Exam 9

Exam 9 Questions.

Enter email to receive results:

Security and Risk Management

Communication and Network Security

Security Assessment and Testing

Identity and Access Management (IAM)

Asset Security

134

General Security Principles

134

Security Operations

Software Development Security

Security Architecture and Engineering

Page 1 of 9

Security and Risk Management

1. When developing an organization's information security budget, which of the following is the MOST important consideration?{

The requested funds match the expected cost of breaches

The expected risk to the organization does not exceed the funds allocated

The expected risk can be managed appropriately with the funds allocated

The requested funds are shared with other areas

2. An organization operates a legacy Industrial Control System (ICS) that must be managed remotely via outdated software. How can this risk be BEST managed?{

Deploy a restrictive proxy between all clients and the vulnerable management station

Air-gap and harden the host used for management purposes

Isolate the ICS by moving it onto its own network segment

Convince management to decommission the ICS and migrate to modern technology

3. What is the PRIMARY purpose of creating and reporting metrics for a security awareness, training, and education program?{

Comply with legal regulations and document due diligence

Make all stakeholders aware of the program's progress

Measure the effect of the program on the organization's workforce

Facilitate supervision of periodic training events

4. Which of the following BEST describes why software assurance is critical in helping prevent an increase in business and mission risk for an organization?{

Decommissioning of old software reduces long-term costs related to technical debt

Contracting processes eliminate liability for security vulnerabilities for the purchaser

Software that does not perform as intended may be exploitable which makes it vulnerable to attack

Request for proposals (RFP) avoid purchasing software that does not meet business needs

5. What is a risk of using commercial off-the-shelf (COTS) products?{

Vendors are often hesitant to share their source code

COTS products are typically more expensive than developing software in-house

Cost to implement COTS products is difficult to predict

COTS products may not map directly to an organization’s security requirements

6. Which of the following poses the GREATEST privacy risk to personally identifiable information (PII) when disposing of an office printer or copier?{

The device could contain a document with PII on the platen glass

A hard disk drive (HDD) in the device could contain PII

The device transfer roller could contain imprints of PII

Organizational network configuration information could still be present within the device

7. Which of the following poses the GREATEST privacy risk to personally identifiable information (PII) when disposing of an office printer or copier?{

Organizational network configuration information could still be present within the device

The device could contain a document with PII on the platen glass

The device transfer roller could contain imprints of PII

A hard disk drive (HDD) in the device could contain PII

8. What should be used to determine the risks associated with using Software as a Service (SaaS) for collaboration and email?{

Open Web Application Security Project (OWASP)

Common Security Framework (CSF)

Cloud access security broker (CASB)

Process for Attack Simulation and Threat Analysis (PASTA)

9. The European Union (EU) General Data Protection Regulation (GDPR) requires organizations to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. The Data Owner should therefore consider which of the following requirements?{

Never to store personal data of EU citizens outside the EU

Only to use encryption protocols approved by the EU

Data masking and encryption of personal data

Anonymization of personal data when transmitted to sources outside the EU

10. An organization is preparing to achieve General Data Protection Regulation (GDPR) compliance. The Chief Information Security Officer (CISO) is reviewing data protection methods. Which of the following is the BEST data protection method?{

Strong authentication

Encryption

Data obfuscation

Backups

11. The threat modeling identifies a man-in-the-middle (MITM) exposure. Which countermeasure should the information system security officer (ISSO) select to mitigate the risk of a protected health information (PHI) data leak?{

Anonymization

Data retention

Privacy monitoring

Auditing

12. Which of the following findings would MOST likely indicate a high risk in a vulnerability assessment report?{

Transmission Control Protocol (TCP) port 443 open

Non-standard system naming convention used

End of life system detected

Unlicensed software installed

13. During which phase of a criminal legal proceeding does the lack of a formal data destruction policy have the MOST impact?{

Arraignment

Sentencing

Discovery

Trial

14. A large manufacturing organization arranges to buy an industrial machine system to produce a new line of products. The system includes software provided to the vendor by a third-party organization. The financial risk to the manufacturing organization starting production is high. What step should the manufacturing organization take to minimize its financial risk in the new venture prior to the purchase?{

Hire a performance tester to execute offline tests on a system

Place the machine behind a Layer 3 firewall

Require that the software be thoroughly tested by an accredited independent software testing company

Calculate the possible loss in revenue due to software bugs and vulnerabilities

15. A recent information security risk assessment identified weak system access controls on mobile devices as a high risk. To address this and ensure only authorized staff access company information, which of the following should the organization implement?{

Multi-factor authentication (MFA)

Intrusion prevention system (IPS)

Data loss protection (DLP)

Data at rest encryption

16. A recent information security risk assessment identified weak system access controls on mobile devices as a high risk. In order to address this risk and ensure only authorized staff access company information, which of the following should the organization implement?{

Intrusion prevention system (IPS)

Data loss protection (DLP)

Multi-factor authentication (MFA)

Data at rest encryption

17. To mitigate the risk of unauthorized access to a cloud-based Identity and Access Management (IAM) service provider, what is the BEST solution?{

Install an on-premise Authentication Gateway Service (AGS)

Require the cloud IAM provider to use declarative security

Apply Transport Layer Security (TLS) to the cloud-based authentication checks

Integrate a Web-Application Firewall (WAF) in reverse-proxy mode

18. What is the MOST effective way to protect privacy?{

Eliminate or reduce collection of personal information

Classify all personal information at the highest information classification level

Apply tokenization to all personal information records

Encrypt all collected personal information

Page 2 of 9

Communication and Network Security

19. The security team is notified that a device on the network is infected with malware. Which tool would be MOST effective in quickly locating and remediating the device?{

Vulnerability scanner

Data loss protection (DLP)

Information Technology Asset Management (ITAM)

Intrusion detection

20. Point-to-Point Protocol (PPP) was designed to specifically address what issue?{

Compatibility issues with personal computers and web browsers

A common design flaw in telephone modems

The security of dial-up connections to remote networks

Speed and reliability issues between dial-up users and ISPs

21. An organization recently suffered from a web-application attack that resulted in stolen user session cookie information. The attacker was able to obtain the information when a user’s browser executed a script upon visiting a compromised website. What type of attack MOST likely occurred?{

Extensible Markup Language (XML) external entities

Cross-Site Request Forgery (CSRF)

Cross-Site Scripting (XSS)

SQL injection (SQLI)

22. When deploying an Intrusion Detection System (IDS) on a high-volume network, the need to distribute the load across multiple sensors would create which technical problem?{

Sensor overload

Synchronized sensor updates

Proxy authentication failure

Session continuity

23. Which of the following will an organization's network vulnerability testing process BEST enhance?{

Asset management procedures

Code review procedures

Server hardening processes

Firewall log review processes

24. Additional padding may be added to the Encapsulating Security Protocol (ESP) trailer to provide which of the following?{

Data origin authentication

Protection against replay attack

Access control

Partial traffic flow confidentiality

25. Which of the following BEST ensures the integrity of transactions to intended recipients?{

Blockchain technology

Pre-shared key (PSK)

Web of trust

Public key infrastructure (PKI)

26. Which Open Systems Interconnection (OSI) layer(s) BEST corresponds to the network access layer in the Transmission Control Protocol/Internet Protocol (TCP/IP) model?{

Transport Layer

Session and Network Layers

Data Link and Physical Layers

Application, Presentation, and Session Layers

27. Which of the following will help identify the source IP address of malware being executed on a computer?{

Display TCP/IP network configuration information

List of open network connections

Display the ARP table

List of running processes

28. Which of the following protocols will allow the encrypted transfer of content on the Internet?{

Hypertext Transfer Protocol (HTTP)

Secure Copy (SCP)

Remote Copy (RCP)

Server Message Block (SMB)

29. Which inherent network challenge does a dispersed network without central control face, and what should be the PRIMARY course of action to mitigate exposure?{

Implement management policies, audit control, and data backups

Implement security policies and standards, access controls, and access limitations

Implement security policies and standards, data backups, and audit controls

Implement remote access policies, shared workstations, and log management

30. Which software-defined networking (SDN) architectural component is responsible for translating network requirements?{

SDN Application

SDN Data Path

SDN Northbound Interfaces

SDN Controller

31. Which of the following BEST represents a defense-in-depth concept?{

Web application firewall (WAF), Gateway network device tuning, Database firewall, Next-Generation Firewall (NGFW), Tier-2 demilitarized zone (DMZ) tuning

Endpoint security management, network intrusion detection system (NIDS), Network Access Control (NAC), Privileged Access Management (PAM), security information and event management (SIEM)

Host-based data loss prevention (DLP), Endpoint anti-malware solution, Host-based integrity checker, Laptop locks, hard disk drive (HDD) encryption

Network-based data loss prevention (DLP), Network Access Control (NAC), network-based Intrusion prevention system (NIPS), Port security on core switches

32. Which of the following BEST represents a defense-in-depth concept?{

Web application firewall (WAF), Gateway network device tuning, Database firewall, Next-Generation Firewall (NGFW), Tier-2 demilitarized zone (DMZ) tuning

Host-based data loss prevention (DLP), Endpoint anti-malware solution, Host-based integrity checker, Laptop locks, hard disk drive (HDD) encryption

Endpoint security management, network intrusion detection system (NIDS), Network Access Control (NAC), Privileged Access Management (PAM), security information and event management (SIEM)

Network-based data loss prevention (DLP), Network Access Control (NAC), network-based Intrusion prevention system (NIPS), Port security on core switches

33. Which solution is BEST for verifying endpoint security protections and operating system (OS) versions before granting network access?{

An intrusion detection system (IDS)

A firewall

Network Access Control (NAC)

An intrusion prevention system (IPS)

34. Which network device uses the destination IP address to forward packets?{

A router

A repeater

A bridge

A Layer 2 switch

35. Which Wide Area Network (WAN) technology requires the first router to determine the full path the packet will travel?{

Synchronous Optical Networking (SONET)

Fiber Channel Over Ethernet (FCoE)

Session Initiation Protocol (SIP)

Multiprotocol Label Switching (MPLS)

Page 3 of 9

Security Assessment and Testing

36. Which of the following is TRUE regarding equivalence class testing?{

Test inputs are obtained from derived boundaries of the functional specifications

An entire partition can be covered by considering only one representative value from that partition

It is characterized by the stateless behavior of a process implemented in a function

It is useful for testing communications protocols and graphical user interfaces

37. Functional security testing is MOST critical during which phase of the system development life cycle (SDLC)?{

Initiation

Implementation

Acquisition / Development

Operations / Maintenance

38. Which of the following is the BEST method a security practitioner can use to ensure that systems and sub-systems gracefully handle invalid input?{

Acceptance testing

Integration testing

Unit testing

Negative testing

39. An authentication system that uses challenge and response was recently implemented because penetration testing revealed lateral movement using authenticated credentials. Which attack method was MOST likely used?{

Cross-Site Scripting (XSS)

Brute force

Hash collision

Pass the ticket

40. What is the PRIMARY purpose of auditing, as it relates to the security review cycle?{

To ensure the organization's executive team won't be sued

To ensure the organization's controls and policies are working as intended

To ensure the organization meets contractual requirements

To ensure the organization can still be publicly traded

41. Which audit type is MOST appropriate for evaluating the effectiveness of a security program?{

Assessment

Analysis

Threat

Validation

42. When can a security program be considered effective?{

Badges are regularly performed and validated

Vulnerabilities are proactively identified

Risk is lowered to an acceptable level

Audits are regularly performed and reviewed

43. Which of the following needs to be taken into account when assessing vulnerability?{

Risk identification and validation

Safeguard selection

Threat mapping

Risk acceptance criteria

44. Which of the following is included in change management?{

Business continuity testing

User Acceptance Testing (UAT) before implementation

Cost-benefit analysis (CBA) after implementation

Technical review by business owner

Page 4 of 9

Identity and Access Management (IAM)

45. A company is attempting to enhance the security of its user authentication processes. After evaluating several options, the company decides to utilize Identity as a Service (IDaaS). Which factor likely led to this decision?{

Third-party solutions are known for transferring risk to the vendor

In-house development provides more control

Third-party solutions are inherently more secure

In-house team lacks resources to support an on-premise solution

46. A large human resources organization wants to integrate their identity management with a trusted partner organization. The human resources organization wants to maintain the creation and management of the identities and may want to share with other partners in the future. Which of the following options BEST serves their needs?{

Federated identity

Single sign-on (SSO)

Security Assertion Markup Language (SAML)

Cloud Active Directory (AD)

47. What is the MOST significant benefit of role-based access control (RBAC)?{

Reduction in authorization administration overhead

Reduces inappropriate access

Management of least privilege

Most granular form of access control

48. Which of the following is the FIRST step during digital identity provisioning?{

Creating the entity record with the correct attributes

Issuing an initial random password

Synchronizing directories

Authorizing the entity for resource access

49. A company needs to provide employee access to travel services, which are hosted by a third-party service provider. Employee experience is important, and when users are already authenticated, access to the travel portal is seamless. Which of the following methods is used to share information and grant user access to the travel portal?{

Security Assertion Markup Language (SAML) access

Open Authorization (OAuth) access

Federated access

Single sign-on (SSO) access

50. Which of the following is the FIRST step during digital identity provisioning?{

Authorizing the entity for resource access

Creating the entity record with the correct attributes

Synchronizing directories

Issuing an initial random password

51. Individuals have been identified and determined as having a need-to-know for the information. Which of the following access control methods MUST include a consistent set of rules for controlling and limiting access?{

Role-Based Access Control (RBAC)

Discretionary Access Control (DAC)

Attribute Based Access Control (ABAC)

Mandatory Access Control (MAC)

52. What type of access control determines the authorization to resources based on predefined job titles within an organization?{

Non-discretionary access control

}

Role-Based Access Control (RBAC)

Discretionary Access Control (DAC)

53. A technician wants to install a WAP (Wireless Access Point) in the center of a room that provides service in a radius surrounding the radio. Which of the following antenna types should the AP utilize?{

Directional

Yagi

Omni

Parabolic

54. Which access control method is based on users issuing access requests on system resources, features assigned to those resources, the operational or situational context, and a set of policies specified in terms of those features and context?{

Attribute-Based Access Control (ABAC)

Mandatory Access Control (MAC)

Role-Based Access Control (RBAC)

Discretionary Access Control (DAC)

55. Before allowing personnel to access social media from a corporate device, what is the FIRST step an organization should take?{

Deliver security awareness training

Publish an acceptable usage policy

Publish a social media guidelines document

Document a procedure for accessing social media sites

56. In Identity Management (IdM), when is the verification stage performed?{

Before creation of the identity

As part of system sign-on

After revocation of the identity

During authorization of the identity

57. Which of the following is the BEST way to mitigate circumvention of access controls?{

Multi-vendor approach to technology implementation

Multi-layer access controls working in isolation

Multi-layer firewall architecture with Internet Protocol (IP) filtering enabled

Multi-layer access controls with diversification of technologies

Page 5 of 9

Asset Security

58. Which of the following media is least problematic with data remanence?{

Magnetic disk

Electrically Erasable Programming read-only Memory (EEPROM)

Flash memory

Dynamic Random Access Memory (DRAM)

59. A company wants to store data related to users on an offsite server. What method can be deployed to protect the privacy of the user’s information while maintaining the field-level configuration of the database?{

Tokenization

Encryption

Hashing

Encoding

60. Which of the following steps is performed during the forensic data analysis phase?{

Collect known system files

Create file lists

Search for relevant strings

Recover deleted data

61. An organization is considering outsourcing applications and data to a Cloud Service Provider (CSP). Which of the following is the MOST important concern regarding privacy?{

The CSP may not be subject to the organization’s country legislation

The CSP provides end-to-end encryption services

The CSP determines data criticality

The CSP’s privacy policy may be developed by the organization

62. An employee's home address should be categorized according to which of the following references?{

Existing employee data classifications

The consent form terms and conditions signed by employees

An organization security plan for human resources

The organization's data classification model

63. Which of the following is the MOST effective countermeasure against data remanence?{

Encryption

Destruction

Purging

Clearing

64. Which of the following needs to be tested to achieve a Cat 6a certification for a company's data cabling?{

RJ11

Patch panel

LC ports

F-type connector

65. Which technique is MOST appropriate for destroying magnetic platter hard disk drives (HDDs) containing data with a "HIGH" security categorization?{

Mechanically shred the entire HDD

Process the HDD through a degaussing device

Drill through the device and platters

Remove the control electronics

66. A hospital enforces the Code of Fair Information Practices. What practice applies to a patient requesting their medical records from a web portal?{

Purpose specification

Individual participation

Collection limitation

Use limitation

67. A vehicle of a private courier company that transports backup data for offsite storage was robbed while in transit. The incident management team is now responsible to estimate the robbery's impact. Which of the following would help the team MOST effectively analyze the business impact?{

Log of the transported media and its detailed contents

Log of the transported media and its classification marking

Log of backup administrative actions

Log of backed up data and their respective data custodians

68. Which type of database attack would allow a customer service employee to determine quarterly sales results before they are publicly announced?{

}

Data mining

Aggregation

Inference

69. Which type of database attack would allow a customer service employee to determine quarterly sales results before they are publicly announced?{

}

Data mining

Inference

Aggregation

70. The Chief Information Officer (CIO) has decided to move towards a cloud architecture. Which role must the CIO primarily work with to ensure proper protection of data during and after the migration?{

Chief Security Officer (CSO)

Information owner

General Counsel

Chief Information Security Officer (CISO)

71. Which process is established to collect security information available through implemented controls?{

Risk assessment report

Security Assessment Report (SAR)

Information Security Continuous Monitoring (ISCM)

Organizational risk tolerance

72. What is the BEST approach to minimize the attack surface for a customer's private information?{

Collection limitation

Data masking

Authentication

Obfuscation

Page 6 of 9

General Security Principles

73. Which attack defines a piece of code that is inserted into software to trigger a malicious function?{

Phishing

Back door

Logic bomb

Salami

74. Which of the following is security control volatility?{

A reference to the likelihood of change in the security control

A reference to the stability of the security control

A reference to how unpredictable the security control is

A reference to the impact of the security control

75. Which of the following BEST describes the security role filled by the head of the IT department when they are responsible for technical implementation?{

System security officer

System custodian

System analyst

System processor

76. Which technique is effective to detect taps in fiber optic cables?{

Taking baseline signal level of the cable

Performing network vulnerability scanning

Measuring signal through external oscillator solution devices

Outlining electromagnetic field strength

77. What is the value called when a biometric system adjusts its threshold so that the false rejection rate (FRR) and false acceptance rate (FAR) are the same?{

Accuracy acceptance threshold

Equal error rate

False Acceptance Rate (FAR)

False Rejection Rate (FRR)

78. A company wants to implement two-factor authentication (2FA) to protect their computers from unauthorized users. Which solution provides the MOST secure means of authentication and meets the criteria they have set?{

Short Message Services (SMS) and smartphone authenticator

Username and personal identification number (PIN)

Hardware token and password

Fingerprint and retinal scanners

79. Which of the following attributes could be used to describe a protection mechanism of an open design methodology?{

It can facilitate independent confirmation of the design security

It exposes the design to vulnerabilities and malicious attacks

It must be tamperproof to protect it from malicious attacks

It can facilitate blackbox penetration testing

80. Which of the following is a formal document that expresses an implementation-independent set of security requirements in the common criteria?{

Security Target (ST)

Target of Evaluation (TOE)

Protection Profile (PP)

Organizational Security Policy

81. A company wants to implement two-factor authentication (2FA) to protect their computers from unauthorized users. Which solution provides the MOST secure means of authentication and meets the criteria they have set?{

Hardware token and password

Short Message Services (SMS) and smartphone authenticator

Fingerprint and retinal scanners

Username and personal identification number (PIN)

82. Which of the following attributes could be used to describe a protection mechanism of an open design methodology?{

It exposes the design to vulnerabilities and malicious attacks

It can facilitate independent confirmation of the design security

It must be tamperproof to protect it from malicious attacks

It can facilitate blackbox penetration testing

83. Which of the following System and Organization Controls (SOC) report types should an organization request if they require a period of time report covering security and availability for a particular system?{

SOC 1 Type 2

SOC 2 Type 2

SOC 2 Type 1

SOC 1 Type 1

84. Compared with hardware cryptography, software cryptography is generally:{

More expensive and faster

More expensive and slower

Less expensive and slower

Less expensive and faster

85. Which of the following statements is MOST accurate regarding information assets?{

Information assets inventory is not required for risk assessment

Building an information assets register is a resource-intensive job

ISO 27001 compliance specifies which information assets must be included in asset inventory

Information assets include any information that is valuable to the organization

86. Which is the second phase of public key infrastructure (PKI) key/certificate lifecycle management?{

Initialization phase

Implementation phase

Issued phase

Cancellation phase

87. A security professional was tasked with rebuilding a company's wireless infrastructure. Which of the following are the MOST important factors to consider while making a decision on which wireless spectrum to deploy?{

Hybrid frequency band, service set identifier (SSID), and interpolation

Facility size, intermodulation, and direct satellite service

Performance, geographic location, and radio signal interference

Existing client devices, manufacturer reputation, and electrical interference

88. Which of the following is required to verify the authenticity of a digitally signed document?{

Recipient's public key

Agreed upon shared secret

Digital hash of the signed document

Sender's private key

89. Which of the following is the MOST significant key management problem due to the number of keys created?{

Keys are more difficult to provision

Storage of the keys requires increased security

Exponential growth when using symmetric keys

Exponential growth when using asymmetric keys

90. A client-server infrastructure that provides user-to-server authentication describes which one of the following?{

Secure Sockets Layer (SSL)

X.509

Kerberos

User-based authorization

91. Which of the following techniques is MOST useful when dealing with Advanced Persistent Threat (APT) intrusions on live virtualized environments?{

Memory forensics

Antivirus operations

Logfile analysis

Reverse engineering

92. Which of the following protects personally identifiable information (PII) used by financial services organizations?{

National Institute of Standards and Technology (NIST) SP 800-53

Gramm-Leach-Bliley Act (GLBA)

Health Insurance Portability and Accountability Act (HIPAA)

Payment Card Industry Data Security Standard (PCI-DSS)

93. Which inherent password weakness does a One-Time Password (OTP) generator overcome?{

Static passwords are too predictable

Static passwords are difficult to generate

Static passwords are easily disclosed

Static passwords must be changed frequently

94. Who should an information security practitioner work with to ensure that information is properly categorized?{

Business Continuity (BC) Manager

Information Owner (IO)

Chief Information Officer (CIO)

System Administrator

95. Why is it important for initial security categorization to be done correctly?{

The system engineering process works with selected security controls

It determines the functional and operational requirements

It affects other steps in the certification and accreditation process

It determines the security requirements

96. What is the MAIN purpose of a security assessment plan?{

Provide education to employees on security and privacy

Provide the objectives for the security and privacy control assessments and a detailed roadmap

Provide technical information to executives for securing funding

Provide guidance on security requirements to ensure risks are addressed

97. The Chief Information Security Officer (CISO) has requested a Service Organization Control (SOC) report for the security and availability of a system over a 12-month period. Which type of SOC report should be used?{

SOC 2 Type 2

SOC 3 Type 1

SOC 1 Type 1

}

98. Within a large organization, what business unit is BEST positioned to initiate provisioning and deprovisioning of user accounts?{

Training department

Human resources

Information technology (IT)

Internal audit

99. Which layer handles packet fragmentation and reassembly in the Open Systems Interconnection (OSI) Reference model?{

Session

Data Link

Network

Transport

100. Which of the following is the MOST comprehensive Business Continuity (BC) test?{

Full functional drill

Full simulation

Full interruption

Full table-top

101. When performing an investigation with the potential for legal action, what should be the analyst's FIRST consideration?{

Authorization to collect

Court admissibility

Data decryption

Chain-of-custody

102. Copyright provides protection for which of the following?{

Ideas expressed in literary works

Discoveries of natural phenomena

New and non-obvious invention

A particular expression of an idea

103. Which of the following is included in the Global System for Mobile Communications (GSM) security framework?{

Digital signatures

Symmetric key cryptography

Public-Key Infrastructure (PKI)

Biometric authentication

104. When performing an investigation with the potential for legal action, what should be the analyst's FIRST consideration?{

Chain-of-custody

Court admissibility

Data decryption

Authorization to collect

105. Copyright provides protection for which of the following?{

New and non-obvious inventions

Ideas expressed in literary works

Discoveries of natural phenomena

A particular expression of an idea

106. Which of the following is included in the Global System for Mobile Communications (GSM) security framework?{

Public-Key Infrastructure (PKI)

Symmetric key cryptography

Digital signatures

Biometric authentication

107. What subsection of the change management process involves developing and verifying proposed changes before implementation?{

Implement security controls

Categorize Information System (IS)

Select security controls

Build and test

108. What additional security concern is presented by Commercial off-the-shelf (COTS) software?{

Exploits for COTS software are well documented and publicly available

}

In-house developed software is inherently less secure

Vendors take on the liability for COTS software vulnerabilities

109. Which part of an operating system (OS) is responsible for providing security interfaces among the hardware, OS, and other parts of the computing system?{

Trusted Computing Base (TCB)

Time separation

Security kernel

Reference monitor

110. A user downloads a file from the internet and applies the Secure Hash Algorithm 3 (SHA-3). What is the purpose of this action?{

It verifies the integrity of the file

It encrypts the entire file

It ensures the entire file downloaded

It checks the file for malware

111. Which of the following is applicable to a publicly held company concerned about financial reporting requirements?{

International Organization for Standardization (ISO) 27001

Sarbanes-Oxley (SOX) Act of 2002

Clinger-Cohan Act of 1996

Privacy Act of 1974

112. Which of the following is used to detect steganography?{

Reverse engineering

Statistical analysis

Cryptanalysis

Audio analysis

Page 7 of 9

Security Operations

113. Which of the following is a characteristic of a challenge/response authentication process?{

Requiring the use of non-consecutive numeric characters

Presenting distorted graphics of text for authentication

Transmitting a hash based on the user's password

Using a password history blacklist

114. Which of the following events prompts a review of the disaster recovery plan (DRP)?{

Completion of the security policy review

Change in senior management

New members added to the steering committee

Organizational merger

115. Which of the following activities should a forensic examiner perform FIRST when determining the priority of digital evidence collection at a crime scene?{

Establish the order of volatility

Gather physical evidence

Establish a list of files to examine

Assign responsibilities to personnel on the scene

116. Which of the following initiates the system recovery phase of a disaster recovery plan?{

Issuing a formal disaster declaration

Assessing the extent of damage following the disaster

Evacuating the disaster site

Activating the organization's hot site

117. What is the PRIMARY objective of the post-incident phase of the incident response process in the security operations center (SOC)?{

Validate the integrity of the IR

Improve the incident response (IR) process

Communicate the IR details to the stakeholders

Finalize the IR

Page 8 of 9

Software Development Security

118. Which type of test suite should be run for fast feedback during application development?{

Smoke

Full regression

Specific functionality

End-to-end

119. An organization is implementing security review as part of system development. Which of the following is the BEST technique to follow?{

Engage a third-party auditing firm

Conduct penetration testing

Perform incremental assessments

Review security architecture

120. Which of the following is the BEST method to validate secure coding techniques against injection and overflow attacks?{

The regular use of production code routines from similar applications already in use

Scheduled team review of coding style and techniques for vulnerability patterns

Ensure code editing tools are updated against known vulnerability patterns

Using automated programs to test for the latest known vulnerability patterns

121. Why should Open Web Application Security Project (OWASP) Application Security Verification Standards (ASVS) Level 1 be considered a MINIMUM level of protection for any web application?{

Securing applications at ASVS Level 1 provides adequate protection for sensitive data

ASVS Level 1 ensures that applications are invulnerable to OWASP top 10 threats

Opportunistic attackers will look for any easily exploitable vulnerable applications

Most regulatory bodies consider ASVS Level 1 as a baseline set of controls for applications

122. A security professional has been assigned to assess a web application. The assessment report recommends switching to Security Assertion Markup Language (SAML). What is the PRIMARY security benefit in switching to SAML?{

It enables single sign-on (SSO) for web applications

It uses Transport Layer Security (TLS) to address confidentiality

It limits unnecessary data entry on web forms

The users' password is not passed during authentication

123. Which of the (ISC)² Code of Ethics canons is MOST reflected when preserving the value of systems, applications, and entrusted information while avoiding conflicts of interest?{

Protect society, the commonwealth, and the infrastructure

Provide diligent and competent service to principles

Act honorably, honestly, justly, responsibly, and legally

Advance and protect the profession

124. Which of the (ISC)² Code of Ethics canons is MOST reflected when preserving the value of systems, applications, and entrusted information while avoiding conflicts of interest?{

Provide diligent and competent service to principles

Advance and protect the profession

Act honorably, honestly, justly, responsibly, and legally

Protect society, the commonwealth, and the infrastructure

Page 9 of 9

Security Architecture and Engineering

125. Which algorithm gets its security from the difficulty of calculating discrete logarithms in a finite field and is used to distribute keys but cannot be used to encrypt or decrypt messages?{

Rivest-Shamir-Adleman (RSA)

Kerberos

Diffie-Hellman

Digital Signature Algorithm (DSA)

Security and Risk Management

Communication and Network Security

Security Assessment and Testing

Identity and Access Management (IAM)

Asset Security

General Security Principles

Security Operations

Software Development Security

Security Architecture and Engineering

Submit a Comment Cancel reply

Latest Posts

stay connected

Quick links

Guaranteed by