Section: Protection of Information Assets
Explanation:
Dial-up connectivity not based on centralize control and least preferred from security and control standpoint.
Remote access user can connect remotely to their organization's networks with the same level of functionality as if they would access from within their office.
In connecting to an organization's network, a common method is to use dial-up lines. Access is granted through the organization's network access server (NAS) working in concert with an organization network firewall and router. The NAS handle user authentication, access control and accounting while maintaining connectivity. The most common protocol for doing this is the Remote Access Dial-In User Service (RADIUS) and Terminal Access Controller Access Controller System (TACACS).
Remote access Controls include:
Policy and standard
Proper authorization
Identification and authentication mechanism
Encryption tool and technique such as use of VPN
System and network management
Reference:
CISA Review Manual 2014 Page number 334

Section: The process of Auditing Information System

Section: Protection of Information Assets
Explanation/Reference:
Reflected attack involves sending forged requests to a large number of computers that will reply to the
requests. The source IP address is spoofed to that of the targeted victim, causing replies to flood.
A distributed denial of service attack may involve sending forged requests of some type to a very large
number of computers that will reply to the requests. Using Internet Protocol address spoofing, the source
address is set to that of the targeted victim, which means all the replies will go to (and flood) the target.
(This reflected attack form is sometimes called a "DRDOS".
ICMP Echo Request attacks (Smurf Attack) can be considered one form of reflected attack, as the flooding
host(s) send Echo Requests to the broadcast addresses of mix-configured networks, thereby enticing hosts
to send Echo Reply packets to the victim. Some early DDoS programs implemented a distributed form of
this attack.
In the surf attack, the attacker sends an ICMP ECHO REQUEST packet with a spoofed source address to
a victim's network broadcast address. This means that each system on the victim's subnet receives an
ICMP ECHO REQUEST packet. Each system then replies to that request with an ICMP ECHO REPLY
packet to the spoof address provided in the packets-which is the victim's address. All of these response
packets go to the victim system and overwhelm it because it is being bombarded with packets it does not
necessarily know how to process. The victim system may freeze, crash, or reboot. The Smurf attack is
illustrated in Figure below:
surf-attack

The following answers are incorrect:
Brute force attack - Brute force (also known as brute force cracking) is a trial and error method used by
application programs to decode encrypted data such as passwords or Data Encryption Standard (DES)
keys, through exhaustive effort (using brute force) rather than employing intellectual strategies. Just as a
criminal might break into, or "crack" a safe by trying many possible combinations, a brute force cracking
application proceeds through all possible combinations of legal characters in sequence. Brute force is
considered to be an infallible, although time-consuming, approach.
Buffer overflow - A buffer overflow occurs when a program or process tries to store more data in a buffer
(temporary data storage area) than it was intended to hold. Since buffers are created to contain a finite
amount of data, the extra information - which has to go somewhere - can overflow into adjacent buffers,
corrupting or overwriting the valid data held in them. Although it may occur accidentally through
programming error, buffer overflow is an increasingly common type of security attack on data integrity.
Pulsing Zombie - A Dos attack in which a network is subjected to hostile pinging by different attacker
computer over an extended time period.
Following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 322

Section: Protection of Information Assets
Explanation:
Authenticating the site to be surfed is the primary goal of a web certificate. Authentication of a user is achieved through passwords and not by a web site certificate. The site certificate does not prevent hacking nor does it authenticate a person.

Explanation/Reference:
Explanation:
Firewall systems are the primary tool that enable an organization to prevent unauthorized access between networks. An organization may choose to deploy one or more systems that function as firewalls. Routers can filter packets based on parameters, such as source address, but are not primarily a security tool.
Based on Media Access Control (MAC) addresses, layer 2 switches separate traffic in a port as different segments and without determining if it is authorized or unauthorized traffic. A virtual LAN (VLAN) is a functionality of some switches that allows them to switch the traffic between different ports as if they are in the same LAN. Nevertheless, they do not deal with authorized vs. unauthorized traffic.