Term
| 1. What is the most common form of authentication? a) password b) PIN c) digital certificates d) smart cards |
|
Definition
| Answer: a Difficulty: Easy Section Reference: Understanding Security Policies Explanation: Much of today’s data protection is based on the password. You use passwords to secure your voice mail, ATM access, email account, Facebook account, and a host of other things. |
|
|
Term
2. Anytime you use a password, you should make it ___________.
a) constantly changing
b) migrating
c) strong
d) simple |
|
Definition
Answer: c
Difficulty: Easy
Section Reference: Using Password Policies to Enhance Security
Explanation: One basic component of your information security program is ensuring that all employees select and use strong passwords. The strength of a password can be determined by looking at the password’s length, complexity, and randomness. |
|
|
Term
3. What do you call a password that is at least seven characters long and uses three of the following categories (uppercase, lowercase, numbers, and special characters)?
a) healthy password
b) migrating password
c) standard password
d) complex password |
|
Definition
Answer: d
Difficulty: Easy
Section Reference: Using Password Complexity to Make a Stronger Password
Explanation: Password complexity involves the characters used to make up a password. A complex password uses characters from at least three of the following categories:
• English uppercase characters (A through Z)
• English lowercase characters (a through z)
• Numeric characters (0 through 9)
• Nonalphanumeric characters (!, @, #, $, %, ^, &, and so on)
It should also be a minimum of six characters and not use the user’s name in the password. |
|
|
Term
4. What do you use to define how long a password is in Windows?
a) registry
b) Users applet in the Control Panel
c) group policies
d) NTFS files |
|
Definition
Answer: c
Difficulty: Medium
Section Reference: Using Password Group Policies to Enforce Security
Explanation: A Group Policy Object (GPO) is a set of rules that give an administrator granular control over the configuration of objects in Active Directory (AD), including user accounts, operating systems, applications, and other AD objects. GPOs are used for centralized management and configuration of the Active Directory environment. This will also include defining password parameters. |
|
|
Term
5. Which of the following is not a complex password?
a) Platter*SAN
b) John!Taylor
c) Password01
d) ThereisTimetoLive&Die |
|
Definition
Answer: b
Difficulty: Easy
Section Reference: Using Password Complexity to Make a Stronger Password
Explanation: You should never use the user name as part of the password. |
|
|
Term
6. What settings are used to keep track of incorrect logon attempts and lock the account if too many attempts are detected within a certain set time?
a) account lockout
b) password policy
c) authentication tracker
d) user parameters |
|
Definition
Answer: a
Difficulty: Medium
Section Reference: Using Account Lockout to Prevent Hacking
Explanation: Account lockout refers to the number of incorrect logon attempts permitted before a system locks an account. Each bad logon attempt is tracked by the bad logon counter, and when the counter exceeds the account lockout threshold, no further logon attempts are permitted. This setting is critical because one of the most common password attacks involves repeatedly attempting to log on with guessed passwords. |
|
|
Term
7. What setting is used to prevent users from reusing the same password over and over?
a) minimum password age
b) maximum password age
c) password history
d) account lockout |
|
Definition
Answer: c
Difficulty: Easy
Section Reference: Using Password History to Enforce Security
Explanation: Password history is the setting that determines the number of unique passwords that must be used before a password can be reused. This setting prevents users from recycling the same passwords through a system. The more often a password is used, the greater the chances it can be compromised. |
|
|
Term
8. What prevents users from changing a password multiple times so that they can change it to their original password?
a) minimum password age
b) maximum password age
c) password history
d) account lockout |
|
Definition
Answer: a
Difficulty: Medium
Section Reference: Setting the Time between Password Changes
Explanation: The minimum password age setting controls how many days users must wait before they can reset their password. This setting can be a value from one to 998 days. If set to 0, passwords can be changed immediately. Although this seems to be a fairly innocent setting, too low a value could allow users to defeat your password history settings. |
|
|
Term
9. What setting forces users to change their password?
a) minimum password age
b) maximum password age
c) password history
d) account lockout |
|
Definition
Answer: b
Difficulty: Easy
Section Reference: Setting the Time between Password Changes
Explanation: The maximum password age setting controls the maximum period of time that can elapse before you are forced to reset your password. This setting can range from one to 999 days, or it can be set to 0 if you never want passwords to expire. |
|
|
Term
10. What type of attack tries to guess passwords by trying common words?
a) dictionary attack
b) brute-force attack
c) man-in-the-middle attack
d) smurf attack |
|
Definition
Answer: a
Difficulty: Easy
Section Reference: Examining Dictionary and Brute Force Attacks
Explanation: A dictionary attack uses a dictionary containing an extensive list of potential passwords that the attacker then tries with a user ID in an attempt to guess the appropriate password. The earliest versions of this type of attack actually used lists of words from the dictionary as the basis of logon attempts |
|
|
Term
11. What type of attack tries to guess passwords by every combination of characters?
a) dictionary attack
b) brute-force attack
c) man-in-the-middle attack
d) smurf attack |
|
Definition
Answer: b
Difficulty: Easy
Section Reference: Examining Dictionary and Brute Force Attacks
Explanation: Another, more crude type of attack—called a brute-force attack—doesn’t rely on lists of passwords, but rather tries all possible combinations of permitted character types. Although this type of attack was historically considered ineffective, improvements in processor and network performance have made it more useful, although not nearly as effective as a dictionary attack. |
|
|
Term
12. What malicious software captures every keystroke and sends it to a hacker?
a) dictionary software
b) password leaker
c) keylogger
d) sniffer |
|
Definition
Answer: c
Difficulty: Easy
Section Reference: Looking at Physical Attacks
Explanation: Anytime your computer can be physically accessed by an attacker, that computer is at risk. Physical attacks on your computer can completely bypass almost all security mechanisms, such as by capturing the passwords and other critical data directly from the keyboard when a software or hardware keylogger is used. In fact, if your encryption key passes through a keylogger, you might find that even your encrypted data is jeopardized |
|
|
Term
13. What type of software can you use to view usernames and passwords broadcasted over the network?
a) dictionary software
b) password leaker
c) keylogger
d) sniffer |
|
Definition
Answer: d
Difficulty: Medium
Section Reference: Examining Network and Wireless Sniffers
Explanation: Sniffers are specially designed software (and in some cases hardware) applications that capture network packets as they traverse a network, displaying them for the attacker. Sniffers are valid forms of test equipment, used to identify network and application issues, but the technology has been rapidly co-opted by attackers as an easy way to grab logon credentials. |
|
|
Term
14. What is the generally accepted minimum password length?
a) 4
b) 6
c) 8
d) 12 |
|
Definition
Answer: c
Difficulty: Medium
Section Reference: Looking at Password Length
Explanation: The length of a password is a key component of its strength. Password length is the number of characters used in a password. A password with two characters is considered highly insecure, because a very limited set of unique passwords can be made using two characters. Therefore, a two-character password is considered easy to guess. On the other side of the spectrum is the 14-character password. Although extremely secure relative to a two-character password, a 14-character password is difficult for most users to remember. The generally accepted minimum password length is eight characters. |
|
|
Term
15. What are the only passwords that should not expire?
a) administrator accounts
b) power users
c) service accounts
d) standard user |
|
Definition
Answer: c
Difficulty: Medium
Section Reference: Setting the Time Between Password Changes
Explanation: Passwords should always expire, except in extremely unique circumstances, such as service accounts for running applications. Although this may add administrative overhead to some processes, passwords that don’t expire can be a serious security issue in virtually all environments. |
|
|
Term
16. Which of the following should users not do when dealing with passwords?
a) Avoid allowing other users from seeing you type in your password.
b) Write down your password on a piece of paper and keep it near your computer.
c) Do not use names of children and pets.
d) Do not give your password to your co-workers
e) b, c, and d |
|
Definition
Answer: e
Difficulty: Easy
Section Reference: Understanding Common Attack Methods
Explanation: Don’t use common items that represent you, such as names of children, spouses, girlfriends, and pets. Protect your password by not giving it to other people and avoid allowing people from seeing you type in your password. Don’t write your password on paper. |
|
|
Term
| 17. What might happen if you require passwords to be too long? |
|
Definition
Answer: Users will try to circumvent the password.
Difficulty: Medium
Section Reference: Examining Dictionary and Brute Force Attacks
Explanation: A 14-character password is difficult for most users to remember. When passwords become this long, users often start breaking out the note paper and writing down their passwords, which defeats any security benefits you may have established by requiring a 14-character password in the first place. |
|
|
Term
| 18. What limits how fast a password for an encrypted file is cracked? |
|
Definition
Answer: The speed of your computer, particularly your processor
Difficulty: Medium
Section Reference: Examining Dictionary and Brute Force Attacks
Explanation: Passwords stored in an encrypted state are harder to break than passwords stored in clear text or in a hashed state. However, with today’s computing power, even encrypted password stores are being compromised by password-cracking attacks. |
|
|
Term
| 19. What steps can you do to prevent someone from hacking your password? |
|
Definition
Answer: Use strong passwords and change them frequently.
Difficulty: Medium
Section Reference: Examining Dictionary and Brute-Force Attacks
Explanation: Dictionary and brute-force attacks tend to be most successful when a password’s length is seven characters or less. Each additional character adds a significant number of possible passwords. Such attacks are often successful because users sometimes use common words with the first letter capitalized and then append a number to meet the complexity guidelines. These are the easiest passwords for users to remember, but they are also the easiest for an attacker to compromise. |
|
|
Term
| 20. What is used to prevent someone from guessing a password multiple times? |
|
Definition
Answer: account lockout settings
Difficulty: Hard
Section Reference: Examining Dictionary and Brute Force Attacks
Explanation: The account lockout settings are a critical defense against guessing a password, because an account lockout will either slow or even stop a brute-force attack in its tracks after the configured number of incorrect logon attempts is reached. |
|
|
