responsibilities and delegation options

Clear, legally defensible definition of what constitutes a business record

Consequences for violation of the organization's acceptable-use policy

No expectation of privacy for e-mail communications, using the organization's resources

Discover the information daily activities yield.

Meet with adversaries.

Perform business impact analysis surveys.

Scrutinize their organizations' daily activities.

Analyze indicators, to determine the information an adversary can glean ?both from routine and nonroutine activities.

AES

Blowfish

DES

CAST

Triple DES

False Rejection Rate

User Acceptance Rate

Crossover Error Rate

False Acceptance Rate

Enrollment Failure Rate

Information systems

Shipping and receiving

Marketing

Requesting department

Chief Information Officer

Leased-line security

Salami attacks

Unauthorized network connectivity

Distributed denial-of-service attacks

Secure access to remote organizational resources

When new functional users join an organization

On the anniversary of the procedures' implementation

Each time procedures are used

Whenever business processes are modified

When new exploits and attacks are discovered

Discretionary

Hybrid

Mandatory

Role-based

Nondiscretionary

Parallel

Full interruption

Checklist

Structured walkthrough

Simulation

To allow resources to be shared among employees

To allow appropriate collaboration, and prevent inappropriate resource sharing

To prevent appropriate collaboration

To provide authentication services

To prevent the generation of audit trails from gateway devices

The review and maintenance of security policies should be tied to the performance evaluations of accountable individuals.

Review requirements should be included in the security policies themselves.

When business requirements change, security policies should be reviewed to confirm that policies reflect the new business requirements.

Functional users and information custodians are ultimately responsible for the accuracy and relevance of information security policies.

In the absence of changes to business requirements and processes, information-security policy reviews should be annual.