MULTIPLE CHOICE QUESTIONS:

1. _________ are a collection of string values inherited by each process from its parent that can affect the way a running process behaves.

A. Race conditions B. Deadlocks C. Privileges D. all of the above E. None of the above

2. Windows Vista and later add two other functions. The first is that the firewall is a ______________ of the rewritten TCP/IP networking stack. Second, the firewall supports optionally blocking outbound. A. fully integrated component B. 50% integrated component model C. partially integrated component D. None of the above

3. ______ systems should not run automatic updates because they may possibly introduce instability. A. Change controlled B. Policy controlled C. Configuration controlled D. Process controlled E. None of the above

4. ___________ does its business (covering the tracks of attackers) in kernel space, intercepting system calls pertaining to any users attempts to view the intruders resources. A. A MKLKM rootkit B. A MKLKM sourcekit C. An LKM rootkit D. None of the above

5. SELinux is a ____________ implementation that doesn't prevent zero-day attacks, but it's specifically designed to contain their effects. A. mandatory access B. fully access control C. mandatory access control D. None of the above

6. ________ involve buffers located in the programs global (or static) data area. A. Heap overflows B. Stack buffer overflows C. Global Data Area Overflows D. Position overflows

7. In SELinux objects include not only files and directories but also other processes and various system resources in ______________. A. kernel space only B. both kernel space and userland C. remote RAID, USB flash memory and network storage. D. None of the above

8. __________ will integrate with the operating system of a host computer and monitor program behavior in real time for malicious actions. A. Fingerprint-based scanners B. Action-blocking scanners C. Generic decryption technology D. Heuristic scanners E. None of the above

9. A ___________ is a root-owned program with its setuid bit set; that is, a program that runs as root no matter who executes it. A. setgid root program B. setsid root program C. setuid root program D. None of the above

10. A __________ attack is a bot attack on a computer system or network that causes a loss of service to users. A. spam B. phishing C. DDoS D. sniff E. None of the above

11. Due to a history of abuse against setuid root programs, major Linux distributions no longer ship with unnecessary setuid-root programs. But ______________ for them. A. system attackers still could not scan B. system attackers still scan C. system attackers still embed D. None of the above

12. SELinux implements different types of MAC: ________________________. A. Style Enforcement, and Role Based Access Controls, B. Multi Level Security, Role Based Access Controls and Type Enforcement, C. Multi Task Level Security D. None of the above

13. __________ is malware that encrypts the users data and demands payment in order to access the key needed to recover the information. A. Trojan horse B. Ransomware C. Crimeware D. Polymorphic E. None of the above

14. ______ are resources that should be used as part of the system security planning process. A. Texts B. Online resources C. Specific system hardening guides D. All of the above E. None of the above

15. Versions of Windows based on the Windows 95 code base, including Windows 98, Windows 98 SE, and Windows Me, had ____________, in contrast to the Windows NT code base, on which all current versions of Windows are based. A. security model B. token model C. two security models D. None of the above

16. In Linux system, a vulnerability is a specific weakness or security-related bug in an application or operating system. A threat is the combination of a vulnerability, an attacker, and _________________. A. None of the above B. a weakness vector C. an attack and vulnerability vector D. an attack vector

17. A runtime technique that can be used is to place ________ between critical regions of memory in a processes address space. A. guard pages B. library functions C. shellcodes D. MMUs E. None of the above

18. _______ defenses involve changes to the memory management of the virtual address space of processes that act to either alter the properties of regions of memory or to make predicting the location of target buffers sufficiently difficult to thwart many types of attacks. A. Run-time B. Position independent C. Buffer D. Compile-time E. None of the above

19. Windows Vista and later changes the default; all user accounts are users and not administrators. This is referred to as ______________ A. User Control Account (UCA.) B. Tolerance User Account Control (TUAC.) C. Preventive User Account Control (PUAC.) D. None of the above

20. The most common variant of injecting malicious script content into pages returned to users by the targeted sites is the _________ vulnerability. A. PHP file inclusion B. chroot jail C. atomic bomb D. XSS reflection E. None of the above