All Domains #1

Question 1

Barbie maintains a collection of items in her boutique, including dresses, accessories, and furniture. These items represent what type of assets in her inventory?
1. Tangible
2. Both Tangible and Intangible
3. Neither Tangible nor Intangible
4. Intangible

Answer 1

Tangible

The correct answer: Tangible. The dresses, accessories, and furniture that Barbie maintains in her boutique are examples of Tangible assets. Tangible assets are physical items that have value and can be touched or held. The incorrect answers: Intangible: Intangible assets are non-physical assets, such as patents, copyrights, and trademarks. In this case, the assets mentioned (dresses, accessories, furniture) are physical items, so they are not intangible assets. Both Tangible and Intangible: While a business can have both types of assets, in this particular case, the assets mentioned are only tangible, physical items. Neither Tangible nor Intangible: This option is incorrect as the items mentioned are clearly tangible, physical assets.

Question 2

Which of the following is the MOST likely definition of Data Terminal Equipment (DTE)?
1. Device that receives power from a network
2. Device that encrypts and decrypts data
3. Device that processes and stores data
4. Device that transmits and receives data over a network

Answer 2

A device that transmits and receives data over a network

The correct answer: Data Terminal Equipment (DTE) refers to any device or equipment that is used to transmit and receive data over a network. This includes devices such as computers, terminals, printers, and modems. These devices are connected to a Data Communications Equipment (DCE) device, such as a router or switch, to send and receive data over a network. The incorrect answers: While DTE does transmit and receive data, it does not necessarily process or store data. That function would be performed by a different device, such as a server or a storage device. Encrypting and decrypting data is not a core function of DTE. While some DTE devices may have the capability to encrypt and decrypt data, it is not a defining characteristic of DTE. DTE is not a device that receives power from a network. It is a device that transmits and receives data over a network, but it receives power from a different source, such as a power outlet or a battery.

Question 3

Database transactions require atomicity, consistency, isolation, and durability, also referred to as the ACID model. What is atomicity focused on?
1. Ensuring that a transaction is completed only if all of its individual steps are successful.
2. Ensuring that a transaction cannot be interrupted by other transactions
3. Ensuring that a transaction can only be accessed by a single user at a time.
4. Ensuring that a transaction is completed only if all of its individual steps are completed in the correct order.

Answer 3

Ensuring that a transaction is completed only if all of its individual steps are successful.

The correct answer: Atomicity in the ACID model of database transactions refers to the ‘all or nothing’ principle. If a transaction consists of multiple steps, atomicity guarantees that either all the steps are executed successfully and the transaction is committed, or if any step fails, the entire transaction is rolled back. No intermediate state is acceptable, ensuring data integrity. The incorrect answers: While the order of operations may be important in a transaction, ensuring that operations are completed in the correct order isn’t the primary focus of atomicity. This is more related to the sequencing or scheduling of transactions, not atomicity. Ensuring that a transaction can only be accessed by a single user at a time is not what atomicity is about. This statement is more closely related to the concept of ‘Isolation’ in the ACID model, where each transaction is executed in a way as if it is the only operation being processed, independent of others. Ensuring that a transaction cannot be interrupted by other transactions is also not the primary focus of atomicity. This relates more to ‘Isolation’ in the ACID model, which ensures that each transaction is executed independently of others, and other transactions cannot affect it during its execution.

Question 4

Which of the following is the PRIMARY indicator used in User Entity and Behavior Analytics (UEBA) to detect anomalies in user behavior?
1. Highest number of failed login attempts
2. Most frequently accessed data
3. First login time
4. Most recent login time

Answer 4

Most frequently accessed data

The correct answer: Most frequently accessed data: UEBA (User and Entity Behavior Analytics) is a cybersecurity process that takes note of the normal conduct of users and then detects any anomalous behavior or instances when they deviate from these patterns. The “most frequently accessed data” is a key indicator used by UEBA. The reason is that changes in the data a user regularly accesses can indicate potentially harmful actions. For instance, if a user who typically accesses a particular set of data suddenly starts accessing a different, more sensitive set of data, it could signify a compromised account or insider threat. UEBA systems detect such sudden changes in behavior and alert cybersecurity teams accordingly. The incorrect answers: The first login time isn’t a primary indicator used in UEBA. This is because it usually remains constant for a given user. It may be used as a secondary factor in the context of user behavior, such as tracking when a new user starts exhibiting unusual behavior, but it’s not the primary means of identifying anomalous actions. The highest number of failed login attempts could indicate a brute force attack or account compromise attempt, but it isn’t a primary indicator used in UEBA. Failed logins fall under the umbrella of traditional security tools and are usually monitored by intrusion detection systems (IDS) or security information and event management (SIEM) solutions. While it’s true that UEBA might consider failed logins in its broader behavioral analysis, it’s not the main method UEBA uses to identify abnormal behavior. Most recent login time is an important piece of information for various security practices, and can be used as a secondary indicator in UEBA, but it isn’t the primary indicator of abnormal behavior. The primary focus of UEBA is to understand consistent patterns in data access and other activities over time, not isolated incidents like a single login event. A sudden change in login time might be taken into account, but it’s the repetitive anomalies in behavior that UEBA systems chiefly look out for.

Question 5

Which of these, if used right, is the MOST secure form of “something you have” authentication?
1. A security token with a One-time pwd
2. A key fob with a static pwd
3. A pwd protected USB drive
4. A biometric fingerprint scanner

Question 6

When Governor Swann restricts access to the treasury room only to his trusted advisor and himself, which principle of access control is he implementing?
1. Mandatory access control
2. least privilege
3.Discretionary Access Control
4.Role-based access control

Question 7

We need to get rid of some old hard drives, and we need to ensure proper data disposal and no data remanence. Which of these options has NO known tools that can restore the data once that specific disposal process has been used?
1. Encrypting
2. Physical Destruction
3. Degaussing
4. Overwriting

Question 8

We use different risk analysis approaches and tools in our risk assessments. Which of the following risk analysis methods involves assigning a numerical value to the probability and impact of a risk?
1. Qualitative risk analysis
2. Vulnerability risk analysis
3. Quantitative risk analysis
4. Technical risk analysis

Question 9

Which of the following is the MOST common type of investigation?
1. Internal investigation
2. Criminal investigation
3. Environmental ivestigation
4. Forensic investigation

Question 10

What type of access control model is based on the concept of a trusted third party for authentication?
1. Federated Access Control
2. Multifactor Authentication
3. Role-based Access Control
4. Rule-based Access Control

Question 11

Which of the following is NOT a characteristic of the Kerberos authentication protocol?

1. It is a decentralized protocol
2. It uses a trusted third party to authenticate users
3. It uses symmetric key cryptography
4. It provides single sign-on functionality

Question 12

Which of the following is the MOST complex component of L2TP (Layer 2 Tunneling Protocol)?

1. Authentication
2. Encapsulation
3. Tunnel Management
4. Handshake

Question 13

What type of security policy would be MOST effective for protecting sensitive data in a cloud environment?

1. An encryption policy
2. A perimeter security policy
3. A user access control policy
4. A data classification policy

Question 14

You are the IT security manager at a large financial institution. You have recently implemented a new change management process, which includes a thorough evaluation of the risks associated with any proposed changes to the IT infrastructure. What is the primary goal of the change management process?

1. to minimize the potential risks associated with any changes to the IT infra
2. To ensure that all changes are implemented as quickly as possible
3. To ensure that all changes are documents and tracked.
4. To ensure that all changes are approved by the IT security team before they are implemented.

Question 15

What is the best way to protect against a SQL (Structured Query Language) injection attack?

1. Limit access to the database server to only a select few users
2. Use firewalls to block all incoming traffic to the database server
3. Input validation and sanitization on all user-supplied data
4. Implement regular security updates and patches on all database systems

Question 16

What is the FIRST step in protecting a company’s trademark?

1. Conducting a trademark search
2. Registering the trademark with the USPTO
3. Implementing a trademark usage policy
4. Monitoring the use of the trademark

Question 16

In a regulatory investigation, which of the following is the PRIMARY objective?

1. To collect evidence and build a case against individuals or orgs.
2. To identify and punish individuals or orgs that have violated regulations.
3. To evaluate the effectiveness of current regulations
4. To prevent future violations of regulations.

Question 17

Which encryption technique is considered to have the HIGHEST level of security?

1. One-time pad
2. AES
3. RSA
4. Blowfish

Question 17

What is the MOST important step in the cryptography process?

1. Hashing the message
2. Encrypting the message
3. Key exchange
4. Establishing trust between the sender and the recipient

Question 17

Which of the following is the HIGHEST level of asset classification?

1. Unclassified
2. Public
3. Confidential
4. Restricted

Question 18

When an attacker has obtained our sensitive data and chooses to disclose it on a website, which leg of the CIA triad would be MOST affected?

1. Integrity
2. Authenticity
3. Confidentiality
4. Availability

Question 19

Which of the following describes a system that uses a decentralized approach to control access to resources?

1. Access control list
2. Role-based Access Control
3. Rule-based Access control
4. Blockchain

Question 20

In order to ensure the safety of ThorTeaches.com’s sensitive data, it is crucial to identify any potential vulnerabilities or threats in the system. Which of the following is a method of identifying potential vulnerabilities and threats in a system?

1. Security audit
2. Risk assessment
3. Statistical analysis
4. Attacker-centric threat modeling

Question 21

Which of the following factors is NOT considered in the CWSS (Common Weakness Scoring System) scoring?

1. the likelihood of exploitation
2. The number of vendors affected by the weakness
3. The length of time the weakness has existed
4. The level of difficulty to fix the weakness.

Question 22

Which of the following is NOT a benefit of using a Keyboard, Video Mouse (KVM)?

1. Decreased performance of connected devices
2. Increased security through separation of devices
3. Improved accessibility to multiple computers
4. Reduced cost of hardware.

Question 23

Which of the following is the HIGHEST priority when reviewing facility security controls?

1. Providing access badges and identification systems
2. Implementing security cameras and surveillance systems
3. Ensuring that all doors have locks.
4. Conducting regular security assessments and audits.

Question 24

ThorTeaches.com has recently undergone a major data breach, with sensitive customer information being stolen by hackers. You and your team are working on implementing new cybersecurity measures to prevent future attacks. Which of the following options is the most effective way to secure ThorTeaches.com’s data?

1. Implementing two-factor authentication for all accs.
2. Regularly updating software and applications
3. Implementing a firewall
4. Training employees on how to identify phishing emails.

Question 25

When we are reviewing our audit logs, it is which type of control?

1. Directive
2. Preventive
3. Corrective
4. Detective

Question 26

As the IT director of a mid-sized tech startup, your organization is setting up a remote site in a rural area. Due to the remote location, your internet connectivity options are limited. You need a solution that offers decent internet speeds for your team’s cloud-based workloads and video conferencing needs. The options available to you are DSL, Fiber (offered by a local power company), and Satellite Internet. Considering the location and the organization’s needs, which internet connectivity solution should you choose?

1. DSL
2. Satellite Internet
3. Fiber
4. Dialup

Question 27

Which of the following is considered the MOST effective method for managing quantitative risk?

1. Implementing access control measures.
2. Implementing firewalls and IDS
3. Regularly conducting vulnerability assessments
4. Establishing risk tolerance levels and implementing risk mitigation strategies.

Question 27

Which of the following is the PRIMARY indicator that a company has met the requirements of a SOC 2 audit?

1. Regularly conducting risk assessment
2. Implementing strong pwd policies
3. Having a comprehensive data backup plan
4. Establishing appropriate controls for security and availability

Question 28

Which of the following is the MOST important aspect of CM (Configuration Management)?

1. Ensuring that config changes are documented and approved.
2. Implementing strict access controls to prevent unauthorized changes
3. Regularly backing up config files
4. Regularly testing and verifying the effectiveness of security controls.

Question 29

Which of the following techniques is NOT commonly used by attackers in the MITRE ATT&CK framework?

1. Malware
2. Watering hole attacks
3. Phishing
4. Social engineering

Question 30

We have had some tapes go missing from our inventory. We are unsure if they were stolen or just misplaced. Which of these should we ALWAYS use when dealing with sensitive tape backups?

1. Proper marking
2. All of these
3. Proper destruction
4. Proper handling

Question 31

Which of the following is NOT considered PII (Personally Identifiable Information)?

1. Full name
2. Social security number
3. User ID
4. Address

Question 32

Which of the following is the LEAST common type of cybercrime?

1. Identity theft
2. Phishing
3. Ransomware
4. DDoS attacks

Question 33

Which of the following is the MOST effective method to prevent Spectre attacks?

1. Enabling processor virtualization
2. Installing a hardware-based firewall
3. Updating OS
4. Implementing regular software patches

Question 34

Which of the following is the MOST important benefit of implementing dual control?

1. Reduced error rates
2. Improved security
3. Increased productivity
4. Enhanced data integrity

Question 35

Which of the following is the MOST effective method for de-identifying personal data?

1. Applying statistical techniques to remove identifying characteristics
2. Encrypting data with a weak cipher
3. Replacing names with random values
4. Redacting sensitive information

Question 36

As the Director of Information Security for ThorTeaches.com, you are reviewing a detailed report from a recently completed penetration test. The report highlights several significant vulnerabilities and provides recommendations for mitigating them. The vulnerabilities range from low-risk to high-risk, and the associated mitigations vary in terms of implementation effort, cost, and time. To ensure the company effectively addresses these vulnerabilities, you need to strategize a plan for prioritizing the mitigation actions. What should be the primary criterion for prioritizing the mitigation actions recommended in the penetration testing report?

1. The ease of exploiting the identified vulnerabilities
2. The estimated time it would take to implement the recommended mitigations measures.
3. The severity of the vulnerabilities identified
4. The cost of implementing the recommended mitigation measures.

Question 37

As the IT Security Manager of a multinational corporation, you are overseeing the disposal of outdated server hardware, including spinning disk hard drives. The data on these drives includes proprietary information and sensitive client details. The drives are functioning, but some sectors are damaged. Your team proposes a number of approaches to ensure the data is completely eradicated. Given the sensitive nature of the data, the functioning status of the drives, and the fact that some sectors are damaged, which of the following methods will provide the most comprehensive destruction of data?

1. Encrypting the data on the hard drives
2. Degaussing followed by physical disk shredding
3. Overwriting the data on the hard drives with random characters
4. Using a software-based data sanitization method.

Question 38

What is the primary benefit of implementing a security awareness program in an organization?

1. To improve the overall security posture of the org
2. To prevent employees from accidentally leaking sensitive info
3. To ensure compliance with industry regulations
4. To increase employee productivity

Question 39

Which of these types of data destruction would we use to ensure there is no data remanence on our PROM, flash memory, and SSD drives?

1. Overwriting
2. Degaussing
3. Shredding
4. Incinerating

Question 40

Which of the following metrics is the BEST indicator of the accuracy of a biometric system?

1. False acceptance rate
2. Crossing Error Rate (CER)
3. False rejection rate
4. Equal error rate

Question 41

Which of the following is the FIRST principle that should be considered when assessing and implementing secure design principles in network architectures?

1. Confidentiality
2. Integrity
3. Availability
4. Lease privilege

Question 42

Which is the WORST type of security breach for an organization?

1. A data leakage
2. A malware infection
3. A social engineering attack
4. A physical intrusion

Question 43

Which of the following is the MOST important factor to consider when analyzing network device log files for security incidents?

1. The source of the logs
2. The severity of the logs
3. The date and time of the logs
4. The volume of the logs.

Question 44

Which of the following is the FIRST step in responding to a network attack?

1. Notify relevant parties
2. Implement countermeasures
3. Identify the type of attack
4. Shut down the affected network

Question 45

You are the Chief Information Security Officer (CISO) of a large financial organization. Recently, there has been a security incident that was traced back to a group account used by one of the teams within the organization. Given the nature of the group account, it is challenging to identify the individual responsible for the incident. You recognize the risks and challenges of non-repudiation associated with the use of group accounts and need to propose a measure to eliminate this security risk. What is the most effective measure to enhance accountability and non-repudiation in this context?

1. Transition to a system that assigns individual accounts with unique identifies to all employees
2. Provide employees with training on the risks associated with group accounts.
3. Implement regular pwd changes for all group accs.
4. Implement 2-factor auth for all group accs.

Question 46

The finance department is implementing a new system for tracking expenses and needs to make sure that all data is correctly formatted and checked for errors before it is entered into the system. What is the layer of the OSI model that is responsible for providing services to the application layer, such as data formatting and error checking?

1. Transport layer
2. Physical layer
3. Datalink layer
4. Network layer

Question 47

Which of the following cloud computing models is typically considered the easiest to implement?

1. Public cloud
2. Private cloud
3. Community cloud
4. Hybrid cloud

Question 48

Our IT team has noticed a pattern of code injection attacks on our systems, and we need to find a way to disrupt this. Which of the following techniques is used to prevent attackers from successfully executing code injection attacks by randomizing the memory locations where executable code is stored?

1. Encrypting memory
2. Address space layout randomization (ASLR)
3. Input validation
4. Disabling kernel extensions

Question 49

As an IT manager of a growing startup, you’re in charge of creating a framework for handling the data within your company, from the point of acquisition to the point of disposal. Your firm handles a vast amount of personally identifiable information (PII) and sensitive business data. Considering the importance of data security and the potential risks at each stage of the data lifecycle, which of the following would be the best approach to secure the data lifecycle in your organization?

1. Implementing encryption for data at rest, use strong access controls, and ensure secure disposal of data
2. Apply a comprehensive security approach by adopting a mixture of technical administrative, and physical controls throughout the lifecycle.
3. Establish strong firewalls, use IDS, and adopt regular patching
4. Incorporate DLP tools, apply network segmentation, and perform regular vulnerability assessments.

Question 49

We use the CIA triad as a logical model for IT Security and the protection profile our organization wants. What does the A stand for in the CIA triad?

1. Access
2. Availability
3. Authority
4. Authenticity

Question 50

Which of the following is the MOST effective approach to implementing RBAC (Role-Based Access Control) in a large organization?

1. Developing a set of roles based on the tasks and functions performed by individuals within the org.
2. Implementing a single, global role for all employees
3. Assigning roles to individuals based on their job titles.
4. Using a hierarchical approach to role assignment based on individual’s position in the org structure.

Question 51

What is a style sheet language that is used to describe the presentation of a document written in a markup language like HTML (Hypertext Markup Language)?

1. Ruby
2. JavaScript
3. CSS
4. PHP

Question 51

In our software testing, we are doing “Unit testing.” What are we testing?

1. Testing the security of the software system
2. Testing the functionality of the entire software system
3. Testing the compatibility of the software system with other systems
4. Testing individual units or components of the software

Question 52

In our quantitative risk analysis, we are looking at the Annualized Rate of Occurrence (ARO). What does that tell us?

1. The ARO tells us the likelihood of an attack or a breach occuring
2. The ARO tells us the potential impact of an attack or a breach on our org
3. The ARO tells us the severity of the attach or breach in terms of the harm it causes
4. The ARO tells us the average number of attacks or breaches we can expect in a given time period.

Question 52

As the Chief Information Security Officer (CISO) of a large corporation, you have invested significantly in advanced network security systems, including signature-based, heuristic-based, and hybrid IDS/IPS systems. However, you understand that these systems, despite their complexity and capabilities, can sometimes provide incorrect alerts (both false positives and false negatives). You are reviewing these concepts to ensure that your team is well-prepared to handle such situations. What is the best way to understand the concept of false positives and false negatives in the context of Intrusion Detection and Prevention Systems (IDS/IPS)?

1. False positives imply that the IDS/IPS is overly sensitive, and false negatives indicate that the system is not sensitive enough
2. False positives are when the IDS/IPS identifies normal traffic as a threat, and false negatives are when an actual threat is identified as normal traffic.
3. False positives and false negatives relate to the system’s inability to correctly identify 0-day attacks
4. False positives are a sign of ineffective signature-based detection, and false negatives suggest ineffective heuristic-based detection

Question 52

Your company is currently operating at a Capability Maturity Model (CMM) Level 1, often referred to as the “Initial” level, where processes are mostly undocumented and reactive. As the company’s new Chief Information Security Officer (CISO), you’ve been asked to develop a roadmap for the company’s IT Security processes to reach Level 2 or the “Repeatable” level. What is the most crucial step you should take to ensure your company moves from Level 1 to Level 2 in the CMM?

1. Initiate a robust training program for employees to understand IT security protocols
2. Standardize and document basic security processes that are repeatable
3. Invest in advanced security software to prevent potential threats
4. Conduct a company-wide audit to identify all potential security vulnerabilities

Question 52

At the end of our software development project, we are doing interface testing. What are we testing?

1. The security of the software
2. The user experience of the software
3. The compatibility of the software with different OS
4. The interactions between different components of the software systems

Question 52

Which of the following is the BEST method for detecting errors in data transmission?

1. Encryption
2. Parity Check
3. Hash function
4. Cyclic redundancy check (CRC)

Question 53

Which of the following is the FIRST step in the release and deployment process?

1. Build the release and deployment
2. Test the release and deployment
3. Obtain approval for the release and deployment
4. Plan the release and deployment

Question 53

Lupe has been working on our server redundancy, and she is adding parity to the Redundant Array of Independent Disks (RAID) configurations. Why does she do that?

1. To ensure data integrity and fault tolerance in case of disk failure
2. To increase the storage capacity of the system
3. To reduce the number of disks required in the system
4. To improve the speed and performance of the system

Question 53

One of our clients has asked us to review their wireless network security and make recommendations for improving authentication. What protocol is often used in wireless networks to authenticate users before granting access to network resources?

1. RADIUS
2. Kerberos
3. OAuth
4. SSL/TLS

Question 53

Which of the following protocols is the FIRST to be developed for creating Virtual Private Networks (VPNs)?

1. Layer 2 tunneling protocol (L2TP)
2. Internet Protocol Security (IPSec)
3. Secure Sockets Layer (SSL)
4. Point-to-point tunneling protocol (PPTP)

Question 53

As the Chief Information Security Officer (CISO) of a tech company, you have been informed that a startup is infringing on your company’s patented cryptographic algorithm. The patented technology is fundamental to your company’s key product offerings, and unauthorized use could have significant business implications. The infringement could be intentional or unintentional, but you need to decide the best course of action. What is the most appropriate initial step in responding to the suspected patent infringement?

1. Report the infringement to the patent office
2. Reach out to the startup, informing them about the patent and its potential violation
3. Launch an internal investigation to validate the claim before taking further action
4. File a lawsuit against the startup immediately.

Question 54

What is the MOST important principle for implementing a secure network?

1. Implement robust access controls and authentication measures
2. Regularly update antivirus software
3. Use the latest security tools and technologies
4. Conduct regular security assessments and penetration testing

Question 54

Which of the following is the HIGHEST level of risk avoidance in the context of risk management?

1. Avoiding the risk altogether
2. Implementing a contingency plan
3. Accepting the risk and implementing a mitigation plan
4. Transferring the risk to a third party

Question 54

As an IT Security Manager at a global corporation, you’re tasked with enhancing the efficiency of your network infrastructure. Your company currently uses distance vector routing protocols, which are creating efficiency issues due to their focus on the number of hops rather than the quality of the links. Considering the need for an upgrade, you are exploring the idea of shifting to link-state routing protocols. What would be the most compelling reason to transition from distance vector routing protocols to link state routing protocols in your network infrastructure?

1. To change from routing information protocol (RIP) to a newer protocol
2. To better handle the transmission of larger files
3. To reduce the number of hops between source and destination
4. To prioritize the bandwidth and response time over the number of hops.

Question 55

In your organization, there is a major shift in the IT security management hierarchy. As the IT Security Manager, you have been told that you will now report directly to the Chief Information Security Officer (CISO), who will, in turn, report directly to the CEO, not the Chief Information Officer (CIO). The goal of this shift is to ensure an unbiased approach to IT security, separate from the overall IT functions. Why is this change in reporting structure crucial to the organization’s IT security?

1. It reinforces the priority of IT security in the org
2. It reduces the workload of the CIO
3. It promotes faster decision-making in IT security matters.
4. It enhances the transparency of IT security operations

Question 56

As the IT manager of a large corporation, Freja has recently been informed of an increase in security breaches in the company. Upon investigation, she discovered that many employees were using weak passwords and sharing them with others. She has decided to implement a new authentication system to improve security. Which of the following authentication methods would be the most effective in preventing password sharing and strengthening password security?

1. SSO
2. Pwd complexity requirements
3. PWD expiration policies
4. MFA

Question 57

Which of the following is considered the MOST secure method of data destruction?

1. Encrypting files
2. Physical destruction
3. Deleting Files
4. Shredding

Question 58

Which of the following best describes the Graham-Denning model?

1. A model for implementing authentication protocols
2. A model for selecting and implementing security controls
3. A model for identifying security risks and vulnerabilities
4. A model for creating secure communication channels

Question 59

Which of the following is considered the BEST practice for conducting external audits?

1. Conducting the audit during peak business hours
2. Conducting the audit with a small team of auditors
3. Conducting the audit with the participation and cooperation of the auditee
4. Conducting the audit without informing the auditee

Question 59

A hacker successfully infiltrates ThorTeaches.com’s database, stealing sensitive customer information. ThorTeaches.com’s reputation is severely damaged, and they lose a significant amount of business as a result. What is the connection between potential weaknesses in an organization’s information systems and the potential impact on its assets and business objectives?

1. Vulnerabilities decrease the potential risks to an org’s assets and business objectives
2. There is no relationship between vulnerabilities and assets or risks
3. Vulnerabilities have no effect on the potential risks to an org’s assets and business objectives
4. Vulnerabilities increase the potential risks to an org’s assets and business objectives

Question 60

Which of the following is the MOST effective method for conducting a security audit?

1. Conducting the audit in-house
2. Conducting the audit through an automated software program
3. Conducting the audit through a third-party vendor
4. Conducting the audit by hiring a consultant

Question 61

Star-Lord notices that the source code for the Milano’s digital cockpit interface has some unused code and components. These unused components could introduce which type of source-code level security weakness?

1. Cross-site scripting
2. Unnecessary complexity
3. Injection
4. Buffer overflow