Updated Questions for CISSP Exam

dumps2022-06-11T01:46:37+08:00

CISSP exam updated questions are available. Study the updated CISSP exam questions and answers to pass the test easily. Recently, many candidates came to our website to ask the updated CISSP questions. Now, you can read and study the updated CISSP questions. Free updated CISSP exam questions are below.

Page 1 of 45

1. Intellectual property rights are PRIMARY concerned with which of the following?

Owner’s ability to realize financial gain

Owner’s ability to maintain copyright

Right of the owner to enjoy their creation

Right of the owner to control delivery method

2. Which of the following types of technologies would be the MOST cost-effective method to provide a reactive control for protecting personnel in public areas?

Install mantraps at the building entrances

Enclose the personnel entry area with polycarbonate plastic

Supply a duress alarm for personnel exposed to the public

Hire a guard to protect the public area

3. Which of the following actions will reduce risk to a laptop before traveling to a high risk area?

Examine the device for physical tampering

Implement more stringent baseline configurations

Purge or re-image the hard disk drive

Change access codes

4. All of the following items should be included in a Business Impact Analysis (BIA) questionnaire EXCEPT questions that

determine the risk of a business interruption occurring

determine the technological dependence of the business processes

Identify the operational impacts of a business interruption

Identify the financial impacts of a business interruption

5. What is the MOST important consideration from a data security perspective when an organization plans to relocate?

Ensure the fire prevention and detection systems are sufficient to protect personnel

Review the architectural plans to determine how many emergency exits are present

Conduct a gap analysis of a new facilities against existing security requirements

Revise the Disaster Recovery and Business Continuity (DR/BC) plan

6. Which of the following represents the GREATEST risk to data confidentiality?

Network redundancies are not implemented

Security awareness training is not completed

Backup tapes are generated unencrypted

Users have administrative privileges

7. When assessing an organization’s security policy according to standards established by the International Organization for Standardization (ISO) 27001 and 27002, when can management responsibilities be defined?

Only when assets are clearly defined

Only when standards are defined

Only when controls are put in place

Only procedures are defined

8. A company whose Information Technology (IT) services are being delivered from a Tier 4 data center, is preparing a companywide Business Continuity Planning (BCP) .

Which of the following failures should the IT manager be concerned with?

Application

Storage

Power

Network

9. An important principle of defense in depth is that achieving information security requires a balanced focus on which PRIMARY elements?

Development, testing, and deployment

Prevention, detection, and remediation

People, technology, and operations

Certification, accreditation, and monitoring

10. In a data classification scheme, the data is owned by the

system security managers

business managers

Information Technology (IT) managers

end users

Page 2 of 45

11. Which of the following is an initial consideration when developing an information security management system?

Identify the contractual security obligations that apply to the organizations

Understand the value of the information assets

Identify the level of residual risk that is tolerable to management

Identify relevant legislative and regulatory compliance requirements

12. Which of the following BEST describes the responsibilities of a data owner?

Ensuring quality and validation through periodic audits for ongoing data integrity

Maintaining fundamental data availability, including data storage and archiving

Ensuring accessibility to appropriate users, maintaining appropriate levels of data security

Determining the impact the information has on the mission of the organization

13. Which of the following is an effective control in preventing electronic cloning of Radio Frequency Identification (RFID) based access cards?

Personal Identity Verification (PIV)

Cardholder Unique Identifier (CHUID) authentication

Physical Access Control System (PACS) repeated attempt detection

Asymmetric Card Authentication Key (CAK) challenge-response

14. An organization has doubled in size due to a rapid market share increase. The size of the Information Technology (IT) staff has maintained pace with this growth. The organization hires several contractors whose onsite time is limited. The IT department has pushed its limits building servers and rolling out workstations and has a backlog of account management requests.

Which contract is BEST in offloading the task from the IT staff?

Platform as a Service (PaaS)

Identity as a Service (IDaaS)

Desktop as a Service (DaaS)

Software as a Service (SaaS)

15. When implementing a data classification program, why is it important to avoid too much granularity?

The process will require too many resources

It will be difficult to apply to both hardware and software

It will be difficult to assign ownership to the data

The process will be perceived as having value

16. Which one of the following affects the classification of data?

Assigned security label

Multilevel Security (MLS) architecture

Minimum query size

Passage of time

17. Which of the following is MOST important when assigning ownership of an asset to a department?

The department should report to the business owner

Ownership of the asset should be periodically reviewed

Individual accountability should be ensured

All members should be trained on their responsibilities

18. Which component of the Security Content Automation Protocol (SCAP) specification contains the data required to estimate the severity of vulnerabilities identified automated vulnerability assessments?

Common Vulnerabilities and Exposures (CVE)

Common Vulnerability Scoring System (CVSS)

Asset Reporting Format (ARF)

Open Vulnerability and Assessment Language (OVAL)

19. What is the second phase of Public Key Infrastructure (PKI) key/certificate life-cycle management?

Implementation Phase

Initialization Phase

Cancellation Phase

Issued Phase

20. Who in the organization is accountable for classification of data information assets?

Data owner

Data architect

Chief Information Security Officer (CISO)

Chief Information Officer (CIO)

Page 3 of 45

21. The use of private and public encryption keys is fundamental in the implementation of which of the following?

Diffie-Hellman algorithm

Secure Sockets Layer (SSL)

Advanced Encryption Standard (AES)

Message Digest 5 (MD5)

22. Which technique can be used to make an encryption scheme more resistant to a known plaintext attack?

Hashing the data before encryption

Hashing the data after encryption

Compressing the data after encryption

Compressing the data before encryption

23. Which security service is served by the process of encryption plaintext with the sender’s private key and decrypting cipher text with the sender’s public key?

Confidentiality

Integrity

Identification

Availability

24. Which of the following mobile code security models relies only on trust?

Code signing

Class authentication

Sandboxing

Type safety

25. Which of the following is the BEST network defense against unknown types of attacks or stealth attacks in progress?

Intrusion Prevention Systems (IPS)

Intrusion Detection Systems (IDS)

Stateful firewalls

Network Behavior Analysis (NBA) tools

26. An input validation and exception handling vulnerability has been discovered on a critical web-based system .

Which of the following is MOST suited to quickly implement a control?

Add a new rule to the application layer firewall

Block access to the service

Install an Intrusion Detection System (IDS)

Patch the application source code

27. An external attacker has compromised an organization’s network security perimeter and installed a sniffer onto an inside computer .

Which of the following is the MOST effective layer of security the organization could have implemented to mitigate the attacker’s ability to gain further information?

Implement packet filtering on the network firewalls

Install Host Based Intrusion Detection Systems (HIDS)

Require strong authentication for administrators

Implement logical network segmentation at the switches

28. Which of the following is used by the Point-to-Point Protocol (PPP) to determine packet formats?

Layer 2 Tunneling Protocol (L2TP)

Link Control Protocol (LCP)

Challenge Handshake Authentication Protocol (CHAP)

Packet Transfer Protocol (PTP)

29. Which of the following operates at the Network Layer of the Open System Interconnection (OSI) model?

Packet filtering

Port services filtering

Content filtering

Application access control

30. Which of the following factors contributes to the weakness of Wired Equivalent Privacy (WEP) protocol?

WEP uses a small range Initialization Vector (IV)

WEP uses Message Digest 5 (MD5)

WEP uses Diffie-Hellman

WEP does not use any Initialization Vector (IV)

Page 4 of 45

31. What is the purpose of an Internet Protocol (IP) spoofing attack?

To send excessive amounts of data to a process, making it unpredictable

To intercept network traffic without authorization

To disguise the destination address from a target’s IP filtering devices

To convince a system that it is communicating with a known entity

32. At what level of the Open System Interconnection (OSI) model is data at rest on a Storage Area Network (SAN) located?

Link layer

Physical layer

Session layer

Application layer

33. In a Transmission Control Protocol/Internet Protocol (TCP/IP) stack, which layer is responsible for negotiating and establishing a connection with another node?

Transport layer

Application layer

Network layer

Session layer

34. Which of the following BEST describes an access control method utilizing cryptographic keys derived from a smart card private key that is embedded within mobile devices?

Derived credential

Temporary security credential

Mobile device credentialing service

Digest authentication

35. What is the BEST approach for controlling access to highly sensitive information when employees have the same level of security clearance?

Audit logs

Role-Based Access Control (RBAC)

Two-factor authentication

Application of least privilege

36. A manufacturing organization wants to establish a Federated Identity Management (FIM) system with its 20 different supplier companies .

Which of the following is the BEST solution for the manufacturing organization?

Trusted third-party certification

Lightweight Directory Access Protocol (LDAP)

Security Assertion Markup language (SAML)

Cross-certification

37. Users require access rights that allow them to view the average salary of groups of employees .

Which control would prevent the users from obtaining an individual employee’s salary?

Limit access to predefined queries

Segregate the database into a small number of partitions each with a separate security level

Implement Role Based Access Control (RBAC)

Reduce the number of people who have access to the system for statistical purposes

38. Which of the following is of GREATEST assistance to auditors when reviewing system configurations?

Change management processes

User administration procedures

Operating System (OS) baselines

System backup documentation

39. Which of the following is a PRIMARY benefit of using a formalized security testing report format and structure?

Executive audiences will understand the outcomes of testing and most appropriate next steps for corrective actions to be taken

Technical teams will understand the testing objectives, testing strategies applied, and business risk associated with each vulnerability

Management teams will understand the testing objectives and reputational risk to the organization

Technical and management teams will better understand the testing objectives, results of each test phase, and potential impact levels

40. In which of the following programs is it MOST important to include the collection of security process data?

Quarterly access reviews

Security continuous monitoring

Business continuity testing

Annual security training

Page 5 of 45

41. Which of the following could cause a Denial of Service (DoS) against an authentication system?

Encryption of audit logs

No archiving of audit logs

Hashing of audit logs

Remote access audit logs

42. A Virtual Machine (VM) environment has five guest Operating Systems (OS) and provides strong isolation .

What MUST an administrator review to audit a user’s access to data files?

Host VM monitor audit logs

Guest OS access controls

Host VM access controls

Guest OS audit logs

43. With what frequency should monitoring of a control occur when implementing Information Security Continuous Monitoring (ISCM) solutions?

Continuously without exception for all security controls

Before and after each change of the control

At a rate concurrent with the volatility of the security control

Only during system implementation and decommissioning

44. What is the MOST important step during forensic analysis when trying to learn the purpose of an unknown application?

Disable all unnecessary services

Ensure chain of custody

Prepare another backup of the system

Isolate the system from the network

45. A continuous information security monitoring program can BEST reduce risk through which of the following?

Collecting security events and correlating them to identify anomalies

Facilitating system-wide visibility into the activities of critical user accounts

Encompassing people, process, and technology

Logging both scheduled and unscheduled system changes

46. What would be the MOST cost effective solution for a Disaster Recovery (DR) site given that the organization’s systems cannot be unavailable for more than 24 hours?

Warm site

Hot site

Mirror site

Cold site

47. An organization is found lacking the ability to properly establish performance indicators for its Web hosting solution during an audit .

What would be the MOST probable cause?

Absence of a Business Intelligence (BI) solution

Inadequate cost modeling

Improper deployment of the Service-Oriented Architecture (SOA)

Insufficient Service Level Agreement (SLA)

48. Recovery strategies of a Disaster Recovery planning (DRIP) MUST be aligned with which of the following?

Hardware and software compatibility issues

Applications’ critically and downtime tolerance

Budget constraints and requirements

Cost/benefit analysis and business objectives

49. When is a Business Continuity Plan (BCP) considered to be valid?

When it has been validated by the Business Continuity (BC) manager

When it has been validated by the board of directors

When it has been validated by all threat scenarios

When it has been validated by realistic exercises

50. Which of the following is the FIRST step in the incident response process?

Determine the cause of the incident

Disconnect the system involved from the network

Isolate and contain the system involved

Investigate all symptoms to confirm the incident

Page 6 of 45

51. Which of the following types of business continuity tests includes assessment of resilience to internal and external risks without endangering live operations?

Walkthrough

Simulation

Parallel

White box

52. A Business Continuity Plan/Disaster Recovery Plan (BCP/DRP) will provide which of the following?

Guaranteed recovery of all business functions

Minimization of the need decision making during a crisis

Insurance against litigation following a disaster

Protection from loss of organization resources

53. Which of the following is a PRIMARY advantage of using a third-party identity service?

Consolidation of multiple providers

Directory synchronization

Web based logon

Automated account management

54. What is the PRIMARY reason for implementing change management?

Certify and approve releases to the environment

Provide version rollbacks for system changes

Ensure that all applications are approved

Ensure accountability for changes to the environment

55. What should be the FIRST action to protect the chain of evidence when a desktop computer is involved?

Take the computer to a forensic lab

Make a copy of the hard drive

Start documenting

Turn off the computer

56. The configuration management and control task of the certification and accreditation process is incorporated in which phase of the System Development Life Cycle (SDLC)?

System acquisition and development

System operations and maintenance

System initiation

System implementation

57. When in the Software Development Life Cycle (SDLC) MUST software security functional requirements be defined?

After the system preliminary design has been developed and the data security categorization has been performed

After the vulnerability analysis has been performed and before the system detailed design begins

After the system preliminary design has been developed and before the data security categorization begins

After the business functional analysis and the data security categorization have been performed

58. What is the BEST approach to addressing security issues in legacy web applications?

Debug the security issues

Migrate to newer, supported applications where possible

Conduct a security assessment

Protect the legacy application with a web application firewall

59. Which of the following is the PRIMARY risk with using open source software in a commercial software construction?

Lack of software documentation

License agreements requiring release of modified code

Expiration of the license agreement

Costs associated with support of the software

60. A Java program is being developed to read a file from computer A and write it to computer B, using a third computer C. The program is not working as expected .

What is the MOST probable security feature of Java preventing the program from operating as intended?

Least privilege

Privilege escalation

Defense in depth

Privilege bracketing

Page 7 of 45

61. Which of the following is a web application control that should be put into place to prevent exploitation of Operating System (OS) bugs?

Check arguments in function calls

Test for the security patch level of the environment

Include logging functions

Digitally sign each application module

62. Which of the following is the BEST method to prevent malware from being introduced into a production environment?

Purchase software from a limited list of retailers

Verify the hash key or certificate key of all updates

Do not permit programs, patches, or updates from the Internet

Test all new software in a segregated environment

63. Which of the following is a limitation of the Common Vulnerability Scoring System (CVSS) as it relates to conducting code review?

It has normalized severity ratings.

It has many worksheets and practices to implement.

It aims to calculate the risk of published vulnerabilities.

It requires a robust risk management framework to be put in place.

64. An organization is designing a large enterprise-wide document repository system. They plan to have several different classification level areas with increasing levels of controls.

The BEST way to ensure document confidentiality in the repository is to

encrypt the contents of the repository and document any exceptions to that requirement.

utilize Intrusion Detection System (IDS) set drop connections if too many requests for documents are detected.

keep individuals with access to high security areas from saving those documents into lower security areas.

require individuals with access to the system to sign Non-Disclosure Agreements (NDA).

65. An advantage of link encryption in a communications network is that it

makes key management and distribution easier.

protects data from start to finish through the entire network.

improves the efficiency of the transmission.

encrypts all information, including headers and routing information.

66. A security consultant has been asked to research an organization's legal obligations to protect privacy-related information .

What kind of reading material is MOST relevant to this project?

The organization's current security policies concerning privacy issues

Privacy-related regulations enforced by governing bodies applicable to the organization

Privacy best practices published by recognized security standards organizations

Organizational procedures designed to protect privacy information

67. An external attacker has compromised an organization's network security perimeter and installed a sniffer onto an inside computer .

Which of the following is the MOST effective layer of security the organization could have implemented to mitigate the attacker's ability to gain further information?

Implement packet filtering on the network firewalls

Require strong authentication for administrators

Install Host Based Intrusion Detection Systems (HIDS)

Implement logical network segmentation at the switches

68. Which of the following is an authentication protocol in which a new random number is generated uniquely for each login session?

Challenge Handshake Authentication Protocol (CHAP)

Point-to-Point Protocol (PPP)

Extensible Authentication Protocol (EAP)

Password Authentication Protocol (PAP)

69. Which of the following is an attacker MOST likely to target to gain privileged access to a system?

Programs that write to system resources

Programs that write to user directories

Log files containing sensitive information

Log files containing system calls

70. Which of the following elements MUST a compliant EU-US Safe Harbor Privacy Policy contain?

An explanation of how long the data subject's collected information will be retained for and how it will be eventually disposed.

An explanation of who can be contacted at the organization collecting the information if corrections are required by the data subject.

An explanation of the regulatory frameworks and compliance standards the information collecting organization adheres to.

An explanation of all the technologies employed by the collecting organization in gathering information on the data subject.

Page 8 of 45

71. Which of the following actions should be performed when implementing a change to a database schema in a production system?

Test in development, determine dates, notify users, and implement in production

Apply change to production, run in parallel, finalize change in production, and develop a back-out strategy

Perform user acceptance testing in production, have users sign off, and finalize change

Change in development, perform user acceptance testing, develop a back-out strategy, and implement change

72. What is the ultimate objective of information classification?

To assign responsibility for mitigating the risk to vulnerable systems

To ensure that information assets receive an appropriate level of protection

To recognize that the value of any item of information may change over time

To recognize the optimal number of classification categories and the benefits to be gained from their use

73. Which of the following BEST represents the principle of open design?

Disassembly, analysis, or reverse engineering will reveal the security functionality of the computer system.

Algorithms must be protected to ensure the security and interoperability of the designed system.

A knowledgeable user should have limited privileges on the system to prevent their ability to compromise security capabilities.

The security of a mechanism should not depend on the secrecy of its design or implementation.

74. At a MINIMUM, a formal review of any Disaster Recovery Plan (DRP) should be conducted

monthly.

quarterly.

annually.

bi-annually.

75. A vulnerability test on an Information System (IS) is conducted to

exploit security weaknesses in the I

measure system performance on systems with weak security controls.

evaluate the effectiveness of security controls.

prepare for Disaster Recovery (DR) planning.

76. The BEST method of demonstrating a company's security level to potential customers is

a report from an external auditor.

responding to a customer's security questionnaire.

a formal report from an internal auditor.

a site visit by a customer's security team.

77. Which of the following MUST be part of a contract to support electronic discovery of data stored in a cloud environment?

Integration with organizational directory services for authentication

Tokenization of data

Accommodation of hybrid deployment models

Identification of data location

78. Which of the following can BEST prevent security flaws occurring in outsourced software development?

Contractual requirements for code quality

Licensing, code ownership and intellectual property rights

Certification of the quality and accuracy of the work done

Delivery dates, change management control and budgetary control

79. Which of the following wraps the decryption key of a full disk encryption implementation and ties the hard disk drive to a particular device?

Trusted Platform Module (TPM)

Preboot eXecution Environment (PXE)

Key Distribution Center (KDC)

Simple Key-Management for Internet Protocol (SKIP)

80. A software scanner identifies a region within a binary image having high entropy .

What does this MOST likely indicate?

Encryption routines

Random number generator

Obfuscated code

Botnet command and control

Page 9 of 45

81. By allowing storage communications to run on top of Transmission Control Protocol/Internet Protocol (TCP/IP) with a Storage Area Network (SAN), the

confidentiality of the traffic is protected.

opportunity to sniff network traffic exists.

opportunity for device identity spoofing is eliminated.

storage devices are protected against availability attacks.

82. Why must all users be positively identified prior to using multi-user computers?

To provide access to system privileges

To provide access to the operating system

To ensure that unauthorized persons cannot access the computers

To ensure that management knows what users are currently logged on

83. A system has been scanned for vulnerabilities and has been found to contain a number of communication ports that have been opened without authority. To which of the following might this system have been subjected?

Trojan horse

Denial of Service (DoS)

Spoofing

Man-in-the-Middle (MITM)

84. The Structured Query Language (SQL) implements Discretionary Access Controls (DAC) using

INSERT and DELET

GRANT and REVOK

PUBLIC and PRIVAT

ROLLBACK and TERMINAT

85. Alternate encoding such as hexadecimal representations is MOST often observed in which of the following forms of attack?

Smurf

Rootkit exploit

Denial of Service (DoS)

Cross site scripting (XSS)

86. An Intrusion Detection System (IDS) is generating alarms that a user account has over 100 failed login attempts per minute. A sniffer is placed on the network, and a variety of passwords for that user are noted .

Which of the following is MOST likely occurring?

A dictionary attack

A Denial of Service (DoS) attack

A spoofing attack

A backdoor installation

87. Which of the following methods protects Personally Identifiable Information (PII) by use of a full replacement of the data element?

Transparent Database Encryption (TDE)

Column level database encryption

Volume encryption

Data tokenization

88. In a basic SYN flood attack, what is the attacker attempting to achieve?

Exceed the threshold limit of the connection queue for a given service

Set the threshold to zero for a given service

Cause the buffer to overflow, allowing root access

Flush the register stack, allowing hijacking of the root account

89. The birthday attack is MOST effective against which one of the following cipher technologies?

Chaining block encryption

Asymmetric cryptography

Cryptographic hash

Streaming cryptography

90. Which one of the following security mechanisms provides the BEST way to restrict the execution of privileged procedures?

Role Based Access Control (RBAC)

Biometric access control

Federated Identity Management (IdM)

Application hardening

Page 10 of 45

91. A disadvantage of an application filtering firewall is that it can lead to

a crash of the network as a result of user activities.

performance degradation due to the rules applied.

loss of packets on the network due to insufficient bandwidth.

Internet Protocol (IP) spoofing by hackers.

92. Passive Infrared Sensors (PIR) used in a non-climate controlled environment should

reduce the detected object temperature in relation to the background temperature.

increase the detected object temperature in relation to the background temperature.

automatically compensate for variance in background temperature.

detect objects of a specific temperature independent of the background temperature.

93. Logical access control programs are MOST effective when they are

approved by external auditors.

combined with security token technology.

maintained by computer security officers.

made part of the operating system.

94. Checking routing information on e-mail to determine it is in a valid format and contains valid information is an example of which of the following anti-spam approaches?

Simple Mail Transfer Protocol (SMTP) blacklist

Reverse Domain Name System (DNS) lookup

Hashing algorithm

Header analysis

95. In the area of disaster planning and recovery, what strategy entails the presentation of information about the plan?

Communication

Planning

Recovery

Escalation

96. What is the MOST important purpose of testing the Disaster Recovery Plan (DRP)?

Evaluating the efficiency of the plan

Identifying the benchmark required for restoration

Validating the effectiveness of the plan

Determining the Recovery Time Objective (RTO)

97. Which layer of the Open Systems Interconnections (OSI) model implementation adds information concerning the logical connection between the sender and receiver?

Physical

Session

Transport

Data-Link

98. The goal of software assurance in application development is to

enable the development of High Availability (HA) systems.

facilitate the creation of Trusted Computing Base (TCB) systems.

prevent the creation of vulnerable applications.

encourage the development of open source applications.

99. The three PRIMARY requirements for a penetration test are

A defined goal, limited time period, and approval of management

A general objective, unlimited time, and approval of the network administrator

An objective statement, disclosed methodology, and fixed cost

A stated objective, liability waiver, and disclosed methodology

100. Which Hyper Text Markup Language 5 (HTML5) option presents a security challenge for network data leakage prevention and/or monitoring?

Cross Origin Resource Sharing (CORS)

WebSockets

Document Object Model (DOM) trees

Web Interface Definition Language (IDL)

Page 11 of 45

101. Which of the following defines the key exchange for Internet Protocol Security (IPSec)?

Secure Sockets Layer (SSL) key exchange

Internet Key Exchange (IKE)

Security Key Exchange (SKE)

Internet Control Message Protocol (ICMP)

102. What would be the PRIMARY concern when designing and coordinating a security assessment for an Automatic Teller Machine (ATM) system?

Physical access to the electronic hardware

Regularly scheduled maintenance process

Availability of the network connection

Processing delays

103. Which of the following statements is TRUE for point-to-point microwave transmissions?

They are not subject to interception due to encryption.

Interception only depends on signal strength.

They are too highly multiplexed for meaningful interception.

They are subject to interception by an antenna within proximity.

104. When constructing an Information Protection Policy (IPP), it is important that the stated rules are necessary, adequate, and

flexible.

confidential.

focused.

achievable.

105. The overall goal of a penetration test is to determine a system's

ability to withstand an attack.

capacity management.

error recovery capabilities.

reliability under stress.

106. Which of the following is the FIRST step of a penetration test plan?

Analyzing a network diagram of the target network

Notifying the company's customers

Obtaining the approval of the company's management

Scheduling the penetration test during a period of least impact

107. Copyright provides protection for which of the following?

Ideas expressed in literary works

A particular expression of an idea

New and non-obvious inventions

Discoveries of natural phenomena

108. Which one of the following effectively obscures network addresses from external exposure when implemented on a firewall or router?

Network Address Translation (NAT)

Application Proxy

Routing Information Protocol (RIP) Version 2

Address Masking

109. Two companies wish to share electronic inventory and purchase orders in a supplier and client relationship .

What is the BEST security solution for them?

Write a Service Level Agreement (SLA) for the two companies.

Set up a Virtual Private Network (VPN) between the two companies.

Configure a firewall at the perimeter of each of the two companies.

Establish a File Transfer Protocol (FTP) connection between the two companies.

110. An organization is selecting a service provider to assist in the consolidation of multiple computing sites including development, implementation and ongoing support of various computer systems .

Which of the following MUST be verified by the Information Security Department?

The service provider's policies are consistent with ISO/IEC27001 and there is evidence that the service provider is following those policies.

The service provider will segregate the data within its systems and ensure that each region's policies are met.

The service provider will impose controls and protections that meet or exceed the current systems controls and produce audit logs as verification.

The service provider's policies can meet the requirements imposed by the new environment even if they differ from the organization's current policies.

Page 12 of 45

111. What should be the INITIAL response to Intrusion Detection System/Intrusion Prevention System (IDS/IPS) alerts?

Ensure that the Incident Response Plan is available and current.

Determine the traffic's initial source and block the appropriate port.

Disable or disconnect suspected target and source systems.

Verify the threat and determine the scope of the attack.

112. The BEST way to check for good security programming practices, as well as auditing for possible backdoors, is to conduct

log auditing.

code reviews.

impact assessments.

static analysis.

113. A practice that permits the owner of a data object to grant other users access to that object would usually provide

Mandatory Access Control (MAC).

owner-administered control.

owner-dependent access control.

Discretionary Access Control (DAC).

114. Which of the following is ensured when hashing files during chain of custody handling?

Availability

Accountability

Integrity

Non-repudiation

115. In Disaster Recovery (DR) and business continuity training, which BEST describes a functional drill?

A full-scale simulation of an emergency and the subsequent response functions

A specific test by response teams of individual emergency response functions

A functional evacuation of personnel

An activation of the backup site

116. The type of authorized interactions a subject can have with an object is

control.

permission.

procedure.

protocol.

117. Which of the following is a potential risk when a program runs in privileged mode?

It may serve to create unnecessary code complexity

It may not enforce job separation duties

It may create unnecessary application hardening

It may allow malicious code to be inserted

118. The use of strong authentication, the encryption of Personally Identifiable Information (PII) on database servers, application security reviews, and the encryption of data transmitted across networks provide

data integrity.

defense in depth.

data availability.

non-repudiation.

119. Which of the following is an appropriate source for test data?

Production data that is secured and maintained only in the production environment.

Test data that has no similarities to production dat

Test data that is mirrored and kept up-to-date with production dat

Production data that has been sanitized before loading into a test environment.

120. Which of the following is the MOST important consideration when storing and processing Personally Identifiable Information (PII)?

Encrypt and hash all PII to avoid disclosure and tampering.

Store PII for no more than one year.

Avoid storing PII in a Cloud Service Provider.

Adherence to collection limitation laws and regulations.

Page 13 of 45

121. In a financial institution, who has the responsibility for assigning the classification to a piece of information?

Chief Financial Officer (CFO)

Chief Information Security Officer (CISO)

Originator or nominated owner of the information

Department head responsible for ensuring the protection of the information

122. The process of mutual authentication involves a computer system authenticating a user and authenticating the

user to the audit process.

computer system to the user.

user's access to all authorized objects.

computer system to the audit process.

123. When implementing controls in a heterogeneous end-point network for an organization, it is critical that

hosts are able to establish network communications.

users can make modifications to their security software configurations.

common software security components be implemented across all hosts.

firewalls running on each host are fully customizable by the user.

124. Which of the following is a security feature of Global Systems for Mobile Communications (GSM)?

It uses a Subscriber Identity Module (SIM) for authentication.

It uses encrypting techniques for all communications.

The radio spectrum is divided with multiple frequency carriers.

The signal is difficult to read as it provides end-to-end encryption.

125. Which of the following does the Encapsulating Security Payload (ESP) provide?

Authorization and integrity

Availability and integrity

Integrity and confidentiality

Authorization and confidentiality

126. What maintenance activity is responsible for defining, implementing, and testing updates to application systems?

Program change control

Regression testing

Export exception control

User acceptance testing

127. Which of the following is the FIRST action that a system administrator should take when it is revealed during a penetration test that everyone in an organization has unauthorized access to a server holding sensitive data?

Immediately document the finding and report to senior management.

Use system privileges to alter the permissions to secure the server

Continue the testing to its completion and then inform IT management

Terminate the penetration test and pass the finding to the server management team

128. Which one of these risk factors would be the LEAST important consideration in choosing a building site for a new computer facility?

Vulnerability to crime

Adjacent buildings and businesses

Proximity to an airline flight path

Vulnerability to natural disasters

129. Which of the following is the MAIN reason that system re-certification and re-accreditation are needed?

To assist data owners in making future sensitivity and criticality determinations

To assure the software development team that all security issues have been addressed

To verify that security protection remains acceptable to the organizational security policy

To help the security team accept or reject new systems for implementation and production

130. The stringency of an Information Technology (IT) security assessment will be determined by the

system's past security record.

size of the system's database.

sensitivity of the system's data.

age of the system.

Page 14 of 45

131. Following the completion of a network security assessment, which of the following can BEST be demonstrated?

The effectiveness of controls can be accurately measured

A penetration test of the network will fail

The network is compliant to industry standards

All unpatched vulnerabilities have been identified

132. What is the MOST effective countermeasure to a malicious code attack against a mobile system?

Sandbox

Change control

Memory management

Public-Key Infrastructure (PKI)

133. Which of the following statements is TRUE of black box testing?

Only the functional specifications are known to the test planner.

Only the source code and the design documents are known to the test planner.

Only the source code and functional specifications are known to the test planner.

Only the design documents and the functional specifications are known to the test planner.

134. Why MUST a Kerberos server be well protected from unauthorized access?

It contains the keys of all clients.

It always operates at root privilege.

It contains all the tickets for services.

It contains the Internet Protocol (IP) address of all network entities.

135. An internal Service Level Agreement (SLA) covering security is signed by senior managers and is in place.

When should compliance to the SLA be reviewed to ensure that a good security posture is being delivered?

As part of the SLA renewal process

Prior to a planned security audit

Immediately after a security breach

At regularly scheduled meetings

136. The FIRST step in building a firewall is to

assign the roles and responsibilities of the firewall administrators.

define the intended audience who will read the firewall policy.

identify mechanisms to encourage compliance with the policy.

perform a risk analysis to identify issues to be addressed.

137. Which one of the following is a fundamental objective in handling an incident?

To restore control of the affected systems

To confiscate the suspect's computers

To prosecute the attacker

To perform full backups of the system

138. Internet Protocol (IP) source address spoofing is used to defeat

address-based authentication.

Address Resolution Protocol (ARP).

Reverse Address Resolution Protocol (RARP).

Transmission Control Protocol (TCP) hijacking.

139. When transmitting information over public networks, the decision to encrypt it should be based on

the estimated monetary value of the information.

whether there are transient nodes relaying the transmission.

the level of confidentiality of the information.

the volume of the information.

140. Which of the following is a method used to prevent Structured Query Language (SQL) injection attacks?

Data compression

Data classification

Data warehousing

Data validation

Page 15 of 45

141. Which of the following is an effective method for avoiding magnetic media data remanence?

Degaussing

Encryption

Data Loss Prevention (DLP)

Authentication

142. What is the FIRST step in developing a security test and its evaluation?

Determine testing methods

Develop testing procedures

Identify all applicable security requirements

Identify people, processes, and products not in compliance

143. Multi-threaded applications are more at risk than single-threaded applications to

race conditions.

virus infection.

packet sniffing.

database injection.

144. What is the term commonly used to refer to a technique of authenticating one machine to another by forging packets from a trusted source?

Man-in-the-Middle (MITM) attack

Smurfing

Session redirect

Spoofing

145. Including a Trusted Platform Module (TPM) in the design of a computer system is an example of a technique to what?

Interface with the Public Key Infrastructure (PKI)

Improve the quality of security software

Prevent Denial of Service (DoS) attacks

Establish a secure initial state

146. Which of the following is considered best practice for preventing e-mail spoofing?

Spam filtering

Cryptographic signature

Uniform Resource Locator (URL) filtering

Reverse Domain Name Service (DNS) lookup

147. The key benefits of a signed and encrypted e-mail include

confidentiality, authentication, and authorization.

confidentiality, non-repudiation, and authentication.

non-repudiation, authorization, and authentication.

non-repudiation, confidentiality, and authorization.

148. As one component of a physical security system, an Electronic Access Control (EAC) token is BEST known for its ability to

overcome the problems of key assignments.

monitor the opening of windows and doors.

trigger alarms when intruders are detected.

lock down a facility during an emergency.

149. An auditor carrying out a compliance audit requests passwords that are encrypted in the system to verify that the passwords are compliant with policy .

Which of the following is the BEST response to the auditor?

Provide the encrypted passwords and analysis tools to the auditor for analysis.

Analyze the encrypted passwords for the auditor and show them the results.

Demonstrate that non-compliant passwords cannot be created in the system.

Demonstrate that non-compliant passwords cannot be encrypted in the system.

150. Which of the following would be the FIRST step to take when implementing a patch management program?

Perform automatic deployment of patches.

Monitor for vulnerabilities and threats.

Prioritize vulnerability remediation.

Create a system inventory.

Page 16 of 45

151. The Hardware Abstraction Layer (HAL) is implemented in the

system software.

system hardware.

application software.

network hardware.

152. To prevent inadvertent disclosure of restricted information, which of the following would be the LEAST effective process for eliminating data prior to the media being discarded?

Multiple-pass overwriting

Degaussing

High-level formatting

Physical destruction

153. An organization allows ping traffic into and out of their network. An attacker has installed a program on the network that uses the payload portion of the ping packet to move data into and out of the network .

What type of attack has the organization experienced?

Data leakage

Unfiltered channel

Data emanation

Covert channel

154. What principle requires that changes to the plaintext affect many parts of the ciphertext?

Diffusion

Encapsulation

Obfuscation

Permutation

155. A security professional has just completed their organization's Business Impact Analysis (BIA). Following Business Continuity Plan/Disaster Recovery Plan (BCP/DRP) best practices, what would be the professional's NEXT step?

Identify and select recovery strategies.

Present the findings to management for funding.

Select members for the organization's recovery teams.

Prepare a plan to test the organization's ability to recover its operations.

156. Which of the following assessment metrics is BEST used to understand a system's vulnerability to potential exploits?

Determining the probability that the system functions safely during any time period

Quantifying the system's available services

Identifying the number of security flaws within the system

Measuring the system's integrity in the presence of failure

157. What is an effective practice when returning electronic storage media to third parties for repair?

Ensuring the media is not labeled in any way that indicates the organization's name.

Disassembling the media and removing parts that may contain sensitive dat

Physically breaking parts of the media that may contain sensitive dat

Establishing a contract with the third party regarding the secure handling of the medi

158. Which of the following is the BEST mitigation from phishing attacks?

Network activity monitoring

Security awareness training

Corporate policy and procedures

Strong file and directory permissions

159. Which of the following does Temporal Key Integrity Protocol (TKIP) support?

Multicast and broadcast messages

Coordination of IEEE 802.11 protocols

Wired Equivalent Privacy (WEP) systems

Synchronization of multiple devices

160. Which of the following is a security limitation of File Transfer Protocol (FTP)?

Passive FTP is not compatible with web browsers.

Anonymous access is allowed.

FTP uses Transmission Control Protocol (TCP) ports 20 and 21.

Authentication is not encrypted.

Page 17 of 45

161. How can a forensic specialist exclude from examination a large percentage of operating system files residing on a copy of the target system?

Take another backup of the media in question then delete all irrelevant operating system files.

Create a comparison database of cryptographic hashes of the files from a system with the same operating system and patch level.

Generate a message digest (MD) or secure hash on the drive image to detect tampering of the media being examined.

Discard harmless files for the operating system, and known installed programs.

162. Which of the following is a network intrusion detection technique?

Statistical anomaly

Perimeter intrusion

Port scanning

Network spoofing

163. During an audit of system management, auditors find that the system administrator has not been trained .

What actions need to be taken at once to ensure the integrity of systems?

A review of hiring policies and methods of verification of new employees

A review of all departmental procedures

A review of all training procedures to be undertaken

A review of all systems by an experienced administrator

164. When designing a networked Information System (IS) where there will be several different types of individual access, what is the FIRST step that should be taken to ensure all access control requirements are addressed?

Create a user profile.

Create a user access matrix.

Develop an Access Control List (ACL).

Develop a Role Based Access Control (RBAC) list.

165. When building a data center, site location and construction factors that increase the level of vulnerability to physical threats include

hardened building construction with consideration of seismic factors.

adequate distance from and lack of access to adjacent buildings.

curved roads approaching the data center.

proximity to high crime areas of the city.

166. Which of the following is a physical security control that protects Automated Teller Machines (ATM) from skimming?

Anti-tampering

Secure card reader

Radio Frequency (RF) scanner

Intrusion Prevention System (IPS)

167. Which one of the following describes granularity?

Maximum number of entries available in an Access Control List (ACL)

Fineness to which a trusted system can authenticate users

Number of violations divided by the number of total accesses

Fineness to which an access control system can be adjusted

168. Which one of the following is a threat related to the use of web-based client side input validation?

Users would be able to alter the input after validation has occurred

The web server would not be able to validate the input after transmission

The client system could receive invalid input from the web server

The web server would not be able to receive invalid input from the client

169. Which one of the following transmission media is MOST effective in preventing data interception?

Microwave

Twisted-pair

Fiber optic

Coaxial cable

170. Which of the following is TRUE about Disaster Recovery Plan (DRP) testing?

Operational networks are usually shut down during testing.

Testing should continue even if components of the test fail.

The company is fully prepared for a disaster if all tests pass.

Testing should not be done until the entire disaster plan can be tested.

Page 18 of 45

171. While impersonating an Information Security Officer (ISO), an attacker obtains information from company employees about their User IDs and passwords .

Which method of information gathering has the attacker used?

Trusted path

Malicious logic

Social engineering

Passive misuse

172. Who must approve modifications to an organization's production infrastructure configuration?

Technical management

Change control board

System operations

System users

173. Which type of control recognizes that a transaction amount is excessive in accordance with corporate policy?

Detection

Prevention

Investigation

Correction

174. Which one of the following considerations has the LEAST impact when considering transmission security?

Network availability

Data integrity

Network bandwidth

Node locations

175. Which of the following is an essential element of a privileged identity lifecycle management?

Regularly perform account re-validation and approval

Account provisioning based on multi-factor authentication

Frequently review performed activities and request justification

Account information to be provided by supervisor or line manager

176. Which of the following MUST be done when promoting a security awareness program to senior management?

Show the need for security; identify the message and the audience

Ensure that the security presentation is designed to be all-inclusive

Notify them that their compliance is mandatory

Explain how hackers have enhanced information security

177. Contingency plan exercises are intended to do which of the following?

Train personnel in roles and responsibilities

Validate service level agreements

Train maintenance personnel

Validate operation metrics

178. Which of the following is the best practice for testing a Business Continuity Plan (BCP)?

Test before the IT Audit

Test when environment changes

Test after installation of security patches

Test after implementation of system patches

179. Why is a system's criticality classification important in large organizations?

It provides for proper prioritization and scheduling of security and maintenance tasks.

It reduces critical system support workload and reduces the time required to apply patches.

It allows for clear systems status communications to executive management.

It provides for easier determination of ownership, reducing confusion as to the status of the asset.

180. In Business Continuity Planning (BCP), what is the importance of documenting business processes?

Provides senior management with decision-making tools

Establishes and adopts ongoing testing and maintenance strategies

Defines who will perform which functions during a disaster or emergency

Provides an understanding of the organization's interdependencies

Page 19 of 45

181. Which security action should be taken FIRST when computer personnel are terminated from their jobs?

Remove their computer access

Require them to turn in their badge

Conduct an exit interview

Reduce their physical access level to the facility

182. The PRIMARY purpose of a security awareness program is to

ensure that everyone understands the organization's policies and procedures.

communicate that access to information will be granted on a need-to-know basis.

warn all users that access to all systems will be monitored on a daily basis.

comply with regulations related to data and information protection.

183. Which of the following Disaster Recovery (DR) sites is the MOST difficult to test?

Hot site

Cold site

Warm site

Mobile site

184. What technique BEST describes antivirus software that detects viruses by watching anomalous behavior?

Signature

Inference

Induction

Heuristic

185. Which of the following is the BEST way to verify the integrity of a software patch?

Cryptographic checksums

Version numbering

Automatic updates

Vendor assurance

186. What security management control is MOST often broken by collusion?

Job rotation

Separation of duties

Least privilege model

Increased monitoring

187. Which one of the following is the MOST important in designing a biometric access system if it is essential that no one other than authorized individuals are admitted?

False Acceptance Rate (FAR)

False Rejection Rate (FRR)

Crossover Error Rate (CER)

Rejection Error Rate

188. An engineer in a software company has created a virus creation tool. The tool can generate thousands of polymorphic viruses. The engineer is planning to use the tool in a controlled environment to test the company's next generation virus scanning software .

Which would BEST describe the behavior of the engineer and why?

The behavior is ethical because the tool will be used to create a better virus scanner.

The behavior is ethical because any experienced programmer could create such a tool.

The behavior is not ethical because creating any kind of virus is bad.

The behavior is not ethical because such a tool could be leaked on the Internet.

189. What is the PRIMARY reason for ethics awareness and related policy implementation?

It affects the workflow of an organization.

It affects the reputation of an organization.

It affects the retention rate of employees.

It affects the morale of the employees.

190. Refer to the information below to answer the question.

A large organization uses unique identifiers and requires them at the start of every system session. Application access is based on job classification. The organization is subject to periodic independent reviews of access controls and violations. The organization uses wired and wireless networks and remote access. The organization also uses secure connections to branch offices and secure backup and recovery strategies for selected information and processes.

Following best practice, where should the permitted access for each department and job classification combination be specified?

Security procedures

Security standards

Human resource policy

Human resource standards

Page 20 of 45

191. A system is developed so that its business users can perform business functions but not user administration functions. Application administrators can perform administration functions but not user business functions. These capabilities are BEST described as

least privilege.

rule based access controls.

Mandatory Access Control (MAC).

separation of duties.

192. When implementing a secure wireless network, which of the following supports authentication and authorization for individual client endpoints?

Temporal Key Integrity Protocol (TKIP)

Wi-Fi Protected Access (WPA) Pre-Shared Key (PSK)

Wi-Fi Protected Access 2 (WPA2) Enterprise

Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP)

193. Refer to the information below to answer the question.

A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive e-mail, search the web, and use instant messaging. The organization’s Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee's access.

Which of the following documents explains the proper use of the organization's assets?

Human resources policy

Acceptable use policy

Code of ethics

Access control policy

194. Refer to the information below to answer the question.

A large, multinational organization has decided to outsource a portion of their Information Technology (IT) organization to a third-party provider’s facility. This provider will be responsible for the design, development, testing, and support of several critical, customer-based applications used by the organization.

What additional considerations are there if the third party is located in a different country?

The organizational structure of the third party and how it may impact timelines within the organization

The ability of the third party to respond to the organization in a timely manner and with accurate information

The effects of transborder data flows and customer expectations regarding the storage or processing of their data

The quantity of data that must be provided to the third party and how it is to be used

195. Which of the following assures that rules are followed in an identity management architecture?

Policy database

Digital signature

Policy decision point

Policy enforcement point

196. Which of the following problems is not addressed by using OAuth (Open Standard to Authorization) 2.0 to integrate a third-party identity provider for a service?

Resource Servers are required to use passwords to authenticate end users.

Revocation of access of some users of the third party instead of all the users from the third party.

Compromise of the third party means compromise of all the users in the service.

Guest users need to authenticate with the third party identity provider.

197. Refer to the information below to answer the question.

A security practitioner detects client-based attacks on the organization’s network. A plan will be necessary to address these concerns.

What is the BEST reason for the organization to pursue a plan to mitigate client-based attacks?

Client privilege administration is inherently weaker than server privilege administration.

Client hardening and management is easier on clients than on servers.

Client-based attacks are more common and easier to exploit than server and network based attacks.

Client-based attacks have higher financial impact.

198. Host-Based Intrusion Protection (HIPS) systems are often deployed in monitoring or learning mode during their initial implementation .

What is the objective of starting in this mode?

Automatically create exceptions for specific actions or files

Determine which files are unsafe to access and blacklist them

Automatically whitelist actions or files known to the system

Build a baseline of normal or safe system events for review

199. A security manager has noticed an inconsistent application of server security controls resulting in vulnerabilities on critical systems .

What is the MOST likely cause of this issue?

A lack of baseline standards

Improper documentation of security guidelines

A poorly designed security policy communication program

Host-based Intrusion Prevention System (HIPS) policies are ineffective

200. Refer to the information below to answer the question.

Desktop computers in an organization were sanitized for re-use in an equivalent security environment. The data was destroyed in accordance with organizational policy and all marking and other external indications of the sensitivity of the data that was formerly stored on the magnetic drives were removed.

After magnetic drives were degaussed twice according to the product manufacturer's directions, what is the MOST LIKELY security issue with degaussing?

Commercial products often have serious weaknesses of the magnetic force available in the degausser product.

Degausser products may not be properly maintained and operated.

The inability to turn the drive around in the chamber for the second pass due to human error.

Inadequate record keeping when sanitizing media.

Page 21 of 45

201. What do Capability Maturity Models (CMM) serve as a benchmark for in an organization?

Experience in the industry

Definition of security profiles

Human resource planning efforts

Procedures in systems development

202. Which of the following provides effective management assurance for a Wireless Local Area Network (WLAN)?

Maintaining an inventory of authorized Access Points (AP) and connecting devices

Setting the radio frequency to the minimum range required

Establishing a Virtual Private Network (VPN) tunnel between the WLAN client device and a VPN concentrator

Verifying that all default passwords have been changed

203. What is the MOST important reason to configure unique user IDs?

Supporting accountability

Reducing authentication errors

Preventing password compromise

Supporting Single Sign On (SSO)

204. An online retail company has formulated a record retention schedule for customer transactions .

Which of the following is a valid reason a customer transaction is kept beyond the retention schedule?

Pending legal hold

Long term data mining needs

Customer makes request to retain

Useful for future business initiatives

205. Which of the following methods provides the MOST protection for user credentials?

Forms-based authentication

Digest authentication

Basic authentication

Self-registration

206. If an attacker in a SYN flood attack uses someone else's valid host address as the source address, the system under attack will send a large number of Synchronize/Acknowledge (SYN/ACK) packets to the

default gateway.

attacker's address.

local interface being attacked.

specified source address.

207. An organization's data policy MUST include a data retention period which is based on

application dismissal.

business procedures.

digital certificates expiration.

regulatory compliance.

208. Which of the following is the MOST difficult to enforce when using cloud computing?

Data access

Data backup

Data recovery

Data disposal

209. Which of the following secure startup mechanisms are PRIMARILY designed to thwart attacks?

Timing

Cold boot

Side channel

Acoustic cryptanalysis

210. Refer to the information below to answer the question.

An organization has hired an information security officer to lead their security department.

The officer has adequate people resources but is lacking the other necessary components to have an effective security program. There are numerous initiatives requiring security involvement.

The security program can be considered effective when

vulnerabilities are proactively identified.

audits are regularly performed and reviewed.

backups are regularly performed and validated.

risk is lowered to an acceptable level.

Page 22 of 45

211. Refer to the information below to answer the question.

A large, multinational organization has decided to outsource a portion of their Information Technology (IT) organization to a third-party provider’s facility. This provider will be responsible for the design, development, testing, and support of several critical, customer-based applications used by the organization.

The organization should ensure that the third party's physical security controls are in place so that they

are more rigorous than the original controls.

are able to limit access to sensitive information.

allow access by the organization staff at any time.

cannot be accessed by subcontractors of the third party.

212. Refer to the information below to answer the question.

An organization experiencing a negative financial impact is forced to reduce budgets and the number of Information Technology (IT) operations staff performing basic logical access security administration functions. Security processes have been tightly integrated into normal IT operations and are not separate and distinct roles.

Which of the following will MOST likely allow the organization to keep risk at an acceptable level?

Increasing the amount of audits performed by third parties

Removing privileged accounts from operational staff

Assigning privileged functions to appropriate staff

Separating the security function into distinct roles

213. An organization decides to implement a partial Public Key Infrastructure (PKI) with only the servers having digital certificates .

What is the security benefit of this implementation?

Clients can authenticate themselves to the servers.

Mutual authentication is available between the clients and servers.

Servers are able to issue digital certificates to the client.

Servers can authenticate themselves to the client.

214. Which of the following is the MOST effective attack against cryptographic hardware modules?

Plaintext

Brute force

Power analysis

Man-in-the-middle (MITM)

215. Which of the following BEST mitigates a replay attack against a system using identity federation and Security Assertion Markup Language (SAML) implementation?

Two-factor authentication

Digital certificates and hardware tokens

Timed sessions and Secure Socket Layer (SSL)

Passwords with alpha-numeric and special characters

216. A business has implemented Payment Card Industry Data Security Standard (PCI-DSS) compliant handheld credit card processing on their Wireless Local Area Network (WLAN) topology. The network team partitioned the WLAN to create a private segment for credit card processing using a firewall to control device access and route traffic to the card processor on the Internet .

What components are in the scope of PCI-DSS?

The entire enterprise network infrastructure.

The handheld devices, wireless access points and border gateway.

The end devices, wireless access points, WLAN, switches, management console, and firewall.

The end devices, wireless access points, WLAN, switches, management console, and Internet

217. Refer to the information below to answer the question.

An organization experiencing a negative financial impact is forced to reduce budgets and the number of Information Technology (IT) operations staff performing basic logical access security administration functions. Security processes have been tightly integrated into normal IT operations and are not separate and distinct roles.

Which of the following will indicate where the IT budget is BEST allocated during this time?

Policies

Frameworks

Metrics

Guidelines

218. The use of proximity card to gain access to a building is an example of what type of security control?

Legal

Logical

Physical

Procedural

219. Which of the following is a critical factor for implementing a successful data classification program?

Executive sponsorship

Information security sponsorship

End-user acceptance

Internal audit acceptance

220. Refer to the information below to answer the question.

In a Multilevel Security (MLS) system, the following sensitivity labels are used in increasing levels of sensitivity: restricted, confidential, secret, top secret. Table A lists the clearance levels for four users, while Table B lists the security classes of four different files.

In a Bell-LaPadula system, which user cannot write to File 3?

User A

User B

User C

User D

Page 23 of 45

221. What is the MOST effective method for gaining unauthorized access to a file protected with a long complex password?

Brute force attack

Frequency analysis

Social engineering

Dictionary attack

222. Which of the following violates identity and access management best practices?

User accounts

System accounts

Generic accounts

Privileged accounts

223. With data labeling, which of the following MUST be the key decision maker?

Information security

Departmental management

Data custodian

Data owner

224. Which of the following is the BEST countermeasure to brute force login attacks?

Changing all canonical passwords

Decreasing the number of concurrent user sessions

Restricting initial password delivery only in person

Introducing a delay after failed system access attempts

225. Multi-Factor Authentication (MFA) is necessary in many systems given common types of password attacks .

Which of the following is a correct list of password attacks?

Masquerading, salami, malware, polymorphism

Brute force, dictionary, phishing, keylogger

Zeus, netbus, rabbit, turtle

Token, biometrics, IDS, DLP

226. Which of the following is critical for establishing an initial baseline for software components in the operation and maintenance of applications?

Application monitoring procedures

Configuration control procedures

Security audit procedures

Software patching procedures

227. Refer to the information below to answer the question.

An organization experiencing a negative financial impact is forced to reduce budgets and the number of Information Technology (IT) operations staff performing basic logical access security administration functions. Security processes have been tightly integrated into normal IT operations and are not separate and distinct roles.

When determining appropriate resource allocation, which of the following is MOST important to monitor?

Number of system compromises

Number of audit findings

Number of staff reductions

Number of additional assets

228. Which of the following is required to determine classification and ownership?

System and data resources are properly identified

Access violations are logged and audited

Data file references are identified and linked

System security controls are fully integrated

229. Which of the following is the PRIMARY benefit of a formalized information classification program?

It drives audit processes.

It supports risk assessment.

It reduces asset vulnerabilities.

It minimizes system logging requirements.

230. Refer to the information below to answer the question.

A large organization uses unique identifiers and requires them at the start of every system session. Application access is based on job classification. The organization is subject to periodic independent reviews of access controls and violations. The organization uses wired and wireless networks and remote access. The organization also uses secure connections to branch offices and secure backup and recovery strategies for selected information and processes.

In addition to authentication at the start of the user session, best practice would require re-authentication

periodically during a session.

for each business process.

at system sign-off.

after a period of inactivity.

Page 24 of 45

231. A risk assessment report recommends upgrading all perimeter firewalls to mitigate a particular finding .

Which of the following BEST supports this recommendation?

The inherent risk is greater than the residual risk.

The Annualized Loss Expectancy (ALE) approaches zero.

The expected loss from the risk exceeds mitigation costs.

The infrastructure budget can easily cover the upgrade costs.

232. What is the MAIN feature that onion routing networks offer?

Non-repudiation

Traceability

Anonymity

Resilience

233. The amount of data that will be collected during an audit is PRIMARILY determined by the.

audit scope.

auditor's experience level.

availability of the data.

integrity of the data.

234. Refer to the information below to answer the question.

A large, multinational organization has decided to outsource a portion of their Information Technology (IT) organization to a third-party provider’s facility. This provider will be responsible for the design, development, testing, and support of several critical, customer-based applications used by the organization.

The third party needs to have

processes that are identical to that of the organization doing the outsourcing.

access to the original personnel that were on staff at the organization.

the ability to maintain all of the applications in languages they are familiar with.

access to the skill sets consistent with the programming languages used by the organization.

235. Refer to the information below to answer the question.

A large organization uses unique identifiers and requires them at the start of every system session. Application access is based on job classification. The organization is subject to periodic independent reviews of access controls and violations. The organization uses wired and wireless networks and remote access. The organization also uses secure connections to branch offices and secure backup and recovery strategies for selected information and processes.

What MUST the access control logs contain in addition to the identifier?

Time of the access

Security classification

Denied access attempts

Associated clearance

236. Refer to the information below to answer the question.

An organization has hired an information security officer to lead their security department. The officer has adequate people resources but is lacking the other necessary components to have an effective security program. There are numerous initiatives requiring security involvement.

Given the number of priorities, which of the following will MOST likely influence the selection of top initiatives?

Severity of risk

Complexity of strategy

Frequency of incidents

Ongoing awareness

237. When dealing with compliance with the Payment Card Industry-Data Security Standard (PCI-DSS), an organization that shares card holder information with a service provider MUST do which of the following?

Perform a service provider PCI-DSS assessment on a yearly basis.

Validate the service provider's PCI-DSS compliance status on a regular basis.

Validate that the service providers security policies are in alignment with those of the organization.

Ensure that the service provider updates and tests its Disaster Recovery Plan (DRP) on a yearly basis.

238. Refer to the information below to answer the question.

In a Multilevel Security (MLS) system, the following sensitivity labels are used in increasing levels of sensitivity: restricted, confidential, secret, top secret. Table A lists the clearance levels for four users, while Table B lists the security classes of four different files.

In a Bell-LaPadula system, which user has the MOST restrictions when writing data to any of the four files?

User A

User B

User C

User D

239. Refer to the information below to answer the question.

In a Multilevel Security (MLS) system, the following sensitivity labels are used in increasing levels of sensitivity: restricted, confidential, secret, top secret. Table A lists the clearance levels for four users, while Table B lists the security classes of four different files.

Which of the following is true according to the star property (*property)?

User D can write to File 1

User B can write to File 1

User A can write to File 1

User C can write to File 1

240. Which of the following provides the MOST protection against data theft of sensitive information when a laptop is stolen?

Set up a BIOS and operating system password

Encrypt the virtual drive where confidential files can be stored

Implement a mandatory policy in which sensitive data cannot be stored on laptops, but only on the corporate network

Encrypt the entire disk and delete contents after a set number of failed access attempts

Page 25 of 45

241. Refer to the information below to answer the question.

During the investigation of a security incident, it is determined that an unauthorized individual accessed a system which hosts a database containing financial information.

If the intrusion causes the system processes to hang, which of the following has been affected?

System integrity

System availability

System confidentiality

System auditability

242. Which of the following is the BEST reason to review audit logs periodically?

Verify they are operating properly

Monitor employee productivity

Identify anomalies in use patterns

Meet compliance regulations

243. Refer to the information below to answer the question.

During the investigation of a security incident, it is determined that an unauthorized individual accessed a system which hosts a database containing financial information.

If it is discovered that large quantities of information have been copied by the unauthorized individual, what attribute of the data has been compromised?

Availability

Integrity

Accountability

Confidentiality

244. Which of the following is the MOST crucial for a successful audit plan?

Defining the scope of the audit to be performed

Identifying the security controls to be implemented

Working with the system owner on new controls

Acquiring evidence of systems that are not compliant

245. During an investigation of database theft from an organization's web site, it was determined that the Structured Query Language (SQL) injection technique was used despite input validation with client-side scripting .

Which of the following provides the GREATEST protection against the same attack occurring again?

Encrypt communications between the servers

Encrypt the web server traffic

Implement server-side filtering

Filter outgoing traffic at the perimeter firewall

246. From a security perspective, which of the following is a best practice to configure a Domain Name Service (DNS) system?

Configure secondary servers to use the primary server as a zone forwarder.

Block all Transmission Control Protocol (TCP) connections.

Disable all recursive queries on the name servers.

Limit zone transfers to authorized devices.

247. When using third-party software developers, which of the following is the MOST effective method of providing software development Quality Assurance (QA)?

Retain intellectual property rights through contractual wording.

Perform overlapping code reviews by both parties.

Verify that the contractors attend development planning meetings.

Create a separate contractor development environment.

248. What is a common challenge when implementing Security Assertion Markup Language (SAML) for identity integration between on-premise environment and an external identity provider service?

Some users are not provisioned into the service.

SAML tokens are provided by the on-premise identity provider.

Single users cannot be revoked from the service.

SAML tokens contain user information.

249. Which of the following is a process within a Systems Engineering Life Cycle (SELC) stage?

Requirements Analysis

Development and Deployment

Production Operations

Utilization Support

250. What physical characteristic does a retinal scan biometric device measure?

The amount of light reflected by the retina

The size, curvature, and shape of the retina

The pattern of blood vessels at the back of the eye

The pattern of light receptors at the back of the eye

Page 26 of 45

251. Which of the following is the MOST beneficial to review when performing an IT audit?

Audit policy

Security log

Security policies

Configuration settings

252. Refer to the information below to answer the question.

An organization has hired an information security officer to lead their security department. The officer has adequate people resources but is lacking the other necessary components to have an effective security program. There are numerous initiatives requiring security involvement.

Which of the following is considered the MOST important priority for the information security officer?

Formal acceptance of the security strategy

Disciplinary actions taken against unethical behavior

Development of an awareness program for new employees

Audit of all organization system configurations for faults

253. Refer to the information below to answer the question.

A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive e-mail, search the web, and use instant messaging. The organization’s Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee's access.

Which of the following methods is the MOST effective way of removing the Peer-to-Peer (P2P) program from the computer?

Run software uninstall

Re-image the computer

Find and remove all installation files

Delete all cookies stored in the web browser cache

254. Which of the following is the BEST solution to provide redundancy for telecommunications links?

Provide multiple links from the same telecommunications vendor.

Ensure that the telecommunications links connect to the network in one location.

Ensure that the telecommunications links connect to the network in multiple locations.

Provide multiple links from multiple telecommunications vendors.

255. When is security personnel involvement in the Systems Development Life Cycle (SDLC) process MOST beneficial?

Testing phase

Development phase

Requirements definition phase

Operations and maintenance phase

256. Refer to the information below to answer the question.

During the investigation of a security incident, it is determined that an unauthorized individual accessed a system which hosts a database containing financial information.

Aside from the potential records which may have been viewed, which of the following should be the PRIMARY concern regarding the database information?

Unauthorized database changes

Integrity of security logs

Availability of the database

Confidentiality of the incident

257. A Business Continuity Plan (BCP) is based on

the policy and procedures manual.

an existing BCP from a similar organization.

a review of the business processes and procedures.

a standard checklist of required items and objectives.

258. Which item below is a federated identity standard?

802.11i

Kerberos

Lightweight Directory Access Protocol (LDAP)

Security Assertion Markup Language (SAML)

259. Which of the following is the MAIN goal of a data retention policy?

Ensure that data is destroyed properly.

Ensure that data recovery can be done on the dat

Ensure the integrity and availability of data for a predetermined amount of time.

Ensure the integrity and confidentiality of data for a predetermined amount of time.

260. For a service provider, which of the following MOST effectively addresses confidentiality concerns for customers using cloud computing?

Hash functions

Data segregation

File system permissions

Non-repudiation controls

Page 27 of 45

261. Which of the following is a detective access control mechanism?

Log review

Least privilege

Password complexity

Non-disclosure agreement

262. A large university needs to enable student access to university resources from their homes .

Which of the following provides the BEST option for low maintenance and ease of deployment?

Provide students with Internet Protocol Security (IPSec) Virtual Private Network (VPN) client software.

Use Secure Sockets Layer (SSL) VPN technology.

Use Secure Shell (SSH) with public/private keys.

Require students to purchase home router capable of VP

263. Which of the following MOST influences the design of the organization's electronic monitoring policies?

Workplace privacy laws

Level of organizational trust

Results of background checks

Business ethical considerations

264. During the procurement of a new information system, it was determined that some of the security requirements were not addressed in the system specification .

Which of the following is the MOST likely reason for this?

The procurement officer lacks technical knowledge.

The security requirements have changed during the procurement process.

There were no security professionals in the vendor's bidding team.

The description of the security requirements was insufficient.

265. What component of a web application that stores the session state in a cookie can be bypassed by an attacker?

An initialization check

An identification check

An authentication check

An authorization check

266. What is the PRIMARY advantage of using automated application security testing tools?

The application can be protected in the production environment.

Large amounts of code can be tested using fewer resources.

The application will fail less when tested using these tools.

Detailed testing of code functions can be performed.

267. During an audit, the auditor finds evidence of potentially illegal activity .

Which of the following is the MOST appropriate action to take?

Immediately call the police

Work with the client to resolve the issue internally

Advise the person performing the illegal activity to cease and desist

Work with the client to report the activity to the appropriate authority

268. Refer to the information below to answer the question.

A security practitioner detects client-based attacks on the organization’s network. A plan will be necessary to address these concerns.

In addition to web browsers, what PRIMARY areas need to be addressed concerning mobile code used for malicious purposes?

Text editors, database, and Internet phone applications

Email, presentation, and database applications

Image libraries, presentation and spreadsheet applications

Email, media players, and instant messaging applications

269. Refer to the information below to answer the question.

An organization experiencing a negative financial impact is forced to reduce budgets and the number of Information Technology (IT) operations staff performing basic logical access security administration functions. Security processes have been tightly integrated into normal IT operations and are not separate and distinct roles.

Which of the following will be the PRIMARY security concern as staff is released from the organization?

Inadequate IT support

Loss of data and separation of duties

Undocumented security controls

Additional responsibilities for remaining staff

270. What is the MOST critical factor to achieve the goals of a security program?

Capabilities of security resources

Executive management support

Effectiveness of security management

Budget approved for security resources

Page 28 of 45

271. An organization publishes and periodically updates its employee policies in a file on their intranet .

Which of the following is a PRIMARY security concern?

Availability

Confidentiality

Integrity

Ownership

272. Which of the following describes the concept of a Single Sign -On (SSO) system?

Users are authenticated to one system at a time.

Users are identified to multiple systems with several credentials.

Users are authenticated to multiple systems with one login.

Only one user is using the system at a time.

273. According to best practice, which of the following is required when implementing third party software in a production environment?

Scan the application for vulnerabilities

Contract the vendor for patching

Negotiate end user application training

Escrow a copy of the software

274. Which of the following actions MUST be taken if a vulnerability is discovered during the maintenance stage in a System Development Life Cycle (SDLC)?

Make changes following principle and design guidelines.

Stop the application until the vulnerability is fixed.

Report the vulnerability to product owner.

Monitor the application and review code.

275. Refer to the information below to answer the question.

A security practitioner detects client-based attacks on the organization’s network. A plan will be necessary to address these concerns.

What MUST the plan include in order to reduce client-side exploitation?

Approved web browsers

Network firewall procedures

Proxy configuration

Employee education

276. What does secure authentication with logging provide?

Data integrity

Access accountability

Encryption logging format

Segregation of duties

277. Without proper signal protection, embedded systems may be prone to which type of attack?

Brute force

Tampering

Information disclosure

Denial of Service (DoS)

278. Refer to the information below to answer the question.

A large organization uses unique identifiers and requires them at the start of every system session. Application access is based on job classification. The organization is subject to periodic independent reviews of access controls and violations. The organization uses wired and wireless networks and remote access. The organization also uses secure connections to branch offices and secure backup and recovery strategies for selected information and processes.

Which of the following BEST describes the access control methodology used?

Least privilege

Lattice Based Access Control (LBAC)

Role Based Access Control (RBAC)

Lightweight Directory Access Control (LDAP)

279. HOTSPOT

Identify the component that MOST likely lacks digital accountability related to information access.

Click on the correct device in the image below.

280. Refer to the information below to answer the question.

A security practitioner detects client-based attacks on the organization’s network. A plan will be necessary to address these concerns.

In the plan, what is the BEST approach to mitigate future internal client-based attacks?

Block all client side web exploits at the perimeter.

Remove all non-essential client-side web services from the network.

Screen for harmful exploits of client-side services before implementation.

Harden the client image before deployment.

Page 29 of 45

281. Which of the following BEST describes Recovery Time Objective (RTO)?

Time of data validation after disaster

Time of data restoration from backup after disaster

Time of application resumption after disaster

Time of application verification after disaster

282. Refer to the information below to answer the question.

A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive e-mail, search the web, and use instant messaging. The organization’s Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee's access.

Which of the following solutions would have MOST likely detected the use of peer-to-peer programs when the computer was connected to the office network?

Anti-virus software

Intrusion Prevention System (IPS)

Anti-spyware software

Integrity checking software

283. Refer to the information below to answer the question.

Desktop computers in an organization were sanitized for re-use in an equivalent security environment. The data was destroyed in accordance with organizational policy and all marking and other external indications of the sensitivity of the data that was formerly stored on the magnetic drives were removed.

Organizational policy requires the deletion of user data from Personal Digital Assistant (PDA) devices before disposal. It may not be possible to delete the user data if the device is malfunctioning .

Which destruction method below provides the BEST assurance that the data has been removed?

Knurling

Grinding

Shredding

Degaussing

284. A large bank deploys hardware tokens to all customers that use their online banking system. The token generates and displays a six digit numeric password every 60 seconds. The customers must log into their bank accounts using this numeric password.

This is an example of

asynchronous token.

Single Sign-On (SSO) token.

single factor authentication token.

synchronous token.

285. What is the BEST method to detect the most common improper initialization problems in programming languages?

Use and specify a strong character encoding.

Use automated static analysis tools that target this type of weakness.

Perform input validation on any numeric inputs by assuring that they are within the expected range.

Use data flow analysis to minimize the number of false positives.

286. Which of the following are required components for implementing software configuration management systems?

Audit control and signoff

User training and acceptance

Rollback and recovery processes

Regression testing and evaluation

287. DRAG DROP

Given the various means to protect physical and logical assets, match the access management area to the technology.

288. Which of the following is an example of two-factor authentication?

Retina scan and a palm print

Fingerprint and a smart card

Magnetic stripe card and an ID badge

Password and Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA)

289. According to best practice, which of the following groups is the MOST effective in performing an information security compliance audit?

In-house security administrators

In-house Network Team

Disaster Recovery (DR) Team

External consultants

290. What is the BEST first step for determining if the appropriate security controls are in place for protecting data at rest?

Identify regulatory requirements

Conduct a risk assessment

Determine business drivers

Review the security baseline configuration

Page 30 of 45

291. Which of the following MUST system and database administrators be aware of and apply when configuring systems used for storing personal employee data?

Secondary use of the data by business users

The organization's security policies and standards

The business purpose for which the data is to be used

The overall protection of corporate resources and data

292. Refer to the information below to answer the question.

An organization has hired an information security officer to lead their security department. The officer has adequate people resources but is lacking the other necessary components to have an effective security program. There are numerous initiatives requiring security involvement.

The effectiveness of the security program can PRIMARILY be measured through

audit findings.

risk elimination.

audit requirements.

customer satisfaction.

293. Which of the following is the BEST way to determine if a particular system is able to identify malicious software without executing it?

Testing with a Botnet

Testing with an EICAR file

Executing a binary shellcode

Run multiple antivirus programs

294. Which of the following is a BEST practice when traveling internationally with laptops containing Personally Identifiable Information (PII)?

Use a thumb drive to transfer information from a foreign computer.

Do not take unnecessary information, including sensitive information.

Connect the laptop only to well-known networks like the hotel or public Internet cafes.

Request international points of contact help scan the laptop on arrival to ensure it is protected.

295. A thorough review of an organization's audit logs finds that a disgruntled network administrator has intercepted emails meant for the Chief Executive Officer (CEO) and changed them before forwarding them to their intended recipient .

What type of attack has MOST likely occurred?

Spoofing

Eavesdropping

Man-in-the-middle

Denial of service

296. DRAG DROP

Place the following information classification steps in sequential order.

297. Which of the following is a MAJOR consideration in implementing a Voice over IP (VoIP) network?

Use of a unified messaging.

Use of separation for the voice network.

Use of Network Access Control (NAC) on switches.

Use of Request for Comments (RFC) 1918 addressing.

298. Refer to the information below to answer the question.

A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive e-mail, search the web, and use instant messaging. The organization’s Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee's access.

Which of the following could have MOST likely prevented the Peer-to-Peer (P2P) program from being installed on the computer?

Removing employee's full access to the computer

Supervising their child's use of the computer

Limiting computer's access to only the employee

Ensuring employee understands their business conduct guidelines

299. The implementation of which features of an identity management system reduces costs and administration overhead while improving audit and accountability?

Two-factor authentication

Single Sign-On (SSO)

User self-service

A metadirectory

300. By carefully aligning the pins in the lock, which of the following defines the opening of a mechanical lock without the proper key?

Lock pinging

Lock picking

Lock bumping

Lock bricking

Page 31 of 45

301. Which of the following is the PRIMARY security concern associated with the implementation of smart cards?

The cards have limited memory

Vendor application compatibility

The cards can be misplaced

Mobile code can be embedded in the card

302. Which one of the following operates at the session, transport, or network layer of the Open System Interconnection (OSI) model?

Data at rest encryption

Configuration Management

Integrity checking software

Cyclic redundancy check (CRC)

303. The BEST method to mitigate the risk of a dictionary attack on a system is to

use a hardware token.

use complex passphrases.

implement password history.

encrypt the access control list (ACL).

304. In the Open System Interconnection (OSI) model, which layer is responsible for the transmission of binary data over a communications network?

Application Layer

Physical Layer

Data-Link Layer

Network Layer

305. Which of the following BEST describes a rogue Access Point (AP)?

An AP that is not protected by a firewall

An AP not configured to use Wired Equivalent Privacy (WEP) with Triple Data Encryption Algorithm (3DES)

An AP connected to the wired infrastructure but not under the management of authorized network administrators

An AP infected by any kind of Trojan or Malware

306. While inventorying storage equipment, it is found that there are unlabeled, disconnected, and powered off devices .

Which of the following is the correct procedure for handling such equipment?

They should be recycled to save energy.

They should be recycled according to NIST SP 800-88.

They should be inspected and sanitized following the organizational policy.

They should be inspected and categorized properly to sell them for reuse.

307. Which one of the following is a common risk with network configuration management?

Patches on the network are difficult to keep current.

It is the responsibility of the systems administrator.

User ID and passwords are never set to expire.

Network diagrams are not up to date.

308. The World Trade Organization's (WTO) agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS) requires authors of computer software to be given the

right to refuse or permit commercial rentals.

right to disguise the software's geographic origin.

ability to tailor security parameters based on location.

ability to confirm license authenticity of their works.

309. How can lessons learned from business continuity training and actual recovery incidents BEST be used?

As a means for improvement

As alternative options for awareness and training

As indicators of a need for policy

As business function gap indicators

310. Which of the following is the MOST effective method of mitigating data theft from an active user workstation?

Implement full-disk encryption

Enable multifactor authentication

Deploy file integrity checkers

Disable use of portable devices

Page 32 of 45

311. Which security approach will BEST minimize Personally Identifiable Information (PII) loss from a data breach?

A strong breach notification process

Limited collection of individuals' confidential data

End-to-end data encryption for data in transit

Continuous monitoring of potential vulnerabilities

312. When planning a penetration test, the tester will be MOST interested in which information?

Places to install back doors

The main network access points

Job application handouts and tours

Exploits that can attack weaknesses

313. Are companies legally required to report all data breaches?

No, different jurisdictions have different rules.

No, not if the data is encrypted.

No, companies' codes of ethics don't require it.

No, only if the breach had a material impact.

314. DRAG DROP

Order the below steps to create an effective vulnerability management process.

315. Data leakage of sensitive information is MOST often concealed by which of the following?

Secure Sockets Layer (SSL)

Secure Hash Algorithm (SHA)

Wired Equivalent Privacy (WEP)

Secure Post Office Protocol (POP)

316. What is the PRIMARY difference between security policies and security procedures?

Policies are used to enforce violations, and procedures create penalties

Policies point to guidelines, and procedures are more contractual in nature

Policies are included in awareness training, and procedures give guidance

Policies are generic in nature, and procedures contain operational details

317. Application of which of the following Institute of Electrical and Electronics Engineers (IEEE) standards will prevent an unauthorized wireless device from being attached to a network?

IEEE 802.1F

IEEE 802.1H

IEEE 802.1Q

IEEE 802.1X

318. Which of the following types of security testing is the MOST effective in providing a better indication of the everyday security challenges of an organization when performing a security risk assessment?

External

Overt

Internal

Covert

319. Which of the following is a function of Security Assertion Markup Language (SAML)?

File allocation

Redundancy check

Extended validation

Policy enforcement

320. Disaster Recovery Plan (DRP) training material should be

consistent so that all audiences receive the same training.

stored in a fire proof safe to ensure availability when needed.

only delivered in paper format.

presented in a professional looking manner.

Page 33 of 45

321. Which of the following secures web transactions at the Transport Layer?

Secure HyperText Transfer Protocol (S-HTTP)

Secure Sockets Layer (SSL)

Socket Security (SOCKS)

Secure Shell (SSH)

322. What security risk does the role-based access approach mitigate MOST effectively?

Excessive access rights to systems and data

Segregation of duties conflicts within business applications

Lack of system administrator activity monitoring

Inappropriate access requests

323. Which of the following is the BEST method to assess the effectiveness of an organization's vulnerability management program?

Review automated patch deployment reports

Periodic third party vulnerability assessment

Automated vulnerability scanning

Perform vulnerability scan by security team

324. For an organization considering two-factor authentication for secure network access, which of the following is MOST secure?

Challenge response and private key

Digital certificates and Single Sign-On (SSO)

Tokens and passphrase

Smart card and biometrics

325. DRAG DROP

A software security engineer is developing a black box-based test plan that will measure the system's reaction to incorrect or illegal inputs or unexpected operational errors and situations. Match the functional testing techniques on the left with the correct input parameters on the right.

326. Which of the following are Systems Engineering Life Cycle (SELC) Technical Processes?

Concept, Development, Production, Utilization, Support, Retirement

Stakeholder Requirements Definition, Architectural Design, Implementation, Verification, Operation

Acquisition, Measurement, Configuration Management, Production, Operation, Support

Concept, Requirements, Design, Implementation, Production, Maintenance, Support, Disposal

327. Which of the following is the MOST important output from a mobile application threat modeling exercise according to Open Web Application Security Project (OWASP)?

Application interface entry and endpoints

The likelihood and impact of a vulnerability

Countermeasures and mitigations for vulnerabilities

A data flow diagram for the application and attack surface analysis

328. Which of the following is a recommended alternative to an integrated email encryption system?

Sign emails containing sensitive data

Send sensitive data in separate emails

Encrypt sensitive data separately in attachments

Store sensitive information to be sent in encrypted drives

329. An organization has hired a security services firm to conduct a penetration test .

Which of the following will the organization provide to the tester?

Limits and scope of the testing.

Physical location of server room and wiring closet.

Logical location of filters and concentrators.

Employee directory and organizational chart.

330. Software Code signing is used as a method of verifying what security concept?

Integrity

Confidentiality

Availability

Access Control

Page 34 of 45

331. If compromised, which of the following would lead to the exploitation of multiple virtual machines?

Virtual device drivers

Virtual machine monitor

Virtual machine instance

Virtual machine file system

332. Which of the following roles has the obligation to ensure that a third party provider is capable of processing and handling data in a secure manner and meeting the standards set by the organization?

Data Custodian

Data Owner

Data Creator

Data User

333. DRAG DROP

During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant.

What is the best approach for the CISO?

Below are the common phases to creating a Business Continuity/Disaster Recovery (BC/DR) plan. Drag the remaining BCDR phases to the appropriate corresponding location.

334. DRAG DROP

In which order, from MOST to LEAST impacted, does user awareness training reduce the occurrence of the events below?

335. Which of the following questions can be answered using user and group entitlement reporting?

When a particular file was last accessed by a user

Change control activities for a particular group of users

The number of failed login attempts for a particular user

Where does a particular user have access within the network

336. Which of the following has the GREATEST impact on an organization's security posture?

International and country-specific compliance requirements

Security violations by employees and contractors

Resource constraints due to increasing costs of supporting security

Audit findings related to employee access and permissions process

337. How does an organization verify that an information system's current hardware and software match the standard system configuration?

By reviewing the configuration after the system goes into production

By running vulnerability scanning tools on all devices in the environment

By comparing the actual configuration of the system against the baseline

By verifying all the approved security patches are implemented

338. What is the MOST effective method of testing custom application code?

Negative testing

White box testing

Penetration testing

Black box testing

339. Discretionary Access Control (DAC) restricts access according to

data classification labeling.

page views within an application.

authorizations granted to the user.

management accreditation.

340. The 802.1x standard provides a framework for what?

Network authentication for only wireless networks

Network authentication for wired and wireless networks

Wireless encryption using the Advanced Encryption Standard (AES)

Wireless network encryption using Secure Sockets Layer (SSL)

Page 35 of 45

341. Which of the following BEST avoids data remanence disclosure for cloud hosted resources?

Strong encryption and deletion of the keys after data is deleted.

Strong encryption and deletion of the virtual host after data is deleted.

Software based encryption with two factor authentication.

Hardware based encryption on dedicated physical servers.

342. To protect auditable information, which of the following MUST be configured to only allow read access?

Logging configurations

Transaction log files

User account configurations

Access control lists (ACL)

343. The BEST example of the concept of "something that a user has" when providing an authorized user access to a computing system is

the user's hand geometry.

a credential stored in a token.

a passphrase.

the user's face.

344. Which of the following command line tools can be used in the reconnaisance phase of a network vulnerability assessment?

dig

ifconfig

ipconfig

nbtstat

345. What is one way to mitigate the risk of security flaws in custom software?

Include security language in the Earned Value Management (EVM) contract

Include security assurance clauses in the Service Level Agreement (SLA)

Purchase only Commercial Off-The-Shelf (COTS) products

Purchase only software with no open source Application Programming Interfaces (APIs)

346. Regarding asset security and appropriate retention, which of the following INITIAL top three areas are important to focus on?

Security control baselines, access controls, employee awareness and training

Human resources, asset management, production management

Supply chain lead time, inventory control, encryption

Polygraphs, crime statistics, forensics

347. Which of the following is the BEST approach to take in order to effectively incorporate the concepts of business continuity into the organization?

Ensure end users are aware of the planning activities

Validate all regulatory requirements are known and fully documented

Develop training and awareness programs that involve all stakeholders

Ensure plans do not violate the organization's cultural objectives and goals

348. What is the GREATEST challenge to identifying data leaks?

Available technical tools that enable user activity monitoring.

Documented asset classification policy and clear labeling of assets.

Senior management cooperation in investigating suspicious behavior.

Law enforcement participation to apprehend and interrogate suspects.

349. Which of the following disaster recovery test plans will be MOST effective while providing minimal risk?

Read-through

Parallel

Full interruption

Simulation

350. A security professional has been asked to evaluate the options for the location of a new data center within a multifloor building. Concerns for the data center include emanations and physical access controls.

Which of the following is the BEST location?

On the top floor

In the basement

In the core of the building

In an exterior room with windows

Page 36 of 45

351. A security professional is asked to provide a solution that restricts a bank teller to only perform a savings deposit transaction but allows a supervisor to perform corrections after the transaction .

Which of the following is the MOST effective solution?

Access is based on rules.

Access is determined by the system.

Access is based on user's role.

Access is based on data sensitivity.

352. HOTSPOT

Which Web Services Security (WS-Security) specification handles the management of security tokens and the underlying policies for granting access? Click on the correct specification in the image below.

353. Which of the following controls is the FIRST step in protecting privacy in an information system?

Data Redaction

Data Minimization

Data Encryption

Data Storage

354. Which of the following standards/guidelines requires an Information Security Management System (ISMS) to be defined?

International Organization for Standardization (ISO) 27000 family

Information Technology Infrastructure Library (ITIL)

Payment Card Industry Data Security Standard (PCIDSS)

ISO/IEC 20000

355. Which of the following explains why record destruction requirements are included in a data retention policy?

To comply with legal and business requirements

To save cost for storage and backup

To meet destruction guidelines

To validate data ownership

356. A global organization wants to implement hardware tokens as part of a multifactor authentication solution for remote access. The PRIMARY advantage of this implementation is

the scalability of token enrollment.

increased accountability of end users.

it protects against unauthorized access.

it simplifies user access administration.

357. Which of the following methods can be used to achieve confidentiality and integrity for data in transit?

Multiprotocol Label Switching (MPLS)

Internet Protocol Security (IPSec)

Federated identity management

Multi-factor authentication

358. Which of the following is the MOST important element of change management documentation?

List of components involved

Number of changes being made

Business case justification

A stakeholder communication

359. What is the PRIMARY goal for using Domain Name System Security Extensions (DNSSEC) to sign records?

Integrity

Confidentiality

Accountability

Availability

360. During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant.

What is the best approach for the CISO?

During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant.

What is the best approach for the CISO?

Document the system as high risk

Perform a vulnerability assessment

Perform a quantitative threat assessment

Notate the information and move on

Page 37 of 45

361. HOTSPOT

Which Web Services Security (WS-Security) specification maintains a single authenticated identity across multiple dissimilar environments? Click on the correct specification in the image below.

362. Retaining system logs for six months or longer can be valuable for what activities?

Disaster recovery and business continuity

Forensics and incident response

Identity and authorization management

Physical and logical access control

363. What does an organization FIRST review to assure compliance with privacy requirements?

Best practices

Business objectives

Legal and regulatory mandates

Employee's compliance to policies and standards

364. The MAIN reason an organization conducts a security authorization process is to

force the organization to make conscious risk decisions.

assure the effectiveness of security controls.

assure the correct security organization exists.

force the organization to enlist management support.

365. The goal of a Business Continuity Plan (BCP) training and awareness program is to

enhance the skills required to create, maintain, and execute the plan.

provide for a high level of recovery in case of disaster.

describe the recovery organization to new employees.

provide each recovery team with checklists and procedures.

366. Which of the following statements is TRUE regarding value boundary analysis as a functional software testing technique?

It is useful for testing communications protocols and graphical user interfaces.

It is characterized by the stateless behavior of a process implemented in a function.

Test inputs are obtained from the derived threshold of the given functional specifications.

An entire partition can be covered by considering only one representative value from that partition.

367. Sensitive customer data is going to be added to a database .

What is the MOST effective implementation for ensuring data privacy?

Discretionary Access Control (DAC) procedures

Mandatory Access Control (MAC) procedures

Data link encryption

Segregation of duties

368. A network scan found 50% of the systems with one or more critical vulnerabilities .

Which of the following represents the BEST action?

Assess vulnerability risk and program effectiveness.

Assess vulnerability risk and business impact.

Disconnect all systems with critical vulnerabilities.

Disconnect systems with the most number of vulnerabilities.

369. The PRIMARY characteristic of a Distributed Denial of Service (DDoS) attack is that it

exploits weak authentication to penetrate networks.

can be detected with signature analysis.

looks like normal network activity.

is commonly confused with viruses or worms.

370. An organization has developed a major application that has undergone accreditation testing. After receiving the results of the evaluation, what is the final step before the application can be accredited?

Acceptance of risk by the authorizing official

Remediation of vulnerabilities

Adoption of standardized policies and procedures

Approval of the System Security Plan (SSP)

Page 38 of 45

371. While investigating a malicious event, only six days of audit logs from the last month were available .

What policy should be updated to address this problem?

Retention

Reporting

Recovery

Remediation

372. What type of encryption is used to protect sensitive data in transit over a network?

Payload encryption and transport encryption

Authentication Headers (AH)

Keyed-Hashing for Message Authentication

Point-to-Point Encryption (P2PE)

373. After acquiring the latest security updates, what must be done before deploying to production systems?

Use tools to detect missing system patches

Install the patches on a test system

Subscribe to notifications for vulnerabilities

Assess the severity of the situation

374. Which of the following prevents improper aggregation of privileges in Role Based Access Control (RBAC)?

Hierarchical inheritance

Dynamic separation of duties

The Clark-Wilson security model

The Bell-LaPadula security model

375. Which methodology is recommended for penetration testing to be effective in the development phase of the life-cycle process?

White-box testing

Software fuzz testing

Black-box testing

Visual testing

376. Which of the following could elicit a Denial of Service (DoS) attack against a credential management system?

Delayed revocation or destruction of credentials

Modification of Certificate Revocation List

Unauthorized renewal or re-issuance

Token use after decommissioning

377. Which of the following BEST describes a Protection Profile (PP)?

A document that expresses an implementation independent set of security requirements for an IT product that meets specific consumer needs.

A document that is used to develop an IT security product from its security requirements definition.

A document that expresses an implementation dependent set of security requirements which contains only the security functional requirements.

A document that represents evaluated products where there is a one-to-one correspondence between a PP and a Security Target (ST).

378. Which of the following analyses is performed to protect information assets?

Business impact analysis

Feasibility analysis

Cost benefit analysis

Data analysis

379. Which of the following is the MOST likely cause of a non-malicious data breach when the source of the data breach was an un-marked file cabinet containing sensitive documents?

Ineffective data classification

Lack of data access controls

Ineffective identity management controls

Lack of Data Loss Prevention (DLP) tools

380. What is the GREATEST challenge of an agent-based patch management solution?

Time to gather vulnerability information about the computers in the program

Requires that software be installed, running, and managed on all participating computers

The significant amount of network bandwidth while scanning computers

The consistency of distributing patches to each participating computer

Page 39 of 45

381. Which of the following is the BIGGEST weakness when using native Lightweight Directory Access Protocol (LDAP) for authentication?

Authorizations are not included in the server response

Unsalted hashes are passed over the network

The authentication session can be replayed

Passwords are passed in cleartext

382. For privacy protected data, which of the following roles has the highest authority for establishing dissemination rules for the data?

Information Systems Security Officer

Data Owner

System Security Architect

Security Requirements Analyst

383. A Simple Power Analysis (SPA) attack against a device directly observes which of the following?

Static discharge

Consumption

Generation

Magnetism

384. What should happen when an emergency change to a system must be performed?

The change must be given priority at the next meeting of the change control board.

Testing and approvals must be performed quickly.

The change must be performed immediately and then submitted to the change board.

The change is performed and a notation is made in the system log.

385. Discretionary Access Control (DAC) is based on which of the following?

Information source and destination

Identification of subjects and objects

Security labels and privileges

Standards and guidelines

386. Which of the following entities is ultimately accountable for data remanence vulnerabilities with data replicated by a cloud service provider?

Data owner

Data steward

Data custodian

Data processor

387. The PRIMARY security concern for handheld devices is the

strength of the encryption algorithm.

spread of malware during synchronization.

ability to bypass the authentication mechanism.

strength of the Personal Identification Number (PIN).

388. DRAG DROP

Match the objectives to the assessment questions in the governance domain of Software Assurance Maturity Model (SAMM).

389. Changes to a Trusted Computing Base (TCB) system that could impact the security posture of that system and trigger a recertification activity are documented in the

security impact analysis.

structured code review.

routine self assessment.

cost benefit analysis.

390. DRAG DROP

Drag the following Security Engineering terms on the left to the BEST definition on the right.

Page 40 of 45

391. An organization has decided to contract with a cloud-based service provider to leverage their identity as a service offering. They will use Open Authentication (OAuth) 2.0 to authenticate external users to the organization's services.

As part of the authentication process, which of the following must the end user provide?

An access token

A username and password

A username

A password

392. How does Encapsulating Security Payload (ESP) in transport mode affect the Internet Protocol (IP)?

Encrypts and optionally authenticates the IP header, but not the IP payload

Encrypts and optionally authenticates the IP payload, but not the IP header

Authenticates the IP payload and selected portions of the IP header

Encrypts and optionally authenticates the complete IP packet

393. Which of the following is generally indicative of a replay attack when dealing with biometric authentication?

False Acceptance Rate (FAR) is greater than 1 in 100,000

False Rejection Rate (FRR) is greater than 5 in 100

Inadequately specified templates

Exact match

394. Which of the following is an essential step before performing Structured Query Language (SQL) penetration tests on a production system?

Verify countermeasures have been deactivated.

Ensure firewall logging has been activated.

Validate target systems have been backed up.

Confirm warm site is ready to accept connections.

395. Which of the following is most helpful in applying the principle of LEAST privilege?

Establishing a sandboxing environment

Setting up a Virtual Private Network (VPN) tunnel

Monitoring and reviewing privileged sessions

Introducing a job rotation program

396. Which of the following describes the BEST configuration management practice?

After installing a new system, the configuration files are copied to a separate back-up system and hashed to detect tampering.

After installing a new system, the configuration files are copied to an air-gapped system and hashed to detect tampering.

The firewall rules are backed up to an air-gapped system.

A baseline configuration is created and maintained for all relevant systems.

397. Which of the following activities BEST identifies operational problems, security misconfigurations, and malicious attacks?

Policy documentation review

Authentication validation

Periodic log reviews

Interface testing

398. Who is ultimately responsible to ensure that information assets are categorized and adequate measures are taken to protect them?

Data Custodian

Executive Management

Chief Information Security Officer

Data/Information/Business Owners

399. Single Sign-On (SSO) is PRIMARILY designed to address which of the following?

Confidentiality and Integrity

Availability and Accountability

Integrity and Availability

Accountability and Assurance

400. The application of which of the following standards would BEST reduce the potential for data breaches?

ISO 9000

ISO 20121

ISO 26000

ISO 27001

Page 41 of 45

401. Which of the following is an advantage of on-premise Credential Management Systems?

Improved credential interoperability

Control over system configuration

Lower infrastructure capital costs

Reduced administrative overhead

402. A health care provider is considering Internet access for their employees and patients .

Which of the following is the organization's MOST secure solution for protection of data?

Public Key Infrastructure (PKI) and digital signatures

Trusted server certificates and passphrases

User ID and password

Asymmetric encryption and User ID

403. Which of the following PRIMARILY contributes to security incidents in web-based applications?

Systems administration and operating systems

System incompatibility and patch management

Third-party applications and change controls

Improper stress testing and application interfaces

404. If an identification process using a biometric system detects a 100% match between a presented template and a stored template, what is the interpretation of this result?

User error

Suspected tampering

Accurate identification

Unsuccessful identification

405. Which of the following provides the minimum set of privileges required to perform a job function and restricts the user to a domain with the required privileges?

Access based on rules

Access based on user's role

Access determined by the system

Access based on data sensitivity

406. A mobile device application that restricts the storage of user information to just that which is needed to accomplish lawful business goals adheres to what privacy principle?

Onward transfer

Collection Limitation

Collector Accountability

Individual Participation

407. Which of the following BEST describes the purpose of performing security certification?

To identify system threats, vulnerabilities, and acceptable level of risk

To formalize the confirmation of compliance to security policies and standards

To formalize the confirmation of completed risk mitigation and risk analysis

To verify that system architecture and interconnections with other systems are effectively implemented

408. What is the MOST efficient way to secure a production program and its data?

Disable default accounts and implement access control lists (ACL)

Harden the application and encrypt the data

Disable unused services and implement tunneling

Harden the servers and backup the data

409. Which of the following is the PRIMARY concern when using an Internet browser to access a cloud-based service?

Insecure implementation of Application Programming Interfaces (API)

Improper use and storage of management keys

Misconfiguration of infrastructure allowing for unauthorized access

Vulnerabilities within protocols that can expose confidential data

410. During a fingerprint verification process, which of the following is used to verify identity and authentication?

A pressure value is compared with a stored template

Sets of digits are matched with stored values

A hash table is matched to a database of stored value

A template of minutiae is compared with a stored template

Page 42 of 45

411. Which of the following is the BEST example of weak management commitment to the protection of security assets and resources?

poor governance over security processes and procedures

immature security controls and procedures

variances against regulatory requirements

unanticipated increases in security incidents and threats

412. An organization lacks a data retention policy. Of the following, who is the BEST person to consult for such requirement?

Application Manager

Database Administrator

Privacy Officer

Finance Manager

413. The PRIMARY outcome of a certification process is that it provides documented

system weaknesses for remediation.

standards for security assessment, testing, and process evaluation.

interconnected systems and their implemented security controls.

security analyses needed to make a risk-based decision.

414. What is an important characteristic of Role Based Access Control (RBAC)?

Supports Mandatory Access Control (MAC)

Simplifies the management of access rights

Relies on rotation of duties

Requires two factor authentication

415. HOTSPOT

Which Web Services Security (WS-Security) specification negotiates how security tokens will be issued, renewed and validated? Click on the correct specification in the image below.

416. Which of the following is the PRIMARY benefit of implementing data-in-use controls?

If the data is lost, it must be decrypted to be opened.

If the data is lost, it will not be accessible to unauthorized users.

When the data is being viewed, it can only be printed by authorized users.

When the data is being viewed, it must be accessed using secure protocols.

417. After a thorough analysis, it was discovered that a perpetrator compromised a network by gaining access to the network through a Secure Socket Layer (SSL) Virtual Private Network (VPN) gateway. The perpetrator guessed a username and brute forced the password to gain access .

Which of the following BEST mitigates this issue?

Implement strong passwords authentication for VPN

Integrate the VPN with centralized credential stores

Implement an Internet Protocol Security (IPSec) client

Use two-factor authentication mechanisms

418. In order for a security policy to be effective within an organization, it MUST include

strong statements that clearly define the problem.

a list of all standards that apply to the policy.

owner information and date of last revision.

disciplinary measures for non compliance.

419. DRAG DROP

Place in order, from BEST (1) to WORST (4), the following methods to reduce the risk of data remanence on magnetic media.

420. Which of the following is a reason to use manual patch installation instead of automated patch management?

The cost required to install patches will be reduced.

The time during which systems will remain vulnerable to an exploit will be decreased.

The likelihood of system or application incompatibilities will be decreased.

The ability to cover large geographic areas is increased.

Page 43 of 45

421. Secure Sockets Layer (SSL) encryption protects

data at rest.

the source IP address.

data transmitted.

data availability.

422. HOTSPOT

In the network design below, where is the MOST secure Local Area Network (LAN) segment to deploy a Wireless Access Point (WAP) that provides contractors access to the Internet and authorized enterprise services?

423. What is the process called when impact values are assigned to the security objectives for information types?

Qualitative analysis

Quantitative analysis

Remediation

System security categorization

424. Which of the following BEST describes the purpose of the security functional requirements of Common Criteria?

Level of assurance of the Target of Evaluation (TOE) in intended operational environment

Selection to meet the security objectives stated in test documents

Security behavior expected of a TOE

Definition of the roles and responsibilities

425. What type of test assesses a Disaster Recovery (DR) plan using realistic disaster scenarios while maintaining minimal impact to business operations?

Parallel

Walkthrough

Simulation

Tabletop

426. Data remanence refers to which of the following?

The remaining photons left in a fiber optic cable after a secure transmission.

The retention period required by law or regulation.

The magnetic flux created when removing the network connection from a server or personal computer.

The residual information left on magnetic storage media after a deletion or erasure.

427. Between which pair of Open System Interconnection (OSI) Reference Model layers are routers used as a communications device?

Transport and Session

Data-Link and Transport

Network and Session

Physical and Data-Link

428. DRAG DROP

Match the types of e-authentication tokens to their description.

Drag each e-authentication token on the left to its corresponding description on the right.

429. As a best practice, the Security Assessment Report (SAR) should include which of the following sections?

Data classification policy

Software and hardware inventory

Remediation recommendations

Names of participants

430. A vulnerability in which of the following components would be MOST difficult to detect?

Kernel

Shared libraries

Hardware

System application

Page 44 of 45

431. Which of the following is needed to securely distribute symmetric cryptographic keys?

Officially approved Public-Key Infrastructure (PKI) Class 3 or Class 4 certificates

Officially approved and compliant key management technology and processes

An organizationally approved communication protection policy and key management plan

Hardware tokens that protect the user’s private key.

432. An employee of a retail company has been granted an extended leave of absence by Human Resources (HR). This information has been formally communicated to the access provisioning team .

Which of the following is the BEST action to take?

Revoke access temporarily.

Block user access and delete user account after six months.

Block access to the offices immediately.

Monitor account usage temporarily.

433. Which of the following information MUST be provided for user account provisioning?

Full name

Unique identifier

Security question

Date of birth

434. DRAG DROP

Match the access control type to the example of the control type.

Drag each access control type net to its corresponding example.

435. When building a data classification scheme, which of the following is the PRIMARY concern?

Purpose

Cost effectiveness

Availability

Authenticity

436. At which layer of the Open Systems Interconnect (OSI) model are the source and destination address for a datagram handled?

Transport Layer

Data-Link Layer

Network Layer

Application Layer

437. Which of the following restricts the ability of an individual to carry out all the steps of a particular process?

Job rotation

Separation of duties

Least privilege

Mandatory vacations

438. Which of the following adds end-to-end security inside a Layer 2 Tunneling Protocol (L2TP) Internet Protocol Security (IPSec) connection?

Temporal Key Integrity Protocol (TKIP)

Secure Hash Algorithm (SHA)

Secure Shell (SSH)

Transport Layer Security (TLS)

439. Which of the following is the BEST method to reduce the effectiveness of phishing attacks?

User awareness

Two-factor authentication

Anti-phishing software

Periodic vulnerability scan

440. DRAG DROP

Match the name of access control model with its associated restriction.

Drag each access control model to its appropriate restriction access on the right.

Page 45 of 45

441. Which of the following would BEST describe the role directly responsible for data within an organization?

Data custodian

Information owner

Database administrator

Quality control

442. Which of the following media sanitization techniques is MOST likely to be effective for an organization using public cloud services?

Low-level formatting

Secure-grade overwrite erasure

Cryptographic erasure

Drive degaussing

443. The application of a security patch to a product previously validate at Common Criteria (CC) Evaluation Assurance Level (EAL) 4 would

require an update of the Protection Profile (PP).

require recertification.

retain its current EAL rating.

reduce the product to EAL 3.

444. Which technology is a prerequisite for populating the cloud-based directory in a federated identity solution?

Notification tool

Message queuing tool

Security token tool

Synchronization tool

445. Which of the following is the PRIMARY reason for employing physical security personnel at entry points in facilities where card access is in operation?

To verify that only employees have access to the facility.

To identify present hazards requiring remediation.

To monitor staff movement throughout the facility.

To provide a safe environment for employees.

446. An application developer is deciding on the amount of idle session time that the application allows before a timeout. The BEST reason for determining the session timeout requirement is

organization policy.

industry best practices.

industry laws and regulations.

management feedback.

447. What is a characteristic of Secure Socket Layer (SSL) and Transport Layer Security (TLS)?

SSL and TLS provide a generic channel security mechanism on top of Transmission Control Protocol (TCP).

SSL and TLS provide nonrepudiation by default.

SSL and TLS do not provide security for most routed protocols.

SSL and TLS provide header encapsulation over HyperText Transfer Protocol (HTTP).

Updated Questions for CISSP Exam

Updated Questions for CISSP Exam

Share this post

Leave a Reply Cancel reply

Related Posts

CISSP-ISSEP Information Systems Security Engineering Professional Questions

HealthCare Information Security and Privacy Practitioner HCISPP Exam Questions

Certified Authorization Professional CAP Study Guides

Real Exam Dumps for CCSP Test

ISC Certification CISSP CAT Exam Great Dumps