Exam 8

1. What is a security concern when considering implementing software-defined networking (SDN)?{

2. Individual access to a network is BEST determined based on: {

3. The security organization is looking for a solution that could help them determine with a strong level of confidence that attackers have breached their network. Which solution is MOST effective at discovering a successful network breach?{

4. Which of the following trust services principles refers to the accessibility of information used by the systems, products, or services offered to a third-party provider’s customers?{

5. Internet Protocol Security (IPSec), Point-to-Point Tunneling Protocol (PPTP), and Secure Sockets Layer (SSL) all use which of the following to prevent replay attacks?{

6. What technique used for spoofing the origin of an email can successfully conceal the sender's Internet Protocol (IP) address?{

7. What should be the FIRST action for a security administrator who detects an intrusion on the network based on precursors and other indicators?{

8. The security operations center (SOC) has received credible intelligence that a threat actor is planning to attack with multiple variants of a destructive virus. After obtaining a sample set of this virus’ variants and reverse engineering them to understand how they work, a commonality was found. All variants are coded to write to a specific memory location. What security feature enabled by default mitigates this threat?{

9. An organization has implemented a protection strategy to secure the network from unauthorized external access. The new Chief Information Security Officer (CISO) wants to increase security by better protecting the network from unauthorized internal access. Which Network Access Control (NAC) capability BEST meets this objective?{

10. A cloud service accepts Security Assertion Markup Language (SAML) assertions from users to access the service. An attacker was able to spoof a registered account on the network and query the SAML provider. What is the MOST common attack leveraged against this flaw?{

11. An information security administrator wishes to block peer-to-peer (P2P) traffic over Hypertext Transfer Protocol (HTTP) tunnels. Which of the following layers of the Open Systems Interconnection (OSI) model requires inspection?{

12. Which is the RECOMMENDED configuration mode for sensors in an intrusion prevention system (IPS) if prevention capabilities will be used?{

13. Which of the following is the BEST defense against password guessing?{

14. Which protocol does Secure Shell (SSH) version 2 support?{

15. What security principle addresses the issue of "Security by Obscurity"?{

16. Which of the following is the BEST definition of Cross-Site Request Forgery (CSRF)?{

17. Company A is evaluating new software to replace an in-house developed application. What step should Company A take after receiving a response from Company B with their flagship product that meets security and functional requirements but runs on an unfamiliar OS?{

18. Using the ciphertext and resultant clear text message to derive the non-alphabetic cipher key is an example of which method of cryptanalytic attack?{

19. If a wide area network (WAN) supports converged applications like Voice over Internet Protocol (VoIP), what becomes essential to ensure network reliability and security?{

20. An organization wants to enable users to authenticate across multiple security domains using Federated Identity Management (FIM). Which of the following is used behind the scenes in a FIM deployment?{

21. What action should a security professional take when a mission-critical computer network attack is suspected?{

22. Which is MOST important when negotiating an Internet service provider (ISP) service-level agreement (SLA) by an organization that solely provides Voice over Internet Protocol (VoIP) services?{

23. To comply with industry requirements, a security assessment on the cloud server should identify which protocols and weaknesses are being exposed to attackers on the Internet. Which of the following tools is the MOST appropriate to complete the assessment?{

24. A subscription service provides power, climate control, raised flooring, and telephone wiring but NOT the computer and peripheral equipment. This is BEST described as a: {

25. What documentation is produced FIRST when performing an effective physical loss control process?{

26. Which of the following threats would be MOST likely mitigated by monitoring assets containing open source libraries for vulnerabilities?{

27. At what phase of the product lifecycle would a security architect MOST likely assess the security of various brands of mobile devices?{

28. The Chief Information Security Officer (CISO) of a small organization is making a case for building a security operations center (SOC). While debating between an in-house, fully outsourced, or hybrid capability, which of the following would be the MAIN consideration, regardless of the model?{

29. What is the MAIN purpose of conducting a business impact analysis (BIA)?{

30. Which of the following is the top barrier for companies adopting cloud technology?{

31. Which is the MOST efficient option to prevent buffer overflow attacks?{

32. Physical assets defined in an organization’s Business Impact Analysis (BIA) could include which of the following?{

33. How should the retention period for an organization's social media content be defined?{

34. Which of the following is the MOST effective measure for dealing with rootkit attacks?{

35. Which is the PRIMARY benefit of off-site storage?{

36. Which of the following will accomplish Multi-Factor Authentication (MFA)?{

37. Which of the following attacks is dependent upon the compromise of a secondary target in order to reach the primary target?{

38. Which of the following determines the level of security of a combination lock?{

39. Which of the following MUST a security professional do in order to quantify the value of a security program to organization management?{

40. Which of the following criteria ensures information is protected relative to its importance to the organization?{

41. Which of the following are the three MAIN categories of security controls?{

42. Which of the following is mobile device remote fingerprinting?{

43. Which technique should be used to track the distribution of digital content and prevent piracy for an Internet media company?{

44. Which one of the following is an advantage of an effective release control strategy from a configuration control standpoint?{

45. A cloud hosting provider would like to provide a Service Organization Control (SOC) report relevant to its security program. This report should be an abbreviated report that can be freely distributed. Which type of report BEST meets this requirement?{

46. In setting expectations when reviewing the results of a security test, which of the following statements is MOST important to convey to reviewers?{

47. When a flaw in Industrial Control System (ICS) software is discovered, what is the GREATEST impediment to deploying a patch?{

48. Which of the following authorization standards is built to handle Application programming Interface (API) access for federated Identity management (FIM)?{

49. What is the BEST way to restrict access to a file system on computing systems?{

50. In Federated Identity Management (FIM), what represents the concept of federation?{

51. A company-wide penetration test shows customers could access and read files through a web browser. Which of the following can be used to mitigate this vulnerability?{

52. Which of the following services can be deployed via cloud or on-premises to integrate with Identity as a Service (IDaaS) as the authoritative source of user identities?{

53. In a large company, a system administrator needs to assign users access to files using Role-Based Access Control (RBAC). Which option is an example of RBAC?{

54. What is the BEST way to prevent access privilege creep in an organization?{

55. Configuring a Wireless Access Point (WAP) with the same Service Set Identifier (SSID) as another WAP in order to have users unknowingly connect is referred to as which of the following?{

56. In which of the following scenarios is locking server cabinets and limiting access to keys preferable to locking the server room to prevent unauthorized access?{

57. A user is allowed to access the file labeled “Financial Forecast,” but only between 9:00 a.m. and 5:00 p.m., Monday through Friday. Which type of access mechanism should be used to accomplish this?{

58. An employee receives a promotion that entitles them to access higher-level functions on the company’s accounting system, as well as keeping their access to the previous system that is no longer needed or applicable. What is the name of the process that tries to remove this excess privilege?{

59. Which of the following system components enforces access controls on an object?{

60. If a content management system (CMS) is implemented, which one of the following would occur?{

61. Which is the MOST effective countermeasure to prevent electromagnetic emanations on unshielded data cables?{

62. A security professional needs to find a secure and efficient method of encrypting data on an endpoint. Which solution includes a root key?{

63. A cloud service provider requires its customer organizations to enable maximum audit logging for its data storage service and to retain the logs for a period of three months. The audit logging generates extremely high amounts of logs. What is the MOST appropriate strategy for log retention?{

64. Which of the following provides the GREATEST level of data security for a Virtual Private Network (VPN) connection?{

65. The core component of Role-Based Access Control (RBAC) must be constructed of defined data elements. Which elements are required?{

66. Which of the following is an open standard for exchanging authentication and authorization data between parties?{

67. In addition to life, protection of which of the following elements is MOST important when planning a data center site?{

68. An organization outgrew its internal data center and is evaluating third-party hosting facilities. In this evaluation, which of the following is a PRIMARY factor for selection?{

69. Which of the following is PRIMARILY adopted for ensuring the integrity of information is preserved?{

70. For the purpose of classification, which of the following is used to divide trust domains and trust boundaries?{

71. What high availability (HA) option for databases allows multiple clients to access multiple database servers simultaneously?{

72. What is the most effective form of media sanitization to ensure residual data cannot be retrieved?{

73. Which security evaluation model assesses a product's Security Assurance Level (SAL) in comparison to similar solutions?{

74. Which of the following should be included in a good defense-in-depth strategy provided by object-oriented programming for software deployment?{

75. Which of the following is the MOST challenging aspect of investigating malware that targets Supervisory Control and Data Acquisition (SCADA) systems?{

76. Which fire suppression system minimizes damage to IT equipment stored in a data center during a false fire alarm event?{

77. A company is enrolled in a hard drive reuse program where decommissioned equipment is sold back to the vendor when it is no longer needed. The vendor pays more money for functioning drives than equipment that is no longer operational. Which method of data sanitization would provide the most secure means of preventing unauthorized data loss, while also receiving the most money from the vendor?{

78. An analysis finds unusual activity coming from a computer that was thrown away several months prior, which of the following steps ensures the proper removal of the system?{

79. Which of the following is the BEST way to protect an organization's data assets?{

80. Which of the following job functions MUST be separated to maintain data and application integrity?{

81. From an asset security perspective, what is the BEST countermeasure to prevent data theft due to data remanence when sensitive data storage media is no longer needed?{

82. Which of the following is the BEST method to identify security controls that should be implemented for a web-based application while in development?{

83. An attack utilizing social engineering and a malicious Uniform Resource Locator (URL) link to take advantage of a victim's existing browser session with a web application is an example of which of the following types of attack?{

84. Which of the following is the MOST effective method of detecting vulnerabilities in web-based applications early in the secure Software Development Life Cycle (SDLC)?{

85. Which of the following practices provides the development team with a definition of security and identification of threats in designing software?{

86. Which of the following methods MOST efficiently manages user accounts when using a third-party cloud-based application and directory solution?{

87. What is the BEST way to prevent improper session handling in a web application?{

88. While performing a security review for a new product, an information security professional discovers that the organization’s product development team is proposing to collect government-issued identification (ID) numbers from customers to use as unique customer identifiers. Which of the following recommendations should be made to the product development team?{

89. Which of the following BEST describes the purpose of software forensics?{

90. Which of the following would be considered an incident if reported by a security information and event management (SIEM) system?{

91. Which of the following is the BEST approach for a forensic examiner to obtain the greatest amount of relevant information from malicious software?{

92. Which of the following is the first step prior to executing a test of an organization’s disaster recovery (DR) or business continuity plan (BCP)?{

93. Which of the following initiates the systems recovery phase of a disaster recovery plan?{

94. An IT technician suspects a break in one of the uplinks that provides connectivity to the core switch. Which of the following command-line tools should the technician use to determine where the incident is occurring?{

95. An organization is planning to have an IT audit of its Software as a Service (SaaS) application to demonstrate to external parties that the security controls around availability are properly designed and operationally effective. Which Service Organization Control (SOC) report would BEST fit their needs?{

96. When auditing the Software Development Life Cycle (SDLC), which of the following is one of the high-level audit phases?{

97. Which type of penetration testing simulates an attack from an external source with little or no prior knowledge of the target system?{

98. An organization's internal audit team performed a security audit on the company's system and reported minor issues. Six months later, an external audit team identified severe weaknesses in the same system. What is MOST likely to be the root cause of the internal audit team's failure in detecting these security issues?{

99. What is the MOST effective way to determine a mission-critical asset in an organization?{

100. When testing password strength, which of the following is the BEST method for brute forcing passwords?{

101. Which of the following is a common term used to describe log reviews, synthetic transactions, and code reviews?{

102. An Internet software application requires authentication before a user is permitted to utilize the resource. Which testing scenario BEST validates the functionality of the application?{

103. A colleague who recently left the organization asked a security professional for a copy of the organization's confidential incident management policy. What is the BEST response to this request?{

104. Which of the following goals represents a modern shift in risk management according to the National Institute of Standards and Technology (NIST)?{

105. What is considered the last line of defense in a Governance, Risk Management, and Compliance (GRC) program?{

106. Which of the following is a risk matrix?{

107. A security professional can BEST mitigate the risk of using a Commercial Off-The-Shelf (COTS) solution by deploying the application with which of the following controls?{

108. When designing a business continuity plan (BCP), what is the formula to determine the Maximum Tolerable Downtime (MTD)?{

109. Which is the PRIMARY mechanism for providing the workforce with the information needed to protect an agency’s vital information resources?{

110. What is the FIRST step required in establishing a records retention program?{

111. Which of the following should be included in a hardware retention policy?{

112. An international organization has decided to use a Software as a Service (SaaS) solution to support its business operations. Which of the following compliance standards should the organization use to assess the international code security and data privacy of the solution?{

113. An organization has implemented a password complexity and an account lockout policy enforcing five incorrect logins tries within ten minutes. Network users have reported significantly increased account lockouts. Which of the following security principles is this company affecting?{

114. Which type of disaster recovery plan (DRP) testing carries the MOST operational risk?{

115. What type of investigation is appropriate when malicious behavior is suspected between two organizations?{

116. Which of the following open-source software issues poses the MOST risk to an application?{

117. At which phase of the software assurance life cycle should risks associated with software acquisition strategies be identified?{

118. Which of the following management processes allots ONLY those services required for users to accomplish their tasks, change default user passwords, and set servers to retrieve antivirus updates?{

119. Which of the following is an indicator that a company's new user security awareness training module has been effective?{

120. Which of the following four iterative steps are conducted on third-party vendors in an ongoing basis?{

121. Which application type is considered high risk and provides a common way for malware and viruses to enter a network?{

122. What is the MAIN objective of risk analysis in Disaster Recovery (DR) planning?{

123. Which of the following attacks is MOST likely to compromise a software-defined networking (SDN) architecture?{

124. Which security architecture strategy should be applied to secure an operating system (OS) baseline for deployment within a corporate enterprise?{

125. Which of the following statements is TRUE about Secure Shell (SSH)?{