Chapter 12
Practice Test 4

  1. What type of access control is intended to discover unwanted or unauthorized activity by providing information after the event has occurred?
    1. Preventive
    2. Corrective
    3. Detective
    4. Directive
  2. Which one of the following presents the most complex decoy environment for an attacker to explore during an intrusion attempt?
    1. Honeypot
    2. Darknet
    3. Honeynet
    4. Pseudoflaw

    Ben's organization is adopting biometric authentication for their high-security building's access control system. Using this chart, answer questions 3–5 about their adoption of the technology.

    Graph depicts the adoption of the technology for the high-security building’s access control system.
  3. Ben's company is considering configuring their systems to work at the level shown by point A on the diagram. What level are they setting the sensitivity to?
    1. The FRR crossover
    2. The FAR point
    3. The CER
    4. The CFR
  4. At point B, what problem is likely to occur?
    1. False acceptance will be very high.
    2. False rejection will be very high.
    3. False rejection will be very low.
    4. False acceptance will be very low.
  5. What should Ben do if the FAR and FRR shown in this diagram do not provide an acceptable performance level for his organization's needs?
    1. Adjust the sensitivity of the biometric devices.
    2. Assess other biometric systems to compare them.
    3. Move the CER.
    4. Adjust the FRR settings in software.
  6. Ed is tasked with protecting information about his organization's customers, including their name, Social Security number, birthdate, and place of birth, as well as a variety of other information. What is this information known as?
    1. PHI
    2. PII
    3. Personal protected data
    4. PID
  7. What software development lifecycle model is shown in the following illustration?
    Schematic illustration of the software development lifecycle model.
    1. Spiral
    2. Agile
    3. Boehm
    4. Waterfall
  8. Encapsulation is the core concept that enables what type of protocol?
    1. Bridging
    2. Multilayer
    3. Hashing
    4. Storage
  9. Amanda wants to use contacts from the existing Gmail accounts that new users for her application already have. What protocol from the following options is used to provide secure delegated access for this type of use by many cloud providers?
    1. Open ID
    2. Kerberos
    3. OAuth
    4. SAML
  10. Which one of the following metrics specifies the amount of time that business continuity planners find acceptable for the restoration of service after a disaster?
    1. MTD
    2. RTO
    3. RPO
    4. MTO
  11. Jill is working to procure new network hardware for her organization. She finds a gray market supplier that is importing the hardware from outside the country at a much lower price. What security concern is the most significant for hardware acquired this way?
    1. The security of the hardware and firmware
    2. Availability of support for the hardware and software
    3. Whether the hardware is a legitimate product of the actual vendor
    4. The age of the hardware
  12. What process is typically used to ensure data security for workstations that are being removed from service but that will be resold or otherwise reused?
    1. Destruction
    2. Erasing
    3. Sanitization
    4. Clearing
  13. Colleen is conducting a software test that is evaluating code for both security flaws and usability issues. She is working with the application from an end-user perspective and referencing the source code as she works her way through the product. What type of testing is Colleen conducting?
    1. White box
    2. Blue box
    3. Gray box
    4. Black box
  14. Harold is looking for a software development methodology that will help with a major issue he is seeing in his organization. Currently, developers and operations staff do not work together and are often seen as taking problems and “throwing them over the fence” to the other team. What technology management approach is designed to alleviate this problem?
    1. ITIL
    2. Lean
    3. ITSM
    4. DevOps
  15. NIST Special Publication 800-92, the Guide to Computer Security Log Management, describes four types of common challenges to log management:
    • Many log sources
    • Inconsistent log content
    • Inconsistent timestamps
    • Inconsistent log formats

    Which of the following solutions is best suited to solving these issues?

    1. Implement SNMP for all logging devices.
    2. Implement a SIEM.
    3. Standardize on the Windows event log format for all devices and use NTP.
    4. Ensure that logging is enabled on all endpoints using their native logging formats and set their local time correctly.
  16. Mike has a flash memory card that he would like to reuse. The card contains sensitive information. What technique can he use to securely remove data from the card and allow its reuse?
    1. Degaussing
    2. Physical destruction
    3. Cryptoshredding
    4. Reformatting
  17. Carlos is investigating the compromise of sensitive information in his organization. He believes that attackers managed to retrieve personnel information on all employees from the database and finds the following user-supplied input in a log entry for a web-based personnel management system:

    What type of attack took place, and how could it be prevented?

    1. SQL injection, use of stored procedures
    2. Buffer overflow, automatic buffer expansion
    3. Cross-site scripting, turning on XSS prevention on the web server
    4. Cross-site request forgery, requiring signed requests
  18. Which one of the following is a detailed, step-by-step document that describes the exact actions that individuals must complete?
    1. Policy
    2. Standard
    3. Guideline
    4. Procedure
  19. What purpose are the CIS benchmarks frequently used for in organizations?
    1. Secure coding standards
    2. Performance testing
    3. Baselining
    4. Monitoring metrics
  20. Bryan has a set of sensitive documents that he would like to protect from public disclosure. He would like to use a control that, if the documents appear in a public forum, may be used to trace the leak back to the person who was originally given the document copy. What security control would best fulfill this purpose?
    1. Digital signature
    2. Document staining
    3. Hashing
    4. Watermarking
  21. Carlos is planning a design for a data center that will be constructed within a new four-story corporate headquarters. The building consists of a basement and three above-ground floors. What is the best location for the data center?
    1. Basement
    2. First floor
    3. Second floor
    4. Third floor
  22. Chris is an information security professional for a major corporation, and as he is walking into the building, he notices that the door to a secure area has been left ajar. Physical security does not fall under his responsibility, but he takes immediate action by closing the door and informing the physical security team of his action. What principle is Chris demonstrating?
    1. Due care
    2. Crime prevention through environmental design
    3. Separation of duties
    4. Informed consent
  23. Which one of the following investigation types always uses the beyond-a-reasonable-doubt standard of proof?
    1. Civil investigation
    2. Criminal investigation
    3. Operational investigation
    4. Regulatory investigation
  24. Kristen wants to use multiple processing sites for her data, but does not want to pay for a full data center. Which of the following options would you recommend as her best option if she wants to be able to quickly migrate portions of her custom application environment to facilities in multiple countries without having to wait to ship or acquire hardware?
    1. A cloud PaaS vendor
    2. A hosted data center provider
    3. A cloud IaaS vendor
    4. A data center vendor that provides rack, power, and remote hands services
  25. What type of alternate processing facility contains the hardware necessary to restore operations but does not have a current copy of data?
    1. Hot site
    2. Warm site
    3. Cold site
    4. Mobile site
  26. Which one of the following terms describes a period of momentary high voltage?
    1. Sag
    2. Brownout
    3. Spike
    4. Surge
  27. Greg needs to label drives used for his company's medical insurance claims database. What data label from the following list best matches the type of data he is dealing with?
    1. PII
    2. Secret
    3. Business confidential
    4. PHI
  28. The Open Shortest Path First (OSPF) protocol is a routing protocol that keeps a map of all connected remote networks and uses that map to select the shortest path to a remote destination. What type of routing protocol is OSPF?
    1. Link state
    2. Shortest path first
    3. Link mapping
    4. Distance vector
  29. Selah wants to ensure that vehicles cannot crash through into her company's entryway and front lobby while still remaining accessible to pedestrians and wheelchairs or other mobility devices. What physical security control is best suited to this purpose?
    1. Fences
    2. Bollards
    3. Walls
    4. Stairs

    For questions 30–34, please refer to the following scenario:

    Concho Controls is a midsize business focusing on building automation systems. It hosts a set of local file servers in its on-premises data center that store customer proposals, building plans, product information, and other data that is critical to their business operations.

    Tara works in the Concho Controls IT department and is responsible for designing and implementing the organization's backup strategy, among other tasks. She currently conducts full backups every Sunday evening at 8 p.m. and differential backups on Monday through Friday at noon.

    Concho experiences a server failure at 3 p.m. on Wednesday. Tara rebuilds the server and wants to restore data from the backups.

  30. What backup should Tara apply to the server first?
    1. Sunday's full backup
    2. Monday's differential backup
    3. Tuesday's differential backup
    4. Wednesday's differential backup
  31. How many backups in total must Tara apply to the system to make the data it contains as current as possible?
    1. 1
    2. 2
    3. 3
    4. 4
  32. In this backup approach, some data may be irretrievably lost. How long is the time period where any changes made will have been lost?
    1. 3 hours.
    2. 5 hours.
    3. 8 hours.
    4. No data will be lost.
  33. If Tara followed the same schedule but switched the differential backups to incremental backups, how many backups in total would she need to apply to the system to make the data it contains as current as possible?
    1. 1
    2. 2
    3. 3
    4. 4
  34. If Tara made the change from differential to incremental backups and we assume that the same amount of information changes each day, which one of the following files would be the largest?
    1. Monday's incremental backup.
    2. Tuesday's incremental backup.
    3. Wednesday's incremental backup.
    4. All three will be the same size.
  35. The following figure shows an example of an attack where Mal, the attacker, has redirected traffic from a user's system to their own, allowing them to read TLS encrypted traffic. Which of the following terms best describes this attack?
    Schematic illustration of an example of an attack where Mal, the attacker, has redirected traffic from a user’s system to their own, allowing them to read TLS encrypted traffic.
    1. A DNS hijacking attack
    2. An ARP spoofing attack
    3. A man-in-the-middle attack
    4. A SQL injection attack
  36. Bob has been tasked with writing a policy that describes how long data should be kept and when it should be purged. What concept does this policy deal with?
    1. Data remanence
    2. Record retention
    3. Data redaction
    4. Audit logging
  37. Which component of IPsec provides authentication, integrity, and nonrepudiation?
    1. L2TP
    2. Encapsulating Security Payload
    3. Encryption Security Header
    4. Authentication Header
  38. Renee notices that a system on her network recently received connection attempts on all 65,536 TCP ports from a single system during a short period of time. What type of attack did Renee most likely experience?
    1. Denial-of-service
    2. Reconnaissance
    3. Malicious insider
    4. Compromise
  39. What type of Windows audit record describes events like an OS shutdown or a service being stopped?
    1. An application log
    2. A security log
    3. A system log
    4. A setup log
  40. Melissa is in charge of her organization's security compliance efforts and has been told that the organization does not install Windows patches until a month has passed since the patch has been released unless there is a zero-day exploit that is being actively exploited. Why would the company delay patching like this?
    1. To minimize business impact of the installation
    2. To allow any flaws with the patch to be identified
    3. To prevent malware in the patches from being installed before it is identified
    4. To allow the patch to be distributed to all systems
  41. What level of RAID is also known as disk striping?
    1. RAID 0
    2. RAID 1
    3. RAID 5
    4. RAID 10
  42. Jacob executes an attack against a system using a valid but low-privilege user account by accessing a file pointer that the account has access to. After the access check, but before the file is opened, he quickly switches the file pointer to point to a file that the user account does not have access to. What type of attack is this?
    1. TOCTOU
    2. Permissions creep
    3. Impersonation
    4. Link swap
  43. What is the minimum number of disks required to implement RAID level 0?
    1. 1
    2. 2
    3. 3
    4. 5
  44. Fred's company wants to ensure the integrity of email messages sent via its central email servers. If the confidentiality of the messages is not critical, what solution should Fred suggest?
    1. Digitally sign and encrypt all messages to ensure integrity.
    2. Digitally sign but don't encrypt all messages.
    3. Use TLS to protect messages, ensuring their integrity.
    4. Use a hashing algorithm to provide a hash in each message to prove that it hasn't changed.
  45. The leadership at Susan's company has asked her to implement an access control system that can support rule declarations like “Only allow access to salespeople from managed devices on the wireless network between 8 a.m. and 6 p.m.” What type of access control system would be Susan's best choice?
    1. ABAC
    2. RBAC
    3. DAC
    4. MAC
  46. Nora's company operates servers on a five-year lifecycle. When they reach their end of life according to that process, the servers are sent to an e-waste recycler. Which of the following is the most effective control that Nora could implement to ensure that a data breach does not occur due to remanent data?
    1. Zero wipe the drives before the servers leave the organization.
    2. Remove the drives and shred them.
    3. Reformat the drives before the servers are sent to the e-waste company.
    4. Require certificates of disposal from the e-waste company.
  47. Chris is deploying a gigabit Ethernet network using Category 6 cable between two buildings. What is the maximum distance he can run the cable according to the Category 6 standard?
    1. 50 meters
    2. 100 meters
    3. 200 meters
    4. 300 meters
  48. Howard is a security analyst working with an experienced computer forensics investigator. The investigator asks him to retrieve a forensic drive controller, but Howard cannot locate a device in the storage room with this name. What is another name for a forensic drive controller?
    1. RAID controller
    2. Write blocker
    3. SCSI terminator
    4. Forensic device analyzer
  49. The web application that Saria's development team is working on needs to provide secure session management that can prevent hijacking of sessions using the cookies that the application relies on. Which of the following techniques would be the best for her to recommend to prevent this?
    1. Set the Secure attribute for the cookies, thus forcing TLS.
    2. Set the Domain cookie attribute to to limit cookie access to servers in the same domain.
    3. Set the Expires cookie attribute to less than a week.
    4. Set the HTTPOnly attribute to require only unencrypted sessions.
  50. Ben's company has recently retired its fleet of multifunction printers. The information security team has expressed concerns that the printers contain hard drives and that they may still have data from scans and print jobs. What is the technical term for this issue?
    1. Data pooling
    2. Failed clearing
    3. Data permanence
    4. Data remanence
  51. What access control scheme labels subjects and objects and allows subjects to access objects when the labels match?
    1. DAC
    2. MAC
    3. Rule-based access control (RBAC)
    4. Role-based access control (RBAC)
  52. A cloud-based service that provides account provisioning, management, authentication, authorization, reporting, and monitoring capabilities is known as what type of service?
    1. PaaS
    2. IDaaS
    3. IaaS
    4. SaaS
  53. Sally wants to secure her organization's VoIP systems. Which of the following attacks is one that she shouldn't have to worry about?
    1. Eavesdropping
    2. Denial-of-service
    3. Blackboxing
    4. Caller ID spoofing
  54. Marty discovers that the access restrictions in his organization allow any user to log into the workstation assigned to any other user, even if they are from completely different departments. This type of access most directly violates which information security principle?
    1. Separation of duties
    2. Two-person control
    3. Need to know
    4. Least privilege
  55. Fred needs to transfer files between two servers on an untrusted network. Since he knows the network isn't trusted, he needs to select an encrypted protocol that can ensure that his data remains secure. What protocol should he choose?
    1. SSH
    2. TCP
    3. SFTP
    4. IPsec
  56. Chris uses a packet sniffer to capture traffic from a TACACS+ server. What protocol should he monitor, and what data should he expect to be readable?
    1. UDP; none—TACACS+ encrypts the full session.
    2. TCP; none—TACACS+ encrypts the full session.
    3. UDP; all but the username and password, which are encrypted.
    4. TCP; all but the username and password, which are encrypted.

    Use your knowledge of Kerberos authentication and authorization as well as the following diagram to answer questions 57–59.

    Schematic illustration of the Kerberos authentication and authorization.
  57. If the client has already authenticated to the KDC, what does the client workstation send to the KDC at point A when it wants to access a resource?
    1. It resends the password
    2. A TGR
    3. Its TGT
    4. A service ticket
  58. What occurs between steps A and B?
    1. The KDC verifies the validity of the TGT and whether the user has the right privileges for the requested resource.
    2. The KDC updates its access control list based on the data in the TGT.
    3. The KDC checks its service listing and prepares an updated TGT based on the service request.
    4. The KDC generates a service ticket to issue to the client.
  59. What system or systems does the service that is being accessed use to validate the ticket?
    1. The KDC.
    2. The client workstation and the KDC.
    3. The client workstation supplies it in the form of a client-to-server ticket and an authenticator.
    4. The KVS.
  60. What does a service ticket (ST) provide in Kerberos authentication?
    1. It serves as the authentication host.
    2. It provides proof that the subject is authorized to access an object.
    3. It provides proof that a subject has authenticated through a KDC and can request tickets to access other objects.
    4. It provides ticket granting services.
  61. Judy is preparing to conduct a business impact analysis. What should her first step be in the process?
    1. Identify threats to the business.
    2. Identify risks to the organization.
    3. Identify business priorities.
    4. Conduct likelihood analysis.
  62. What is the most common risk that cellular phone hotspots create for business networks?
    1. They can provide attackers with a nonsecured network path into your network.
    2. They can be used like rogue access points for man-in-the-middle attacks.
    3. They allow wireless data to be intercepted.
    4. They are unencrypted and can be easily sniffed.
  63. Which one of the following fire suppression systems poses the greatest risk of accidental discharge that damages equipment in a data center?
    1. Wet pipe
    2. Dry pipe
    3. Deluge
    4. Preaction
  64. Amanda's healthcare provider maintains such data as details about her health, treatments, and medical billing. What type of data is this?
    1. Protected health information
    2. Personally identifiable information
    3. Protected health insurance
    4. Individual protected data
  65. What type of code review is best suited to identifying business logic flaws?
    1. Mutational fuzzing
    2. Manual
    3. Generational fuzzing
    4. Interface testing
  66. Something you know is an example of what type of authentication factor?
    1. Type 1
    2. Type 2
    3. Type 3
    4. Type 4
  67. Saria is the system owner for a healthcare organization. What responsibilities does she have related to the data that resides on or is processed by the systems she owns?
    1. She has to classify the data.
    2. She has to make sure that appropriate security controls are in place to protect the data.
    3. She has to grant appropriate access to personnel.
    4. She bears sole responsibility for ensuring that data is protected at rest, in transit, and in use.
  68. During software testing, Jack diagrams how a hacker might approach the application he is reviewing and determines what requirements the hacker might have. He then tests how the system would respond to the attacker's likely behavior. What type of testing is Jack conducting?
    1. Misuse case testing
    2. Use case testing
    3. Hacker use case testing
    4. Static code analysis
  69. Rick's risk assessment for his company's web application noted that it could suffer from SQL injection attacks. Which of the following mitigation techniques would you recommend Rick apply to help reduce this risk? (Select all that apply.)
    1. Stored procedures
    2. Escaping all user-supplied input
    3. Parameterized queries
    4. Input validation
  70. Chris has been assigned to scan a system on all of its possible TCP and UDP ports. How many ports of each type must he scan to complete his assignment?
    1. 65,536 TCP ports and 32,768 UDP ports
    2. 1,024 common TCP ports and 32,768 ephemeral UDP ports
    3. 65,536 TCP and 65,536 UDP ports
    4. 16,384 TCP ports, and 16,384 UDP ports
  71. CVE and the NVD both provide information about what?
    1. Vulnerabilities
    2. Markup languages
    3. Vulnerability assessment tools
    4. Penetration testing methodologies
  72. Michelle wants to ensure that her company does not keep logs for longer than they need to. What type of policy should she write and implement to ensure this?
    1. An EOL policy
    2. A data classification policy
    3. An EOS policy
    4. A record retention policy
  73. In what type of trusted recovery process does the system recover against one or more failure types without administrator intervention while protecting itself against data loss?
    1. Automated recovery
    2. Manual recovery
    3. Function recovery
    4. Automated recovery without undue data loss
  74. What three important items should be considered if you are attempting to control the strength of signal for a wireless network as well as where it is accessible?
    1. Antenna placement, antenna type, antenna power levels
    2. Antenna design, power levels, use of a captive portal
    3. Antenna placement, antenna design, use of a captive portal
    4. Power levels, antenna placement, FCC minimum strength requirements
  75. What is the best way to ensure that data is unrecoverable from an SSD?
    1. Use the built-in erase commands.
    2. Use a random pattern wipe of 1s and 0s.
    3. Physically destroy the drive.
    4. Degauss the drive.
  76. Alice sends a message to Bob and wants to ensure that Mal, a third party, does not read the contents of the message while in transit. What goal of cryptography is Alice attempting to achieve?
    1. Confidentiality
    2. Integrity
    3. Authentication
    4. Nonrepudiation
  77. Place the following stages in their proper order for the MITRE ATT&CK framework shown here. Note that Recon is the start of the process and Maintain is the end.
    Schematic illustration of the stages in the MITRE ATT&CK framework.
    1. 1 Recon – 2 Deliver – 3 Weaponize – 4 Exploit – 5 Control – 6 Execute – 7 Maintain
    2. 1 Recon – 2 Weaponize – 3 Deliver – 4 Exploit – 5 Control – 6 Execute – 7 Maintain
    3. 1 Recon – 2 Weaponize – 3 Deliver – 4 Exploit – 5 Execute – 6 Control – 7 Maintain
    4. 1 Recon – 2 Weaponize – 3 Exploit – 4 Deliver – 5 Control – 6 Execute – 7 Maintain
  78. The company that Gary works for processes credit cards and operates under an industry standard for credit card handling. Which of the following standards will his company need to comply with?
    1. ISO27001
    2. FIPS 140
    3. PCI-DSS
    4. ISO 27002
  79. James has opted to implement a NAC solution that uses a post-admission philosophy for its control of network connectivity. What type of issues can't a strictly post-admission policy handle?
    1. Out-of-band monitoring
    2. Preventing an unpatched laptop from being exploited immediately after connecting to the network
    3. Denying access when user behavior doesn't match an authorization matrix
    4. Allowing a user access to a specific object when user behavior is allowed based on an authorization matrix
  80. Ben has built an access control list that lists the objects that his users are allowed to access. When users attempt to access an object that they don't have rights to, they are denied access, even though there isn't a specific rule that prevents it. What access control principle is key to this behavior?
    1. Least privilege
    2. Implicit deny
    3. Explicit deny
    4. Final rule fall-through
  81. Mary is a security risk analyst for an insurance company. She is currently examining a scenario where a hacker might use a SQL injection attack to deface a web server due to a missing patch in the company's web application. In this scenario, what is the risk?
    1. Unpatched web application
    2. Web defacement
    3. Hacker
    4. Operating system
  82. The mean time to detect a compromise is what type of security measurement?
    1. An MTO
    2. A technical control objective
    3. A compliance objective
    4. A KPI
  83. Val is attempting to review security logs but is overwhelmed by the sheer volume of records maintained in her organization's central log repository. What technique can she use to select a representative set of records for further review?
    1. Statistical sampling.
    2. Clipping.
    3. Choose the first 5 percent of records from each day.
    4. Choose 5 percent of records from the middle of the day.
  84. In Jen's job as the network administrator for an industrial production facility, she is tasked with ensuring that the network is not susceptible to electromagnetic interference due to the large motors and other devices running on the production floor. What type of network cabling should she choose if this concern is more important than cost and difficulty of installation?
    1. 10Base2
    2. 100BaseT
    3. 1000BaseT
    4. Fiber optic

    For questions 85–88, please refer to the following scenario:

    Jasper Diamonds is a jewelry manufacturer that markets and sells custom jewelry through its website. Bethany is the manager of Jasper's software development organization, and she is working to bring the company into line with industry-standard practices. She is developing a new change management process for the organization and wants to follow commonly accepted approaches.

  85. Bethany would like to put in place controls that provide an organized framework for company employees to suggest new website features that her team will develop. What change management process facilitates this?
    1. Configuration control
    2. Change control
    3. Release control
    4. Request control
  86. Bethany would also like to create a process that helps multiple developers work on code at the same time. What change management process facilitates this?
    1. Configuration control
    2. Change control
    3. Release control
    4. Request control
  87. Bethany is working with her colleagues to conduct user acceptance testing. What change management process includes this task?
    1. Configuration control
    2. Change control
    3. Release control
    4. Request control
  88. Bethany noticed that some problems arise when system administrators update libraries without informing developers. What change management process can assist with this problem?
    1. Configuration control
    2. Change control
    3. Release control
    4. Request control
  89. Ben has written the password hashing system for the web application he is building. His hashing code function for passwords results in the following process for a series of passwords:
     hash (password1 + 07C98BFE4CF67B0BFE2643B5B22E2D7D) =
     hash (password2 + 07C98BFE4CF67B0BFE2643B5B22E2D7D) =

    What flaw has Ben introduced with his hashing implementation?

    1. Plaintext salting
    2. Salt reuse
    3. Use of a short salt
    4. Poor salt algorithm selection
  90. Which one of the following is an example of risk transference?
    1. Building a guard shack
    2. Purchasing insurance
    3. Erecting fences
    4. Relocating facilities
  91. What protocol takes the place of certificate revocation lists and adds real-time status verification?
    1. RTCP
    2. RTVP
    3. OCSP
    4. CSRTP
  92. Xavier's company has been using an increasing number of cloud services, and he is concerned that the security policies that the company has implemented in its existing data center are not being followed in the cloud. Which of the following solutions is best suited to ensuring that policies are applied to all cloud services?
    1. A CIPS
    2. A CASB
    3. A CSG
    4. A CDLP
  93. What process makes TCP a connection-oriented protocol?
    1. It works via network connections.
    2. It uses a handshake.
    3. It monitors for dropped connections.
    4. It uses a complex header.
  94. Susan wants to build a security awareness program for her organization, but knows that keeping staff engaged is difficult. Which of the following techniques is often associated with the use of points and scores as part of the assessment process?
    1. Gamification
    2. Phishing testing
    3. Security champions
    4. Social engineering evaluations
  95. You are conducting a qualitative risk assessment for your organization. The two important risk elements that should weigh most heavily in your analysis of risk are probability and ________________.
    1. Likelihood
    2. History
    3. Impact
    4. Cost
  96. Using the OSI model, what format does the Data Link layer use to format messages received from higher up the stack?
    1. A data stream
    2. A frame
    3. A segment
    4. A datagram
  97. What is the maximum penalty that may be imposed by an (ISC)2 peer review board when considering a potential ethics violation?
    1. Revocation of certification
    2. Termination of employment
    3. Financial penalty
    4. Suspension of certification
  98. Which one of the following statements about the SDLC is correct?
    1. The SDLC requires the use of an iterative approach to software development.
    2. The SDLC requires the use of a sequential approach to software development.
    3. The SDLC does not include training for end users and support staff.
    4. The waterfall methodology is compatible with the SDLC.
  99. In the diagram shown here, Harry is prevented from reading a file at a higher classification level than his security clearance. What security model prevents this behavior?
    Schematic illustration of Harrry's blocked read request for the data file.
    1. Bell–LaPadula
    2. Biba
    3. Clark–Wilson
    4. Brewer–Nash
  100. Susan is setting up the network for a local coffee house and wants to ensure that users have to authenticate using an email address and agree to the coffee house's acceptable use policy before being allowed on the network. What technology should she use to do this?
    1. 802.11
    2. NAC
    3. A captive portal
    4. A wireless gateway
  101. Travis is concerned about the security that his organization's use of Microsoft's BitLocker provides for systems. When are the systems most secure from data loss based on the encryption state of the drive if the systems are equipped with TPM and use full disk encryption?
    1. When they are booted up and running because the system monitors for drive access
    2. When the system is shutting down because keys are removed from memory
    3. When they are booting up because the TPM checks for a secure boot process
    4. When they are off because the drive is fully encrypted
  102. Andrea wants to ensure that her virtualized networks are secure between virtual environments. She uses virtual machine clusters in multiple locations in her state with third-party internet service providers between those locations. Which of the following solutions is best suited to protecting her traffic if she runs a flattened layer 2 network between those locations?
    1. TLS
    2. BGP
    3. IPsec
    4. AES

    For questions 103–105, please refer to the following scenario:

    The company that Fred works for is reviewing the security of their company-issued cell phones. They issue 4G-capable smartphones running Android and iOS and use a mobile device management solution to deploy company software to the phones. The mobile device management software also allows the company to remotely wipe the phones if they are lost.

  103. What security considerations should Fred's company require for sending sensitive data over the cellular network?
    1. They should use the same requirements as data over any public network.
    2. Cellular provider networks are private networks and should not require special consideration.
    3. Encrypt all traffic to ensure confidentiality.
    4. Require the use of WAP for all data sent from the phone.
  104. Fred intends to attend a major hacker conference this year and needs to connect to his employer's network during his time at the conference. What should he do when connecting to his cellular provider's 4G network while at the conference?
    1. Continue normal usage.
    2. Discontinue all usage; towers can be spoofed.
    3. Only use trusted WiFi networks.
    4. Connect to his company's encrypted VPN service.
  105. What are the most likely circumstances that would cause a remote wipe of a mobile phone to fail?
    1. The phone has a passcode on it.
    2. The phone cannot contact a network.
    3. The provider has not unlocked the phone.
    4. The phone is in use.
  106. Elaine is developing a business continuity plan for her organization. What value should she seek to minimize?
    1. AV
    2. SSL
    3. RTO
    4. MTO
  107. Warren wants to conduct an internal security audit. He wants to use a broadly accepted audit framework so that he can more easily compare the results to other organizations. Which of the following options should he select as his base audit framework?
    1. ITSM
    2. ATT&CK
    3. COBIT
    4. CIS
  108. Place the list of disaster recovery test types in order of their potential impact on the business, starting with the least impactful and progressing through the most impactful.
    1. Checklist review
    2. Parallel test
    3. Tabletop exercise
    4. Full interruption test
    1. 1, 2, 3, 4
    2. 1, 3, 2, 4
    3. 1, 3, 4, 2
    4. 2, 1, 3, 4
  109. Jack's data center design calls for dual-power supplies in every critical server. What part of the CIA triad is he addressing with this design decision?
    1. Confidentiality
    2. Integrity
    3. Availability
    4. None of the above
  110. What step is missing from the IR process cycle diagram shown here?
    Schematic illustration of the diagram of the IR process cycle.
    1. Forensics
    2. Retribution
    3. Recovery
    4. Analysis
  111. Frank is attempting to protect his web application against cross-site scripting attacks. Users do not need to provide input containing scripts, so he decided the most effective way to filter would be to write a filter on the server that watches for the <SCRIPT> tag and removes it. What is the issue with Frank's approach?
    1. Validation should always be performed on the client side.
    2. Attackers may use XSS filter evasion techniques against this approach.
    3. Server-side validation requires removing all HTML tags, not just the <SCRIPT> tag.
    4. There is no problem with Frank's approach.
  112. Megan wants to ensure that the new software as a service provider that her company is signing a contract with will make sure the service works all the time without disruptions. Which of the following is often part of contracts to provide that assurance?
    1. An SLA
    2. An RPA
    3. An NDA
    4. An MOU
  113. Uptown Records Management recently entered into a contract with a hospital for the secure storage of medical records. The hospital is a U.S.-based, HIPAA-covered entity, which means it needs to ensure that organizations they contract with can meet security practice requirements. What type of agreement should the two organizations sign to meet this requirement?
    1. NDA
    2. NCA
    3. BAA
    4. SLA
  114. Norm would like to conduct a disaster recovery test for his organization and wants to choose the most thorough type of test, recognizing that it may be quite disruptive. What type of test should Norm choose?
    1. Full interruption test
    2. Parallel test
    3. Tabletop exercise
    4. Checklist review
  115. Ed is building a network that supports IPv6 but needs to connect it to an IPv4 network. What type of device should Ed place between the networks?
    1. A switch
    2. A router
    3. A bridge
    4. A gateway
  116. Henry's company has deployed an extensive IoT infrastructure for building monitoring that includes environmental controls, occupancy sensors, and a variety of other sensors and controllers that help manage the building. Which of the following security concerns should Henry report as the most critical in his analysis of the IoT deployment?
    1. The lack of local storage space for security logs that is common to IoT devices.
    2. The IoT devices may not have a separate administrative interface, allowing anybody on the same network to attempt to log into them and making brute-force attacks possible.
    3. The IoT devices may not support strong encryption for communications, exposing the log and sensor data to interception on the network.
    4. The long-term support and patching model for the IoT devices may create security and operational risk for the organization.
  117. Isaac wants to use a connectionless protocol to transfer data because he needs to optimize speed of transmission over reliability. Which protocol should he select?
    1. ICMP
    2. TCP
    3. UDP
    4. SNMP
  118. Which one of the following actions is not required under the EU General Data Protection Regulation?
    1. Organizations must allow individuals to opt out of information sharing.
    2. Organizations must provide individuals with lists of employees with access to information.
    3. Organizations must use proper mechanisms to protect data against unauthorized disclosure.
    4. Organizations must have a dispute resolution process for privacy issues.
  119. Tammy is selecting a disaster recovery facility for her organization. She would like to choose a facility that balances the time required to recover operations with the cost involved. What type of facility should she choose?
    1. Hot site
    2. Warm site
    3. Cold site
    4. Red site
  120. What layer of the OSI model is associated with datagrams?
    1. Session
    2. Transport
    3. Network
    4. Data Link
  121. Which one of the following is not a valid key length for the Advanced Encryption Standard?
    1. 128 bits
    2. 192 bits
    3. 256 bits
    4. 384 bits
  122. Which one of the following technologies provides a function interface that allows developers to directly interact with systems without knowing the implementation details of that system?
    1. Data dictionary
    2. Object model
    3. Source code
    4. API
  123. Ian wants to assess the security of his company's new SaaS provider. Which of the following options is the most likely option that he can realistically expect to be able to use to assess a major cloud provider's security?
    1. Run a vulnerability scan against the provider's external services.
    2. Request a SOC 2 Type II report.
    3. Run a vulnerability scan against the provider's internal systems.
    4. Request a SOC 1 Type II report.
  124. When Ben lists the files on a Linux system, he sees a set of attributes as shown here.
    Schematic illustration of a set of attributes on a Linux system.

    The letters rwx indicate different levels of what?

    1. Identification
    2. Authorization
    3. Authentication
    4. Accountability
  125. Match each one of the numbered protocols with the most accurate lettered description. Use each answer exactly once.


    1. TCP
    2. UDP
    3. DNS
    4. ARP


    1. Performs translations between MAC addresses and IP addresses
    2. Performs translations between FQDNs and IP addresses
    3. Transports data over a network in a connection-oriented fashion
    4. Transports data over a network in a connectionless fashion
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.