Which of the following are included in Technical Controls? Each correct answer represents a complete solution. Choose all that apply.

1. A. Identification and authentication methods
2. B. Configuration of the infrastructure
3. C. Password and resource management
4. D. Implementing and maintaining access control mechanisms
5. E. Security devices
6. F. Conducting security-awareness training

Correct Answer: ABCDE
Technical Controls are also known as Logical Controls. These controls include the following: Implementing and maintaining access control mechanisms Password and resource management Identification and authentication methods Security devices Configuration of the infrastructure Answer F is incorrect. It is a part of Administrative Controls.

In which of the following cryptographic attacking techniques does an attacker obtain encrypted messages that have been encrypted using the same encryption algorithm?

1. A. Chosen plaintext attack
2. B. Chosen ciphertext attack
3. C. Ciphertext only attack
4. D. Known plaintext attack

Correct Answer: C
In a ciphertext only attack, an attacker obtains encrypted messages that have been encrypted using the same encryption algorithm.

Which of the following is the process of finding weaknesses in cryptographic algorithms and obtaining the plaintext or key from the ciphertext?

1. A. Cryptographer
2. B. Cryptography
3. C. Kerberos
4. D. Cryptanalysis

Correct Answer: D
Cryptanalysis is the process of analyzing cipher text and finding weaknesses in cryptographic algorithms. These weaknesses can be used to decipher the cipher text without knowing the secret key. Answer B is incorrect. Kerberos is an industry standard authentication protocol used to verify user or host identity. Kerberos v5 authentication protocol is the default authentication service for Windows 2000. It is integrated into the administrative and security model, and provides secure communication between Windows 2000 Server domains and clients. Answer A is incorrect. A cryptographer is a person who is involved in cryptography.
Answer B is incorrect. Cryptography is a branch of computer science and mathematics. It is used for protecting information by encoding it into an unreadable format known as cipher text.

The Data and Analysis Center for Software (DACS) specifies three general principles for software assurance which work as a framework in order to categorize various secure design principles. Which of the following principles and practices does the General Principle 1 include? Each correct answer represents a complete solution. Choose two.

1. A. Principle of separation of privileges, duties, and roles
2. B. Assume environment data is not trustworthy
3. C. Simplify the design
4. D. Principle of least privilege

Correct Answer: AD
General Principle 1- Minimize the number of high-consequence targets includes the following principles and practices:
Principle of least privilege Principle of separation of privileges, duties, and roles Principle of separation of domains Answer B is incorrect. Assume environment data is not trustworthy principle is included in the General Principle 2. Answer B is incorrect. Simplify the design principle is included in the General Principle 3.

FITSAF stands for Federal Information Technology Security Assessment Framework. It is a methodology for assessing the security of information systems. Which of the following FITSAF levels shows that the procedures and controls have been implemented?

1. A. Level 2
2. B. Level 3
3. C. Level 5
4. D. Level 1
5. E. Level 4

Correct Answer: B
The following are the five levels of FITSAF based on SEI's Capability Maturity Model (CMM): Level 1: The first level reflects that an asset has documented a security policy. Level 2: The second level shows that the asset has documented procedures and controls to implement the policy. Level 3: The third level indicates that these procedures and controls have been implemented. Level 4: The fourth level shows that the procedures and controls are tested and reviewed. Level 5: The fifth level is the final level and shows that the asset has procedures and controls fully integrated into a comprehensive program.