SEC 571 Week 8 Final Exam

Multiple Choice & Essay:

1. (TCO A) You are responsible for developing a security evaluation process that can …. used to assess various operating systems both during and after development. List the five most desirable qualities your evaluation process should have and explain why they are important. (Be sure to address qualities of the evaluation process, not specific metrics for assessment of operating systems.)
2. (TCO B) The Open Systems Interconnection model is inherently inefficient. On the source host, each layer must take the work of higher layers, add some result, and pass the work to lower layers. On the destination host, each layer must process these results from lower layers and pass the appropriate information to upper layers. Surely this wrapping and unwrapping process is inefficient. Assess the security advantage of this layered approach.
3.  (TCO C) Why is a firewall usually a good place to terminate a Virtual Private Network (VPN) connection from a remote user?……..? Under what circumstances would VPN termination at the server be a good idea?
4. (TCO D) A computer programmer……arraigned for a computer crime. She is….. of having accessed system files on a public Web server. The programmer’s attorney argues that his client was only trying to determine if the website was secure and that no harm was…..to the Web server or its system files. The programmer’s attorney also argues that it is possible that the log files that show……What is your analysis of these arguments?
5. (TCO E) After reading about attacks on servers similar to the ones used in one of your company’s departments, the CIO has asked you to come up with a report as to what, if any, steps should ….. taken with your servers. List and describe the steps you would need to take in order to complete a detailed report.
6. (TCO F) In the U.S., laws are enforced by police agencies and the courts. What are ethics and who enforces them?
7. (TCO G) Which of the following statements is true?
8. (TCO H) Some IT department policies are designed to prevent behaviors by IT staff. While some depend upon the employee voluntarily complying with the policy (for example: do not reveal technical information to outside parties), others are enforced technically (for example, authentication required for system access). What is an example of a policy that technically enforces ethical behavior by IT staff? Provide policy wording for your example.