An incremental backup is designed to be efficient by capturing only the data that has been created or modified since the last backup was performed, regardless of whether that last backup was a full or a previous incremental one. This process typically involves checking and then resetting a file's archive bit to mark it as backed up. While this method results in the fastest backup times and smallest storage footprint for daily operations, a full restoration requires the last full backup and every subsequent incremental backup file, which can complicate and lengthen the recovery process.

A. Differential backup: This method backs up all data that has changed since the last full backup, not the most recent backup of any type.

C. Daily backup: This backs up files based on the modification date (e.g., all files modified today), not in relation to the last backup event.

D. Full backup: This method backs up all selected data, irrespective of any changes since the previous backup.

1. National Institute of Standards and Technology (NIST). (2010). SP 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems. Page 40 (Section 4.3.2). "Incremental backup—a copy of all files that have changed since the last full or incremental backup."

2. Carnegie Mellon University Information Security Office. (n.d.). Data Backup Options. Retrieved from https://www.cmu.edu/iso/governance/guidelines/data-backup.html. The guideline states

"Incremental Backup: Backs up only the data that has changed since the last backup (of any kind)."

3. Silberschatz

A.

Galvin

P. B.

& Gagne

G. (2018). Operating System Concepts (10th ed.). Wiley. In Chapter 12

Section 12.7.2

"Backup and Restore

" it is defined that "An incremental backup copies only the files that have changed since the last partial backup."

Virtual Private Networks (VPNs) are specifically designed to provide a secure communication channel over an insecure public network like the Internet. VPNs use cryptographic tunneling protocols, such as IPsec or TLS/SSL, to encapsulate and encrypt data packets. This process ensures the confidentiality, integrity, and authenticity of the data in transit, effectively creating a private, secure "tunnel" through the public infrastructure. This directly addresses the requirement of sending data in a secure format.

A. Serial Line Interface Protocol: This is an obsolete data link layer protocol for point-to-point serial connections that provides no security features like encryption or authentication.

B. Point-to-Point Protocol: While it replaced SLIP and includes authentication mechanisms (PAP, CHAP), PPP does not inherently encrypt the data payload, failing to secure the data's content.

C. Browsing: This is a user activity performed with a web browser. While browsing can be secured using protocols like HTTPS, "browsing" itself is not the method that provides security.

1. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 8

Section 8.6

"Network Layer Security: IPsec and Virtual Private Networks

" the text explains

"A VPN is created by using IPsec to create an encrypted tunnel between two hosts

between two routers

or between a host and a router." (p. 757).

2. Kent

S.

& Seo

K. (2005). Security Architecture for the Internet Protocol. IETF. RFC 4301. Section 1.1

"Introduction

" states that IPsec is designed to provide security services for IP packets

including access control

connectionless integrity

data origin authentication

protection against replays

and confidentiality (encryption). This RFC forms the basis for most modern VPNs. (https://doi.org/10.17487/RFC4301)

3. Simpson

W. (Ed.). (1994). The Point-to-Point Protocol (PPP). IETF. RFC 1661. This document defines the PPP standard. The abstract and subsequent sections detail its function for encapsulating datagrams over serial links and establishing link control

but its security scope is limited to authentication (e.g.

LCP Authentication-Protocol)

not payload encryption. (https://doi.org/10.17487/RFC1661)

A Business Continuity Plan (BCP) is the strategic and comprehensive plan that outlines the procedures for an organization to maintain its critical business functions during and after a disruptive event. The primary objective of a BCP is to ensure the continuous delivery of products or services at acceptable predefined levels, thereby minimizing financial losses and operational impact. It addresses the business as a whole, focusing on the processes, people, and resources required to keep the business operational, which directly aligns with the question's focus on protecting "critical business processes" and preventing "loss of capital."

A. Disaster recovery plan: This plan is a component of a BCP and is primarily focused on the technical recovery of IT systems, data, and infrastructure at an alternate location after a disaster.

B. Contingency plan: This is a broad, overarching term. While a BCP is a type of contingency plan, the term BCP is more specific and accurately describes the plan's focus on business processes.

D. Crisis communication plan: This plan is a component of the overall BCP/DRP effort, specifically detailing how to communicate with employees, customers, suppliers, and the public during a crisis.

1. NIST Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems. Section 2.3

"Relationship among Contingency Plan Components

" states

"The BCP focuses on sustaining an organization’s mission/business processes during and after a disruption... A DRP is a key component of a BCP that contains detailed procedures to facilitate recovery of capabilities at an alternate site."

2. ISO 22301:2019

Security and resilience — Business continuity management systems — Requirements. Section 3.4 defines business continuity as the "capability of an organization to continue the delivery of products and services at acceptable predefined levels following a disruptive incident." This definition directly supports the purpose described in the question.

3. Carnegie Mellon University

Software Engineering Institute (SEI). Defining and Differentiating BCP

COOP

and DRP (CMU/SEI-2008-TN-003). Page 2 states

"A BCP is a plan to continue operations if a place of business is affected by different levels of disaster... The scope of a BCP can be wide and can encompass the whole organization." This highlights the BCP's focus on the entire business process

not just IT.

This phase, commonly known as the Development/Implementation phase in many System Development Life Cycle (SDLC) models, is where the system design is translated into a functional product. Key activities include writing code ("programming") that adheres to the design specifications, integrating software and hardware components, and preparing the system for its end-users. This preparation involves creating comprehensive system documentation (for users, administrators, and maintenance) and developing and delivering training programs to ensure users can operate the system effectively and securely.

A. Initiation: This is the first phase, focused on defining the system's purpose, scope, and feasibility, long before any coding or training material development occurs.

C. Design: This phase involves creating the detailed technical specifications and architectural blueprint for the system, but no actual coding or system building takes place.

D. Evaluation and acceptance: This phase occurs after development and involves testing the built system to verify it meets the specified requirements before it is formally accepted for deployment.

1. National Institute of Standards and Technology (NIST) Special Publication 800-64 Rev. 2

Security Considerations in the System Development Life Cycle.

Section 2.2

Development / Acquisition Phase (Page 8): "During this phase

the system is developed or acquired

installed

and configured in accordance with the specifications detailed in the design phase... System documentation is developed during this phase... Training materials are also developed and finalized during this phase." This directly aligns the activities of development (programming)

documentation

and training within a single phase.

2. Purdue University

College of Technology Courseware

CNIT 45500 - Systems and Software Security.

Module: Secure Software Development Life Cycle

"Implementation Phase": Course materials describe this phase as where the actual code is written based on the design documents. It also emphasizes the creation of secure coding standards and initial documentation for the system's functionality

which precedes formal user training.

3. Sommerville

I. (2016). Software Engineering (10th ed.). Pearson.

Chapter 2

Section 2.1.3

"Software design and implementation": This academic textbook describes the implementation stage as the process of "realizing the design as a program." It is distinct from the design phase (creating specifications) and the validation phase (testing). The development of user documentation is also cited as a key activity during implementation.

Mutual authentication establishes two-way trust. The customer's client (e.g., web browser) authenticates the bank's server, and the server authenticates the customer. The critical step against a fake website is server authentication, typically accomplished via a valid Transport Layer Security (TLS) certificate. The customer's browser verifies that the certificate is valid and issued to the legitimate bank. A phishing site cannot present a valid certificate for the real bank's domain. This allows the browser to warn the user or terminate the connection before any sensitive credentials are submitted, directly mitigating the phishing attack.

A. MAC: This is a Mandatory Access Control model, an internal system security policy that is irrelevant to protecting external customers from fraudulent websites.

C. Three-factor authentication: This strengthens user-to-server authentication but does not authenticate the server to the user. A user can still be tricked into entering all three factors into a fake site.

D. Two-factor authentication: Like three-factor authentication, this secures the user's login but does not prevent the user from submitting their credentials to a convincing phishing website.

---

1. National Institute of Standards and Technology (NIST). (2017). Special Publication (SP) 800-63-3: Digital Identity Guidelines.

Section 5.1.1

"TLS for Confidentiality and Integrity

" Page 17: "The use of TLS protects the communications from eavesdropping and tampering. It also provides authentication of the CSP [Credential Service Provider] to the claimant

which can help to mitigate phishing and man-in-the-middle attacks." This highlights that authenticating the server (the bank) to the user (the claimant) is the key defense against phishing.

2. Rivest

R. (2017). 6.857 Computer and Network Security

Fall 2017 Lecture Notes. MIT OpenCourseWare.

Lecture 15: Network Security I

SSL/TLS

Page 4: The lecture notes explain that a primary goal of SSL/TLS is for the "client [to] want to verify server’s identity." It explicitly states this "Prevents man-in-the-middle (MITM) attacks

" which is the mechanism used by sophisticated phishing sites.

3. Dierks

T.

& Rescorla

E. (2008). RFC 5246: The Transport Layer Security (TLS) Protocol Version 1.2. The Internet Engineering Task Force (IETF).

Section 1

"Introduction

" Page 2: The document states that one of the primary goals of the TLS protocol is authentication. "The server is typically authenticated

while the client is optionally authenticated. This is referred to as one-way authentication. It is also possible for both the client and the server to be authenticated. This is referred to as mutual authentication." The server authentication piece is what prevents the phishing attack.

Access Control is the security process and system that manages and dictates what actions subjects (e.g., users, processes) are permitted to perform on objects (e.g., files, physical rooms). The definition in the question precisely describes an access control system's function: enabling an authority to enforce policies that regulate entry to physical areas and use of logical resources within an information system. It is a fundamental security principle that encompasses authentication, authorization, and accountability to minimize risk to the organization's assets.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations. Special Publication (SP) 800-53

Revision 5. Page 51

Introduction to the Access Control (AC) Family. The document defines access control as "the process of granting or denying specific requests to: 1) obtain and use information and related information systems...; 2) enter specific physical facilities..."

DOI: https://doi.org/10.6028/NIST.SP.800-53r5

2. Sandhu

R. S.

& Samarati

P. (1994). Access control: principle and practice. IEEE Communications Magazine

32(9)

40-48. In Section I

"Introduction

" the authors state

"Access control is concerned with determining the allowed activities of legitimate users

mediating every attempt by a user to access a resource in the system." (p. 40).

DOI: https://doi.org/10.1109/35.312842

3. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE

63(9)

1278-1308. This foundational paper

often used in university curricula

outlines the core principles. Section I-A-2

"The Access Control Mechanism

" describes the concept of a system that controls access by comparing the requested action to a set of authorizations.

DOI: https://doi.org/10.1109/PROC.1975.9939

A motion detector is a security device specifically designed to sense and quantify movement within a designated area. It employs various technologies, such as passive infrared (PIR), microwave, or ultrasonic sensors, to identify changes in the environment caused by a moving object. As described in the question, once motion is detected, the device transmits a signal to an integrated or connected system, such as an alarm panel or a surveillance system, to generate an alert. This function is a fundamental component of modern intrusion detection and physical security systems.

1. Garcia

M. L. (2008). The Design and Evaluation of Physical Protection Systems (2nd ed.). Butterworth-Heinemann (an imprint of Elsevier). p. 111

Section 6.3.1

"Motion Sensors." The text states

"Motion sensors detect motion in their field of view... When they detect motion

they send an alarm signal to the control panel."

2. U.S. General Services Administration. (2018). Facilities Standards for the Public Buildings Service (P100). Section 3.7.3.2

"Interior Intrusion Detection Systems (IDS)." This standard lists "motion sensors" as a primary component of interior IDS

which are designed to "detect an unauthorized intrusion... and annunciate an alarm."

3. Fay

J. J. (Ed.). (2007). Encyclopedia of Security Management (2nd ed.). Butterworth-Heinemann (an imprint of Elsevier). p. 581. The entry for "Motion Detection Devices" defines them as devices that "recognize changes in a particular environment

" listing various types like ultrasonic

microwave

and passive infrared detectors used for triggering alarms.

The Master Disaster Recovery Plan (MDRP) is a high-level, umbrella document that coordinates and summarizes the various detailed Disaster Recovery Plans (DRPs) for specific systems or departments across an entire organization. Unlike a system-specific DRP, which is highly technical and detailed, the MDRP provides a consolidated, strategic view of all recovery efforts. It serves as a simple yet comprehensive overview, ensuring consistency and synchronization among all recovery activities and aligning them with the overall business continuity strategy.

1. Al-Ahmad

W.

& Al-Oqily

I. (2013). A Framework for a Master Disaster Recovery Plan. International Journal of Computer Applications

69(21)

1-6. The abstract defines the Master Disaster Recovery Plan (MDRP) as a "comprehensive document that coordinates and synchronizes all DRPs within the organization." DOI: https://doi.org/10.5120/11978-7911.

2. ISO/IEC 27031:2011

Information technology — Security techniques — Guidelines for information and communication technology readiness for business continuity. Section 5

"Policy and organization

" outlines the need for a governing framework for the entire ICT readiness for business continuity (IRBC) program

under which a coordinating master plan would operate to provide a high-level view.

3. NIST Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems. Section 2.3

"Relationship among Plans

" describes the hierarchical nature of continuity plans. This structure supports the concept of a master plan that provides a high-level view and coordinates the more specific

subordinate plans (e.g.

individual system DRPs) that constitute the organization's overall recovery efforts.

The ElGamal encryption system is an asymmetric public-key cryptosystem based on the computational difficulty of the discrete logarithm problem. Its design is a direct extension of the Diffie-Hellman key exchange protocol, adapting the key agreement mechanism for encryption. In ElGamal, a sender uses the recipient's public key to generate a shared secret key for one-time use, which is then used to encrypt the plaintext. This direct lineage from the principles of Diffie-Hellman distinguishes it from other common asymmetric algorithms like RSA, which is based on the difficulty of integer factorization.

1. Elgamal

T. (1985). A public key cryptosystem and a signature scheme based on discrete logarithms. IEEE Transactions on Information Theory

31(4)

469–472. The paper's abstract states the system is "based on the discrete logarithm problem

" the same mathematical foundation as Diffie-Hellman. DOI: https://doi.org/10.1109/TIT.1985.1057074

2. Katz

J.

& Lindell

Y. (2014). Introduction to Modern Cryptography (2nd ed.). CRC Press. In Chapter 11

Section 11.3

"The El Gamal Encryption Scheme

" the text explicitly states

"The El Gamal encryption scheme...is closely related to the Diffie-Hellman key-exchange protocol...".

3. Rivest

R. L. (2017). Lecture 10: Public-Key Cryptography: Diffie-Hellman

ElGamal

RSA. MIT OpenCourseWare

6.857 Computer and Network Security

Fall 2017. The lecture notes describe the ElGamal encryption scheme as being "based on Diffie-Hellman key exchange."

4. Menezes

A. J.

van Oorschot

P. C.

& Vanstone

S. A. (1996). Handbook of Applied Cryptography. CRC Press. In Chapter 8

Section 8.4

"ElGamal public-key encryption" (page 294)

the algorithm is presented

and its relationship to the discrete logarithm problem and Diffie-Hellman is established.

The listed security controls—Misuse Case Modeling, Security Design and Architecture Review, Threat and Risk Modeling, and Security Requirements and Test Cases Generation—are most comprehensively performed during the Design phase of the Software Development Life Cycle (SDLC). During this phase, the high-level requirements gathered previously are translated into a detailed system architecture and design. Threat modeling (e.g., STRIDE) and misuse case analysis are used to identify potential vulnerabilities in the proposed design. The security architecture is then reviewed to ensure it effectively mitigates these identified risks. Based on this finalized design, detailed security test cases are generated to be used in the subsequent testing phase.

B. Maintenance: This phase occurs post-deployment and focuses on updates, patches, and monitoring of the operational system, not its initial design and architecture.

C. Deployment: This phase involves releasing the tested software into the production environment. The listed activities must be completed long before this stage.

D. Requirements Gathering: While high-level security requirements are defined here, detailed threat modeling, architecture review, and test case generation are premature as the system's design does not yet exist.

1. NIST Special Publication 800-64 Rev. 2

Security Considerations in the System Development Life Cycle.

Section 3.3

Design Phase (Page 27): This section explicitly states that the design phase includes activities such as conducting a risk assessment

designing security architecture

and developing security test and evaluation plans. It notes

"The security activities and the resulting security documentation are a product of the design phase."

2. NIST Special Publication 800-218

Secure Software Development Framework (SSDF) Version 1.1.

Section 3

The Practices

DE.1 (Page 15): "Design Software to Mitigate Risks" describes performing threat modeling and designing security architecture during the design phase.

Section 3

The Practices

DE.2 (Page 16): "Review Software Design" details the necessity of reviewing the design and architecture to ensure it complies with security requirements before coding begins.

3. Gary McGraw

Software Security: Building Security In. Addison-Wesley Professional

2006.

Chapter 5

Architectural Risk Analysis (Page 87): The author

a leading expert

places architectural risk analysis (a form of threat modeling) as a critical activity to be performed after the software architecture has been defined

which is central to the design phase.

4. MIT OpenCourseWare

6.858 Computer Systems Security

Fall 2014.

Lecture 19: Web Security

Part II (Threat models): The lecture materials discuss threat modeling techniques like STRIDE as a design-time activity to systematically reason about potential threats to a system's design. This aligns the activity with the SDLC's Design phase. (Available at: https://ocw.mit.edu/courses/6-858-computer-systems-security-fall-2014/pages/lecture-notes/)