A false positive occurs when a security tool incorrectly identifies a normal or non-vulnerable condition as a security vulnerability. In the context of scanning tools, web application firewalls (WAF), or intrusion prevention systems (IPS), a false positive means that the system has flagged something as a threat when, in fact, it is not.

Here’s a brief overview of the other options:

1. False negative: This refers to the opposite situation, where a security vulnerability is present but not detected by the tool.
2. Alert: This is a general notification of a potential issue, which could be accurate or false.
3. Findings: This refers to the results or issues discovered by a security tool, whether they are accurate or not.

The phrase ‘True positives’ correctly fills the blank

Except phishing, all other are types of viruses

Due diligence fits the description in question

A polymorphic virus is a type of computer virus that can change its code or appearance while maintaining its original function. The ability to alter its code helps the virus evade detection by traditional antivirus software that relies on signature-based detection methods. Polymorphic viruses use various techniques, such as encryption or code obfuscation, to create multiple, slightly different versions of themselves. This dynamic behavior makes it challenging for antivirus programs to recognize and block every variant, making polymorphic viruses more resilient against detection and removal efforts.

The correct answer is Non-repudiation.

Non-repudiation ensures that a party involved in a communication or transaction cannot deny the authenticity of their actions, such as sending, receiving, or signing a message. This is typically achieved using encryption techniques and digital signatures, which provide proof of the origin and integrity of the data.

Here’s a brief overview of the other options:

1. SYN-ACK handshake: This refers to part of the process in TCP communication to establish a connection between two networked devices, but it does not provide non-repudiation.
2. Key exchange: This is the process of securely exchanging cryptographic keys between parties, but it does not inherently ensure non-repudiation.
3. Private Key: A private key is used in asymmetric encryption and digital signatures, but by itself, it does not provide non-repudiation; it must be part of a system like digital signatures to do so.

Information disclosure refers to the unauthorized or unintended release of sensitive or confidential information to individuals or entities that should not have access to it. This can occur through various means, such as security vulnerabilities, data breaches, or human error. Information disclosure poses a significant risk to the confidentiality of data, as it may lead to the exposure of private or confidential information to unauthorized parties.

NDA matches the description mentioned in the question

The false statement in question suggests that, even if confidentiality and integrity are maintained, the absence of availability would not impact the security of a business. However, availability is critical because if systems or data are not available when needed, it can lead to significant business disruptions, financial losses, and potential reputational damage. A denial-of-service (DoS) attack or any other event that compromises availability can be just as detrimental to an organization as breaches in confidentiality or integrity.

Audit trails are detective controls because they serve to detect and investigate security incidents by recording and monitoring events within a system, helping identify unauthorized activities and deviations from security policies.

User account lockout is a preventive control because it helps prevent unauthorized access by temporarily disabling an account after a certain number of unsuccessful login attempts. This measure safeguards against brute-force attacks and unauthorized access attempts, enhancing the overall security of user accounts.

Watermarking is the process of embedding a visible or invisible mark or identifier into digital content, such as images, audio, video, or documents. The purpose of watermarking varies depending on the context, but it often serves as a form of protection, authentication, or attribution for the content.

User Authentication is not related to code signatures/digital signing

A Demilitarized Zone (DMZ) in information security is a network segment that acts as a buffer zone between an organization’s internal network and the external, untrusted network (usually the internet). The DMZ contains servers and services that need to be accessible from both internal and external networks, such as web servers, email servers, or public-facing applications. It helps enhance security by isolating these services from the internal network, reducing the risk of direct attacks on sensitive internal systems.

The correct answer is Due Care.

Due care refers to the actions that an organization takes to ensure that it has implemented reasonable safeguards and countermeasures to protect against security breaches, compromises, or disasters. It involves the proactive steps required to mitigate risks and reduce the impact of potential threats. The goal of due care is to demonstrate that the organization acted responsibly in protecting its assets.

Here’s a brief overview of the other options:

1. Due diligence: This refers to the investigation and evaluation process undertaken to assess risks, typically before making a decision or investment, but it doesn’t necessarily involve the implementation of safeguards.
2. Network Pen Testing: This is a specific type of security testing aimed at identifying vulnerabilities in a network, but it is only one aspect of security practices, not a comprehensive risk management strategy like due care.
3. Setup information use policy: This refers to establishing rules for the use and handling of information, but it is not synonymous with due care.

The correct answer is Baseline document.

A baseline document is a starting point that establishes the minimum security configurations and standards that an organization should adhere to. It can be customized for an organization’s specific needs and typically includes security configurations, policies, and controls. Group policies and other tools can be used to check and enforce compliance with the baseline to ensure that systems meet the required security standards.

Here’s a brief overview of the other options:

1. Policy document: A policy document outlines high-level security principles and expectations but does not provide detailed configurations or technical standards.
2. Procedures: Procedures provide step-by-step instructions on how to implement policies but are more about actions than technical baselines.
3. Security Framework: A security framework is a broader structure for managing security, providing guidelines, standards, and best practices, but it is not specifically a starting point for minimum configurations like a baseline.