Exam 3

1. In a Bell-LaPadula system, which user cannot write to File 3?

2. The security program can be considered effective when

3. A large bank deploys hardware tokens to all customers that use their online banking system. The token generates and displays a six-digit numeric password every 60 seconds. This is an example of

4. Which of the following is a critical factor for implementing a successful data classification program?

5. What is the MOST effective method for gaining unauthorized access to a file protected with a long complex password?

6. What is the BEST reason for the organization to pursue a plan to mitigate client-based attacks?

7. In a Multilevel Security (MLS) system, the following sensitivity labels are used in increasing levels of sensitivity: restricted, confidential, secret, top secret. Table A lists the clearance levels for four users, while Table B lists the security classes of four different files. Which of the following is true according to the star property (*property)?

8. Which of the following is the BEST way to determine if a particular system is able to identify malicious software without executing it?

9. In the plan, what is the BEST approach to mitigate future internal client-based attacks?

10. What additional considerations are there if the third party is located in a different country?

11. During an audit, the auditor finds evidence of potentially illegal activity. Which of the following is the MOST appropriate action to take?

12. Which of the following provides effective management assurance for a Wireless Local Area Network (WLAN)?

13. A risk assessment report recommends upgrading all perimeter firewalls to mitigate a particular finding. Which of the following BEST supports this recommendation?

14. When dealing with compliance with the Payment Card Industry-Data Security Standard (PCI-DSS), an organization that shares card holder information with a service provider MUST do which of the following?

15. What is the MOST LIKELY security issue with degaussing a magnetic drive?

16. Which of the following actions MUST be taken if a vulnerability is discovered during the maintenance stage in a System Development Life Cycle (SDLC)?

17. Where should the permitted access for each department and job classification combination be specified?

18. What is the PRIMARY concern regarding database information after unauthorized access?

19. When using third-party software developers, which of the following is the MOST effective method of providing software development Quality Assurance (QA)?

20. Host-Based Intrusion Protection (HIPS) systems are often deployed in monitoring or learning mode during their initial implementation. What is the objective of starting in this mode?

21. Which of the following are required components for implementing software configuration management systems?

22. A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive e-mail, search the web, and use instant messaging. The organization’s IT department discovers that a peer-to-peer program has been installed on the computer using the employee's access. Which of the following methods is the MOST effective way of removing the Peer-to-Peer (P2P) program from the computer?

23. Which of the following is a process within a Systems Engineering Life Cycle (SELC) stage?

24. During the investigation of a security incident, it is determined that an unauthorized individual accessed a system which hosts a database containing financial information. If it is discovered that large quantities of information have been copied by the unauthorized individual, what attribute of the data has been compromised?

25. An organization experiencing a negative financial impact is forced to reduce budgets and the number of IT operations staff performing basic logical access security administration functions. Security processes have been tightly integrated into normal IT operations and are not separate and distinct roles. Which of the following will be the PRIMARY security concern as staff is released from the organization?

26. Which of the following secure startup mechanisms are PRIMARILY designed to thwart attacks?

27. Which of the following is required to determine classification and ownership?

28. From a security perspective, which of the following is a best practice to configure a Domain Name Service (DNS) system?

29. What is the MOST critical factor to achieve the goals of a security program?

30. Desktop computers in an organization were sanitized for re-use in an equivalent security environment. Organizational policy requires the deletion of user data from Personal Digital Assistant (PDA) devices before disposal. It may not be possible to delete the user data if the device is malfunctioning. Which destruction method below provides the BEST assurance that the data has been removed?

31. The amount of data that will be collected during an audit is PRIMARILY determined by the

32. During an investigation of database theft from an organization's website, it was determined that the SQL injection technique was used despite input validation with client-side scripting. Which of the following provides the GREATEST protection against the same attack occurring again?

33. Without proper signal protection, embedded systems may be prone to which type of attack?

34. An organization publishes and periodically updates its employee policies in a file on their intranet. Which of the following is a PRIMARY security concern?

35. In a Multilevel Security (MLS) system with increasing sensitivity labels (restricted, confidential, secret, top secret), and following the Bell-LaPadula model, which user has the MOST restrictions when writing data?

36. What security risk does the role-based access approach mitigate MOST effectively?

37. What type of test assesses a Disaster Recovery (DR) plan using realistic disaster scenarios while maintaining minimal impact to business operations?

38. Which type of test assesses a Disaster Recovery (DR) plan using realistic disaster scenarios while maintaining minimal impact to business operations?

39. The implementation of which feature in an identity management system reduces costs and administration overhead while improving audit and accountability?

40. Which of the following explains why record destruction requirements are included in a data retention policy?

41. When writing security assessment procedures, what is the MAIN purpose of the test outputs and reports?

42. The restoration priorities of a Disaster Recovery Plan (DRP) are based on which of the following documents?

43. Network-based logging has which advantage over host-based logging when reviewing malicious activity on a victim machine?

44. Which of the following could elicit a Denial of Service (DoS) attack against a credential management system?

45. From a cryptographic perspective, the service of non-repudiation includes which of the following features?

46. The application of which of the following standards would BEST reduce the potential for data breaches?

47. What is the MOST effective method of testing custom application code?

48. The PRIMARY purpose of accreditation is to

49. Sensitive customer data is going to be added to a database. What is the MOST effective implementation for ensuring data privacy?

50. Reciprocal backup site agreements are considered to be

51. A vulnerability in which of the following components would be MOST difficult to detect?

52. What does an organization FIRST review to assure compliance with privacy requirements?

53. Which of the following is the BEST example of weak management commitment to the protection of security assets and resources?

54. Which of the following is the PRIMARY security concern associated with the implementation of smart cards?

55. How should an organization determine the priority of its remediation efforts after a vulnerability assessment has been conducted?

56. The MAIN reason an organization conducts a security authorization process is to

57. Which of the following is the MOST effective method of mitigating data theft from an active user workstation?

58. Which of the following information MUST be provided for user account provisioning?

59. To protect auditable information, which of the following MUST be configured to only allow read access?

60. Which of the following countermeasures is the MOST effective in defending against a social engineering attack?

61. Data remanence refers to which of the following?

62. Which one of the following activities would present a significant security risk to organizations when employing a Virtual Private Network (VPN) solution?

63. Which of the following is the BEST approach to take in order to effectively incorporate the concepts of business continuity into the organization?

64. An organization lacks a data retention policy. Of the following, who is the BEST person to consult for such a requirement?

65. Who is ultimately responsible to ensure that information assets are categorized and adequate measures are taken to protect them?

66. What type of wireless network attack BEST describes an Electromagnetic Pulse (EMP) attack?

67. Which one of the following operates at the session, transport, or network layer of the Open Systems Interconnection (OSI) model?

68. An organization’s information security strategic plan MUST be reviewed

69. The BEST method to mitigate the risk of a dictionary attack on a system is to

70. Which of the following approaches is the MOST effective way to dispose of data on multiple hard drives?

71. Application of which of the following Institute of Electrical and Electronics Engineers (IEEE) standards will prevent an unauthorized wireless device from being attached to a network?

72. Which of the following describes the BEST configuration management practice?

73. Which of the following primarily contributes to security incidents in web-based applications?

74. While inventorying storage equipment, it is found that there are unlabeled, disconnected, and powered-off devices. What is the correct procedure for handling such equipment?

75. Which of the following is the best method to assess the effectiveness of an organization's vulnerability management program?

76. Which of the following questions can be answered using user and group entitlement reporting?

77. The goal of a Business Continuity Plan (BCP) training and awareness program is to

78. How can lessons learned from business continuity training and actual recovery incidents BEST be used?

79. The World Trade Organization's (WTO) agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS) requires authors of computer software to be given the

80. An organization regularly conducts its own penetration tests. Which of the following scenarios MUST be covered for the test to be effective?

81. Which of the following restricts the ability of an individual to carry out all the steps of a particular process?

82. When planning a penetration test, the tester will be MOST interested in which information?

83. Which of the following BEST describes a rogue Access Point (AP)?

84. Which of the following is the MOST important output from a mobile application threat modeling exercise according to Open Web Application Security Project (OWASP)?

85. Which Radio Frequency Interference (RFI) phenomenon associated with bundled cable runs can create information leakage?

86. Knowing the language in which an encrypted message was originally produced might help a cryptanalyst to perform

87. A mobile device application that restricts the storage of user information to just that which is needed to accomplish lawful business goals adheres to what privacy principle?

88. Which of the following secures web transactions at the Transport Layer?

89. What balance MUST be considered when web application developers determine how informative application error messages should be constructed?

90. During the Security Assessment and Authorization process, what is the PRIMARY purpose for conducting a hardware and software inventory?

91. What is a characteristic of Secure Socket Layer (SSL) and Transport Layer Security (TLS)?

92. After acquiring the latest security updates, what must be done before deploying to production systems?

93. Which of the following roles has the obligation to ensure that a third-party provider is capable of processing and handling data in a secure manner and meeting the standards set by the organization?

94. If compromised, which of the following would lead to the exploitation of multiple virtual machines?

95. Data leakage of sensitive information is MOST often concealed by which of the following?

96. When using Generic Routing Encapsulation (GRE) tunneling over Internet Protocol version 4 (IPv4), where is the GRE header inserted?

97. Which of the following statements is TRUE regarding value boundary analysis as a functional software testing technique?

98. A Simple Power Analysis (SPA) attack against a device directly observes which of the following?

99. What operations role is responsible for protecting the enterprise from corrupt or contaminated media?

100. In general, servers that are facing the Internet should be placed in a demilitarized zone (DMZ). What is the MAIN purpose of the DMZ?

101. Retaining system logs for six months or longer can be valuable for what activities?

102. The 802.1x standard provides a framework for what?

103. When building a data classification scheme, which of the following is the PRIMARY concern?

104. Which of the following analyses is performed to protect information assets?

105. What is the process called when impact values are assigned to the security objectives for information types?

106. Backup information that is critical to the organization is identified through a

107. An organization has developed a major application that has undergone accreditation testing. After receiving the results of the evaluation, what is the final step before the application can be accredited?

108. During which of the following processes is least privilege implemented for a user account?

109. At which layer of the Open Systems Interconnect (OSI) model are the source and destination addresses for a datagram handled?

110. By carefully aligning the pins in the lock, which of the following defines the opening of a mechanical lock without the proper key?

111. What MUST the access control logs contain in addition to the identifier?

112. What does secure authentication with logging provide?

113. Which of the following is an example of two-factor authentication?

114. When implementing a secure wireless network, which of the following supports authentication and authorization for individual client endpoints?

115. A security professional has been asked to evaluate the options for the location of a new data center within a multifloor building. Concerns for the data center include emanations and physical access controls. Which of the following is the BEST location?

116. Which of the following prevents improper aggregation of privileges in Role-Based Access Control (RBAC)?

117. A global organization wants to implement hardware tokens as part of a multifactor authentication solution for remote access. The PRIMARY advantage of this implementation is

118. Which of the following is the PRIMARY benefit of a formalized information classification program?

119. Place the following information classification steps in sequential order:

120. Which of the following is a characteristic of the initialization vector when using Data Encryption Standard (DES)?

121. What type of encryption is used to protect sensitive data in transit over a network?

122. What is the GREATEST challenge of an agent-based patch management solution?

123. How does a Host-Based Intrusion Detection System (HIDS) identify a potential attack?

124. Which of the following is a reason to use manual patch installation instead of automated patch management?

125. The goal of a Business Impact Analysis (BIA) is to determine which of the following?