Protection of Information Assets Flashcards

Which encryption mode is most appropriate for encrypting large amounts of data where parallel processing is desired?

Answer: Counter (CTR)

Counter (CTR) mode allows parallel encryption and decryption of blocks, making it ideal for large data sets.

A data owner is PRIMARILY responsible for which of the following?

Answer: Classifying data and defining access rules

The data owner is accountable for classifying information and establishing appropriate access control policies.

Which of the following BEST describes a rainbow table attack?

Answer: Using precomputed hash values to reverse password hashes

A rainbow table attack uses precomputed tables of hash values to quickly reverse hashed passwords.

An organization wants to ensure that sensitive data cannot be recovered after hard drive disposal. Which method provides the STRONGEST assurance?

Answer: Physical destruction of the drive

Physical destruction (shredding, crushing) provides the strongest assurance that data cannot be recovered from disposed media.

Which access control model assigns permissions based on the sensitivity label of information and the security clearance of users?

Answer: Mandatory Access Control (MAC)

Mandatory Access Control (MAC) uses security labels and clearances to govern access, and is common in government/military environments.

A security information and event management (SIEM) system is PRIMARILY used to:

Answer: Aggregate and correlate security events for real-time analysis

SIEM systems collect, aggregate, and correlate log and event data from multiple sources to detect and alert on security incidents.

Which of the following is the MOST effective control to prevent unauthorized changes to firewall rule sets?

Answer: Change management process with mandatory peer review

A formal change management process with peer review ensures firewall changes are authorized, tested, and documented before implementation.