CISSP-P1 Flashcards
The CIA triad stands for
Confidentiality Integrity Availability
From a CIA perspective “Access Controls help ensure that only authorized subjects can access objects”
Confidentiality
Integrity
Availability
Confidentiality
From a CIA perspective “Ensures that our data or system configurations are not modified without authorization”
Confidentiality
Integrity
Availability
Integrity
From a CIA perspective “Authorized request for objects must be granted to subjects within a reasonable amount of time”
Confidentiality
Integrity
Availability
Availability
The isc2 code of ethics
P.A.P.A
Protect society, the common wealth, the Infrastructure
Act honorably, honestly, justly, responsibly and legally
Provide diligent and competent service to principals
Advance and protect the profession
Out of these four levels of security policy development which one “offers recommendation”
Security procedures
Security guidelines
Security baselines
Acceptable use policy
Security guidelines
Out of these four levels of security policy development which one offers “detailed step by step”
Security procedures
Security guidelines
Security baselines
Acceptable use policy
Security procedures
Out of these four levels of security policy development which one assigns roles and responsibilities”
Security procedures
Security guidelines
Security baselines
Acceptable use policy
Acceptable use policy
Out of these four levels of security policy development which one defines minimum levels”
Security procedures
Security guidelines
Security baselines
Acceptable use policy
Security baselines
In security planning this pan is categorized as a “Midterm plan developed to provide more details on goals of the strategic plan 1 year”
Strategic
Tactical
Operational
Tactical
In security planning this pan is categorized as a “Long Term, stable plan that should include a risk assessment (5 year with annual updates)”
Strategic
Tactical
Operational
Strategic
In security planning this pan is categorized as a “Short term highly detailed plan based on the strategic and tactical plan”
Strategic
Tactical
Operational
Operational
In the Response to risk category which one of these is defined as “Do nothing, and you must accept the risk and potential loss if threat occurs”.
Risk Rejection
Risk deterrence
Risk avoidance
Risk mitigation
Risk assignment
Risk acceptance
Risk acceptance
In the Response to risk category which one of these is defined as “You do this by implementing a countermeasure and accepting the residual risk”.
Risk mitigation
Risk Rejection
Risk deterrence
Risk acceptance
Risk assignment
Risk mitigation
In the Response to risk category which one of these is defined as “Transfer (assign) to a 3rd party , like by purchasing insurance against damage”.
Risk acceptance
Risk avoidance
Risk Rejection
Risk deterrence
Risk mitigation
Risk assignment
Risk assignment
In the Response to risk category which one of these is “when cost of mitigating or accepting are higher than benefits of the service”.
Risk acceptance
Risk mitigation
Risk avoidance
Risk Rejection
Risk assignment
Risk deterrence
Risk avoidance
In the Response to risk category which one of these is “Implementing deterrents to would be violators of security and Policy”.
Risk acceptance
Risk mitigation
Risk avoidance
Risk deterrence
Risk Rejection
Risk assignment
Risk deterrence
In the Response to risk category which one of these is “An unacceptable possible response to risk is to reject risk or ignore risk”.
Risk acceptance
Risk mitigation
Risk avoidance
Risk deterrence
Risk assignment
Risk Rejection
Risk Rejection
The Seven steps of the risk management framework (NIST 800-37)
People - Prepare or Procure?
Can - Classify or Categorize?
See - Select or Sort?
I - influence or Implement
Am - Authorize or assess”
Always - Authorize or assess?
Monitoring- Monitor or Monitor?
Prepare
Categorize
Select
Implement
Assess
Authorize
Monitor
This type of risk is the risk that remains even with all conceivable safeguards in place.
Residual Risk
Inherent Risk
Total Risk
Residual Risk
This type of risk is newly identified risk not yet addressed with risk management strategies, the amount of risk that exist in the absence of controls
Residual Risk
Inherent Risk
Total Risk
Inherent Risk
Types of risk
Residual = after controls implemented
Inherent = Before controls implemented
Total = Without controls
True
False
True
This type of risk is the amount of risk an organization would face if no safe guards were implemented.
Residual Risk
Inherent Risk
Total Risk
Total Risk
Residual = Before controls implemented
Inherent = Without controls
Total = after controls implemented
True
False
False
Formula for total risk
A. Threats * Vulnerabilities * asset value
B. Threats * Vulnerabilities * ALE
A
Risk is defined as
A. risk= asset * vulnerability
B. risk= threat * vulnerability
B
Which one of these Risk analysis concepts “Assigns a dollar value to evaluate effectiveness of countermeasures?” It is an objective measure.
Qualitative
Quantitative
Quantitative
Risk Analysis steps in quantitative risk analysis?
I - Inventory
IDENTIFIED - Identify
PEOPLE - Perform
ENJOYING -Estimate
RAMBUNCTIOUS - Research
PARTY - Perform
Inventory assets (AV)
Identify Threats (calculate EF and SLE)
Perform a threat analysis (ARO)
Estimate the potential loss (ALE)
Research countermeasures for each threat
Perform a cost benefit analysis
Which one of these Risk analysis concepts “uses a scoring system to rank threats and effectiveness of countermeasures?” It is a subjective measure as it involves opinions, therefore less accurate.
Qualitative
Quantitative
Qualitative
What is the Delphi technique?
A. Uses a scoring system to rank threats and effectiveness of countermeasures
B. Assigns a dollar value to evaluate effectiveness of countermeasures?
C. Anonymous feedback and response process used to arrive at a consensus
C
Threat agents are what caused the threats by exploiting vulnerabilities
True
False
True
In calculating risk this is defined as “Percentage of loss than an organization would experience if a specific asset were violated by a realized risk
EF
In calculating risk this “Represents the cost associated with a single realized risk against a specific asset.”
SLE
Formula for SLE
AV X EF
In calculating risk this is “the expected frequency with a specific threat or risk will occur within a single year.”
ARO
In calculating risk this is “the possible yearly cost of all instances of a specific realized threat against a specific asset.”
ALE
Formula for ALE
SLE X ARO
ALE Example
Office bldg. = 200,000
Hurricane damage estimate 50%
Hurricane probability is one every ten years 10%
(AV X EF = SLE) 200,000 X .50 = 100,000
(SLE X ARO = ALE) 100,000 XS .10 = 10,000
True
ALE Example
Office bldg. = 200,000
Hurricane damage estimate 50%
Hurricane probability is one every ten years 10%
(AV X EF = SLE) 200,000 X 50 = 10,000,000
(SLE X ARO = ALE) 10,000,000 X 10 = 100,000,000
False
Watch that decimal!
In calculating risk a safeguard evaluation means that the security controls are cost effective.
Ale before safeguard - Ale after safeguard - annual cost of safeguard = value of the safeguard
ALE1-ALE2-ACS
True the control cannot cost more than the value of the safeguard, is the safeguard cost effective?
Thread model - S.T.R.I.D.E
STRIDE - Microsoft threat modeling tool
Spoofing
Tampering
Repudiation - attacker can deny participation
Information disclosure
Denial of service
Elevation of privilege
Thread model - At which stage of the pasta model do we perform an “Attack AnalysIs?”
Stage One
Stage Two
Stage Three
Stage Four:
Stage Five:
Stage Six:
Stage Seven:
Stage Six: Attack Analysis
Stage One: Define the Objectives
Stage Two: Define the Technical Scope
Stage Three: Decompose the Application
Stage Four: Analyze the Threats
Stage Five: Vulnerability Analysis
Stage Six: Attack Analysis
Stage Seven: Risk and Impact Analysis
Thread model - At which stage of the pasta model do we “ Decompose the Application?”
Stage One
Stage Two
Stage Three
Stage Four:
Stage Five:
Stage Six:
Stage Seven:
Stage Three: Decompose the Application
Stage One: Define the Objectives
Stage Two: Define the Technical Scope
Stage Three: Decompose the Application
Stage Four: Analyze the Threats
Stage Five: Vulnerability Analysis
Stage Six: Attack Analysis
Stage Seven: Risk and Impact Analysis
Thread model - At which stage of the pasta model do we “ Define the objectives”
Stage One
Stage Two
Stage Three
Stage Four:
Stage Five:
Stage Six:
Stage Seven:
Stage One: Define the Objectives
Stage One: Define the Objectives
Stage Two: Define the Technical Scope
Stage Three: Decompose the Application
Stage Four: Analyze the Threats
Stage Five: Vulnerability Analysis
Stage Six: Attack Analysis
Stage Seven: Risk and Impact Analysis
Thread model - At which stage of the pasta model do we “ Define the Technical Scope”
Stage One:
Stage Two:
Stage Three:
Stage Four:
Stage Five:
Stage Six:
Stage Seven:
Stage Two: Define the Technical Scope
Stage One: Define the Objectives
Stage Two: Define the Technical Scope
Stage Three: Decompose the Application
Stage Four: Analyze the Threats
Stage Five: Vulnerability Analysis
Stage Six: Attack Analysis
Stage Seven: Risk and Impact Analysis
Thread model - At which stage of the pasta model do we “ Analyze the Threats”
Stage One:
Stage Two:
Stage Three:
Stage Four:
Stage Five:
Stage Six:
Stage Seven:
Stage Four: Analyze the Threats
Stage One: Define the Objectives
Stage Two: Define the Technical Scope
Stage Three: Decompose the Application
Stage Four: Analyze the Threats
Stage Five: Vulnerability Analysis
Stage Six: Attack Analysis
Stage Seven: Risk and Impact Analysis
Thread model - At which stage of the pasta model do we perform a “ Vulnerability Analysis”
Stage One:
Stage Two:
Stage Three:
Stage Four:
Stage Five:
Stage Six:
Stage Seven:
Stage Five: Vulnerability Analysis
Stage One: Define the Objectives
Stage Two: Define the Technical Scope
Stage Three: Decompose the Application
Stage Four: Analyze the Threats
Stage Five: Vulnerability Analysis
Stage Six: Attack Analysis
Stage Seven: Risk and Impact Analysis
Thread model - At which stage of the pasta model do we perform a “Risk and Impact Analysis”
Stage One:
Stage Two:
Stage Three:
Stage Four:
Stage Five:
Stage Six:
Stage Seven:
Stage Seven: Risk and Impact Analysis
Stage One: Define the Objectives
Stage Two: Define the Technical Scope
Stage Three: Decompose the Application
Stage Four: Analyze the Threats
Stage Five: Vulnerability Analysis
Stage Six: Attack Analysis
Stage Seven: Risk and Impact Analysis
Treat model V.A.S.T
Visual
Agile
Simple
Threat
Memorize
D.r.e.a.d
Damage potential
Reproducibility
Exploitability
Affected users
Discoverability
Memorize
Trike
Memorize A requirements model
COBIT 5 is based on five principles that are essential for the effective management and governance of enterprise IT
Principle 1: Meeting stakeholder needs
Principle 2: Covering the enterprise end to end
Principle 3: Applying a single integrated framework
Principle 4: Enabling a holistic approach
Principle 5: Separating governance from management
memorize
Access control types fall into one of three categories: administrative, technical, or physical. This control is implemented using software, hardware, or firmware that restricts logical access on an IT system. Examples include firewalls, routers, encryption, etc.
- Administrative (also called directive)
- Technical
- Physical
Technical
Access control types fall into one of three categories: administrative, technical, or physical. This control is implemented by creating and following organizational
policy, procedure, or regulation. User training and awareness also fall into this category.
- Administrative (also called directive)
- Technical
- Physical
Administrative (also called directive)
Access control types fall into one of three categories: administrative, technical, or physical. This control is implemented with devices, such as locks, fences, gates, and security guards
- Administrative (also called directive)
- Technical
- Physical
Physical
This type of access control prevent actions from occurring. It applies restrictions to what a potential user, either authorized or unauthorized, can do. An example of an this control is a preemployment drug screening. It is designed to prevent an organization from hiring an employee who is using illegal drugs
Corrective
Preventive
Compensating
Detective
Deterrent
Recovery
Preventive
This type of access control sends alerts during or after a successful attack. Examples of this control are intrusion detection systems that send alerts after a successful attack, closed-circuit television cameras that alert guards to an intruder, and a building alarm system that is triggered by an intruder
Corrective
Preventive
Compensating
Detective
Deterrent
Recovery
Detective
This type of access control works by “correcting” a damaged system or process. This access control typically works hand in hand with detective access controls. Antivirus software has both components. First, the antivirus software runs a scan and uses its definition file to detect whether there is any software that matches its virus list. If it detects a virus, this control takes over and either places the suspicious software in quarantine or deletes it from the system
Corrective
Preventive
Compensating
Detective
Deterrent
Recovery
Corrective
This type of access control means after a security incident has occurred, we may need to restore the functionality of the system and organization. This control means that the system must be restored, which involves reinstallation from OS media or image, data restored from backups, etc
Corrective
Preventive
Compensating
Detective
Deterrent
Recovery
Recovery
This type of access control deter users from performing certain actions on a system. One example is a “Beware of Dog” sign; a thief encountering two buildings, one with guard dogs and one without, is more likely to attack the building without guard dogs. Another example is large fines for drivers who speed. This control is a sanction policy that makes users understand that they will be fired if they are caught surfing illicit or illegal websites
Corrective
Preventive
Compensating
Detective
Deterrent
Recovery
Deterrent
This type of access control is an additional security control put in place to compensate for weaknesses in other controls
Corrective
Preventive
Compensating
Detective
Deterrent
Recovery
Compensating
This law pertains to those laws where the victim can be seen as society itself. While it might seem odd to consider society the victim when an individual is murdered, the goal of criminal law is to promote and maintain an orderly and law-abiding citizenry. This law can include penalties that remove an individual from society
by incarceration or, in some extreme cases in some regions, death. The goals of this law are to deter crime and to punish offenders. Due to the severity of depriving criminals of either freedom or their lives, the burden of proof in criminal cases is beyond any reasonable doubt
Civil law
Liability
Criminal law
Administrative law
Criminal law
In addition to this law being a major legal system in the world, it also serves as a type of law within the common law legal system. Another term associated with this lawis tort law, which deals with injury (loosely defined), resulting from someone violating their responsibility to provide a duty of care. Tort law is the primary component of this law, and it is the most significant source of lawsuits that seek damages. In the United States, the burden of proof in a criminal court is beyond a reasonable doubt, while the burden of proof in civil proceedings is the preponderance of the evidence. “Preponderance” means more likely than not. Satisfying the burden of proof requirement regarding the preponderance of the evidence in a civil matter is
much easier than meeting the burden of proof requirement in criminal proceedings.
Civil law
Liability
Criminal law
Administrative law
Civil law
This law also known as a regulatory law is law enacted by government agencies. The executive branch (deriving from the Office of the President) enacts this law in the United States. Government-mandated compliance measures are these laws. Some examples of this law are FCC regulations, Health Insurance Portability and Accountability Act (HIPAA) security mandates, FDA regulations, and FAA regulations
Civil law
Liability
Criminal law
Administrative law
Administrative law
Is another important legal concept for information security professionals and their employers. Society has grown quite litigious over the years, and the
question of whether an organization is legally liable for specific actions or inactions can prove costly. Questions of liability often turn into questions regarding potential negligence. When attempting to determine whether certain actions or inactions constitute negligence, the Prudent Man Rule is often applied
Civil law
Liability
Criminal law
Administrative law
LIABILITY
This law is the 1st major piece of US Cybercrime specific legislation
Copyright and the Digital Millennium Copyright Act
Federal Information Security Management Act (FISMA)
Federal Sentencing Guidelines
Computer Fraud and Abuse Act
Computer Fraud and Abuse Act
This law provides punishment guidelines to help federal judges interpret computer crime laws
Copyright and the Digital Millennium Copyright Act
Federal Information Security Management Act (FISMA)
Federal Sentencing Guidelines
Computer Fraud and Abuse Act
Federal Sentencing Guidelines
This law Required a formal Infosec operations for federal government
Copyright and the Digital Millennium Copyright Act
Federal Information Security Management Act (FISMA)
Federal Sentencing Guidelines
Computer Fraud and Abuse Act
Federal Information Security Management Act (FISMA)
This law covers literary, musical and dramatic works
Copyright and the Digital Millennium Copyright Act
Federal Information Security Management Act (FISMA)
Federal Sentencing Guidelines
Computer Fraud and Abuse Act
Copyright and the Digital Millennium Copyright Act
Are associated with marketing, allows for the creation of
a brand in order to distinguish the source of products or services. A name, logo, symbol, or image represents the most common items. In the United States, there are two different symbols that are used by an individual or organization in order to protect distinctive marks.
Trade Secrets
Trademark
Licenses
Copyright
Patent
Trademark
Provide a monopoly to the holder regarding the right to use, make, or sell an invention for a period of time in exchange for the holder’s promise to make the invention public. During the life of this item the holder can, through the use of civil litigation, exclude others from leveraging the invention.
Patent
Represents a type of intellectual property that protects the form of expression in artistic, musical, or literary works and is typically denoted by the circled c
symbol, It’s purpose is to preclude unauthorized
duplication, distribution, or modification of a creative work. Note that it is the form of expression that is protected, not the subject matter or ideas represented
Trade Secrets
Trademark
Licenses
Copyright
Patent
Copyright
Are a contract between a provider of software and the consumer. Though there are types of these that provide explicit permission for the consumer to do virtually anything with the software, including modifying it for use in another commercial product, most commercial of this type provides explicit limits on the use and distribution of the software. EULAs, are an unusual form of contract because using the software typically constitutes contractual agreement, even though a small minority of users read the lengthy EULA
Trade Secrets
Trademark
Licenses
Copyright
Patent
Licenses
Are business-proprietary information that is important to an organization’s ability to compete. The organization must exercise due care and due diligence in the protection of these artifacts. Noncompete and nondisclosure agreements are two of the most common protection methods used.
Trade Secrets
Trademark
Licenses
Copyright
Patent
Trade secrets
4 types of licensing
Contractual
Shrink Wrap
Click Through
Cloud Services
Memorize
HIPPA
HITECH - health information Technology for economic and clinical Health
Gramm-Leach- Biley Act
Coppa - Children’s online privacy protection act
ECPA - Electronics communications Privacy Act
CALEA - Communications Assistance for Law Enforcement Act
Memorize
Due care is doing what a reasonable person would do in a given situation. It is sometimes called the “prudent man” rule. The term is derived from “duty of care”; for example, parents have a duty to care for their children. Due diligence is the management of due care.
Due care and due diligence are often confused; they are related, but there is a difference between them. Due care is informal, while due diligence follows a process.
Think of due diligence as a step beyond due care. For example, expecting your staff
to keep their systems patched means that you expect them to exercise due care, while verifying that your staff has patched their systems is an example of due diligence.
Memorize
Consists of tangible or physical objects. A knife or bloody glove might constitute real evidence in some traditional criminal proceedings.
Direct evidence
Hearsay evidence
Real Evidence
Corroborative evidence
Circumstantial evidence
Secondary evidence
Real Evidence
Is testimony provided by witnesses regarding what they actually experienced through their five senses.
Direct evidence
Hearsay evidence
Real Evidence
Corroborative evidence
Circumstantial evidence
Secondary evidence
Direct evidence
Circumstantial evidence serves to establish the circumstances related to particular points or other evidence.
Direct evidence
Hearsay evidence
Real Evidence
Corroborative evidence
Circumstantial evidence
Secondary evidence
Circumstantial evidence
Corroborative evidence provides additional support for a fact that might have been called into question.
Direct evidence
Hearsay evidence
Real Evidence
Corroborative evidence
Circumstantial evidence
Secondary evidence
Corroborative evidence
Constitutes second-hand evidence. As opposed to direct evidence, which is witnessed using any of the five senses, involves indirect information.
Direct evidence
Hearsay evidence
Real Evidence
Corroborative evidence
Circumstantial evidence
Secondary evidence
Hearsay evidence
Consists of copies of original documents and oral descriptions. Computer-generated logs and documents might also constitute this type of evidence rather than best evidence.
Direct evidence
Hearsay evidence
Real Evidence
Corroborative evidence
Circumstantial evidence
Secondary evidence
Secondary evidence
A digital rights management solution can be used for:
Protection of intellectual property
Protection of digital real estate
Protection from digital squatting
Protection of digital assets
Protection of intellectual property
Which of the following statements is not correct concerning contingencies?
The recovery time objective must be less than the maximum allowable downtime
The recovery point objective is not a preference
The maximum allowable downtime cannot be exceeded
The recovery time objective is a preference
The recovery point objective is not a preference
The Maximum Allowable Downtime (MAD) also known as the Maximum Tolerable Downtime (MTD), and also a Maximum Allowable Outage (MAO) is the amount of time that the business can be disrupted before the organization dies. The Recovery Time Objective (RTO) is the target time set for recovering from an interruption. The recovery point objective (RPO) is how much data can be lost before the organization dies.
If 12 yachts are worth $5 million each, pro-rated slippage fees are $1,000 per year, and damage that can be incurred is $20,000 per boat, what does the value of 0.4% represent?
The Exposure Factor of a single loss in relation to the total of all asset values
The Annualized Loss Expectancy from the exposure factor of one asset
The exposure factor of an annualized loss expectancy
The Annualized rate of occurrence from a single loss in relation to the total of all assets
The Exposure Factor of a single loss in relation to the total of all asset values
This question is looking to see if you know the difference between AF, EF, ALE, ARO, and SLE in a non-standard context. EF in the context of the available choices would be 20K divided by 5 million, not 240,000 divided by 60 million. Try to ignore the additional information that was intentionally thrown into the options (“in relation to…”)
The realization of a risk results in:
The exploitation of a vulnerability
The weakening in layers of defense
Any potential threats becoming stronger
The possible accumulation of weaknesses
The exploitation of a vulnerability
Vulnerability is a weakness, or lack of a safeguard. A safeguard is a control; a threat is something that can take advantage of the vulnerability.
If a company has limited funding and assigns a single employee to be responsible for creating the security policy, standards, procedures, and to participate in source code writing, forensic investigations, and firewall request, which of the following statements is most correct?
The company should consider separating some the employee’s duties
The company is violating the principle of least privilege by giving the employee too many job duties
The employee should not have this many job duties unless they are clearly articulated in the job description.
The employee should verify with management whether there are too many responsibilities
The employee should not have this many job duties unless they are clearly articulated in the job description.
Least privilege has to do with access. While the other responses are good, the MOST correct statement is that he shouldn’t have such duties unless they are articulated in his job description.
Which of the following could be an issue with the business impact analysis?
User error issues
The BIA has many vulnerabilities that could be exploited by an administrative process
The asset values contained therein might be nominal values to one particular area
The analysis is ongoing and never viewed as complete by the business owners
The asset values contained therein might be nominal values to one particular area
Ideally the BIA will contain mostly accurate asset values rather than nominal values that one particular area of the business presumes.
The difference between training and awareness is:
Training seeks to educate, awareness seeks to remind
Training is informal, awareness is semi-formal
Training helps change employee behavior, awareness prevents it
One is more formal than the other
Training seeks to educate, awareness seeks to remind
As presented in Domain 1, education is more formal, offered by an accredited organization and results in a degree or certification. This can be through an accredited college, or official training program. Training is semi-formal, typically offered by employers, it can be documented & tracked, occurs during employment, and may be required by law or industry/regulator policy. Awareness is the effort to make employees aware of security requirements. It is informal, unscheduled, not required, and consists of reminders and encouragement, typically in the form of email reminders, security posters, team meeting discussions, conference call presentation, in-person presentations and guest speaker presentations.
The Wassenar Agreement is primarily known its position on what?
The import/export of encrypted files
The import/export of cryptographic software and hardware
The import/export of block cipher technology
The import/export of non-approved cryptosystems
The import/export of cryptographic software and hardware
Which of the following would be a violation of the ISC2 code of ethics?
Monitoring contents of a hard drive from an executive manager you don’t like and who has bullied you in the past. You conduct this activity only after receiving explicit e-mail instructions from the chief information officer.
Conducting dictionary attacks on competitor website accounts at work; this type of attack is documented as part of your job duties under the category of “ethical hacking activities” to conduct on your company’s website.
Using a rainbow table to steal credentials from employees as part of internal penetration testing activities. While this activity is not explicitly stated in your job description, you are part of the pentest team, and management has directed you to perform this activity while your co-worker is out sick.
Sniffing the internet activity conducted on your home router after you suspect that an unauthorized individual is connecting to it in order to stream movies online.
Conducting dictionary attacks on competitor website accounts at work; this type of attack is documented as part of your job duties under the category of “ethical hacking activities” to conduct on your company’s website.
According to the ISC2 code of conduct, the (ISC)2 member is expected to do the following:
1. Protect society, the common good, necessary public trust and confidence, and the infrastructure.
2. Act honorably, honestly, justly, responsibly, and legally.
3. Provide diligent and competent service to principals.
4. Advance and protect the profession.
If your activities are not authorized you would be violating the second and third tenets of the code of conduct (acting justly and legally responsible; providing diligent and competent service). Conducting dictionary attacks on competitor websites would violate these tenets (because it is not authorized by your job description).
Public domain software typically refers to which of the following?
Free to use including any modifications but support and extra features are not free
Download requires registration but the software can be used for any purpose
Modifications are free to use, but extra support and use are not featured
Free to download including any support, but features and modifications include installation
Free to use including any modifications but support and extra features are not free
What can executive management do with an identified risk?
Accept, transfer, avoid, protect according to the risk value
Mitigate, accept, transfer, abandon the activity
Transfer, postpone, avoid, mitigate to an acceptable level
Accept, ignore, transfer, verify its accuracy
Mitigate, accept, transfer, abandon the activity
Abandon the activity” is the same as to avoid the risk. If you struggled with this question.
Which of the following is not a privacy law tenet?
Notification
Scope
Limitation
Accountability
Accountability
Accountability is not a tenet of privacy law, however it does apply to data ownership responsibility.
A hacker gains access to a device on the network and is able to intercept transmissions, however the transmissions are encrypted. Which of the following is most likely a deterrent for the hacker?
The use of shielded twisted pair
Work factor in breaking the algorithm
The use of fiber optics
The difficulty of capturing packets
Work factor in breaking the algorithm
Which of the following statements is most true?
Education about security is the best way to change employee behavior
Non-Disclosure Agreements prevent employees from divulging sensitive information
Policy sets the foundation for the organizational culture
Procedures ensure that tasks are performed according to standards
Procedures ensure that tasks are performed according to standards
Knowledge needed:
Candidates need to be aware of the difference between policies, standards, procedures, and guidelines.
Policy – should have the following components:
-High level overview of security strategy or goals
-Contains data classifications (confidential, sensitive, etc.)
-Type of access management (whether role-based, etc.)
-Expected user behavior with the entity’s IT systems and data
-High level personnel security practices, such as background checks
Standard – should have the following elements:
-Can come from statutory/administrative law, professional organizations, or industry groups
-Describes settings, expectations of performance, configurations, specific requirements
Guidelines – contain recommendations and suggestions, but they are not required.
Procedures – contain specific, repeatable steps; very task-oriented.
Alex is a security practitioner of a cloud services provider whose customers have selected NIST 800-53 as the security framework. During an internal review, Alex discovers that none of the security controls have been applied to the baseline configuration. Alex has observed:
That non-compliance could be occurring, and that due practice has not been achieved.
That the company could be liable under the prudent person rule.
That this is a potentially reportable security incident, and should be investigated or
researched further.
That the company has not practiced due diligence.
That the company could be liable under the prudent person rule.
Explanation:
This question may be especially challenging since it has multiple correct or incorrect answers, depending on how you interpret it. The best approach with questions like this is to rate each response according to which one would be better than the other. Whichever response has the better rating should be the answer you select.
Knowledge needed:
Due diligence involves the research and preparation, whereas due care (aka “prudent person”) applies to the actions afterward. This would not constitute a security incident (however it could lead to a security incident). Not applying the selected security framework could make the company liable under the prudent person rule. There is no such thing as due practice.
Which of the following statements is correct concerning contingencies?
The recovery objectives overall must be stated in the policy
The recovery point objective must be more than the maximum allowable downtime
The recovery time objective must be less than the maximum allowable downtime
The recovery objectives overall must be decided by functional management
The recovery time objective must be less than the maximum allowable downtime
RTO is a preference, MAD cannot be exceeded, otherwise the business cannot continue.
Executive management publishes an official email that describes what could happen to an employee who willingly violates the information security policy. This email can most likely be considered:
A standard derived from policy
Part of training & awareness
A guideline rather than a procedure
A reminder to all employees
Part of training & awareness
Knowledge needed:
Awareness is the effort to make employees aware of security requirements. It is informal, unscheduled, not required, and consists of reminders and encouragement, typically in the form of email reminders, security posters, team meeting discussions, conference call presentation, in-person presentations and guest speaker presentations.
Policy – should have the following components:
- High level overview of security strategy or goals
- Contains data classifications (confidential, sensitive, etc.)
- Type of access management (whether role-based, etc.)
- Expected user behavior with the entity’s IT systems and data
- High level personnel security practices, such as background checks
Procedures contain specific, repeatable steps; very task-oriented.
Standards should have the following elements:
- Can come from statutory/administrative law, professional organizations, or industry groups
- Describes settings, expectations of performance, configurations, specific requirements
Guidelines – contain recommendations and suggestions, but they are not required.
Which of the following is most likely not something to use as input into a business impact analysis?
The results of a financial audit that are not current
A hybrid survey focused on both employee and customer varying opinions
An external survey focused on overly-negative customer opinions
An internal survey focused on overly-positive employee opinions
The results of a financial audit that are not current
The type of opinions is irrelevant when conducting surveys in a BIA. An old financial audit does not capture variances in the asset values, thus would not be used as input for a BIA.
Which of the following would not be considered intellectual property?
Unreleased music
Unreleased movie script
Software source code
None of the above
None of the above
Correct
all of these are intellectual property
Contingency operations are concerned with:
Ensuring that profits rendered from current activities continue without disruption
Ensuring that existing operations do not fail without appropriate safeguards
Ensuring that recovery objectives are met and set appropriately
Ensuring that the critical path continues despite or without disruption
Ensuring that the critical path continues despite or without disruption
Correct
Critical path is synonymous with mission criticality. Profits may or may not be part of the critical path. The other two options are not optimal because they are concerned with management decisions and recovery rather than continuity.
Which of the following is not a privacy law tenet?
The subject should be told at the time their data is collected or created
The data should be collected for a specific, legal, and ethical purpose
The data can be shared with others
The subject’s information should only be retained as long as it’s needed
The data can be shared with others
Explanation:
This question may be especially challenging since it asks the question in roundabout way. These questions are presented with statements like “which of the following is NOT”, which is misleading for those of us who are quick readers. The best approach with questions like this is to rephrase the question in your mind, and turn it into something like “all of these are good options EXCEPT” and then find the choice that doesn’t fit.
Knowledge needed:
Dissemination refers to the tenet that data should not be shared with others. Here is the mnemonic to use that can help memorize the general privacy tenets presented in the Common Body of Knowledge, but keep in mind ISC2 has added the GDPR privacy tenets as well, which are slightly different. Here is the mnemonic for the general tenets: “PLS (please) Acquire or Reveal Some DoNuts”. These are intentionally out of order from your book(s) to make memorization easier:
- Participation – the data subject should have the option to opt in or opt out.
- Limitation – data can only use it for the purpose stated.
- Scope – there must be a specific purpose (and it must be legal/ethical), the scope should be include in the notification.
- Accuracy – the data must be as accurate as possible, and the data subject should be able to make corrections.
- Retention – the data should be kept only as long as it’s needed.
- Security – the custodian must protect the data.
- Dissemination – the custodian must not share the data without notifying the data subject.
- Notification – must notify the user that you’re collecting and creating their data before it’s used, should include purpose of use
If twelve yachts are worth five million each with a slippage fee of $1,000 and can incur $20,000 of damage per disaster, what would $240,000 represent if disasters occur once every three years?
Exposure factor
Asset value
Cost of risk mitigation
Single loss expectancy
Single loss expectancy
Correct
Explanation:
This question may be especially challenging since it contains irrelevant information. The best approach with questions like this is to take your time in reading the question and available responses a few times to identify the irrelevant information. This will help you to understand what the question is really asking.
Knowledge needed:
Single loss expectancy is the correct answer since this is a dollar amount (20,000 x 12). The Risk Measurement Model from Domain 1 is outdated according to ISC2 and is based on a physical security model, but they are still holding tight to these concepts. Asset Value (AV) is of course the asset’s value, exposure factor (EF) is the percent of the asset that can be lost from a certain event, single loss expectancy (SLE) is the AV x the EF, measured in money; the annual rate of occurrence (ARO) is how many times in a year the event occurs, typically a decimal but it can be more; the Annual loss expectancy (ALE) is the SLE x ARO, which shows how much the business is currently losing without implementing safeguards. If the safeguards are cheaper than the ALE, it’s best to implement the safeguards.
If social engineering is used to gain access to a restricted area, upon which an individual logs into a server but does not have sufficient permissions to access data, which statement is most true if the security settings log the user activity, send it to an appliance for analysis, and alert the information security officer of the activity?
The sensitive data has sufficient controls to protect it.
The alert is a compensating control in the absence of other controls.
The audit logs are administrative controls.
The audit logs are preventive controls.
The alert is a compensating control in the absence of other controls.
Incorrect
Compensating controls only exist in the absence of other, more efficient controls.
Marco works for the University of Law whose CIO requests information on how frequently earthquakes have occurred within the area so that a risk assessment can be performed. What metric should Marco present to the CIO as input for the risk assessment?
Exposure factor of earthquakes in the area
Exposure factor of earthquakes worldwide
The annualized rate of earthquake occurrence for the area
The annualized loss expectancy from any given local earthquake
The annualized rate of earthquake occurrence for the area
This question may be especially challenging since it takes concepts from the Common Body of Knowledge and applies them to a realistic scenario. The best approach with questions like this is to try and identify which concept you are being quizzed on, which you can do by reading both question and available options slowly. It may take several times before you fully understand what the question is asking. Try not to rush in the real exam, and be patient with yourself.
Knowledge needed:
The Risk Measurement Model from Domain 1 is outdated according to ISC2 and is based on a physical security model, but they are still holding tight to these concepts. Asset Value (AV) is of course the asset’s value, exposure factor (EF) is the percent of the asset that can be lost from a certain event, single loss expectancy (SLE) is the AV x the EF, measured in money; the annual rate of occurrence (ARO) is how many times in a year the event occurs, typically a decimal but it can be more; the Annual loss expectancy (ALE) is the SLE x ARO, which shows how much the business is currently losing without implementing safeguards. If the safeguards are cheaper than the ALE, it’s best to implement the safeguards.
A possible difference between a contractual mandate and a regulatory mandate is:
Regulatory mandates may have stronger consequences
Contractual mandates have stronger incentives
Regulatory mandates do not have financial incentives
Contractual mandates are derived from regulatory mandates
Regulatory mandates do not have financial incentives
This is a convoluted way of saying that contractual mandates do have financial incentives.
Which of the following would most likely not be considered intellectual property?
A work that is not registered with a copyright organization
A work that is published to the web and available for the public to see
A work that is in the public domain without the knowledge of the original author
A work that is given by the author into the public domain
A work that is given by the author into the public domain
Correct
Public domain works, as long as they are given as such by the creator, are not considered intellectual property and do not need to be protected.
If twelve yachts are worth 60 million total and the damage per boat from a hurricane is $20,000, and hurricanes occur once every three years, what does the value 0.33 represent?
Rate of expected loss
Rate of loss expectancy
Rate of asset valuation
Rate of annualized occurrence
Rate of annualized occurrence
Correct
This question is looking to see if you know the difference between AF, EF, ALE, ARO, and SLE. While this is not worded exactly correct, ARO is the correct answer even though it rearranges the words to throw you off.
Which of the following would not be a component of an acceptable use policy?
Password requirements for the company’s systems
Disclosure requirements for employees who handle sensitive data
Email and internet use guidelines for onsite vendors
The company’s system usage guidelines for applications that process public data
Password requirements for the company’s systems
Password requirements for systems are typically part of requirements identified during the SDLC. All other options would be included in the policy even though they are worded slightly different than your book may have presented them.
Which of the following could be an issue with the business impact analysis?
The asset values contained therein might be nominal values to one particular area
User error issues
The analysis is ongoing and never viewed as complete by the business owners
The BIA has many vulnerabilities that could be exploited by an administrative process
The asset values contained therein might be nominal values to one particular area
This question may be especially challenging since it does not have enough information to make a good choice with the available options (the question is vague or ambiguous). The best approach with questions like this is to either think through the process to what the eventual outcome or missing component might be, or to give the available options a rating to see which one is CLOSEST to being the right answer.
Knowledge needed:
Ideally the BIA will contain mostly accurate asset values rather than nominal values that one particular area of the business presumes.
Privacy Law Tenet
- Participation – the data subject should have the option to opt in or opt out.
- Limitation – data can only use it for the purpose stated.
- Scope – there must be a specific purpose (and it must be legal/ethical), the scope should be include in the notification.
- Accuracy – the data must be as accurate as possible, and the data subject should be able to make corrections.
- Retention – the data should be kept only as long as it’s needed.
- Security – the custodian must protect the data.
- Dissemination – the custodian must not share the data without notifying the data subject.
- Notification – must notify the user that you’re collecting and creating their data before it’s used, should include purpose of use
Non-Disclosure Agreements prevent employees from divulging sensitive information
Procedures ensure that tasks are performed according to standards
Education about security is the best way to change employee behavior
Policy sets the foundation for the organizational culture
Procedures ensure that tasks are performed according to standards
Knowledge needed:
Candidates need to be aware of the difference between policies, standards, procedures, and guidelines.
Policy – should have the following components:
-High level overview of security strategy or goals
-Contains data classifications (confidential, sensitive, etc.)
-Type of access management (whether role-based, etc.)
-Expected user behavior with the entity’s IT systems and data
-High level personnel security practices, such as background checks
Standard – should have the following elements:
-Can come from statutory/administrative law, professional organizations, or industry groups
-Describes settings, expectations of performance, configurations, specific requirements
Guidelines – contain recommendations and suggestions, but they are not required.
Procedures – contain specific, repeatable steps; very task-oriented.
The disallowance of unfair trade practices might be an example of:
Code of ethics
Policy
Standard
Procedure
.
Code of ethics
While this is a specific directive, you have to think about where it would fit within the given options (don’t assume too much) – in this case an organizational code of ethics would be the best fit.
Marco works for the University of Law whose CIO requests information on how much damage would be done to the campus if an earthquake occurred. What metric should Marco present to the CIO as input for the risk assessment?
Exposure factor from an earthquake
Annualized cost of mitigation of an earthquake
Single loss expectancy from an earthquake
Annual loss expectancy from earthquakes in the area
Exposure factor from an earthquake
ALE is the amount of loss the company currently experiences, single loss expectancy is the loss from a single instance, and annualized cost of mitigation is not a concept in the CBK.
Who is ultimately responsible for security?
Policy as written by upper and executive management
Executives who are not directly interacting with staff carrying out the program
Employees who have delegated authority from executives
Everyone in the organization, at the direction of executives
While many organizations state that all employees are responsible, such a directive can only come from executive management.
Executives who are not directly interacting with staff carrying out the program
While many organizations state that all employees are responsible, such a directive can only come from executive management.
If a mannequin is placed at the front desk to look like a security guard and the facility also has dim lighting, a fenced perimeter, and an alarm system, which of the following statements is most true?
The mannequin is a preventive control.
The fence is a compensating control.
The mannequin represents a mitigation.
The mannequin is a vulnerability.
Since the lack of a guard is a vulnerability, the other controls are compensating.
The fence is a compensating control.
Since the lack of a guard is a vulnerability, the other controls are compensating.
Barney is the front desk security guard and has called in sick for his night shift. He is the only guard willing to work the night shift since the other guards have small children and family duties. Due to separation of duties, your CIO won’t let you fill in for Barney, but instructs you to take one of the mannequins from storage and dress it up in security guard clothing and prop it at the guard desk for the night. Due to the dim lighting inside, a fenced perimeter, and an alarm system, the CIO felt okay with giving you this directive. Which of the following statements is most true?
The mannequin represents a mitigation
The fence is a compensating control
The mannequin is a deterrent control
The mannequin is a vulnerability
The mannequin is a deterrent control
This question tries to confuse you with too much information in the beginning. Since the lack of a guard is a vulnerability, the mannequin would deter an attacker from breaking in.
What is the best description of governance?
The process of how an organization is managed
The security of an organization within a company
The management of various processes and procedures
The process of managing security policies to influence behavior
The process of how an organization is managed
Your CIO instructs you to perform a risk analysis on an issue that the company’s failover site is currently experiencing. Employees at the site often disagree with information security principles, and the CIO’s vision due to lack of education and training. There is limited-to-no information on asset values due to the failover site losing its accounting records in a fire last year, and the company’s data mostly consisting of intellectual property that hasn’t been released yet. What is the best approach to this situation?
Take a subjective approach to risk analysis
Take a hypothetical approach to risk analysis
Take a hybrid approach to risk analysis, combining quantitative and qualitative methods
Take an objective approach to risk analysis
Take a subjective approach to risk analysis
“Subjective” means that something is based on opinions or feelings, and is the description of “qualitative”. This is the best approach due to the lack of numeric values and un-quantifiable metrics.
Astrotek Company has just experienced an unexpected outage of both the primary site and the mirror site. The duration of this outage has been declared to be at least three weeks. As you begin to examine the contingency plan, what is the first category of items you should look for?
Recovery steps to the hot site within the given recovery time objective
Reconstitution steps to the cold site within the recovery point objective
Reconstitution steps to the warm site that exceed the maximum allowable downtime
Recovery steps to the alternate site within the recovery time objective
Recovery steps to the alternate site within the recovery time objective
Alternate site (could be warm or cold) within the RTO is the best choice here, given that we don’t have more details. The other options mix terminology to confuse you. A hot site is the same as mirror.
What is the best recommendation for a risk assessment wherein 12 yachts are valued at 5 million each, hurricanes cause $20,000 worth of damage per boat, and typically occur once every three years?
The annualized rate of occurrence drops to 0.32%
Purchase insurance if the annualized loss expectancy for each boat exceeds the cost of the annualized rate of insurance.
The total cost of insurance for each boat is $100,000.
Purchase insurance if the single loss expectancy for each boat exceeds the cost of the annualized rate of insurance.
Purchase insurance if the annualized loss expectancy for each boat exceeds the cost of the annualized rate of insurance.
Remember that the ALE is what’s currently being experienced, thus the cost to transfer the risk (insurance) must be less than the ALE.
A site license means:
All staff at one location can use the software, regardless of the number
All staff for one business can use the software, regardless of the number
All staff at one location can use the software, regardless of the number of companies
All individuals can use the software at a specific location, as long as they agree to the terms
All staff at one location can use the software, regardless of the number
Which of the following is a list of assets that also shows criticality?
Business impact analysis
Asset classification inventory
Privacy impact analysis
Software inventory
Business impact analysis
Which of the following would be an efficient method of evaluating the effectiveness of a Security, Education, Training and Awareness (SETA) program?
A logging mechanism that shows which employee took the training with date and time stamp, and average outcomes.
Gamification that includes difficult quizzes for employees to complete within the training modules.
Games, quizzes, and prizes included with the module to make the SETA activities fun and engaging.
Embedded security games within the training that feed user scores into a separate data analytics system.
Embedded security games within the training that feed user scores into a separate data analytics system.
One of the key words in this question is “evaluating”. Hold on to that word as you read through the options to determine which of the options is the best option. While the question itself doesn’t ask you to find the “best option”, you should assume that’s the case with all questions. Gamification, while fun and engaging, is useless in evaluating the training’s effectiveness unless scores can be viewed and evaluated by management.
Which of the following is not an example of governance?
Regulations dictating who can make decisions
A formalized decision making policy that involves board members
The business owner arbitrarily made the decision not to purchase and install a layer 3 switch
The security officer conducting in-person training to board members
The security officer conducting in-person training to board members
This is almost a giveaway question, but could be challenging since it presents real-world scenarios. If you understand what governance is, the key word “decision” should stand out in all the options here. Also, note how the question uses the phrase “is not”, in which case you should, by now, be able to flip the wording in your mind by saying “all of these are examples EXCEPT…” and hopefully arrive at the right answer.
What could be a problem with the Traditional/Loss Expectancy risk assessment model taught in the Common Body of Knowledge?
It is more of a corrective approach rather than preventive
Unrealistic vulnerability identifications, standard compensating controls that prevent future loss expectancy capabilities, and more emphasis on application security
It is more of a qualitative approach rather than quantitative
Unrealistic single loss expectancies, standard quick remediations that prevent future occurrences, and it may be more suitable to physical security
Unrealistic vulnerability identifications, standard compensating controls that prevent future loss expectancy capabilities, and more emphasis on application security
This is part of the CBK that is hidden within the pages of the risk management module. Pay special attention to these sections as they often have important information for the exam.
Before any penetration test activities are performed, what must be considered?
Management approval
Potential impact to organizational assets
Potential impact to asset values
Management oversight
Potential impact to organizational assets
Ambiguous questions can be difficult. Two key words are “performed” and “considered” – management decisions have already been made if you are “performing” pentest activities. Make sure you understand the question completely before choosing an answer.
Security is most likely considered which of the following?
An operations function
A compliance function
A support function
A governance function
A support function
Remember that the purpose of security is to support the organizational mission/goals.
What is the entirety of policies, roles, and processes that an organization uses to make security decisions?
Governance
Incident management
Organizational culture
Security governance
Security governance
“Security decisions”
Which of the following is an aspect of governance?
The process of how a decision is made
The process of how employees behave
The incident response process
The divestiture process
The process of how a decision is made
Which of the following might not apply to third-party assessors?
Employment agreements
Service level agreements
Organizational policies
Non-disclosure agreements
Employment agreements
Since the third-party is not an employee, an employment agreement would not apply to this situation.
Your organization is evaluating whether to adopt a three-step photoelectric cell analysis process for more accurate smoke detection, or a one-step process for quicker detection. What risk perspective is being utilized?
Asset-based
Process-based
Vulnerability-based
Outcomes-based
Process-based
Knowledge needed:
Safety critical activities can frequently be the focus of process-based risk perspectives. As the title suggests, processes are the primary focus of process-based risk analysis.
Which of the following is not a security control framework?
ISO 27002
COBIT
GDPR
NIST RMF
GDPR
Who most likely makes the final decision on what a company’s potential asset values might be?
Functional management
Senior management
Accounting staff
Line supervisors
.
Senior management
Line supervisors are typically concerned with day-to-day supervision tasks, whereas functional management has a better perspective on what the asset values might be. Senior and Executive management would make the final decision while taking into consideration the input of functional management
A control that imposes a mandate is also known as:
Detective
Dispensive
Deterrent
Directive
Directive
Which of the following is not a physical vulnerability?
First floor data center with a planned floor raising project
Humidified areas in a data center
Flammable materials near a fire extinguisher
Automatically opening doors that never lock near a guard kiosk
Humidified areas in a data center
Again when questions contain “not”, be sure to re-write them in your mind to something like “These are all physical vulnerabilities EXCEPT”… at which point the question should become easier.
Looking at the results of a recent vendor audit prior to purchasing products or services might be an example of:
Due diligence
Due care
Comprehensive staff work
Work factor
Due diligence
Remember that due diligence is doing the pre-decision work, or the research; whereas due care is the action, or the decision piece. In the context of this question, purchasing the services of the best and most compliant vendor would be practicing due care.
Which of the following best represents the principle of data minimization?
An online tax portal that collects user name, address, social security number, and hair color.
An online trading platform that collects user bank account and bank transaction histories along with name, address, and social security number.
A tele-health mobile phone application that collects credit card, billing, name, and criminal history information.
An e-commerce web application that collects individual’s names, shipping/billing address, and credit card information.
An e-commerce web application that collects individual’s names, shipping/billing address, and credit card information.
Data minimization principle of GDPR stipulates that data collected must be limited to the minimum amount of data necessary for the specified purpose.
iin which of the following scenarios has the organization implemented “enough” of its security standards?
No encryption of data in transit; with a corrective action plan that is analyzed quarterly
Lack of data classification program; with perimeter firewalls and IPSec
Lack of encryption for data at rest; with an organizational viewpoint that more can always be done
Monthly security control reviews and quarterly vulnerability scans, but no official security program
Lack of encryption for data at rest; with an organizational viewpoint that more can always be done
This question combines the concepts of professional ethics and risk maturity from Domain 1 in a vague fashion. Continuous improvement is a philosophy in the ISO 27,000 Family of Standards. It claims that “enough” implementation does not really exist, thus the assumption is that no matter what you do you can always do more. Security management is process, not a goal or task with a definable end date.
If your company pulls copied flat-files from a credit reporting agency in order to conduct administrative investigations, what type of non-disclosure agreement (NDA) is in place?
Multilateral NDA
Bilateral NDA
Unilateral NDA
non-compete agreement (NCA)
Unilateral NDA
Unilateral refers to a one-way disclosure agreement.
What is the tradeoff with implementing any given security control?
It requires time and resources
It may have a negative impact on operations
It requires change management
It may have a negative impact on asset value
It may have a negative impact on operations
Which of the following would provide the best number of samples and data points for a risk assessment prior to building and deploying a mobile device management system?
Systems audit
Security assessment
Certification
Simulation
Simulation
Simulation provides numbers, samples, and data points as a basis of risk before systems are built. If you struggled with this question, be sure to read up on simulation in Domain 1.
Elevation of privilege in the STRIDE model refers to which of the following?
Attaining a level of control with the capability to destroy target data and systems.
Obtaining authorized-user credentials on the target system to carry out attacks.
The destruction of users with elevated privileges within a target system.
Elevating permissions of authorized users in the system.
Attaining a level of control with the capability to destroy target data and systems.
Vague options can be confusing. Rule out any options that contain information that is too specific, such as destruction of users, or allowing unauthorized users into the system. Elevating permissions may be tempting, but the key phrase in that option is too specific (allowing users into the system). While this could be part of the threat model, the STRIDE model is described at a higher-level in the Common Body of Knowledge.
Which of the following is most likely not a software vulnerability?
An aspect of the code that does not create an exploitable vulnerability
Unintentional defect in programming
Intentional defect in programming
An aspect of the code that creates an exploitable vulnerability
An aspect of the code that does not create an exploitable vulnerability
Double negatives can be tricky. Rephrase the question in your mind to “All of these are software vulnerabilities” and then find the one that isn’t. If there’s another negative in the answer/response, rephrase the response, in this case to read “An aspect of the code that prevented vulnerabilities”.
What is the best way to prevent risk assessments from using poorly constructed averages that mix qualitative and quantitative measures erroneously?
Using risk simulations
Factor analysis of information risk (FAIR) method
Assigning probability of occurrence values to each risk
Using the NIST Risk Management Framework
Incorrect
Factor analysis of information risk (FAIR) method
The FAIR method uses straightforward, numeric, and simple ways to make most risk assessment tasks start out quantitative and stay that way.
As the new information security analyst for an e-commerce company specializing in diaper sales, what risk perspective should you have if the company considers daily sales of diapers to be its primary asset?
Vulnerability-based
Asset-based
Threat-based
Outcomes-based
Outcomes-based
Outcomes-based risk approach identifies goals or objectives the company wants to achieve and links them to core business processes that make them happen.
What is the best course of action if you discover that lack of sufficient humidity controls is causing a risk of condensation in the server room?
Request that senior management decide on whether to transfer, mitigate, accept, or avoid the risk due to its severity.
Alert senior management so that a priority can be set on the risk, and request that a decision be made to mitigate, transfer, accept, or avoid the risk.
Present the risk to senior management under the context of human safety and request that one of the four risk decisions be made.
Schedule a meeting with senior management to discuss the risk, and request that a decision be made to either mitigate or avoid the risk.
Alert senior management so that a priority can be set on the risk, and request that a decision be made to mitigate, transfer, accept, or avoid the risk.
Domain 1 of the revised Common Body of Knowledge (May 2021) brings a new update to the decision making process for risk. Each risk must have two decisions made before anything should be done to respond.
1) Prioritize
2) Choose one of the four decisions: mitigate, accept, transfer, avoid.
Since the condensation is a risk and not an imminent threat (i.e. it’s not happening right now), the two decisions must be made before acting on it.
Which of the following is intended to manage and document security functions for an organization?
ITIL
COBIT
ISO 31000
ISO 27001
COBIT
A control that is implemented through policy or procedure is:
Management
Directive
Deterrent
Administrative
Administrative
Controls that recognize activities can be referred to as which of the following?
Detective controls
Corrective controls
Directive controls
Recovery controls
Detective controls
Detective controls identify or recognize malicious activity.
Which of the following is most likely not considered a recovery control?
Restoring a desktop computer after a malware infection
The decision to conduct backups
Adherence to a backup standard
Adherence to the disaster recovery plan
The decision to conduct backups
A decision to conduct backups would most likely be considered part of the governance process and not a recovery control. The others are administrative, technical, preventative, and corrective controls (controls may fall into more than one category).
Other threat models outside of STRIDE may include which of the following?
Strike, FIPS
Streak, OTTO-OCTAVIUS
TWEAK, OCTAVE-S
OCTAVE, Trike
OCTAVE, Trike
The difference between regulatory standards and legal standards is:
Legal standards are based on court decisions; regulatory standards are mandates set by government agencies
Regulatory standards are enacted by the public; legal standards are based on jury outcomes
Regulatory standards are based on international laws; legal standards are based on local laws
Legal standards represent the views of government agencies; regulatory standards represent the views of court decisions
Legal standards are based on court decisions; regulatory standards are mandates set by government agencies
Comparison questions can be the trickiest. Be sure to focus on the question and what you know.
The difference between an employee handbook and an employee contract is which of the following?
The handbook informs employees about expectations; the contract holds employees accountable for disclosure issues
The handbook informs contractors about expectations; the contract holds them accountable for behavior requirements
The contract informs employees about expectations; the handbook holds employees accountable
The handbook informs employees about expectations; the contract holds them accountable for behavior requirements
The handbook informs employees about expectations; the contract holds them accountable for behavior requirements
Your CIO wants to protect media using a technical control. Which of the following would be the best recommendation?
Electronic use policy/procedure
Electronic locks
Encryption
Technical logging implementation procedures
Encryption
Pretending to be an authorized user occurs in which element of the STRIDE model?
Elevation of privilege
Spamming
Spoofing
Masquerading
Spoofing
Noncompliance with PCI-DSS could result in:
Issues with the supply chain
A reduction in revenue
Regulatory shutdown
Audit findings
A reduction in revenue
Regulatory shutdown
PCI DSS noncompliance results in loss of ability to process card payments, resulting in loss of sales or revenue.
rrr
Which of the following might be considered a support function?
Cryptographic services applied to informational assets by the security office staff who were intentionally left out of the recovery plan documentation
The facilities group that ensures the stability of critical of day-to-day activities
Network administration of a large IT services company who were mistakenly left out of the recovery plan documentation
Revenue generating operations, such as sales, and the employees designated as critical path
Cryptographic services applied to informational assets by the security office staff who were intentionally left out of the recovery plan documentation
Information security is a supporting function. One of the key words here is “critical”. Security staff may or may not be designated as critical path, however, such terminology can be thrown in just to confuse you.
Indicating to someone that their data will be collected for a specific purpose, but not indicating how it will further be used might be an indication of:
The Participation tenet but not the Retention tenet
The Scope tenet but lacking the Limitation tenet
The Scope tenet but not the Privacy tenet
The Notification tenet but lacking the Scope tenet
The Scope tenet but lacking the Limitation tenet
The difference between risk management and risk mitigation is most likely which of the following?
Managerial opinion versus staff opinion
Addressing many issues versus addressing a single issue
Policy versus procedure
Avoiding issues versus acceptable issues
Addressing many issues versus addressing a single issue
Take your time with questions like these. When there is vague wording, look at the overall spirit of the question and pick “the best of the worst” since all of these options are poorly worded.
Notifying an individual that the data will only be used for the scope in which it was collected might refer to which of the following?
Participation tenet
Notification tenet
Scope tenet
Limitation tenet
Limitation tenet
Your CIO asks you to review a risk report that details the former cost of a soon-to-be deprecated data center. The report indicates that despite the legacy system, the organization cannot decommission the data center or update its systems without incurring major cost. What type of report is this, and what should be done?
Quantitative risk analysis; consideration of mitigating controls presented in the risk report
Qualitative risk analysis; consideration of mitigating controls presented in the risk report
Qualitative risk analysis; consideration of compensating controls presented in the risk report
Quantitative risk analysis; consideration of compensating controls presented in the risk report
Quantitative risk analysis; consideration of compensating controls presented in the risk report
Informing the data subject that their information is about to be collected and used for something might refer to which of the following?
Limitation tenet
Scope tenet
Participation tenet
Notification tenet
Notification tenet
You receive an email that states the following: “We are required to protect any information transmitted between network segments, devices, and endpoints.” The requirement most likely refers to which of the following?
Security Policy
Security Framework
Security Standard
Security baseline
Security Policy
You receive an email that states the following: “We are required to protect all attachments using Advanced Encryption Standard. The best way to achieve this is through the use of the ZiparChives software licensing that we already have via bulk purchase.” This email is most likely an example of:
Security Policy
Security Framework
Security Guideline
Security Guideline
Notifying the data subject that they can disallow the data custodian from interacting with any data collected refers to which of the following?
Participation tenet
Limitation tenet
Scope tenet
Notification tenet
Participation tenet
Restricting traffic disclosure in a star topology by utilizing smart port management might be an example of:
A guideline
A policy
A procedure
A Standard
A standard
A security pamphlet that is normally given to the public outlining an organization’s security practices might be derived from which of the following?
Guidelines
Procedure
Standards
Policy
Standards
This is straight from the CBK. “Practices” typically represent what is currently being done, thus standards would be the best choice. Policy influences standards, which drive procedures, and guidelines are good ideas.
Your organization is using a deprecated cryptographic protocol internally within the network, but has disabled the ability of anyone to use, install, or connect decryption technologies while preventing external connections. The deprecated protocol represents:
A safeguard
A threat
A vulnerability
A risk
A vulnerability
If a server team is responsible for web applications and their data, why might the server team take into consideration contacting the security practitioner in the event of a mirrored disk failure?
Because policy might require it
Because regional regulations might require it
Because guidelines might suggest it
Because procedures might require it
Because guidelines might suggest it
This question requires you to pay attention to the wording (as do all questions). It tests your knowledge of the difference between policy, procedures, guidelines, and regulation. The phrase “Take into consideration” is the giveaway – guidelines are suggestions and not required. All other options would be some type of requirement.
An internal process document that contains an overview of your organization’s incident response process has the following: triage, intake, declaration, investigation, operational-state, root-cause analysis, root-cause resolution, lessons-learned meeting. This document is most likely which of the following?
Standard
Guideline
Procedure
Policy
Standard
The document is a standard because it represents an overview of a process rather than specific steps.
As an employer requiring a high degree of trust in your employees, what is the most effective method of achieving this level of trust?
Background check, employment check, and financial profile check
Implementing strict personnel security policies within the organization
Writing precise expectations within an employee handbook that must be adhered to
Codifying the performance expectations through an employment contract
Codifying the performance expectations through an employment contract
Since contracts are legally enforceable, this is the best option.
Three documents have been delivered to you that contain the following: a document that describes the security strategy of your organization; a document that requires that background checks be conducted by the Department of Justice, and a document that states employees should use heat-proof gloves when removing food from the ovens. These documents represent which of the following?
Policy, standard, guideline
Requirement, guideline, standard
Strategy, standard, procedure
Policy, procedure, governance
Policy, standard, guideline
What is the difference between risk acceptance and risk avoidance?
Both are documented within policies; one addresses management approach and the other addresses the decision making process
Both are policies; one addresses baseline configuration and the other addresses management approach
Both are decisions; one addresses attitudes on risk and the other addresses performing the assessment
Both are decisions; one addresses consequences and the other addresses preventing the consequences
Both are decisions; one addresses consequences and the other addresses preventing the consequences
If a server team is responsible for web applications and their data, why might the security practitioner be contacted in the event of a mirrored disk failure?
Because it could impact integrity and could be related to a security incident
Because it might not impact confidentiality but might impact integrity
Because it could impact availability and could be related to a security incident
Because it is related to availability and might impact integrity
Because it could impact availability and could be related to a security incident
This question tests your knowledge of the difference between the CIA tenets of information security from Domain 1.
Before beginning your new position, the Human Resource department paid for access to a database containing portions of your credit report and criminal history without your knowledge. What best describes this scenario?
A procedural action
A preventive control
A privacy issue
An administrative control
An administrative control
The key concept is that the organization did something before hiring you, which is an administrative control no matter how you might feel about it or what the laws might be in your area. It would not be considered a procedure because the question does not mention any referencing of a document.
What is the difference between training/awareness review and training/awareness evaluation?
Review is formal, evaluation is informal
Review examines content, evaluation examines context
Review examines outputs, evaluation looks at inputs
Review looks at inputs, evaluation looks at outputs
Review looks at inputs, evaluation looks at outputs
This question tries to confuse you with vague wordings. Inputs for training/awareness might be a vague way of indicating the content and what’s driving the content, whereas output refers to the efficacy of the program. Evaluation is the formal process.
Your organization manages a public-facing web application that uses two application servers, two database servers, and a transport layer security (TLS) accelerator that is required by the data classification for user sessions. What is the vulnerability and relative mitigation for this scenario?
If the TLS accelerator fails, then traffic may be unencrypted; consider implementing a redundant accelerator
If either of the web application servers fail, availability will be impacted; implement redundant web servers to handle failures
If the database servers fail, integrity will be impacted; implement a redundant array of independent disks (RAID)
If one web server and one database server fail but the TLS accelerator remains active, only availability will be impacted; implement a RAID solution for the database
If the TLS accelerator fails, then traffic may be unencrypted; consider implementing a redundant accelerator
This question tests your ability to filter out key terms that are used incorrectly, to identify the vulnerability, and to pay attention to wording. The reference to “availability” might have been the most tempting, but pay special attention to the word “either” which means that if one OR the other fails (not both, in which case redundant web servers would be the correct answer).
Recently one of your employees was tricked into downloading ransomware by visiting a compromised legitimate website. What would have been the best preventive measure in this scenario?
Netshare and local file backups
Security awareness training that covers social engineering
Patched systems, content filtering, and up-to-date intrusion prevention systems
Security awareness training that covers phishing
Security awareness training that covers social engineering
The key word here is “tricked,” which means that social engineering has occurred, and the best preventive measure would be appropriate security awareness training. Phishing is a type of social engineering, and since we don’t know the method of trickery, security awareness training that covers social engineering is the best response.
A document that states fences must be at least ten feet tall and preferably twelve feet tall might be considered which of the following?
A policy or a guideline
A standard or a guideline
A hybrid standard/guideline
Physical security preferences
A hybrid standard/guideline
The difference between continuity and contingency is most likely which of the following?
Continuity comes before contingency
Contingency recovers, continuity restores
Continuity comes after contingency
Contingency is critical, continuity is normal
Contingency is critical, continuity is normal
The key word is “critical”. Contingency is concerned with critical operations. While poorly worded, you may see questions like this in the exam that seek to confuse you (aka: test your knowledge).
What is the best example of security governance?
A group of employees comprised of staff and management who meet regularly to discuss how to better respond to and manage security incidents from a governance perspective
Executive management that oversees various processes and procedures used within the organization to govern its business activities
Security managers and officers of an organization within a company who carry out the governance directives
A group of mid-to-high ranking employees who meet regularly to discuss security policies, roles, and processes used to make security decisions
A group of mid-to-high ranking employees who meet regularly to discuss security policies, roles, and processes used to make security decisions
The term “governance” is used in the available responses to tempt you into selecting the wrong answer. Notice that one group is focused on security incidents, another is concerned with overall processes/procedures, and another is concerned with carrying out the governance directives. These can all be ruled out.
You have been asked to look at the policies mentioned in the Security, Education, Training & Awareness (SETA) module to see if anything needs updating. This might be an example of:
Audit of the training program
Program effectiveness evaluation
Evaluation of the awareness program
Assessment of the education program
Program effectiveness evaluation
This is the updated terminology used for a security education training & awareness program in Domain 1.
Several legitimate company users have complained that logging into your web application is five to ten minutes, while an analyst reports to you that pulsing zombies are occasionally flooding the application with packets from compromised systems. In elevating this event, how should it be classified for upper management?
Degradation of service attack
Distributed denial of service attack
Zombie botnet
Pulsing zombie attack
Degradation of service attack
This could be a type of beta question that uses terminology not necessarily covered in the CBK. The key word in this question (not that they all have key words) is “occasionally”, which indicates that the attack is not continuous – in combination with the fact that login is taking five to ten minutes (as opposed to never) indicates this is a degradation, not a denial.
After being alerted that an employee has stolen sensitive equipment and data for personal use, you examine their personnel file and discover that a background check was conducted but reference checks were not. This could indicate which of the following?
Poor personnel screening practices
Policy violation
Poor judgment
Poor personnel hiring practices
Poor personnel screening practices
This question is vague but seeks to test your knowledge about what category background checks and reference checks fit into. When an option is as vague as “poor judgment”, you can instantly rule it out. Also while high-level options (such as hiring practices) might seem good, the exam is testing you on specific concepts presented in the CBK.
When a company manages its operations and policies using the Sigma model, this is indicative of which principle?
Governance
Policy
Configuration management
Change management
Governance
Which of the following is not a technical control?
Staff using write-block technology to conduct forensics on suspicious devices
A log that is created to assist in the detection of inappropriate activity showing username, access time, data accessed
An alert that is sent when a user tries to access a data element without the proper permissions
A configuration setting that reports device locations to the central authentication server
Staff using write-block technology to conduct forensics on suspicious devices
Investigative processes are detective controls, which can sometimes be technical as well, but not in this case.
A security manager is unable to conduct an investigation despite having the knowledge/expertise and not having procedures. What is the most probable cause for the inability to conduct an investigation?
Investigative standards most likely do not exist to guide the security manager
An investigative policy most likely does not exist that provides guidance
Investigative guidelines have most likely not been developed or approved by upper management
A procedure does not exist to indicate the steps the security manager must take
Investigative standards most likely do not exist to guide the security manager
Since the procedures do not exist and the manager already has the appropriate knowledge, focus on what may be missing from this equation and look back to your lesson on the difference between policy, standard, guideline and procedure. In questions like this, not everything will be spelled out perfectly for you, and you may need to make some assumptions using the knowledge you gained from studying the CBK. As always, go with the best of the worst options.
What should be considered in addition to dynamic policy control in order to help protect highly sensitive data?
Licensing and centralized access control
Centralized access control and interoperability
Licensing and continuous audit trails
Decentralized access control and persistency
Licensing and continuous audit trails
Ultimately this question tests your knowledge about digital rights management solutions. Since very little information is given, you have to look for key words and make assumptions (e.g. dynamic policy control).
What is the most important component of the contingency plan?
Remediation steps to the alternate site
Response steps to the primary site
Recovery steps and objectives to the alternate site
Reconstitution steps and objectives to the primary site
Recovery steps and objectives to the alternate site
While short and vague, this question tests your knowledge between terminology from the Security Operations and Security Risk Management domains – the many “Rs” (remediation, response, recovery, etc.) can be confusing when not presented in the context of their respective domains. Be sure to study up on contingency planning and incident management if you missed this question.
Your company’s management philosophy, including its risk appetite might be found where?
In its governance
In its personnel handbook
In its policy
In its standards
In its governance
Vague wording is used in this question. Governance is the best answer because it takes into consideration all the policies, standards, and handbooks from the company.
You receive word from the governance committee that a weaker security framework must be adopted immediately to save costs, but you are approached by an analyst who tells you that adopting the weaker framework could bring the entity out of compliance with federal law. Shortly thereafter, the analyst is laid off. What should you do in this scenario?
Implement the weaker framework
Gather evidence in support of the new framework
Ask the laid off analyst for supporting documents
Notify the regulating federal agency
Implement the weaker framework
In difficult ethical questions like this, pay attention to wording. One key word is “could”, meaning it’s unknown whether the company would be out of compliance. Also, keep in mind that nothing in this question ties the two incidents together (weak framework and being laid off). In addition, remember that security is a supporting function that must align with organizational goals.
If key data inputs and metrics are missing, what is the best approach to conducting a risk analysis?
Subjective
Objective
Hybrid approach that combines quantitative and qualitative
Quantifiable method
Subjective
“Subjective” is the same as qualitative. Since metrics are missing, this is the best option.
Recently a court ruled that forensic investigations in your district can no longer use write-block technology. This is most likely which of the following?
Legal standard
Legal ruling
Regulatory standard
Industry standard
Legal standard
This question tests your knowledge of the difference between legal, regulatory, and industry standards. The key word here is “court ruling”.
Management is concerned that infections in the workplace may rise if temperatures are not taken before employees enter the building. This concern can best be defined as which of the following?
Vulnerability
Exposure
Risk aversion
Likelihood
Likelihood
This is a vague question, but remember that likelihood is the measure of possibility. If the possibility is increasing, the likelihood is increasing.
A protocol document approved by senior management that appears to be outdated conflicts with the runbook approved by your management team. What should be done in this situation?
The protocol document should be followed.
A guideline should be developed.
The runbook should be reviewed.
The runbook should be followed.
The protocol document should be followed.
Given that one of the options talks about “guidelines”, you might be able to decipher that this question is talking about the difference between policy, procedures, standards, etc. Also, given that none of these answers are perfect, you have to choose the best one, which is usually the higher level option since a protocol (policy/standard) would overrule a runbook (procedure). Thesaurus and non-CBK terms are commonly inserted into questions to test your ability to apply the knowledge and ability to wade through challenges.
You are covertly ordered by two out of twelve board members to initiate an internal investigation on your manager. What is the best approach in this situation?
Explain the concept of separation of duties and ask for guidance.
Gently recuse yourself explaining your chain of command.
Conduct the investigation discreetly without anyone’s knowledge.
Educate the board members on how to submit a complaint to internal affairs.
Educate the board members on how to submit a complaint to internal affairs.
In ethical dilemma questions, pay attention to the wording and when in doubt, the best approach is to look for established processes/procedures that can be followed. Also try to ignore irrelevant information within the question, such as the number of board members, and their lack of knowledge. Since each of the available options has an inherent assumption (which will make you uncomfortable during the exam), you have to choose the BEST one.
Which of the following is an adequate clause for a service-level agreement?
Service must comply with security regulations outlined in the contract. Any variances will result in financial penalties.
Interruptions to service must not exceed 3 seconds. Interruptions beyond this threshold must be logged by the system and provided monthly.
A splash screen must be presented to website users for a duration of 5 to 10 seconds, giving them the choice to opt-out of services.
Security incidents must be resolved within 24 hours.
disputed.
Interruptions to service must not exceed 3 seconds. Interruptions beyond this
SLAs need to have a measurable and financially/legally enforceable metric. While some of these options have numeric metrics, they are not objective or reasonable, and could easily be disputed.
Which of the following is not an example of governance?
Organizational roles
Guidelines
Policy
Procedures
Guidelines
When all of the answers are theoretically “correct”, try to choose the option that is the least correct. In this case, since guidelines are recommendations, they would be the least correct out of the options presented here.
How should proposed changes be handled when they comply with policy but do not comply with guidelines?
They should be avoided if any risks are discovered.
They should be considered for implementation through the regular change process.
They should be accepted for risks by management.
They should receive additional scrutiny from stakeholders prior to being considered.
They should be considered for implementation through the regular change process.
While the options available are vague and poorly worded, look for key words that can help you focus on the bottom line and rule out the bad options. Ultimately this question asks what the difference is between policy and guideline. If you remember that guidelines are simply suggestions, then this question becomes fairly easy. If a change complies with policy then it should be considered through the normal process.
In which situation would an employee have the most repudiation?
Administrators have local admin access to change, read, update, and delete.
Administrator activities are logged and they have full read/write permissions.
Administrators have read only access.
Administrators have impersonator accounts where logging is written as the impersonated user.
Administrators have impersonator accounts where logging is written as the impersonated user.
This question is vague, and has multiple right answers, but the best choice is the one in which the employee would have the “most” repudiation. Remember that repudiation is the ability to deny, so in the case where an “impersonator” account exists, the admin remains completely anonymous and users can deny all actions performed under their accounts.
A business that transports and stores your backup media also serves other customers and has concerns with allowing your audit staff on site. If they are subject to your company’s data regulations, what is the most acceptable solution to this dilemma?
Seek cooperation to conduct an onsite audit.
Elevate the issue to the storage facility upper management.
Ensure that the right-to-audit is in the contract.
Request copies of third-party audit results.
Request copies of third-party audit results.
When all of the options seem good, you have to use the process of elimination to weed out the worst options. When ruling out options, re-read the question multiple times, especially if the question is short. In this case since we don’t know what’s in the contract or what the regulations allow, conducting an audit is out of the question, and looking at the contract won’t do any good other than adding to your knowledge. Elevating the issue might be good, but the CBK specifically mentions reviewing audit results for organizations that are subject to the same regulations. Be sure to review risk management concepts in Domain 1 if you struggled with this question.
Which of the following is the best example of a layered defense?
Use of digital signatures and private keys
Multifactor authentication and a separate passcode
Role-based access controls and user monitoring
Security guards at the main entrance and proximity access card locks on the remaining doors
Role-based access controls and user monitoring
This question requires you to think through each option, what they might do as a combination, and how they might complement each other as a layered defense architecture. In this case, the only two that would provide sufficient layered defense would be RBAC and monitoring, because it presents a technical control and administrative/management control combination. The remaining options are good but not the best (remember to always choose the “best” option).
Access authorization rules are typically enforced by:
Access control systems
Organizational standards
Access control procedures
Role-based access control matrices
Access control systems
Standards, procedures, and policy dictate the rules, but systems or processes enforce them.
- Who has the primary responsibility of determining the classification level for
information?
A. The functional manager
B. Senior management
C. The owner
D. The user
- C. A company can have one specific data owner or different data owners who have been delegated the responsibility of protecting specific sets of data. One
of the responsibilities that goes into protecting this information is properly
classifying it
- If different user groups with different security access levels need to access the same information, which of the following actions should management take?
A. Decrease the security level on the information to ensure accessibility and usability of the information.
B. Require specific written approval each time an individual needs to access the information.
C. Increase the security controls on the information.
D. Decrease the classification label on the information.
C. If data is going to be available to a wide range of people, more granular
security should be implemented to ensure that only the necessary people access the data and that the operations they carry out are controlled. The security implemented can come in the form of authentication and authorization technologies, encryption, and specific access control mechanisms.
- What should management consider the most when classifying data?
A. The type of employees, contractors, and customers who will be accessing the data
B. Availability, integrity, and confidentiality
C. Assessing the risk level and disabling countermeasures
D. The access controls that will be protecting the data
- B. The best answer to this question is B, because to properly classify data,
the data owner must evaluate the availability, integrity, and confidentiality
requirements of the data. Once this evaluation is done, it will dictate which
employees, contractors, and users can access the data, which is expressed in
answer A. This assessment will also help determine the controls that should
be put into place.
- Who is ultimately responsible for making sure data is classified and protected?
A. Data owners
B. Users
C. Administrators
D. Management
- D. The key to this question is the use of the word “ultimately.” Though management can delegate tasks to others, it is ultimately responsible for everything that takes place within a company. Therefore, it must continually ensure that data and resources are being properly protected.
- Which factor is the most important item when it comes to ensuring security is successful in an organization?
A. Senior management support
B. Effective controls and implementation methods
C. Updated and relevant security policies and procedures
D. Security awareness by all employees
- A. Without senior management’s support, a security program will not receive
the necessary attention, funds, resources, and enforcement capabilities.
- When is it acceptable to not take action on an identified risk?
A. Never. Good security addresses and reduces all risks.
B. When political issues prevent this type of risk from being addressed
C. When the necessary countermeasure is complex.
D. When the cost of the countermeasure outweighs the value of the asset and
potential loss.
- D. Companies may decide to live with specific risks they are faced with if the cost of trying to protect themselves would be greater than the potential loss
if the threat were to become real. Countermeasures are usually complex to a degree, and there are almost always political issues surrounding different risks, but these are not reasons to not implement a countermeasure.
- Which is the most valuable technique when determining if a specific security control should be implemented?
A. Risk analysis
B. Cost/benefit analysis
C. ALE results
D. Identifying the vulnerabilities and threats causing the risk
- B. Although the other answers may seem correct, B is the best answer here. This is because a risk analysis is performed to identify risks and come up with suggested countermeasures. The ALE tells the company how much it could lose if a specific threat became real. The ALE value will go into the cost/benefit analysis, but the ALE does not address the cost of the countermeasure and the benefit of a countermeasure. All the data captured in answers A, C, and D are inserted into a cost/benefit analysis.
- Which best describes the purpose of the ALE calculation?
A. Quantifies the security level of the environment
B. Estimates the loss possible for a countermeasure
C. Quantifies the cost/benefit result
D. Estimates the loss potential of a threat in a span of a year
- D. The ALE calculation estimates the potential loss that can affect one asset from a specific threat within a one-year time span. This value is used to figure
out the amount of money that should be earmarked to protect this asset from this threat.
- The security functionality defines the expected activities of a security mechanism, and assurance defines which of the following?
A. The controls the security mechanism will enforce
B. The data classification after the security mechanism has been implemented
C. The confidence of the security the mechanism is providing
D. The cost/benefit relationship
- C. The functionality describes how a mechanism will work and behave. This may have nothing to do with the actual protection it provides. Assurance
is the level of confidence in the protection level a mechanism will provide. When systems and mechanisms are evaluated, their functionality and
assurance should be examined and tested individually.
- How do you calculate residual risk?
A. Threats × risks × asset value
B. (Threats × asset value × vulnerability) × risks
C. SLE × frequency = ALE
D. (Threats × vulnerability × asset value) × controls gap
- D. The equation is more conceptual than practical. It is hard to assign a number to an individual vulnerability or threat. This equation enables you to look at the potential loss of a specific asset, as well as the controls gap (what the specific countermeasure cannot protect against). What remains is the residual risk, which is what is left over after a countermeasure is implemented
- Why should the team that will perform and review the risk analysis information be made up of people in different departments?
A. To make sure the process is fair and that no one is left out.
B. It shouldn’t. It should be a small group brought in from outside the organization because otherwise the analysis is biased and unusable.
C. Because people in different departments understand the risks of their department. Thus, it ensures the data going into the analysis is as close to reality as possible.
D. Because the people in the different departments are the ones causing the risks, so they should be the ones held accountable
- C. An analysis is only as good as the data that go into it. Data pertaining to risks the company faces should be extracted from the people who understand best the business functions and environment of the company. Each department
understands its own threats and resources, and may have possible solutions to specific threats that affect its part of the company.
- Which best describes a quantitative risk analysis?
A. A scenario-based analysis to research different security threats
B. A method used to apply severity levels to potential loss, probability of loss,
and risks
C. A method that assigns monetary values to components in the risk
assessment
D. A method that is based on gut feelings and opinions
- C. A quantitative risk analysis assigns monetary values and percentages to the different components within the assessment. A qualitative analysis uses
opinions of individuals and a rating system to gauge the severity level of different threats and the benefits of specific countermeasures.
- Why is a truly quantitative risk analysis not possible to achieve?
A. It is possible, which is why it is used.
B. It assigns severity levels. Thus, it is hard to translate into monetary values.
C. It is dealing with purely quantitative elements.
D. Quantitative measures must be applied to qualitative elements.
- D. During a risk analysis, the team is trying to properly predict the future and all the risks that future may bring. It is somewhat of a subjective exercise and requires educated guessing. It is very hard to properly predict that a flood will take place once in ten years and cost a company up to $40,000 in damages, but this is what a quantitative analysis tries to accomplish.
- What is CobiT and where does it fit into the development of information security systems and security programs?
A. Lists of standards, procedures, and policies for security program development
B. Current version of ISO 17799
C. A framework that was developed to deter organizational internal fraud
D. Open standards for control objectives
- D. The Control Objectives for Information and related Technology (CobiT) is a framework developed by the Information Systems Audit and Control
Association (ISACA) and the IT Governance Institute (ITGI). It defines goals for the controls that should be used to properly manage IT and ensure IT
maps to business needs.
- What are the four domains that make up CobiT?
A. Plan and Organize, Acquire and Implement, Deliver and Support, and Monitor and Evaluate
B. Plan and Organize, Maintain and Implement, Deliver and Support, and Monitor and Evaluate
C. Plan and Organize, Acquire and Implement, Support and Purchase, and Monitor and Evaluate
D. Acquire and Implement, Deliver and Support, and Monitor and Evaluate
- A. CobiT has four domains: Plan and Organize, Acquire and Implement, Deliver and Support, and Monitor and Evaluate. Each category drills down
into subcategories. For example, Acquire and Implement contains the
following subcategories:
* Acquire and Maintain Application Software
* Acquire and Maintain Technology Infrastructure
* Develop and Maintain Procedures
* Install and Accredit Systems
* Manage Changes
- What is the ISO/IEC 27799 standard?
A. A standard on how to protect personal health information
B. The new version of BS 17799
C. Definitions for the new ISO 27000 series
D. The new version of NIST 800-60
- A. It is referred to as the health informatics, and its purpose is to provide
guidance to health organizations and other holders of personal health
information on how to protect such information via implementation
of ISO/IEC 27002.
- CobiT was developed from the COSO framework. What are COSO’s main
objectives and purpose?
A. COSO is a risk management approach that pertains to control objectives and IT business processes.
B. Prevention of a corporate environment that allows for and promotes financial fraud
C. COSO addresses corporate culture and policy development.
D. COSO is risk management system used for the protection of federal
systems.
- B. COSO deals more at the strategic level, while CobiT focuses more at the operational level. CobiT is a way to meet many of the COSO objectives,
but only from the IT perspective. COSO deals with non-IT items also, as in company culture, financial accounting principles, board of director
responsibility, and internal communication structures. Its main purpose
is to help ensure fraudulent financial reporting cannot take place in an
organization
- OCTAVE, NIST 800-30, and AS/NZS 4360 are different approaches to carrying out risk management within companies and organizations. What are the differences between these methods?
A. NIST 800-30 and OCTAVE are corporate based, while AS/NZS is international.
B. NIST 800-30 is IT based, while OCTAVE and AS/NZS 4360 are corporate based.
C. AS/NZS is IT based, and OCTAVE and NIST 800-30 are assurance based.
D. NIST 800-30 and AS/NZS are corporate based, while OCTAVE is international
- B. NIST 800-30 Risk Management Guide for Information Technology Systems is a U.S. federal standard that is focused on IT risks. OCTAVE is a
methodology to set up a risk management program within an organizational structure. AS/NZS 4360 takes a much broader approach to risk management. This methodology can be used to understand a company’s financial, capital,
human safety, and business decisions risks. Although it can be used to analyze security risks, it was not created specifically for this purpose.
A server that houses sensitive data has been stored in an unlocked room for the last few years at Company A. The door to the room has a sign on the door that reads “Room 1.” This sign was placed on the door with the hope that people would not look for important servers in this room. Realizing this is not optimum security, the company has decided to install a reinforced lock and server cage for the server and remove the sign. They have also hardened the server’s configuration and employed strict operating system access controls.
- The fact that the server has been in an unlocked room marked “Room 1” for the last few years means the company was practicing which of the following?
A. Logical security
B. Risk management
C. Risk transference
D. Security through obscurity
- D. Security through obscurity is not implementing true security controls, but rather attempting to hide the fact that an asset is vulnerable in the hope
that an attacker will not notice. Security through obscurity is an approach to try and fool a potential attacker, which is a poor way of practicing security.
Vulnerabilities should be identified and fixed, not hidden.
A server that houses sensitive data has been stored in an unlocked room for the last few years at Company A. The door to the room has a sign on the door that reads “Room 1.” This sign was placed on the door with the hope that people would not look for important servers in this room. Realizing this is not optimum security, the company has decided to install a reinforced lock and server cage for the server and remove the sign. They have also hardened the server’s configuration and employed strict operating system access controls.
- The new reinforced lock and cage serve as which of the following?
A. Logical controls
B. Physical controls
C. Administrative controls
D. Compensating controls
- B. Physical controls are security mechanisms in the physical world, as in locks,
fences, doors, computer cages, etc. There are three main control types, which
are administrative, technical, and physical.
A server that houses sensitive data has been stored in an unlocked room for the last few years at Company A. The door to the room has a sign on the door that reads “Room 1.” This sign was placed on the door with the hope that people would not look for important servers in this room. Realizing this is not optimum security, the company has decided to install a reinforced lock and server cage for the server and remove the sign. They have also hardened the server’s configuration and employed strict operating system access controls
- The operating system access controls comprise which of the following?
A. Logical controls
B. Physical controls
C. Administrative controls
D. Compensating controls
- A. Logical (or technical) controls are security mechanisms, as in firewalls, encryption, software permissions, and authentication devices.They are
commonly used in tandem with physical and administrative controls to provide a defense-in-depth approach to security.
A company has an e-commerce website that carries out 60 percent of its annual revenue. Under the current circumstances, the annualized loss expectancy for a website against the threat of attack is $92,000. After implementing a new application-layer firewall, the new annualized loss expectancy would be $30,000. The firewall costs $65,000 per year to implement and maintain.
22. How much does the firewall save the company in loss expenses?
A. $62,000
B. $3,000
C. $65,000
D. $30,000
- A. $62,000 is the correct answer. The firewall reduced the annualized loss expectancy (ALE) from $92,000 to $30,000 for a savings of $62,000. The
formula for ALE is single loss expectancy × annualized rate of occurrence = ALE.
Subtracting the ALE value after the firewall is implemented from the value before it was implemented results in the potential loss savings this type of control provides.
A company has an e-commerce website that carries out 60 percent of its annual revenue. Under the current circumstances, the annualized loss expectancy for a website against the threat of attack is $92,000. After implementing a new application-layer firewall, the new annualized loss expectancy would be $30,000. The firewall costs $65,000 per year to implement and maintain.
- What is the value of the firewall to the company?
A. $62,000
B. $3,000
C. –$62,000
D. –$3,000
- D. –$3,000 is the correct answer. The firewall saves $62,000, but costs $65,000 per year. 62,000 – 65,000 = –3,000. The firewall actually costs the
company more than the original expected loss, and thus the value to the company is a negative number. The formula for this calculation is (ALE before
the control is implemented) – (ALE after the control is implemented) – (annual cost of control) = value of control.
A company has an e-commerce website that carries out 60 percent of its annual revenue. Under the current circumstances, the annualized loss expectancy for a website against the threat of attack is $92,000. After implementing a new application-layer firewall, the new annualized loss expectancy would be $30,000. The firewall costs $65,000 per year to implement and maintain.
- Which of the following describes the company’s approach to risk
management?
A. Risk transference
B. Risk avoidance
C. Risk acceptance
D. Risk mitigation
- D. Risk mitigation involves employing controls in an attempt to reduce the either the likelihood or damage associated with an incident, or both. The four ways of dealing with risk are accept, avoid, transfer, and mitigate (reduce). A firewall is a countermeasure installed to reduce the risk of a threat.
A small remote office for a company is valued at $800,000. It is estimated, based on historical data, that a fire is likely to occur once every ten years at a facility in this area. It is estimated that such a fire would destroy 60 percent of the facility under the current circumstances and with the current detective and preventative controls in place.
- What is the Single Loss Expectancy (SLE) for the facility suffering from a fire?
A. $80,000
B. $480,000
C. $320,000
D. 60%
- B. $480,000 is the correct answer. The formula for single loss expectancy (SLE) is asset value × exposure factor (EF) = SLE. In this situation the formula would work out as asset value ($800,000) × exposure factor (60%) = $480,000. This
means that the company has a potential loss value of $480,000 pertaining to this one asset (facility) and this one threat type (fire).
A small remote office for a company is valued at $800,000. It is estimated, based on historical data, that a fire is likely to occur once every ten years at a facility in this area. It is estimated that such a fire would destroy 60 percent of the facility under the current circumstances and with the current detective and preventative controls in place.
- What is the Annualized Rate of Occurrence (ARO)?
A. 1
B. 10
C. .1
D. .01
- C. The annualized rate occurrence (ARO) is the frequency that a threat will most likely occur within a 12-month period. It is a value used in the ALE
formula, which is SLE × ARO = ALE.
A small remote office for a company is valued at $800,000. It is estimated, based on historical data, that a fire is likely to occur once every ten years at a facility in this area. It is estimated that such a fire would destroy 60 percent of the facility under the current circumstances and with the current detective and preventative controls in place.
- What is the Annualized Loss Expectancy (ALE)?
A. $480,000
B. $32,000
C. $48,000
D. .6
- C. $48,000 is the correct answer. The annualized loss expectancy formula (SLE × ARO = ALE) is used to calculate the loss potential for one asset experiencing one threat in a 12-month period. The resulting ALE value helps to determine
the amount that can be reasonably be spent in the protection of that asset. In this situation, the company should not spend over $48,000 on protecting this asset from the threat of fire. ALE values help organizations rank the severity
level of the risks they face so they know which ones to deal with first and how
much to spend on each.
- The international standards bodies ISO and IEC developed a series of standards that are used in organizations around the world to implement and maintain information security management systems. The standards were derived from
the British Standard 7799, which was broken down into two main pieces. Organizations can use this series of standards as guidelines, but can also be
certified against them by accredited third parties. Which of the following are incorrect mappings pertaining to the individual standards that make up the ISO/IEC 27000 series?
i. ISO/IEC 27001 outlines ISMS implementation guidelines, and ISO/IEC 27003 outlines the ISMS program’s requirements.
ii. ISO/IEC 27005 outlines the audit and certification guidance, and ISO/IEC 27002 outlines the metrics framework.
iii. ISO/IEC 27006 outlines the program implementation guidelines, and
ISO/IEC 27005 outlines risk management guidelines.
iv. ISO/IEC 27001 outlines the code of practice, and ISO/IEC 27004 outlines the implementation framework.
A. i, iii
B. i, ii
C. ii, iii, iv
D. i, ii, iii, iv
- D. The proper mapping for the ISO/IEC standards are as follows:
* ISO/IEC 27001 ISMS requirements
* ISO/IEC 27002 Code of practice for information security management
* ISO/IEC 27003 Guideline for ISMS implementation
* ISO/IEC 27004 Guideline for information security management measurement and metrics framework
* ISO/IEC 27005 Guideline for information security risk management
* ISO/IEC 27006 Guidance for bodies providing audit and certification of
information security management systems
- The information security industry is made up of various best practices, standards, models, and frameworks. Some were not developed first with security in mind, but can be integrated into an organizational security program to help in its effectiveness and efficiency. It is important to know of all of these different approaches so that an organization can choose the ones that best fit its business needs and culture.
Which of the following best describes the approach(es) that should be put into place if an organization wants to integrate a way to improve
its security processes over a period of time?
i. Information Technology Infrastructure Library should be integrated because it allows for the mapping of IT service process management,
business drivers, and security improvement.
ii. Six Sigma should be integrated because it allows for the defects of security processes to be identified and improved upon.
iii. Capability Maturity Model should be integrated because it provides distinct maturity levels.
iv. The Open Group Architecture Framework should be integrated because it
provides a structure for process improvement.
A. i, iii
B. ii, iii, iv
C. ii, iii
D. ii, iv
- C. The best process improvement approaches provided in this list are Six Sigma and the Capability Maturity Model. The following outlines the
definitions for all items in this question:
* TOGAF Model and methodology for the development of enterprise architectures developed by The Open Group
* ITIL Processes to allow for IT service management developed by the United Kingdom’s Office of Government Commerce
* Six Sigma Business management strategy that can be used to carry out process improvement
* Capability Maturity Model Integration (CMMI) Organizational development for process improvement developed by Carnegie Mellon
Todd is a new security manager and has the responsibility of implementing personnel security controls within the financial institution where he works. Todd knows that many employees do not fully understand how their actions can put the institution at risk; thus, an awareness program needs to be developed. He has determined that the bank tellers need to get a supervisory override when customers have checks over $3,500 that need to be cashed. He has also uncovered that some employees have stayed in their specific positions within the company for over three years. Todd would like to be able to investigate some of the bank’s personnel activities to see if any fraudulent activities have taken place. Todd is already ensuring that two people must use separate keys at the same time to open the bank vault.
- Todd documents several fraud opportunities that the employees have at the financial institution so that management understands these risks and allocates the funds and resources for his suggested solutions. Which of the following best describes the control Todd should put into place to be able to carry out fraudulent investigation activity?
A. Separation of duties
B. Rotation of duties
C. Mandatory vacations
D. Split knowledge
- C. Mandatory vacation is an administrative detective control that allows for an organization to investigate an employee’s daily business activities to uncover any potential fraud that may be taking place. The employee should be forced to be away from the organization for a two-week period and another person put into that role. The idea is that the person who was rotated into that position may be able to detect suspicious activities
- If the financial institution wants to force collusion to take place for fraud to happen successfully in this situation, what should Todd put into place?
A. Separation of duties
B. Rotation of duties
C. Social engineering
D. Split knowledge
- A. Separation of duties is an administrative control that is put into place to ensure that one person cannot carry out a critical task by himself. If a person were able to carry out a critical task alone, this could put the organization at risk. Collusion is when two or more people come together to carry out fraud. So if a task was split between two people, they would have to carry out collusion (working together) to complete that one task and carry out fraud.
- Todd wants to be able to prevent fraud from taking place, but he knows that some people may get around the types of controls he puts into place. In those situations he wants to be able to identify when an employee is doing something suspicious. Which of the following incorrectly describes what Todd is implementing in this scenario and what those specific controls provide?
A. Separation of duties by ensuring that a supervisor must approve the cashing of a check over $3,500. This is an administrative control that
provides preventative protection for Todd’s organization.
B. Rotation of duties by ensuring that one employee only stays in one position
for up to three months of a time. This is an administrative control that provides detective capabilities.
C. Security awareness training, which is a preventive administrative control that can also emphasize enforcement.
D. Dual control, which is an administrative detective control that can ensure that two employees must carry out a task simultaneously.
- D. Dual control is an administrative preventative control. It ensures that two people must carry out a task at the same time, as in two people having
separate keys when opening the vault. It is not a detective control. Notice that the question asks what Todd is not doing. Remember that on the exam
you need to choose the best answer.
Sam has just been hired as the new security officer for a pharmaceutical company. The company has experienced many data breaches and has charged Sam with ensuring that the company is better protected. The company currently has the following classifications in place: public, confidential, and secret. There is a data classification policy that outlines the classification scheme and the definitions for each classification, but there is no supporting documentation that the technical staff can follow to know how to meet these goals. The company has no data loss prevention controls in place and only conducts basic security awareness
training once a year. Talking to the business unit managers, he finds out that only half
of them even know where the company’s policies are located and none of them know
their responsibilities pertaining to classifying data.
33. Which of the following best describes what Sam should address first in this
situation?
A. Integrate data protection roles and responsibilities within the security awareness training and require everyone to attend it within the next 15 days.
B. Review the current classification policies to ensure that they properly address the company’s risks.
C. Meet with senior management and get permission to enforce data owner tasks for each business unit manager.
D. Audit all of the current data protection controls in place to get a firm understanding of what vulnerabilities reside in the environment.
- B. While each answer is a good thing for Sam to carry out, the first thing that needs to be done is to ensure that the policies properly address data
classification and protection requirements for the company. Policies provide direction, and all other documents (standards, procedures, guidelines) and
security controls are derived from the policies and support them.
Sam has just been hired as the new security officer for a pharmaceutical company. The company has experienced many data breaches and has charged Sam with ensuring that the company is better protected. The company currently has the following classifications in place: public, confidential, and secret. There is a data classification policy that outlines the classification scheme and the definitions for each classification, but there is no supporting documentation that the technical staff can follow to know how to meet these goals. The company has no data loss prevention controls in place and only conducts basic security awareness
training once a year. Talking to the business unit managers, he finds out that only half
of them even know where the company’s policies are located and none of them know
their responsibilities pertaining to classifying data.
- Sam needs to get senior management to assign the responsibility of protecting specific data sets to the individual business unit managers, thus making them data owners. Which of the following would be the most important in the criteria the managers would follow in the process of actually classifying data once this responsibility has been assigned to them?
A. Usefulness of the data
B. Age of the data
C. Value of the data
D. Compliance requirements of the data
- C. Data is one of the most critical assets to any organization. The value of the asset must be understood so that the organization knows which assets require the most protection. There are many components that go into calculating the value of an asset: cost of replacement, revenue generated from asset, amount adversaries would pay for the asset, cost that went into the development of the asset, productivity costs if asset was absent or destroyed, and liability costs of not properly protecting the asset. So the data owners need to be able to
determine the value of the data to the organization for proper classification
purposes.
Sam has just been hired as the new security officer for a pharmaceutical company. The company has experienced many data breaches and has charged Sam with ensuring that the company is better protected. The company currently has the following classifications in place: public, confidential, and secret. There is a data classification policy that outlines the classification scheme and the definitions for each classification, but there is no supporting documentation that the technical staff can follow to know how to meet these goals. The company has no data loss prevention controls in place and only conducts basic security awareness
training once a year. Talking to the business unit managers, he finds out that only half of them even know where the company’s policies are located and none of them know their responsibilities pertaining to classifying data.
- From this scenario, what has the company accomplished so far?
A. Implementation of administrative controls
B. Implementation of operational controls
C. Implementation of physical controls
D. Implementation of logical controls
- A. The company has developed a data classification policy, which is an administrative control.
Susan has been told by her boss that she will be replacing the current security manager within her company. Her boss explained to her that operational security measures have not been carried out in a standard fashion, so some systems have proper security configurations and some do not. Her boss needs to understand how dangerous it is to have some of the systems misconfigured along with what to do in this situation.
36. Which of the following best describes what Susan needs to ensure the
operations staff creates for proper configuration standardization?
A. Dual control
B. Redundancy
C. Training
D. Baselines
- D. The operations staff needs to know what minimum level of security is required per system within the network. This minimum level of security is
referred to as a baseline. Once a baseline is set per system, then the staff has something to compare the system against to know if changes have not taken
place properly, which could make the system vulnerable.
Susan has been told by her boss that she will be replacing the current security manager within her company. Her boss explained to her that operational security measures have not been carried out in a standard fashion, so some systems have proper security configurations and some do not. Her boss needs to understand how dangerous it is to have some of the systems misconfigured along with what to do in this situation.
37. Which of the following is the best way to illustrate to her boss the dangers of
the current configuration issues?
A. Map the configurations to the compliancy requirements.
B. Compromise a system to illustrate its vulnerability.
C. Audit the systems.
D. Carry out a risk assessment.
- D. Susan needs to illustrate these vulnerabilities (misconfigured systems) in the context of risk to her boss. This means she needs to identify the specific
vulnerabilities, associate threats to those vulnerabilities, and calculate their risks. This will allow her boss to understand how critical these issues are and what type of action needs to take place
Susan has been told by her boss that she will be replacing the current security manager within her company. Her boss explained to her that operational security measures have not been carried out in a standard fashion, so some systems have proper security configurations and some do not. Her boss needs to understand how dangerous it is to have some of the systems misconfigured along with what to do in this situation.
38. Which of the following is one of the most likely solutions that Susan will
come up with and present to her boss?
A. Development of standards
B. Development of training
C. Development of monitoring
D. Development of testing
- A. Standards need to be developed that outline proper configuration management processes and approved baseline configuration settings. Once
these standards are developed and put into place, then employees can be trained on these issues and how to implement and maintain what is outlined
in the standards. Systems can be tested against what is laid out in the standards, and systems can be monitored to detect if there are configurations that do not meet the requirements outlined in the standards. You will find that some CISSP
questions seem subjective and their answers hard to pin down. Questions that ask what is “best” or “more likely” are common
Policy Protect the CIA of PII by hardening the operating system is considered
Mandatory
Discretionary
Mandatory
Procedure is considered
Step 1: Install prehardened OS Image.
Step 2: Download patches from update server.
Step 3: …
Mandatory
Discretionary
Mandatory
Standard Use Nexus-6 laptop hardware Mandatory is considered
Mandatory
Discretionary
Mandatory
Guideline Patch installation may be automated via the
use of an installer script is considered
Mandatory
Discretionary
Discretionary
Baselines Use the CIS Security Benchmarks Windows is considered
Mandatory
Discretionary
Discretionary
Your company sells Apple iPods online and has suffered many denial-of-service (DoS) attacks. Your company makes an average $20,000 profit per week, and a typical DoS attack lowers sales by 40%. You suffer seven DoS attacks on average per year. A DoS-mitigation service is available for a subscription fee of $10,000 per month. You have tested this service and believe it will mitigate the attacks.
- What is the ARO in the above scenario?
(a) $20,000
(b) 40%
(c) 7
(d) $10,000
- Correct answer and explanation: C. The ARO is the number of attacks in a year.Incorrect answers and explanations: Answers A, B, and D are incorrect. The
AV is $20,000. The EV is 40% and the monthly cost of the DoS service (used to
calculate TCO) is $10,000.
Your company sells Apple iPods online and has suffered many denial-of-service (DoS) attacks. Your company makes an average $20,000 profit per week, and a typical DoS attack lowers sales by 40%. You suffer seven DoS attacks on average per year. A DoS-mitigation service is available for a subscription fee of $10,000 per month. You have tested this service and believe it will mitigate the attacks.
- What is the ALE of lost iPod sales due to the DoS attacks?
(a) $20,000
(b) $8000
(c) $84,000
(d) $56,000
- Correct answer and explanation: D. The ALE is derived by first calculating the SLE, which is the AV, $20,000, multiplied by the EF, 40%.
The SLE is $8000, which is multiplied by the ARO of 7 for an ALE of $56,000.
Incorrect answers and explanations: Answers A, B, and C are incorrect. $20,000 is the AV, while $8000 is the SLE.
Your company sells Apple iPods online and has suffered many denial-of-service (DoS) attacks. Your company makes an average $20,000 profit per week, and a typical DoS attack lowers sales by 40%. You suffer seven DoS attacks on average per year. A DoS-mitigation service is available for a subscription fee of $10,000 per month. You have tested this service and believe it will mitigate the attacks.
- Is the DoS mitigation service a good investment?
(a) Yes, it will pay for itself.
(b) Yes, $10,000 is less than the $56,000 ALE.
(c) No, the annual TCO is higher than the ALE.
(d) No, the annual TCO is lower than the ALE
- Correct answer and explanation: C. The TCO of the DoS mitigation service is higher than ALE of lost sales due to DoS attacks. This means it is less expensive to accept the risk of DoS attacks or to find a less expensive mitigation strategy.Incorrect answers and explanations: Answers A, B, and D are incorrect. The
annual TCO is higher, not lower. $10,000 is the monthly TCO; you must calculate yearly TCO to compare with the ALE.
4.Which canon of The (ISC)2® Code of Ethics should be considered the most
important?
(a) Protect society, the commonwealth, and the infrastructure
(b) Advance and protect the profession
(c) Act honorably, honestly, justly, responsibly, and legally
(d) Provide diligent and competent service to principals
- Correct answer and explanation: A. The canons are applied in order and “To protect society, the commonwealth, and the infrastructure” is the first canon, and is thus the most important of the four canons of The (ISC)2 Code of Ethics.
Incorrect answers and explanations:
Answers B, C, and D are incorrect.
The canons of The (ISC)2 Code of Ethics are presented in order of importance.
The second canon requires the security professional to act honorably, honestly, justly, responsibly, and legally.
The third mandates that professionals provide
diligent and competent service to principals.
The final and therefore least important canon wants professionals to advance and protect the profession.
Which of the following is NOT a component of the CIA triad?
A. Confidentiality
B. Integrity
C. Availability
D. Privacy
Answer: D. Privacy
Explanation: The CIA triad consists of confidentiality, integrity, and availability. Privacy is an important security concept but not part of the CIA
triad
Which of the following is NOT a category of access control?
A. Physical
B. Administrative
C. Technical
D. Financial
Answer: D. Financial
Explanation: Access control has three categories:
physical, administrative, and technical. Financial is
not a category of access control.
What is the primary goal of a security risk assessment?
A. To eliminate all risks
B. To reduce risks to an acceptable level
C. To identify all possible risks
D. To transfer all risks to a third party
Answer: B. To reduce risks to an acceptable level
Explanation: The primary goal of a security risk
assessment is to identify and analyze risks and then
develop strategies to reduce them to an acceptable
level.
Which of the following is an example of symmetric key cryptography?
A. RSA
B.AES
C. ElGamal
D.Diffie-Hellman
Answer: B. AES
Explanation: AES is a symmetric key algorithm, meaning the same key is used for encryption and decryption. RSA, Diffie-Hellman, and ElGamal are
examples of asymmetric key algorithms.
Which of the following is NOT a common Software Development Life Cycle (SDLC) model?
A. Waterfall
B. Agile
C. Spiral
D. Sequential
Answer: D. Sequential
Explanation: There is no SDLC model called sequential. The most common SDLC models are Waterfall, Agile, and Spiral.
What is the primary purpose of a firewall?
A. To prevent unauthorized access to a network
B. To detect and remove viruses from a network
C. To provide secure remote access to a network
D. To encrypt all network traffic
Answer: A. To prevent unauthorized access to a network
Explanation: The primary purpose of a firewall is to prevent unauthorized access to a network by blocking traffic that does not meet specific criteria.
Which of the following is NOT an example of a physical security control?
A. Security cameras
B. Biometric scanners
C. Firewalls
D. Fences
Answer: C. Firewalls
Explanation: Firewalls are an example of technical security control, not physical security. Physical security controls include security cameras, biometric scanners, and fences.
Which of the following is NOT a type of encryption key?
A. Public key
B. Private key
C. Session key
D. Public-private key
Answer: D. Public-private key
Explanation: There is no such thing as a public private key. Public key encryption uses a public and private key, while symmetric key encryption uses a session key.
Which of the following is an example of security control that falls under the security operations domain?
A. Penetration testing
B. Security awareness training
C. Access control
D. Application security testing
Answer: B. Security awareness training
Explanation: Security awareness training is a security control that falls under the security operations domain. It aims to educate employees about their responsibilities in maintaining the organization’s security posture and helps them recognize and respond to potential threats.Penetration testing is not a correct answer because it
falls under the Security Assessment and Testing domain, which involves evaluating an organization’s security posture by simulating real-world attacks. Access control is not a correct answer because it falls under the Identity and Access Management (IAM) domain, which deals with controlling who has access to resources and ensuring that only authorized individuals can access those resources. Application security testing is not a correct answer because it falls under the Software Development security domain, which focuses on ensuring the security of applications throughout their development life cycle.
Which of the following is NOT a security incident response plan component?
A. Preparation
B. Detection
C. Mitigation
D. Penetration
Answer: D. Penetration
Explanation: Penetration is not a component of a security incident response plan. The three primary components of a security incident response plan are preparation, detection, and mitigation. Preparation involves developing policies, procedures, and controls to prevent security incidents from occurring. Detection consists of identifying and analyzing security incidents when they occur. Mitigation consists of responding to and containing the impact of security incidents and preventing similar incidents from occurring.
Which of the following is an example of technical security control?
A. Background checks
B. Security awareness training
C. Intrusion detection system
D. Facility access controls
Answer: C. Intrusion detection system
Explanation: Technical security controls use technology to prevent, detect, or respond to security threats. Examples include firewalls, antivirus software, and intrusion detection systems.
Which of the following is NOT an example of a common authentication factor?
A. Something you know
B. Something you have
C. Something you are
D. Something you want
Answer: D. Something you want
Explanation: The three common authentication factors are something you know (e.g., password), something you have (e.g., token), and something you are (e.g., biometric). Something you want is not a recognized authentication factor.
Which of the following is a security control that falls under the security assessment and testing domain?
A. Change management
B. Vulnerability scanning
C. Disaster recovery
D. Incident response
Answer: B. Vulnerability scanning
Explanation: Vulnerability scanning is a security control under the security assessment and testing domain. It involves scanning a system for known
vulnerabilities and weaknesses.
Which of the following is NOT a common type of access control model?
A. Discretionary access control (DAC)
B. Mandatory access control (MAC)
C. Role-based access control (RBAC)
D. Access control list (ACL)
Answer: D. Access control list (ACL)
Explanation: Access control lists (ACLs) are a common implementation of access control but are not themselves an access control model. The three common access control models are discretionary access control (DAC), mandatory access control (MAC), and role-based access control (RBAC).
Which of the following is a key consideration when designing a secure network architecture?
A. High availability
B. Low cost
C. Easy administration
D. High bandwidth
Answer: A. High availability
Explanation: A key consideration when designing asecure network architecture is ensuring the high availability of critical services and resources. While cost, administration, and bandwidth are also important, they are secondary to availability in the context of security.
What is the purpose of a security baseline?
A. To establish the minimum-security requirements for a system or application
B. To identify and prioritize security risks based on their potential impact
C. To monitor and report on security events and incidents
D. To test the effectiveness of security controls in a simulated attack environment
Answer: A. To establish the minimum-securityrequirements for a system or application
Explanation: A security baseline is a set of minimum-security requirements that a system or application must meet to be considered secure. It serves as a starting point for security configuration and helps ensure security controls are implemented
consistently across the organization.
Which of the following is NOT a common method of authentication?
A. Password
B. Certificate
C. Token
D. Proxy
Answer: D. Proxy
Explanation: Proxy is not a method of authentication. The three common methods of authentication are something you know (e.g.,password), something you have (e.g., token), and something you are (e.g., biometric). The certificate is a type of token-based authentication.
What is the primary goal of a security audit?
A. To identify and assess security risks
B. To monitor and report on security events and incidents
C. To test the effectiveness of security controls
D. To ensure compliance with security policies and standards
Answer: D. To ensure compliance with security
policies and standards
Explanation: A security audit systematically evaluates an organization’s security policies, standards, and procedures to ensure compliance with established security requirements
Which of the following is a key principle of secure software development?
A. Agile development
B. Security by design
C. Minimum viable product
D. Continuous integration
Answer: B. Security by design
Explanation: Security by design is a key principle of secure software development that involves considering security requirements throughout the entire Software Development Life Cycle rather than as an afterthought.
Which of the following is NOT a key component of an incident response plan?
A. Preparation
B. Detection and analysis
C. Containment, eradication, and recovery
D. Termination
Answer: D. Termination
Explanation: Termination is not a key component of an incident response plan. The three primary components are preparation, detection and analysis, and containment, eradication, and recovery.
Which of the following are NOT examples of a non repudiation control?
A. Digital signatures
B. Audit trails
C. Two-factor authentication
D. Passwords
Answer: C. Two-factor authentication and D. Passwords
Explanation: Non-repudiation controls prevent the denial of an action or transaction. Digital signatures and audit trails are examples of non-repudiation controls, as they prove a transaction’s origin and integrity. Two-factor authentication provides authentication and authorization but does not prevent repudiation. Passwords are not a non-repudiation control.
Which of the following is NOT an example of technical security control?
A. Firewalls
B. Biometric authentication
C. Background checks
D. Intrusion detection systems
Answer: C. Background checks
Explanation: Background checks are a type of administrative security control, not a technical security control. Technical security controls involve using technology to prevent, detect, or respond to security threats.
Which of the following is crucial when designing a secure network topology?
A. Network bandwidth
B. Network latency
C. Network availability
D. Network throughput
Answer: C. Network availability
Explanation: Network availability is crucial when designing a secure network topology. The network must be designed to ensure that critical services and resources are available when needed while minimizing downtime and disruption in an attack or failure.
Which of the following is a crucial principle of secure software development?
A. Continuous delivery
B. Code obfuscation
C. Defense in depth
D. Secure coding
Answer: D. Secure coding
Explanation: Secure coding is a key principle of secure software development that involves writing code free from security vulnerabilities and exploits. This helps prevent the introduction of security weaknesses into the software and reduces the risk of
a successful attack.
Which of the following is NOT a type of access control?
A. Identity verification
B. Authorization
C. Accountability
D. Authentication
Answer: C. Accountability
Explanation: Accountability is not a type of access control but rather a concept related to responsibility and liability for actions taken. The three common types of access control are authentication, authorization, and audit/monitoring.
Which of the following is a crucial benefit of using cloud computing for security?
A. Increased control over data security
B. Improved physical security of data centers
C. Reduced risk of insider threats
D. Improved disaster recovery capabilities
Answer: D. Improved disaster recovery capabilities
Explanation: Cloud computing can improve disaster recovery by providing redundant infrastructure and data backups in multiple locations. While cloud providers may also offer enhanced physical security and other benefits, improved disaster recovery is a key benefit for protection.
Which of the following is crucial when designing secure Mobile Device Management?
A. Protecting against insider threats
B. Providing high-bandwidth connectivity
C. Ensuring device compatibility with all apps
D. Enforcing data encryption and access control
policies
Answer: D. Enforcing data encryption and access control policies
Explanation: Enforcing data encryption and access control policies is a key consideration for secure Mobile Device Management. Mobile devices are highly portable and often contain sensitive data, making encryption and access control critical for protecting against unauthorized access or data loss.
Which of the following is a key principle of secure password management?
A. Requiring password changes every 90 days
B. Using long, complex passwords
C. Storing passwords in a centralized database
D. Sharing passwords with trusted colleagues
Answer: B. Using long, complex passwords
Explanation: Using long, complex passwords is a key principle of secure password management Requiring password changes too frequently can lead to weaker passwords while storing passwords in a centralized database or sharing passwords increases the risk of unauthorized access.
Which of the following is NOT a common type of
access control model?
A. Role-based access control (RBAC)
B. Mandatory access control (MAC)
C. Discretionary access control (DAC)
D. Hierarchical access control (HAC)
Answer: D. Hierarchical access control (HAC)
Explanation: Hierarchical access control (HAC) is not a recognized access control model. The three common access control models are role-based access control (RBAC), mandatory access control (MAC), and discretionary access control (DAC).
Which of the following is a key consideration when designing secure network segmentation?
A. Maximizing network throughput
B. Minimizing network latency
C. Isolating critical systems and resources
D. Providing open access to all users
Answer: C. Isolating critical systems and resources
Explanation: Isolating critical systems and resources is a key consideration when designing secure network segmentation. Segmenting the network can help limit the impact of a security breach or failure, but it is important to ensure that critical systems and resources are properly isolated and protected.
Which of the following is a primary consideration when designing secure virtualization environments?
A. Providing unrestricted access to virtual resources
B. Ensuring compatibility with all virtualization platforms
C. Securing virtual machine images and snapshots
D. Maximizing virtual machine density
Answer: C. Securing virtual machine images and snapshots
Explanation: Securing virtual machine images and snapshots is a key consideration when designing secure virtualization environments. Virtual machines can be easily copied or cloned, potentially exposing sensitive data or allowing unauthorized access. Proper security measures must be taken to secure virtual machine images and snapshots.
Which of the following is a critical principle of secure
network design?
A. Maximizing network throughput
B. Minimizing network complexity
C.
Providing unrestricted access to all network
resources
D.
Using open standards and protocols
Answer: B. Minimizing network complexity
Explanation: Minimizing network complexity is a key principle of secure network design. Complex networks are more difficult to manage and secure and can increase the risk of security breaches or failures. Simplifying the network and reducing complexity can help improve security.
Which of the following is NOT a type of vulnerability?
A. Zero-day vulnerability
B. Privilege escalation vulnerability
C. Buffer overflow vulnerability
D. Social engineering vulnerability
Answer: D. Social engineering vulnerability
Explanation: Social engineering is a technique that manipulates people into divulging sensitive information or performing actions that compromise security. It is not a type of vulnerability. The three types of vulnerabilities listed are commonly found in
software or systems.
Which of the following is a crucial consideration when designing secure cloud architecture?
A. Maximizing control over cloud infrastructure
B. Using proprietary cloud technologies
C. Ensuring compliance with applicable regulations
and standards
D. Avoiding the use of third-party cloud providers
Answer: C. Ensuring compliance with applicable regulations and standards
Explanation: Ensuring compliance with applicable regulations and standards is a key consideration when designing secure cloud architecture. Cloud providers must comply with various regulations and standards, such as GDPR or HIPAA, depending on the industry and the data stored in the cloud.
Which of the following is a key principle of secure
application development?
A. Requiring all code to be written in-house
B. Using open source libraries and frameworks
C. Implementing secure coding practices
D. Focusing on functionality over security
Answer: C. Implementing secure coding practices
Explanation: Implementing secure coding practices is a key principle of secure application development. Secure coding involves writing code free from security vulnerabilities and exploits and incorporating security considerations throughout the Software Development Life Cycle.
Which of the following is a primary consideration when implementing secure remote access?
A. Providing unrestricted access to all network resources
B. Using weak authentication mechanisms
C. Minimizing network segmentation and access controls
D. Enforcing strong encryption and access controls
Answer: D. Enforcing strong encryption and access controls
Explanation: Enforcing strong encryption and access controls is a key consideration when implementing secure remote access. Remote access can expose sensitive data and resources to unauthorized access, so it is important to use strong authentication mechanisms and enforce proper access controls
Which of the following is an essential principle of secure data classification?
A. Treating all data as sensitive and confidential
B. Using open data standards and formats
C. Applying consistent data classification criteria
D. Allowing data to be stored on any device or
platform
Answer: C. Applying consistent data classification criteria
Explanation: Applying consistent data classification criteria is a key principle of secure data classification. Data classification involves categorizing data based on its sensitivity and value and applying appropriate security controls based on the classification. Consistency in classification criteria helps ensure that data is properly protected across the organization.
Which of the following is NOT a common type of encryption algorithm?
A. AES
B. RSA
C. SHA-256
D. HMAC
Answer: D. HMAC
Explanation: HMAC (Hash-based Message Authentication Code) is a cryptographic hash function, not an encryption algorithm. The three common encryption algorithms listed are commonly used for encryption and decryption.
Which of the following is a key principle of secure incident response?
A. Ignoring minor incidents to focus on major incidents
B. Minimizing response time to all incidents
C. Conducting thorough post-incident analysis and review
D. Assigning blame and punishing those responsible
Answer: C. Conducting thorough post-incident analysis and review
Explanation: Conducting thorough post-incident analysis and review is a key principle of secure incident response. Incident response involves detecting, analyzing, and responding to security incidents, and conducting a post-incident analysis and review helps identify areas for improvement and strengthen the organization’s security posture.
Which of the following is essential when implementing secure data storage?
A. Maximizing data availability
B. Using open data formats and standards
C. Securing data at rest and in transit
D. Storing all data on a single device or platform
Answer: C. Securing data at rest and in transit
Explanation: Securing data at rest and in transit is a key consideration when implementing secure data storage. Data must be protected against unauthorized access or disclosure, whether stored on disk or transmitted across the network. Encryption and access controls are commonly used to secure data at rest and in transit
Which of the following is a key concept of risk management?
A. Avoid all risks
B. Accept all risks
C. Transfer all risks
D. Risk decisions should be based on the impact on the business
Answer: D. Risk decisions should be based on the impact on the business.
Explanation: Risk decisions should be made case by case, considering the unique context and potential impact on the business. A one-size-fits-all approach to risk management is not effective. Instead, an organization should evaluate each risk regarding its potential impact and decide the most appropriate risk response strategy: accept, avoid, transfer, or mitigate.
What is the purpose of data classification?
A. To ensure data privacy
B. To ensure data integrity
C. To ensure data availability
D. To facilitate appropriate levels of protection
based on value or sensitivity
Answer: D. To facilitate appropriate levels of protection based on value or sensitivity.
Explanation: Data classification is essential to an organization’s information security strategy. By classifying data, organizations can apply appropriate levels of protection to sensitive information and ensure that resources are allocated efficiently.
What is the primary purpose of a firewall in network security?
A. To facilitate network routing
B. To control network traffic based on predetermined security rules
C. To encrypt network traffic
D. To store network data
Answer: B. To control network traffic based on predetermined security rules
Explanation: A firewall is a network security device that monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules. It is a critical piece of a network security infrastructure and can help prevent unauthorized access to or from a network.
What is the primary aspect of security in the Software Development Life Cycle?
A. Using a single programming language
B. Testing the software only at the end of the development
C. Integrating security throughout the life cycle, including design, development, and testing
D. Ignoring security during development and adding it later
Answer: C. Integrating security throughout the life cycle, including design, development, and testing.
Explanation: Security should be a key consideration throughout the entire software development life cycle, not just at the end. This approach, often called “security by design,” helps ensure that security is integrated into the software from the ground up and can help identify and mitigate vulnerabilities early in the development process.
Which type of access control model uses labels and
levels of protection to determine access?
A. Role-based access control (RBAC)
B. Discretionary access control (DAC)
C. Mandatory access control (MAC)
D. None of the above
Answer: C. Mandatory access control (MAC)
Explanation: Mandatory access control (MAC) uses labels (often reflecting different sensitivity levels, such as confidential, secret, and top secret) to determine access. In a MAC model, users do not have the discretion to determine who has access to the
information they own or control.
What is the primary goal of a business continuity plan (BCP)?
A. To provide a framework for building network infrastructure
B. To establish steps to take for immediate response to a security incident
C. To ensure the continuation of business processes during and after a disruption
D. To provide a framework for prosecuting hackers
Answer: C. To ensure the continuation of business processes
Explanation: The primary goal of a business continuity plan (BCP) is to ensure the continuation of business processes during and after a disruption. The BCP is a comprehensive plan to maintain or resume business during a disruption.
In the context of cryptography, what does “integrity” ensure?
A. That the data is accessible when needed
B. That the data has not been altered during transmission
C. That the data is kept confidential
D. That the sender of the data can be authenticated
Answer: B. That the data has not been altered during transmission
Explanation: In cryptography, “integrity” ensures that the data has not been altered during transmission. Alteration can be accidental, such as data corruption during transmission, or intentional, such as a malicious attack
What is the primary purpose of penetration testing?
A. To gain unauthorized access to systems for malicious purposes
B. To evaluate the effectiveness of security controls
C. To troubleshoot network connectivity issues
D. To monitor network traffic in real time
Answer: B. Evaluate the effectiveness of security controls
Explanation: The primary purpose of penetration testing is to evaluate the
effectiveness of security controls by simulating an attack. By identifying
vulnerabilities and testing security measures, organizations can better understand their security posture and make informed decisions about risk management.
What is a key concept of identity and access management?
A. Granting every user full access to all systems
B. Granting users the minimum access necessary to perform their job function
C. Not revoking access rights when a user changes roles
D. Allowing shared accounts for convenience
Answer: B. Granting users the minimum access necessary to perform their job function
Explanation: A key principle of Identity and Access Management is granting users the minimum access necessary to perform their job functions. This principle, known as the principle of least privilege, is critical for reducing the risk of unauthorized access or actions.
Which one of the following is NOT a part of the CIA
triad in information security?
A. Confidentiality
B. Integrity
C. Availability
D. Authenticity
Answer: D. Authenticity
Explanation: The CIA triad in information security stands for confidentiality, integrity, and availability. While authenticity is an important concept in information security, it is not a part of the CIA triad.
What does the term “least privilege” mean in the context of information security?
A. Granting users only the permissions they need to perform their job functions
B. Giving all users the same level of access to information
C. Limiting access to information to the highest ranking individuals in an organization
D. Granting all users full access to information but tracking their activities
Answer: A. Granting users only the permissions they need to perform their job functions
Explanation: The principle of least privilege is a computer security concept in which users are given the minimum access necessary to complete their job functions. This helps to reduce the potential damage caused by errors or malicious actions.
Which of the following best describes “phishing”?
A. A method of securing a network by blocking certain websites
B. An attack that involves sending deceptive emails to trick individuals into revealing sensitive information
C. A physical security measure used to protect sensitive information
D. A type of malware that replicates itself across a network
Answer: B. An attack that involves sending deceptive emails to trick individuals into revealing sensitive information
What does “IDS” stand for in the context of information security?
A. Information Data System
B. Integrated Defense Strategy
C. Intrusion Detection System
D. Internal Domain Security
Answer: C. Intrusion detection system
Explanation: In the context of information security, IDS stands for intrusion detection system. A device or software application monitors a network or systems for malicious activity or policy violations.
What type of security control is a biometric scanner?
A. Physical
B. Technical
C. Administrative
D. Operational
Answer: B. Technical
Explanation: A biometric scanner is technical security control. Technical controls are often hardware or software tools, such as firewalls, encryption, and authentication mechanisms, like biometric scanners, designed to protect systems and data.
What are the three primary components of risk?
A. Threat, consequence, vulnerability
B. Impact, threat, vulnerability
C. Asset, threat, impact
D. Asset, impact, consequence
Answer: B. Impact, threat, vulnerability
Explanation: Risk is typically composed of three components: threat (a potential cause of an incident that may result in harm), vulnerability (a weakness that can be exploited by a threat), and impact (the potential harm caused by a threat exploiting a vulnerability)
Which risk treatment option involves an organization deciding to tolerate a risk without implementing additional controls?
A. Risk avoidance
B. Risk mitigation
C. Risk transfer
D. Risk acceptance
Answer: D. Risk acceptance
Explanation: Risk acceptance is when an organization decides to acknowledge a risk but does not implement additional controls or measures to address it. The other options (avoidance, mitigation,
and transfer) all involve taking some action to address
the risk.
Which of the following is NOT a component of the ISC2 Code of Ethics?
A. Protect society and the infrastructure
B. Act honorably, honestly, and legally
C. Provide diligent and competent service
D. Prioritize personal gain over professional duties
Answer: D. Prioritize personal gain over professional duties
Explanation: The ISC2 Code of Ethics includes the principles of protecting society and the infrastructure; acting honorably, honestly, and legally; and providing diligent and competent service. Prioritizing personal gain over professional duties is contrary to the ethical principles outlined by ISC2.
In the context of business continuity and disaster recovery planning, what does it mean to “identify critical business functions”?
A. Determining the most essential functions and processes of the organization
B. Identifying potential disruptions to business functions
C. Implementing recovery plans for all business functions
D. Regularly testing business functions for potential disruptions
Answer: A. Determining the most essential functions and processes of the organization
Explanation: Identifying critical business functions involves determining the most essential functions and processes of the organization, which should be prioritized for recovery during an incident. This is a crucial first step in business continuity and disaster recovery planning. The other options are also part of the planning process, but they do not define what it means to “identify critical business functions.”
Which of the following best describes a qualitative risk assessment?
A. It uses numerical values to estimate risk.
B. It relies on subjective judgments to rank risk.
C. It calculates the financial value of a risk.
D. It identifies the vulnerabilities that might be
exploited by threats.
Answer: B. It relies on subjective judgments to rank risk.
Explanation: A qualitative risk assessment uses subjective judgments and expert opinions to rank risks, often categorizing them as low, medium, or
high. In contrast, a quantitative risk assessment uses numerical values and calculations to estimate risks.
What does the asset valuation method of “business impact” involve?
A. Calculating the cost of maintaining or replacing an asset
B. Determining the asset’s worth based on market demand
C. Evaluating the potential impact on operations if the asset is compromised
D. Considering the asset’s contribution to the organization’s intellectual property
Answer: C. Evaluating the potential impact on operations if the asset is compromised
Explanation: The “business impact” asset valuation method involves evaluating the potential impact on the organization’s operations, reputation, or bottom line if the asset is compromised. The other options
correspond to different asset valuation methods: “financial value,” “market value,” and “intangible value,” respectively.
Which of the following is NOT a key element of effective risk
communication and reporting effective risk communication and reporting?
A. Clarity
B. Timeliness
C. Consistency
D. Complexity
Answer: D. Complexity
Explanation: Effective risk communication and reporting should be clear, timely, and consistent. Complexity, particularly in the form of jargon and
technical terms, can actually hinder effective communication and should be avoided when possible.
Which of the following activities is NOT involved in regular risk monitoring and review?
A. Tracking risk treatment progress
B. Reviewing risk assessments
C. Analyzing incident reports
D. Implementing risk treatment plans
Answer: D. Implementing risk treatment plans
Explanation: Regular risk monitoring and review involves tracking risk treatment progress, reviewing risk assessments, and analyzing incident reports. Implementing risk treatment plans is part of risk treatment, not monitoring and review.
In the context of compliance and regulatory considerations, what does it mean to “conduct compliance audits”?
A. Determine which laws and regulations apply to the organization
B. Establish policies and procedures that address legal and regulatory requirements
C. Perform regular assessments of the organization’s adherence to relevant laws and regulations
D. Develop and maintain incident response plans
Answer: C. Perform regular assessments of the organization’s adherence to relevant laws and regulations
Explanation: Conducting compliance audits involves performing regular assessments to check if the organization is adhering to relevant laws and
regulations. This process helps to identify any deviations or noncompliance issues, which can then be addressed to avoid legal penalties, reputational damage, and other negative consequences. Options A,B, and D are all important components of a compliance program but do not accurately define the term “conduct compliance audits.
Which one of the following is not a risk treatment option?
A. Risk acceptance
B. Risk avoidance
C. Risk mitigation
D. Risk expansion
Answer: D. Risk expansion
Explanation: Risk expansion is not a recognized risk treatment option. The commonly accepted risk treatment options are risk acceptance, risk avoidance, risk mitigation, and risk transfer.
What does FAIR in the risk management framework stand for?
A. Factual Analysis of Intrinsic Risk
B. Factor Analysis of Information Risk
C. Formal Assessment of Incident Response
D. Functional Analysis of Infrastructure Resilience
Answer: B. Factor Analysis of Information Risk
Explanation: FAIR stands for Factor Analysis of Information Risk. It offers a quantitative approach to risk management, enabling organizations to measure and prioritize risks using financial terms.
What does the risk treatment option “risk transfer” involve?
A. Eliminating the risk by discontinuing the activity that causes it
B. Acknowledging the risk and deciding to tolerate it
C. Implementing controls to reduce the risk
D. Transferring the risk to a third party
Answer: D. Transferring the risk to a third party
Explanation: Risk transfer involves shifting the risk to a third party, such as an insurance company or a service provider.
Which of the following is not a type of control used in risk mitigation strategies?
A. Technical controls
B. Administrative controls
C. Physical controls
D. Emotional controls
Answer: D. Emotional controls
Explanation: Risk mitigation strategies involve technical, administrative, and physical controls. Emotional controls are not a recognized type of
control in risk mitigation.
Which of the following is not a part of the risk assessment process?
A. Identify assets
B. Identify threats
C. Identify vulnerabilities
D. Assess operational efficiency
Answer: D. Assess operational efficiency
Explanation: The risk assessment process involves identifying assets, threats, and vulnerabilities, assessing the potential impact and likelihood of each threat-vulnerability pair, and prioritizing risks. Assessing operational efficiency is not part of this process.
What is the primary purpose of business continuity and disaster recovery planning?
A. To prevent disasters from occurring
B. To prepare for, respond to, and recover from disruptions or disasters
C. To eliminate all risks associated with the organization
D. To ensure all staff are trained in emergency procedures
Answer: B. To prepare for, respond to, and recover rom disruptions or disasters
Explanation: The primary purpose of business continuity and disaster recovery planning is to prepare for, respond to, and recover from disruptions or disasters. While prevention is ideal, it is not always possible, hence the need for preparation, response, and recovery plans.
Which asset valuation methodology considers the asset’s contribution to the organization’s intellectual property, customer trust, or competitive advantage?
A. Financial value
B. Business impact
C. Market value
D. Intangible value
Answer: D. Intangible value
Explanation: Intangible value considers the asset’s contribution to the organization’s intellectual property, customer trust, or competitive advantage. These aspects may not have a direct monetary value but are critical to the organization’s success.
What does the “canons” in the ISC2 Code of Ethics refer to?
A. A list of security technologies
B. A set of fundamental principles
C. A set of regulatory laws
D. A list of cybersecurity certifications
Answer: B. A set of fundamental principles
Explanation: The “canons” in the ISC2 Code of Ethics refer to a set of fundamental principles that guide the ethical and professional behavior of
information security professionals.
What is the primary difference between risk acceptance and risk avoidance?
A. Risk acceptance eliminates the risk, while risk avoidance tolerates the risk.
B. Risk acceptance tolerates the risk, while risk avoidance eliminates the risk.
C. Risk acceptance transfers the risk, while risk avoidance mitigates the risk
D. Risk acceptance mitigates the risk, while risk avoidance transfers the risk.
Answer: B. Risk acceptance tolerates the risk, while risk avoidance eliminates the risk.
Explanation: Risk acceptance involves acknowledging and deciding to tolerate the risk, whereas risk avoidance involves eliminating the risk by discontinuing the activity or process that causes it.
Which of the following is not typically included in a comprehensive enterprise risk management program according to the COSO ERM framework?
A. Risk governance and culture
B. Risk strategy and objective setting
C. Risk in execution and performance
D. Risk in product design and marketing
Answer: B. Risk in product design and marketing
Explanation: The COSO ERM framework includes principles and guidance focusing on risk governance and culture, strategy and objective setting, and risk in execution and performance. Risk in product design and marketing, while important, is not specifically mentioned in the framework.
In the context of risk management, what is the primary role of a quantitative risk assessment?
A. To make subjective judgments about risks
B. To rank risks based on expert opinion
C. To use numerical values to estimate risks
D. To categorize risks as low, medium, or high
Answer: C. To use numerical values to estimate risks
Explanation: Quantitative risk assessment uses numerical values and calculations to estimate potential risks, often in terms of potential financial
impact.
Which of the following is not a primary component of risk, as defined in risk management?
A. Threats
B. Vulnerabilities
C. Impacts
D. Controls
Answer: D. Controls
Explanation: Controls are not a component of risk but are measures taken to mitigate risk. The primary components of risk are threats, vulnerabilities, and potential impacts.
What does the NIST SP 800-37 framework primarily provide guidelines for?
A. Implementing an information security risk management process
B. Implementing a risk management process for federal information systems
C. Providing a quantitative approach to risk management
D. Developing a comprehensive enterprise risk management program
Answer: B. Implementing a risk management process
for federal information systems
Explanation: The NIST SP 800-37 framework primarily provides guidelines for implementing a risk management process for federal information systems.
What is one key element of effective risk communication and reporting?
A. Using complex technical terms to explain risks
B. Communicating risks as infrequently as possible
C. Presenting information in a clear and understandable
D. Presenting information in a clear and understandable manner
Answer: D. Presenting information in a clear and understandable manner
Explanation: Effective risk communication and reporting involve presenting risk-related information clearly, timely, and concisely. This allows stakeholders at all levels, regardless of their technical
expertise, to comprehend the risks and make informed decisions. Option A is incorrect as complex technical terms can make the information harder to understand, especially for nontechnical stakeholders.
Option B is also incorrect as frequent communication of risk-related information is crucial to keep all stakeholders informed and aware of the current risk landscape.
In the context of risk management, why is it important to integrate risk management into an organization’s business processes?
A. It helps to increase the number of risks the organization faces.
B. It allows risk considerations to be part of decision-making processes and overall business strategy.
C. It ensures that risks are only handled by the risk management department.
D. It reduces the need for regular risk monitoring and review.
Answer: B. It allows risk considerations to be part of decision-making processes and overall business strategy.
Explanation: Integrating risk management into an organization’s business processes ensures that risk considerations are incorporated into all aspects of the business, including decision-making processes, resource allocation, and strategic planning. This approach promotes a risk-aware culture and allows the organization to proactively manage risks rather
than reactively responding to them
Which of the following best describes risk acceptance?
A. The organization reduces the risk by implementing controls.
B. The organization acknowledges the risk and decides to tolerate it.
C. The organization transfers the risk to a third party.
D. The organization eliminates the risk source.
Answer: B. The organization acknowledges the risk and decides to tolerate it.
Explanation: Risk acceptance involves acknowledging risk and deciding to tolerate it without implementing additional controls. This typically
occurs when the cost of mitigating the risk exceeds the potential benefit or when the risk is deemed to have a low impact on the organization.
What is the primary purpose of asset valuation in the context of risk management?
A. To estimate the direct monetary value of an asset
B. To identify potential threats to the asset
C. To assess the potential impact and likelihood of threats to the asset
D. To prioritize the asset for risk treatment
Answer: A. To estimate the direct monetary value of an asset
Explanation: Asset valuation involves assigning a value to an organization’s assets, such as hardware, software, data, or personnel. This value can be based on various factors, including the cost of purchasing, maintaining, or replacing the asset; its potential impact on the organization’s operations or reputation; its market value; or its intangible value.
Which of the following is a key component of effective risk communication and reporting?
A. Using complex technical terms and jargon
B. Communicating risks and risk management activities irregularly
C. Tailoring the content and format of risk reports to the needs of the intended audience
D. Keeping risk communication and reporting inconsistent across the organization
Answer: C. Tailoring the content and format of risk reports to the needs of the intended audience
Explanation: Effective risk communication and reporting should be tailored to the needs and preferences of the intended audience. This includes presenting information in a clear, concise, and understandable manner; communicating risks and risk management activities regularly; and maintaining consistency in risk communication and reporting across the organization
What is the main goal of business continuity and disaster recovery planning?
A. To eliminate all risks faced by the organization
B. To ensure that the organization can continue operating during and after a disruption or disaster
C. To prioritize risks for treatment
D. To transfer the financial risk of a disruption or disaster to a third party
Answer: B. To ensure that the organization can continue operating during and after a disruption or disaster
Explanation: Business continuity and disaster recovery planning aim to ensure that an organization can continue its critical operations during and after a disruption or disaster This involves identifying disruption or disaster. This involves identifying critical business functions, assessing potential disruptions, developing recovery strategies, implementing recovery plans, and regularly testing and maintaining these plans.
According to the ISC2 Code of Ethics, which of the following is a primary ethical obligation of a security professional?
A. To advance one’s own professional interests
B. To provide diligent and competent service to principals
C. To avoid service to the community
D. To use their skills primarily for personal gain
Answer: B. To provide diligent and competent service to principals
Explanation: According to the ISC2 Code of Ethics, a primary ethical obligation of a security professional is to provide diligent and competent service to principals. This means that security professionals should strive to serve their employers, clients, and other stakeholders with the highest level of professionalism.
Which of the following is not a type of control mentioned in the risk mitigation strategies?
A. Technical
B. Administrative
C. Physical
D. Spiritual
D.
Spiritual
Which of the following is a key component of the risk monitoring and review process?
A. Ignoring risk treatment progress
B. Avoiding reviewing risk assessments
C. Tracking risk treatment progress
D. Omitting incident report analysis
Answer: C. Tracking risk treatment progress
Explanation: Tracking risk treatment progress is a key component of the risk monitoring and review process. Other elements include reviewing risk
assessments, analyzing incident reports, and evaluating the overall effectiveness of the risk management program
How does integrating risk management into an organization’s business processes benefit the organization?
A. It decreases the organization’s profitability.
B. It ensures that risk considerations are part of decision-making processes.
C. It eliminates all the risks faced by the organization.
D. It restricts stakeholder involvement.
Answer: B. It ensures that risk considerations are part of decision-making processes.
Explanation: Integrating risk management into an organization’s business processes helps ensure that risk considerations are part of decision-making processes, resource allocation, and overall business strategy. This can help the organization make better informed decisions and mitigate potential risks more effectively.
Which of the following activities is not a part of compliance and regulatory considerations?
A. Identifying applicable laws and regulations
B. Developing policies and procedures
C. Ignoring compliance audits
D. Implementing incident response plans
Answer: C. Ignoring compliance audits
Explanation: Ignoring compliance audits is not a part of compliance and regulatory considerations. Regular audits are important for assessing the
organization’s compliance with relevant laws and regulations and identifying potential gaps or areas for improvement.
Which of the following risk treatment options involves transferring the risk to a third party?
A. Risk acceptance
B. Risk avoidance
C. Risk mitigation
D. Risk transfer
Answer: D. Risk transfer
Explanation: Risk transfer is a risk treatment option that involves transferring the risk to a third party, such as an insurance company or a service provider.
What does the intangible value of an asset refer to in the context of asset valuation methodologies?
A. The asset’s direct monetary value
B. The asset’s market demand
C. The asset’s contribution to the organization’s intellectual property or customer trust
D. The asset’s impact on the organization’s operations
Answer: C. The asset’s contribution to the organization’s intellectual property or customer trust
Explanation: The intangible value of an asset refers to nonmonetary aspects such as its contribution to the organization’s intellectual property, customer trust, or competitive advantage.
What is the most effective method to ascertain the value of an intangible asset?
A. Calculate the physical storage costs and multiply by the company’s projected lifespan
B. Engage a financial or accounting expert to determine the asset’s profit returns
C. Examine the intangible asset’s depreciation over the previous three years
D. Refer to the historical cost of acquiring or developing the intangible asset
Answer: B. Engage a financial or accounting expert to determine the asset’s profit returns
Explanation: The value of an intangible asset is
best determined by assessing its economic benefits,
such as the profits it generates. A financial or
accounting professional would be most equipped to
calculate this
What is the key characteristic of qualitative risk assessment?
A. It can be executed easily and by individuals with basic knowledge of the risk assessment process.
B. It can be executed by individuals with basic knowledge of risk assessment and utilizes specific metrics for risk calculation.
C. It uses specific metrics for risk calculation and can be easily implemented.
D. It can be done by individuals with limited risk assessment knowledge and utilizes specific metrics for risk calculation.
Answer: A. It can be executed easily and by individuals with basic knowledge of the risk assessment process.
Explanation: Qualitative risk assessment is characterized by its simplicity and the ability to be performed by individuals with a basic understanding
of the process. It does not rely heavily on specific metrics or calculations; rather, it uses descriptions or categories to assess and prioritize risks.
How is Single Loss Expectancy (SLE) computed?
A. By multiplying the asset value and the Annualized Rate of Occurrence (ARO)
B. By using asset value, Local Annual Frequency Estimate (LAFE), and Standard Annual Frequency Estimate (SAFE)
C. By multiplying the asset value and exposure factor
D. By using the Local Annual Frequency Estimate and the Annualized Rate of Occurrence
Answer: C. By multiplying the asset value and exposure factor
Explanation: Single Loss Expectancy (SLE) is calculated by multiplying the asset value (how much the asset is worth) by the exposure factor (the
proportion of the asset that is lost in the event of an
incident).
What are the factors to consider when deciding on the type of risk assessment to perform?
A. Organizational culture, probability of exposure, and budget
B. Budget, resource capabilities, and probability of exposure
C. Resource capabilities, probability of exposure, and budget
D. Organizational culture, budget, and resource capabilities
Answer: D. Organizational culture, budget, and resource capabilities
Explanation: The type of risk assessment to be performed in an organization is influenced by various factors. These include the organizational culture (which can determine the acceptance and
understanding of the assessment process), the available budget (which can limit or extend the scope and depth of the assessment), and resource
capabilities (which can impact the ability to perform certain types of assessments). While the probability of exposure is a factor in risk assessment, it is part of the assessment process itself rather than a
determining factor in the type of risk assessment to
be conducted.
What does security awareness training encompass?
A. Legal security compliance objectives
B. Security roles and responsibilities of staff
C. High-level results of vulnerability assessments
D. Specialized curriculum tasks, coursework, and an accredited institution
Answer: B. Security roles and responsibilities of staff
Explanation: Security awareness training typically covers the roles and responsibilities of staff regarding security. It aims to equip them with the knowledge they need to recognize and respond appropriately to
security threats.
What is the purpose of a signed user acknowledgment of the corporate security policy?
A. To ensure that users have read the policy
B. To ensure that users understand the policy, as well as the consequences of not adhering to the policy
C. Can be waived if the organization is satisfied that users have a good understanding of the policy
D. To protect the organization if a user’s behavior violates the policy
Answer: D. To protect the organization if a user’s behavior violates the policy
Explanation: While all options may have some relevance, a signed user acknowledgment of the corporate security policy primarily helps protect the organization if a user’s behavior violates the policy. It serves as documented evidence that the user was aware of the policy and the associated consequences of noncompliance.
What does effective security management accomplish?
A. Achieves security at the lowest cost
B. Reduces risk to an acceptable level
C. Prioritizes security for new products
D. Implements patches in a timely manner
Answer: B. Reduces risk to an acceptable level
Explanation: Effective security management focuses on mitigating risk to a level that is acceptableto the organization, balancing the cost of risk
mitigation with the potential impact of security incidents. While cost control, prioritization for new products, and timely patching are important, they are part of a broader strategy aimed at risk reduction.
What threats does the principle of availability protect information from?
A. Denial-of-service attacks, fires, floods, hurricanes, and unauthorized transactions
B. Fires, floods, hurricanes, unauthorized transactions, and unreadable backup tapes
C. Unauthorized transactions, fires, floods, hurricanes, and unreadable backup tapes
D. Denial-of-service attacks, fires, floods, hurricanes, and unreadable backup tapes
Answer: D. Denial-of-service attacks, fires, floods, hurricanes, and unreadable backup tapes
Explanation: The principle of availability in information security is concerned with ensuring that authorized users have access to data and resources when needed. This involves protection against a variety of threats including denial-of-service attacks; natural disasters like fires, floods, and hurricanes; and technical issues such as unreadable backup
tapes.
To maintain impartiality, the security officer could report to which of the following?
A. CEO, application development, or CFO
B. Chief Information Officer, CFO, or application development
C. CFO CEO or Chief Information Officer CFO, CEO, or Chief Information Officer
D. Application development, CFO, or CEO
Answer: C. CFO, CEO, or Chief Information Officer
Explanation: To avoid bias and ensure independence, a security officer could report directly to top-level management such as the Chief Financial
Officer (CFO), Chief Executive Officer (CEO), or the Chief Information Officer (CIO). This arrangement helps to ensure that security concerns are addressed at the highest level of decision-making.
What is the best use of tactical security plans?
A. To establish high-level security policies
B. To enable enterprise-wide security management
C. To minimize downtime
D. To deploy new security technology
Answer: D. To deploy new security technology
Explanation: Tactical security plans are typically used to guide the implementation of specific security measures, such as the deployment of new security technologies. These plans have a shorter time horizon
than strategic security plans and are more detailed, focusing on the practical aspects of implementing security measures.
Who is responsible for the implementation of information security?
A. Everyone
B. Senior management
C. Security officer
D. Data owners
Answer: A. Everyone
Explanation: While specific roles like the security officer, senior management, and data owners have key responsibilities, implementing information security is a shared responsibility. Everyone in an
organization has a part to play in maintaining security, from following established policies to reporting potential security incidents.
In which phase is security likely to be the most costly?
A. Design
B. Rapid prototyping
C. Testing
D. Implementation
Answer: D. Implementation
Explanation: Implementing security measures often involves significant costs, including the purchase of security hardware or software, hiring or
training staff, and potential disruptions to business operations. It’s generally more cost-effective to consider security early in the design phase, where potential issues can be addressed before they become
expensive problems during implementation.
What attributes should a security policy have to remain relevant and meaningful over time?
A. Directive words such as shall, must, or will, technical specifications, and should be short in length
B. A defined policy development process, should be short in length, and contain directive words such as shall, must, or will
C. Short in length, contain technical specifications, and directive words such as shall, must, or will
D. Directive words such as shall, must, or will, a defined policy development process, and is short in length
Answer: D. Directive words such as shall, must, or will a defined policy development process and is will, a defined policy development process, and is short in length
Explanation: A security policy that remains meaningful over time is one that is clear and concise, has a defined policy development and review process, and uses directive words to clearly communicate the
requirements. It doesn’t necessarily need to contain detailed technical specifications, as these may change over time and could make the policy less adaptable and more difficult to maintain.
Which among the following best describes an intangible asset’s valuation process?
A. Multiplying the physical storage costs by the company’s expected lifespan
B. Collaborating with finance or accounting professionals to ascertain the profit returned by the asset
C. Reviewing the intangible asset’s depreciation over the past three years
D. Using the historical acquisition or development cost of the intangible asset
Answer: B. Collaborating with finance or accounting professionals to ascertain the profit returned by the asset
Explanation: The value of an intangible asset is often best determined by its ability to generate profit. Therefore, working with finance or accounting
professionals to ascertain the profit returned by the asset is typically the most effective approach.
Which principle is violated if one individual in the finance department has the ability to add vendors to the vendor database and subsequently make
payments to the vendor?
A. A well-formed transaction
B. Separation of duties
C. Least privilege
D. Data sensitivity level
Answer: B. Separation of duties
Explanation: The separation of duties principle is designed to prevent errors and fraud that might be possible when only one person is in control of all parts of a process. Here, allowing one person to both add vendors and make payments could lead to fraudulent transactions. Hence, this scenario is a violation of the separation of duties principle.
What is the best way to mitigate collusion?
A. Job rotation
B. Data classification
C. Defining job sensitivity level
D. Least privilege
Answer: A. Job rotation
Explanation: Collusion is the act of collaborating fraudulently within an organization to deceive or defraud. Job rotation, which involves moving
employees between different roles, is a good way to prevent collusion because it reduces the opportunity for long-term manipulation in any single position.
Who is best suited to make decisions about data access?
A. User managers
B. Data owners
C. Senior management
D. Application developers
Answer: B. Data owners
Explanation: Data owners, the individuals or entities responsible for the data’s security and use, are best suited to make decisions about data access. They understand the data’s sensitivity and the potential risks of unauthorized access. While other stakeholders may have input, the ultimate decision should lie with the data owner.
What is the most significant source of cybercrime risk?
A. Outsiders
B. Nation-states
C. Insiders
D. Script kiddies
Answer: C. Insiders
Explanation: Although cybercrime can come from various sources, the greatest risk often comes from insiders. These are individuals who have legitimate access to the system and can misuse it for harmful activities. Insider threats are difficult to detect and can cause substantial damage.
What is the primary obstacle in combating computer crime?
A. Computer criminals are generally smarter than computer investigators.
B. Adequate funding to stay ahead of the computer criminals.
C. Activity associated with computer crime is truly international.
D. There are so many more computer criminals than investigators that it is impossible to keep up.
Answer: C. Activity associated with computer crime is truly international.
Explanation: The international nature of computer crime is a major hindrance to fighting it. Jurisdictional issues, differences in laws across countries, and the sheer scope of the Internet make it challenging to
investigate and prosecute cybercrimes effectively.
What discipline does computer forensics combine with computer science, information technology, and engineering?
A. Law
B. Information systems
C. Analytical thought
D. The scientific method
Answer: A. Law
Explanation: Computer forensics is a multidisciplinary field that combines computer science, information technology, and engineering with law. The goal is to gather and analyze data in a way that is legally admissible.
Which principle allows an investigator to identify aspects of a person responsible for a crime, based on the residual traces left behind while stealing information?
A. Meyer’s principle of legal impunity
B. Criminalistic principles
C. IOCE/Group of 8 Nations principles for computer forensics
D. Locard’s principle of exchange
Answer: D. Locard’s principle of exchange
Explanation: Locard’s exchange principle states that the perpetrator of a crime will bring something into the crime scene and leave with something from it and that both can be used as forensic evidence. This principle is applicable to cybercrimes, where digital traces can be left behind
Which of the following is a part of the fundamental principles of evidence?
A. Authenticity, redundancy, and admissibility
B. Completeness, authenticity, and admissibility
C. Completeness, redundancy, and authenticity
D. Redundancy, admissibility, and completeness
Answer: B. Completeness, authenticity, and admissibility
Explanation: The five cardinal rules of evidence include completeness, authenticity, admissibility, accuracy, and reasonableness. Hence, option B is correct as it contains three of these principles.
Which of the following is not listed as a stage in incident response?
A. Documentation
B. Prosecution
C. Containment
D. Investigation
Answer: B. Prosecution
Explanation: While prosecution may be a result of an incident response, it is not a phase in itself. The typical phases of incident response include
preparation, identification, containment, eradication, recovery, and lessons learned/documentation.
Which type of law primarily focuses on the abstract concepts and is greatly influenced by the writings of legal scholars and academics?
A. Criminal law
B. Civil law
C. Religious law
D. Administrative law
Answer: B. Civil law
Explanation: Civil law, also known as Roman law, is primarily based on written codes, statutes, and legal principles developed by legal scholars and academics. It emphasizes abstract concepts of law.
Which category of intellectual property protection covers the expression of ideas rather than the ideas themselves?
A. Trademark
B. Patent
C. Copyright
D. Trade secret
Answer: C. Copyright
Explanation: Copyright law protects the expression of an idea in a tangible medium, such as a book, song, or software program, rather than the idea itself.
Which type of intellectual property safeguards the goodwill that a merchant or vendor invests in its products?
A. Trademark
B. Patent
C. Copyright
D. Trade secret
Answer: A. Trademark
Explanation: Trademarks protect brand names, logos, and other identifiers that signify the source of goods or services. The value of a trademark lies in the goodwill and brand recognition that a merchant or vendor builds in its products or services.
Which of the following represent types of software licensing?
A. Freeware, open source, and commercial
B. Commercial, academic, and open source
C. Academic, freeware, and open source
D. Freeware, commercial, and academic
Answer: D. Freeware, commercial, and academic
Explanation: These are all types of software licensing. Freeware is software that is available free of charge. Commercial software is typically sold for
profit Academic licenses are special types of software profit. Academic licenses are special types of software licenses designed for educational institutions. These licenses are often offered at a discounted rate and
may come with specific terms and conditions that restrict usage to educational purposes only.
What is most directly concerned with the rights and duties of individuals and organizations in relation to the gathering, usage, storage, and sharing of personal data?
A. Privacy
B. Secrecy
C. Availability
D. Reliability
Answer: A. Privacy
Explanation: Privacy deals with the rights and obligations of individuals and organizations with respect to the collection, use, retention, and
disclosure of personal information.
Which of the following subphases are included in the triage process of incident response?
A. Collection, transport, testimony
B. Traceback, feedback, loopback
C. Detection, identification, notification
D. Confidentiality, integrity, availability
Answer: C. Detection, identification, notification
Explanation: The initial steps of triage in incident response typically include detection (discovering the incident), identification (understanding the nature of the incident), and notification (informing relevant parties about the incident).
The integrity of a forensic bit stream image is verified by
A. Comparing hash totals to the original source
B. Keeping good notes
C. Taking pictures
D. Encrypted keys
Answer: A. Comparing hash totals to the original source
Explanation: The integrity of a forensic bit stream image is typically verified by comparing the hash of the image to the hash of the original source. If the hashes match, it verifies that the image is an exact replica of the original.
In the context of digital evidence, the crime scene should
A. Remain unaltered at all times
B. Be fully replicable in a legal setting
C. Be located in a single country
D. Have the minimum possible level of contamination
Answer: D. Have the minimum possible level of contamination
Explanation: The aim should always be to minimize contamination of the crime scene to maintain the integrity of the digital evidence. This aids in its
admissibility and reliability in a court of law.
In the context of outsourcing IT systems
A. All regulatory and compliance requirements must be transferred to the provider.
B. The outsourcing organization is relieved from compliance obligations
compliance obligations.
C. The outsourced IT systems are exempt from compliance obligations.
D. The provider is exempt from compliance obligations.
Answer: A. All regulatory and compliance requirements must be transferred to the provider.
Explanation: The responsibility for regulatory and compliance requirements lies with the organization, but when outsourcing IT systems these requirements but when outsourcing IT systems, these requirements
should be clearly communicated and agreed upon
with the provider.
How does the ISC2 Code of Ethics address conflicts between canons?
A. There can never be conflicts between canons.
B. Through a process of adjudication.
C. Based on the order of the canons.
D. By having all canon conflicts reviewed by the board of directors.
Answer: C. Based on the order of the canons
Explanation: If a conflict arises between the canons in the ISC2 Code of Ethics, they are resolved by giving precedence to the canon that appears
earlier in the list.
Which law in the United States requires federal agencies to develop, document, and implement an agency-wide program to provide security for the information systems that support its operations and
assets?
A. Health Insurance Portability and Accountability Act (HIPAA)
B. Gramm-Leach-Bliley Act (GLBA)
C. Federal Information Security Management Act (FISMA)
D. Sarbanes-Oxley Act (SOX)
Answer: C. Federal Information Security Management Act (FISMA)
Explanation: The FISMA requires federal agencies to develop, document, and implement an agency-wide program to provide information security for the information systems that support its operations and
assets.
The General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy. Which of the following principles is NOT stated in GDPR?
A. Data minimization
B. Consent
C. Data localization
D. Accountability
Answer: C. Data localization
Explanation: Data localization is not a principle stated in GDPR. GDPR principles include lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity
and confidentiality, and accountability.
The _____________ provides guidance for the protection of electronically protected health information.
A. HIPAA Security Rule
B. Sarbanes-Oxley Act
C. Computer Fraud and Abuse Act
D. Federal Information Security Management Act
Answer: A. HIPAA Security Rule
Explanation: The HIPAA Security Rule specifically focuses on the protection of electronic protected health information (ePHI).
Which of the following laws mandates that organizations must have adequate security measures in place to protect customer data?
A. Sarbanes-Oxley Act (SOX)
B. Gramm-Leach-Bliley Act (GLBA)
C. Data Protection Act (DPA)
D. Federal Information Security Management Act (FISMA)
Answer: B. Gramm-Leach-Bliley Act (GLBA)
Explanation: The GLBA requires financial institutions to explain their information-sharing practices to their customers and to safeguard
sensitive data.
The purpose of the _____________ is to ensure the accuracy, fairness, and privacy of the information in a consumer’s credit reports.
A. Fair Credit Reporting Act (FCRA)
B. General Data Protection Regulation (GDPR)
C. Gramm-Leach-Bliley Act (GLBA)
D. Federal Information Security Management Act (FISMA)
Answer: A. Fair Credit Reporting Act (FCRA)
Explanation: FCRA is designed to ensure the accuracy, fairness, and privacy of the information in a consumer’s credit reports.
What is the primary purpose of the Children’s Online Privacy Protection Act (COPPA)?
A. To regulate how websites collect data about children under 13
B. To regulate how websites collect data about all users
C. To protect children from inappropriate content online
D. To protect the privacy of adults when they use websites
Answer: A. To regulate how websites collect data about children under 13
Explanation: COPPA imposes certain requirements on operators of websites or online services directed to children under 13 years of age and on operators of other websites or online services that have actual
knowledge that they are collecting personal information online from a child under 13 years of age.
What is the primary purpose of the Payment Card Industry Data Security Standard (PCI DSS)?
A. To protect customer data during online transactions
B. To ensure the privacy of customer data
C. To ensure the secure disposal of customer data
D. To ensure the security of credit card transactions
Answer: D. To ensure the security of credit card transactions
Explanation: PCI DSS is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment.
The _____________ outlines procedures to enhance the protection of critical infrastructure from cyber threats.
A. Executive Order 13636
B. HIPAA Security Rule
C. Federal Information Security Management Act (FISMA)
D. Computer Fraud and Abuse Act
Answer: A. Executive Order 13636
Explanation: This executive order establishes a policy to enhance the security and resilience of the nation’s critical infrastructure and to maintain a cyber environment that encourages efficiency, innovation,
and economic prosperity.
Which law is designed to combat identity theft by requiring businesses to destroy sensitive information derived from consumer reports?
A. Fair and Accurate Credit Transactions Act (FACTA)
B. General Data Protection Regulation (GDPR)
C. Sarbanes-Oxley Act (SOX)
D. Federal Information Security Management Act (FISMA)
Answer: A. Fair and Accurate Credit Transactions Act (FACTA)
Explanation: FACTA aims to help consumers protect their data from identity theft. It allows consumers to request and obtain a free credit report once every twelve months from each of the three nationwide consumer credit reporting companies.
Which of the following laws makes it a crime to gain unauthorized access to protected computer systems?
A. Computer Fraud and Abuse Act (CFAA)
B. Fair Credit Reporting Act (FCRA)
C. Federal Information Security Management Act (FISMA)
D. Sarbanes-Oxley Act (SOX)
Answer: A. Computer Fraud and Abuse Act (CFAA)
Explanation: The CFAA makes it illegal to intentionally access a computer without authorization or to exceed authorized access and thereby obtain
protected information from any protected computer
Imagine you are a cybersecurity analyst for a retail company. The company has assessed that the Single Loss Expectancy (SLE) for a data breach is $500,000. The exposure factor (EF) for such an event is estimated at 0.85, and the Annualized Rate of Occurrence (ARO) is 0.60. Additionally, the residual risk is calculated to be $200,000. Based on
these metrics, what would be the resulting Annualized Loss Expectancy (ALE) for a data breach?
A. $255,000
B. $510,000
C. $300,000
D. $425,000
Answer: D. $425,000.
Explanation: The Annualized Loss Expectancy (ALE) is calculated by first determining the Single Loss Expectancy (SLE), which is the product of the
asset value and the exposure factor (EF). In this case, the SLE would be $500,000 multiplied by 0.85, resulting in $425,000. The ALE is then calculated by multiplying the SLE by the Annualized Rate of Occurrence (ARO), which is 0.60. However, since the ALE is essentially an annualized version of the SLE in this specific scenario, the ALE would also be $425,000. The residual risk of $200,000 is a separate metric that indicates the remaining risk after security measures have been applied and does not directly factor into the ALE calculation for this question.
The correct sequence for the following formulas should be
A. ALE, residual risk, SLE, ARO
B. ALE, ARO, SLE, residual risk
C. RO, SLE, ALE, residual risk
D. SLE, ARO, ALE, residual risk
Answer: D. SLE, ARO, ALE, residual risk
Explanation: The correct order of these formulas in the context of risk assessment is as follows:
SLE (Single Loss Expectancy): This is calculated first as it represents the monetary loss expected from a single event.
ARO (Annualized Rate of Occurrence): This is the frequency with which a threat is expected to occur within a year.
ALE (Annualized Loss Expectancy): This is calculated by multiplying the SLE by the ARO; hence, it comes after SLE and ARO.
Residual risk: This is the remaining risk after security controls have been applied and is typically assessed after understanding the potential losses
(ALE).
Thus, the proper order is Single Loss Expectancy (SLE),
Annualized Rate of Occurrence (ARO), Annualized Loss
Expectancy (ALE), and then residual risk.
What is the duration of copyright protection in both the United States and the European Union?
A. The author’s life plus 20 years
B. The author’s life plus 30 years
C. The author’s life plus 70 years
D. The author’s life plus 100 years
Answer: C. The author’s life plus 70 years
Explanation: In both the United States and the European Union, copyright protection generally lasts for the duration of the author’s life plus 70 years.
This time frame provides creators with a substantial period of control over their works, incentivizing further creation and innovation. It’s important to
note that copyright laws can vary by country and type of work, so always refer to specific legislation for accurate information.
Which term refers to a flaw, loophole, oversight, or error that leaves an organization open to potential attack or harm?
A. Risk
B. Vulnerability
C. Threat
D. Exploit
Answer: B. Vulnerability
Explanation: In the context of information security, a vulnerability refers to a flaw, loophole, oversight, or error in a system that could be exploited to cause harm. This could include software bugs, misconfigurations, weak passwords, etc. Vulnerabilities can be exploited by threats, such as
hackers or malware, to perform unauthorized actions or gain unauthorized access. The process of identifying and addressing these vulnerabilities is a crucial part of any organization’s risk management
and security strategy. The term “weakness” is quite often used when defining vulnerability.
Which of the following security documents is the broadest in scope?
A. Procedures
B. Standards
C. Policies
D. Baselines
Answer: C. Policies
Explanation: Policies are the most general type of security document. They provide a high-level overview of an organization’s principles, rules, and
expectations regarding information security. Policies set the foundation for all other security documents and guide the development of standards,
procedures, and baselines, which are more specific and detail oriented. They are typically designed to guide decision-making and set the direction for an organization’s information security program.
Which role within an organization is responsible for assigning sensitivity labels to information assets?
A. Management
B. The auditor
C. The user
D. The owner
Answer: D. The owner
Explanation: Within an organization, the owner of an information asset is typically responsible for assigning sensitivity labels. These labels represent
the asset’s classification level and help guide how the asset should be handled, stored, transmitted, and destroyed. The owner, having the best
understanding of the data’s value and sensitivity, is in the best position to assign these labels.
If the cost of implementing a countermeasure exceeds the value of the asset it’s meant to protect, which approach should be preferred?
A. Do nothing
B. Transfer the risk
C. Mitigate the risk
D. Increase the cost of exposure
Answer: B. Transfer the risk
Explanation: When the cost of the countermeasure is more than the value of the asset, the most appropriate approach is typically to transfer the risk. This could be through insurance or by using third-party services. In this way, the organization can balance the cost of protection with the value of the asset. This doesn’t mean ignoring the risk (option A) or unnecessarily increasing costs (option D). Mitigating the risk (option C) might still be more expensive than the asset’s value.
Which ISO document serves as a standard for information security management?
A. ISO 27001
B. ISO 27002
C. ISO 27004
D. ISO 2779
Answer: A. ISO 27001
Explanation: ISO 27001 is the international standard for information security management. It establishes the requirements and best practices for an Information Security Management System (ISMS). The other ISO standards listed here are also part of the ISO 27000 series, but they focus on different aspects of information security. For example, ISO 27002 provides a code of practice for information security controls, while ISO 27004 provides guidelines for the measurement of information security. ISO 27799 provides guidelines for health informatics – information security management in health using ISO/IEC 27002.
Which of the following accurately describes the risk management techniques?
A. Risk acceptance, risk transference, risk avoidance, risk mitigation
B. Risk acceptance, risk containment, risk avoidance, risk migration
C. Risk acceptance, risk mitigation, risk containment, risk quantification
D. Risk avoidance, risk migration, risk containment, risk quantification
Answer: A. Risk acceptance, risk transference, risk avoidance, risk mitigation
Explanation: The four main risk management techniques are risk acceptance (accepting the potential loss and continuing operations), risk
transference (shifting the potential loss to another party), risk avoidance (eliminating the risk by not engaging in a certain activity), and risk mitigation (reducing the impact of the risk). The other terms mentioned in the options, such as risk containment, risk migration, and risk quantification, are not standard risk management techniques.
Which of the following identifies a model that specifically targets security and not governance of an entire enterprise?
A. The Zachman framework
B. COBIT
C. COSO
D. SABSA
Answer: D. SABSA
Explanation: The Sherwood Applied Business Security Architecture (SABSA) is a framework and methodology for enterprise security architecture and
service management. It is specifically designed to focus on security, unlike other models like COBIT, COSO, or the Zachman framework, which are
designed for broader governance of an entire enterprise. COBIT (Control Objectives for Information and Related Technologies) and COSO
(Committee of Sponsoring Organizations of the Treadway Commission) are used for IT governance and enterprise risk management, respectively. The Zachman framework is an enterprise architecture framework, which is not specifically focused on security
Which term allows the management to demonstrate that they took necessary steps to prevent negligence in lawsuits, even if their actions weren’t flawless?
A. Due care
B. Prudency
C. Due diligence
D. Threat agent
Answer: A. Due care
Explanation: “Due care” refers to the effort made by an ordinarily prudent or reasonable party to prevent harm to another taking the circumstances
prevent harm to another, taking the circumstances into account. It is the level of judgment, care, prudence, determination, and activity that a person would reasonably be expected to do under particular circumstances. In the context of lawsuits, demonstrating “due care” can help management show that they took all necessary precautions, even
if the outcomes weren’t perfect. The other options – “prudency,” “due diligence,” and “threat agent” – are not specifically related to this context.
Which term refers to the method of gathering information by interviewing individuals anonymously?
A. ISO/IEC 27001
B. Qualitative valuation
C. The Delphi method
D. Quantitative valuation
Answer: C. The Delphi method
Explanation: The Delphi method is a structured communication technique, originally developed as a systematic, interactive forecasting method which
relies on a panel of experts. The experts answer questionnaires in multiple rounds. After each round, a facilitator provides an anonymous summary of the experts’ forecasts from the previous round as well as the reasons they provided for their judgments. Thus, the Delphi method involves anonymous interviews or surveys, and it’s used to arrive at a group consensus. The other options – ISO/IEC 27001, qualitative valuation, and quantitative valuation – do not involve interviewing people anonymously
What is the suitable standard for governing third party providers?
A. A nondisclosure agreement (NDA)
B. An acceptable use policy
C. The same level as employee
D. The same level as defined by the ISC2 Code of Ethics
Answer: C. The same level as employees Explanation: Third-party providers should be governed at the same level as employees. This is
because they often have access to the same sensitive information and systems as employees and therefore pose a similar risk. They should be subject to the same policies, procedures, and controls as employees to ensure information security. The other options – an NDA, an acceptable use policy, and the ISC2 Code of Ethics – are components of a broader
governance strategy, but they are not comprehensive standards for third-party governance
Which term refers to the expected cost associated with a single loss event?
A. Annualized loss expectancy (ALE)
B. Exposure factor (EF)
C. Asset value (AV)
D. Single loss expectancy (SLE)
Answer: D. Single loss expectancy (SLE)
Explanation: The Single Loss Expectancy (SLE) represents the monetary loss expected from the occurrence of a risk on an asset once. It is calculated by multiplying the asset’s value (AV) by the exposure
factor (EF), which represents the impact of the risk on the asset. The other terms – ALE, EF, and AV – are also important in risk assessment, but they do not directly represent the expected cost of a single loss event.
What is the rationale behind an enterprise reassessing the classification of its data files and records at least once a year?
A. To adhere to the stipulations of the Internet Architecture Board
B. Because the worth of data varies as time progresses
C. Due to the necessity of mitigating new threats
D. To safeguard the data’s confidentiality
Answer: B. Because the worth of data varies as time progresses
Explanation: Data’s value can change over time based on its relevance, accuracy, and usefulness to the organization. Therefore, it’s essential to
periodically reevaluate the classification of data files and records. While the other options may influence data management practices, they don’t directly explain why data classification should be reevaluated annually.
What should be the primary concern of management when establishing a governance framework?
A. Enhancing profits
B. Evading losses
C. Catering to the needs of the business
D. Ensuring safety
Answer: C. Catering to the needs of the business
Explanation: A governance framework should be designed primarily to support the needs of the business. It should guide the organization in
achieving its strategic objectives while managing risks and ensuring compliance. Although maximizing profits, avoiding losses, and ensuring safety are important, they are not the primary purpose of a governance framework.
When it comes to forensically examining digital evidence, which is the most accurate description of the priorities?
A. Carry out an analysis of a bit-level duplicate of the disk.
B. Examine the log files on the duplicated disk.
C. Perform steganographic analysis on the duplicated disk.
D. Detect any harmful code present on the duplicated disk.
Answer: A. Carry out an analysis of a bit-level duplicate of the disk.
Explanation: When forensically analyzing digital evidence the first priority is to create and analyze a evidence, the first priority is to create and analyze a bit-level clone of the disk. This ensures that the original evidence remains unaltered and preserves its admissibility in court. After creating the clone, further analysis like reviewing log files, detecting malicious code, or performing a steganographic analysis can be done.
Which of the following illustrates an instance of self regulation?
A. Sarbanes-Oxley (SOX)
B. Gramm-Leach-Bliley Act (GLBA)
C. Payment Card Industry Data Security Standard (PCI DSS)
D. Third-party governance
Answer: C. Payment Card Industry Data Security Standard (PCI DSS)
Explanation: The Payment Card Industry Data Security Standard (PCI DSS) is an example of self regulation. It’s a standard created by the major credit card companies to protect cardholder data. The companies themselves enforce compliance with the standard, not a governmental or external
regulatory body. In contrast, Sarbanes-Oxley (SOX) and the Gramm-Leach-Bliley Act (GLBA) are examples of governmental regulation, and third party governance is a broader concept that includes various mechanisms of control over third-party relationship
What are the possible actions that can be taken with residual risk?
A. It can be either allocated or accepted.
B. It can be either pinpointed or appraised It can be either pinpointed or appraised.
C. It can be either lessened or computed.
D. It can be either unveiled or evaluated
Answer: A. It can be either allocated or accepted.
Explanation: Residual risk is the remaining risk after controls and mitigation efforts have been applied. This risk can either be accepted (if it’s
within the organization’s risk tolerance) or it can be assigned/transferred to another entity, such as through insurance.
Which element does not constitute part of risk analysis?
A. Assets
B. Threats
C. Vulnerabilities
D. Countermeasures
Answer: D. Countermeasures
Explanation: Risk analysis involves the identification and assessment of assets, threats, and vulnerabilities. Countermeasures, however, are a
response to the identified risk, applied after risk analysis to mitigate the risk. They are not a part of the analysis itself
What is it that security safeguards and controls are incapable of doing?
A. Risk reduction
B. Risk avoidance
C. Risk transfer
D. Risk analysis
Answer: D. Risk analysis
Explanation: Security safeguards and controls are used to reduce, avoid, or transfer risk. However, they do not perform risk analysis. Risk analysis is a separate process that identifies and assesses risk, which then informs the appropriate safeguards and controls.
The quantity of risk an organization can endure should be based on what?
A. Technological level
B. Acceptable level
C. Affordable level
D. Measurable level
Answer: B. Acceptable level
Explanation: The amount of risk an organization can handle or tolerate is based on its acceptable level of risk. This level is determined by factors such as the organization’s strategic goals, resources, and risk appetite. While affordability and measurability
might influence the decision, the acceptable level is
the determining factor
Which of the following best describes the relationship between CobiT and ITIL?
A. CobiT is a model for IT governance, whereas ITIL is a model for corporate governance.
B. CobiT provides a corporate governance roadmap, whereas ITIL is a customizable framework for IT service management.
C. CobiT defines IT goals, whereas ITIL provides the process level steps on how to achieve them.
D. CobiT provides a framework for achieving security goals, whereas ITIL defines a framework for achieving IT service level goals.
C. The Control Objectives for Information and related
Technology (CobiT) is a framework developed by the
Information Systems Audit and Control Association (ISACA)
and the IT Governance Institute (ITGI). It defines goals for
the controls that should be used to properly manage IT and
ensure IT maps to business needs, not specifically just
security needs. The Information Technology Infrastructure
Library (ITIL) is the de facto standard of best practices for IT
service management. A customizable framework, ITIL
provides the goals, the general activities necessary to
achieve these goals, and the input and output values for
each process required to meet these determined goals. In
essence, CobiT addresses “what is to be achieved,” while
ITIL addresses “how to achieve it.”
A is incorrect because, while CobiT can be used as a model
for IT governance, ITIL is not a model for corporate
governance. Actually, Committee of Sponsoring
Organizations of the Treadway Commission (COSO) is a
model for corporate governance. CobiT is derived from the
COSO framework. You can think of CobiT as a way to meet
many of the COSO objectives, but only from the IT
perspective. In order to achieve many of the objectives
addressed in CobiT, an organization can use ITIL, which
provides process-level steps for achieving IT service
management objectives.
B is incorrect because, as previously stated, CobiT can be
used as a model for IT governance, not corporate
governance. COSO is a model for corporate governance. The
second half of the answer is correct. ITIL is a customizable
framework that is available as a series of books or online, for
IT service management.
D is incorrect because CobiT defines goals for the controls
that should be used to properly manage IT and ensure IT
maps to business needs, not just IT security needs. ITIL
provides steps for achieving IT service management goals as
they relate to business needs. ITIL was created because of
the increased dependence on information technology to
meet business needs.
Which of the following is not included in a risk assessment?
A. Discontinuing activities that introduce risk
B. Identifying assets
C. Identifying threats
D. Analyzing risk in order of cost or criticality
A. Discontinuing activities that introduce risk is a way of
responding to risk through avoidance. For example, there
are many risks surrounding the use of instant messaging
(IM) in the enterprise. If a company decides not to allow IM
activity because there is not enough business need for its
use, then prohibiting this service is an example of risk
avoidance. Risk assessment does not include the
implementation of countermeasures such as this.
B is incorrect because identifying assets is part of a risk
assessment, and the question asks to identify what is not
included in a risk assessment. In order to determine the
value of assets, those assets must first be identified. Asset
identification and valuation are also important tasks of risk
management.
C is incorrect because identifying threats is part of a risk
assessment, and the question asks to identify what is not
included in a risk assessment. Risk is present because of the
possibility of a threat exploiting a vulnerability. If there were
no threats, there would be no risk. Risk ties the vulnerability,
threat, and likelihood of exploitation to the resulting business
impact.
D is incorrect because analyzing risk in order of cost or
criticality is part of the risk assessment process, and the
question asks to identify what is not included in a risk
assessment. A risk assessment researches and quantifies the
risk a company faces. Dealing with risk must be done in a
cost-effective manner. Knowing the severity of the risk allows
the organization to determine how to address it effectively.
Sue has been tasked with implementing a number of security
controls, including antivirus and antispam software, to protect
the company’s e-mail system. What type of approach is her
company taking to handle the risk posed by the system?
A. Risk mitigation
B. Risk acceptance
C. Risk avoidance
D. Risk transference
A. Risk can be dealt with in four basic ways: transfer it, avoid
it, reduce it, or accept it. By implementing security controls
such as antivirus and antispam software, Sue is reducing the
risk posed by her company’s e-mail system. This is also
referred to as risk mitigation, where the risk is decreased to
a level considered acceptable. In addition to the use of IT
security controls and countermeasures, risk can be mitigated
by improving procedures, altering the environment, erecting
barriers to the threat, and implementing early detection
methods to stop threats as they occur, thereby reducing their
possible damage.
B is incorrect because identifying assets is part of a risk
assessment, and the question asks to identify what is not
included in a risk assessment. In order to determine the
value of assets, those assets must first be identified. Asset
identification and valuation are also important tasks of risk
management.
C is incorrect because identifying threats is part of a risk
assessment, and the question asks to identify what is not
included in a risk assessment. Risk is present because of the
possibility of a threat exploiting a vulnerability. If there were
no threats, there would be no risk. Risk ties the vulnerability,
threat, and likelihood of exploitation to the resulting business
impact.
D is incorrect because analyzing risk in order of cost or
criticality is part of the risk assessment process, and the
question asks to identify what is not included in a risk
assessment. A risk assessment researches and quantifies the
risk a company faces. Dealing with risk must be done in a
cost-effective manner. Knowing the severity of the risk allows
the organization to determine how to address it effectively.
The integrity of data is not related to which of the following?
A. Unauthorized manipulation or changes to data
B. The modification of data without authorization
C. The intentional or accidental substitution of data
D. The extraction of data to share with unauthorized entities
D. The extraction of data to share with unauthorized entities
is a confidentiality issue, not an integrity issue.
Confidentiality ensures that the necessary level of secrecy is
enforced at each junction of data processing and prevents
unauthorized disclosure. This level of confidentiality should
prevail while data resides on systems and devices within the
network, as it is transmitted, and once it reaches its
destination. Integrity, on the other hand, is the principle that
signifies the data has not been changed or manipulated in
an unauthorized manner.
A is incorrect because integrity is related to the unauthorized
manipulation or changes to data. Integrity is upheld when
any unauthorized modification is prevented. Hardware,
software, and communication mechanisms must work in
concert to maintain and process data correctly and move
data to intended destinations without unexpected alteration.
The systems and network should be protected from outside
interference and contamination.
B is incorrect because the modification of data without
authorization is related to integrity. Integrity is about
protecting data so that it cannot be changed either by users
or other systems that do not have the rights to do so.
C is incorrect because the intentional or accidental
substitution of data is related to integrity. Along with the
assurance that data is not modified by unauthorized entities,
integrity is upheld when the assurance of the accuracy and
reliability of the information and systems is provided. An
environment that enforces integrity prevents attackers, for
example, from inserting a virus, logic bomb, or backdoor into
a system that could corrupt or replace data. Users usually
affect a system or its data’s integrity by mistake (although
internal users may also commit malicious deeds). For
example, a user may insert incorrect values into a data
processing application that ends up charging a customer
$3,000 instead of $300.
There are several methods an intruder can use to gain access
to company assets. Which of the following best describes
masquerading?
A. Changing an IP packet’s source address
B. Elevating privileges to gain access
C. An attempt to gain unauthorized access as another user
D. Creating a new authorized user with hacking tools
C. Masquerading is an attempt to gain unauthorized access
by impersonating an authorized user. Masquerading is
commonly used by attackers carrying out phishing attacks
and has been around for a long time. For example, in 1996
hackers posed as AOL staff members and sent messages to
victims asking for their passwords in order to verify correct
billing information or verify information about the AOL
accounts. Today, phishers often masquerade as large
banking companies and well-known Internet entities like
Amazon.com and eBay. Masquerading is a type of active
attack because the attacker is actually doing something
instead of sitting back and gathering data.
A is incorrect because changing an IP packet’s source
address is an example of masquerading and not a definition
of masquerading. IP spoofing is the act of presenting false
information within packets, to trick other systems and hide
the origin of the message. This is usually done by hackers so
that their identity cannot be successfully uncovered.
B is incorrect because elevating privileges is not part of
masquerading. Elevating privileges is often the next step
after being able to penetrate a system successfully, but it
does not have anything to do directly with fooling a user or
system about the attacker’s true identity.
D is incorrect because masquerading involves commonly
posing as an authorized user that already exists in the
system the attacker is attempting to access. It is common
for the attacker then to attempt to create a new authorized
user account on a compromised system, but successful
masquerading has to happen first
A number of factors should be considered when assigning values to assets. Which of the following is not used to determine the value of an asset?
A. The asset’s value in the external marketplace
B. The level of insurance required to cover the asset
C. The initial and outgoing costs of purchasing, licensing, and
supporting the asset
D. The asset’s value to the organization’s production operations
B. The level of insurance required to cover the asset is not a
consideration when assigning values to assets. It is actually
the other way around: By knowing the value of an asset, an
organization can more easily determine the level of
insurance coverage to purchase for that asset. In fact,
understanding the value of an asset is the first step to
understanding what security mechanisms should be put in
place and what funds should go toward protecting it. This
knowledge can also help companies perform effective
cost/benefit analyses, understand exactly what is at risk, and
comply with legal and regulatory requirements.
A is incorrect because the asset’s value in the external
marketplace is a factor that should be considered when
determining the value of an asset. It should also include the
value the asset might have to competitors or what others are
willing to pay for a given asset.
C is incorrect because the initial and outgoing costs of
purchasing, licensing, and supporting the asset are
considerations when determining the cost and value of an
asset. The asset must be cost-effective to the business
directly. If the supporting requirements of maintaining the
asset outweighs the business need for the asset, its value
will decrease.
D is incorrect because it is a factor to be considered when
determining an asset’s value. The asset’s value to the
organization’s production operations is the determination of
cost to an organization if the asset is not available for a
certain period of time. Along these same lines, the asset’s
usefulness and role in the organization should be considered
as well as the operational and production activities affected
if the asset is unavailable. If the asset helps operations it is
valuable; the trick is to figure out how valuable.
Jill is establishing a companywide sales program that will require different user groups with different privileges to access information on a centralized database. How should the security manager secure the database?
A. Increase the database’s security controls and provide more
granularity.
B. Implement access controls that display each user’s
permissions each time they access the database.
C. Change the database’s classification label to a higher security
status.
D. Decrease the security so that all users can access the
information as needed.
A. The best approach to securing the database in this
situation would be to increase the controls and assign very
granular permissions. These measures would ensure that
users cannot abuse their privileges and the confidentiality of
the information would be maintained. Granularity of
permissions gives network administrators and security
professionals additional control over the resources they are
charged with protecting, and a fine level of detail enables
them to give individuals just the precise level of access they
need.
B is incorrect because implementing access controls that
display each user’s permissions each time they access the
database is an example of one control. It is not the overall
way of dealing with user access to a full database of
information. This may be an example of increasing database
security controls, but it is only one example and more would
need to be put into place.
C is incorrect because the classification level of the
information in the database was previously determined
based on its confidentiality, integrity, and availability levels.
These levels do not change simply because more users need
access to the data. Thus, you would never increase or
decrease the classification level of information when more
users or groups need to access that information. Increasing
the classification level would only mean a smaller subset of
users could access the database.
D is incorrect because it puts data at risk. If security is
decreased so that all users can access it as needed, then
users with lower privileges will be able to access data of
higher classification levels. Lower security also makes it
easier for intruders to break into the database. As stated in
answer C, a classification level is not changed just because
the number of users who need to access the data increases
or decreases
As his company’s CISO, George needs to demonstrate to the Board of Directors the necessity of a strong risk management program. Which of the following should George use to calculate the company’s residual risk?
A. threats × vulnerability × asset value = residual risk
B. SLE × frequency = ALE, which is equal to residual risk
C. (threats × vulnerability × asset value) × control gap =
residual risk
D. (total risk – asset value) × countermeasures = residual risk
C. Countermeasures are implemented to reduce overall risk
to an acceptable level. However, no system or environment
is 100 percent secure, and with every countermeasure some
risk remains. The leftover risk after countermeasures are
implemented is called residual risk. Residual risk differs from
total risk, which is the risk companies face when they choose
not to implement any countermeasures. While the total risk
can be determined by calculating threats × vulnerability ×
asset value = total risk, residual risk can be determined by
calculating (threats × vulnerability × asset value) × control
gap = residual risk. Control gap is the amount of protection
the control cannot provide.
A is incorrect because threats × vulnerability × asset value
does not equal residual risk. It is the equation to calculate
total risk. Total risk is the risk a company faces in the
absence of any security safeguards or actions to reduce the
overall risk exposure. The total risk is reduced by
implementing safeguards and countermeasures, leaving the
company with residual risk—or the risk left over after
safeguards are implemented.
B is incorrect because SLE × frequency is the equation to
calculate the annualized loss expectancy (ALE) as a result of
a threat exploiting a vulnerability and the business impact.
The frequency is the threat’s annual rate of occurrence
(ARO). The ALE is not equal to residual risk. ALE indicates
how much money a specific type of threat is likely to cost
the company over the course of a year. Knowing the real
possibility of a threat and how much damage, in monetary
terms, the threat can cause is important in determining how
much should be spent to try and protect against that threat
in the first place.
D is incorrect and is a distracter answer. There is no such
formula like this used in risk assessments. The actual
equations are threats × vulnerability × asset value = total
risk; and (threats × vulnerability × asset value) × control
gap = residual risK
Susan, an attorney, has been hired to fill a new position at Widgets Inc. The position is Chief Privacy Officer (CPO). What is the primary function of her new role?
A. Ensuring the protection of partner data
B. Ensuring the accuracy and protection of company financial
information
C. Ensuring that security policies are defined and enforced
D. Ensuring the protection of customer, company, and employee
data
D. The Chief Privacy Officer (CPO) position is being created
by companies in response to the increasing demands on
organizations to protect myriad types of data. The CPO is
responsible for ensuring the security of customer, company,
and employee data, which keeps the company free from
legal prosecution and—hopefully—out of the headlines.
Thus, the CPO is directly involved with setting policies on
how data is collected, protected, and distributed to third
parties. The CPO is usually an attorney and reports to the
Chief Security Officer.
A is incorrect because protecting partner data is just a small
subset of all the data the CPO is responsible for protecting.
CPOs are responsible for ensuring the protection of
customer, company, and employee data. Partner data is
among the various types of data that the CPO is responsible
for protecting. In addition, the CPO is responsible for
knowing how its company’s suppliers, partners, and other
third parties are protecting its sensitive information. Many
times, companies will need to review these other parties
(which have copies of data needing protection).
B is incorrect because the accuracy of financial information is
the responsibility of its data owner—the Chief Financial
Officer (CFO). The CFO is responsible for the corporation’s
account and financial activities, and the overall financial
structure of the organization. The CPO is responsible for
helping to ensure the secrecy of this data, but not the
accuracy of the data. The financial information is also a small
subset of all the data types the CPO is responsible for
protecting.
C is incorrect because the definition and enforcement of
security policies is the responsibility of senior management,
commonly delegated to the CISO or CSO—not the CPO. A
security policy is an overall general statement that dictates
what role security plays within the organization. The CPO’s
responsibilities as they relate to policies are to contribute to
the setting of data protection policies, including how data is
collected, protected, and distributed to third parties.
Jared plays a role in his company’s data classification system.
In this role, he must practice due care when accessing data and
ensure that the data is used only in accordance with allowed
policy while abiding by the rules set for the classification of the
data. He does not determine, maintain, or evaluate controls, so
what is Jared’s role?
A. Data owner
B. Data custodian
C. Data user
D. Information systems auditor
C. Any individual who routinely uses data for work-related
tasks is a data user. Users must have the necessary level of
access to the data to perform the duties within their position
and are responsible for following operational security
procedures to ensure the data’s confidentiality, integrity, and
availability to others. This means that users must practice
due care and act in accordance with both security policy and
data classification rules.
A is incorrect because the data owner has a greater level of
responsibility in the protection of the data. Data owners are
responsible for classifying the data, regularly reviewing
classification levels, and delegating the responsibility of the
data protection duties to the data custodian. The data owner
is typically a manager or executive in the organization and is
held responsible when it comes to protecting the company’s
information assets.
B is incorrect because the data custodian is responsible for
the implementation and maintenance of security controls as
dictated by the data owner. In other words, the data
custodian is the technical caretaker of the controls that
protects the data. Her duties include making backups,
restoring data, implementing and maintaining
countermeasures, and administering controls.
D is incorrect because an information systems auditor is
responsible for evaluating controls. After evaluating the
controls, the auditor provides reports to management,
illustrating the mapping between the set acceptable risk level
of the organization and her findings. This does not have to
do with using the data or practicing due care with the use of
data.
Risk assessment has several different methodologies. Which of
the following official risk methodologies was not created for the
purpose of analyzing security risks?
A. FAP
B. OCTAVE
C. ANZ 4360
D. NIST SP 800-30
C. While ANZ 4360 can be used to analyze security risks, it
was not created for that purpose. It takes a much broader
approach to risk management than other risk assessment
methodologies, such as NIST and OCTAVE, which focus on
IT threats and information security risks. ANZ 4360 can be
used to understand a company’s financial, capital, human
safety, and business decisions risks.
A is incorrect because there is no formal FAP risk analysis
approach. It is a distracter answer.
B is incorrect because OCTAVE focuses on IT threats and
information security risks. OCTAVE is meant to be used in
situations where people manage and direct the risk
evaluation for information security within their organization.
The organization’s employees are given the power to
determine the best approach for evaluating security.
D is incorrect because NIST SP 800-30 is specific to IT
threats and how they relate to information security risks. It
focuses mainly on systems. Data is collected from network
and security practice assessments, and from people within
the organization. The data is then used as input values for
the risk analysis steps outlined in the 800-30 document.
Which of the following is not a characteristic of a company with a security governance program in place?
A. Board members are updated quarterly on the company’s
state of security.
B. All security activity takes place within the security
department.
C. Security products, services, and consultants are deployed in
an informed manner.
D. The organization has established metrics and goals for
improving security.
B. If all security activity takes place within the security
department, then security is working within a silo and is not
integrated throughout the organization. In a company with a
security governance program, security responsibilities
permeate the entire organization, from executive
management down the chain of command. A common
scenario would be executive management holding business
unit managements responsible for carrying out risk
management activities for their specific business units. In
addition, employees are held accountable for any security
breaches they participate in, either maliciously or
accidentally.
A is incorrect because security governance is a set of
responsibilities and practices exercised by the board and
executive management of an organization with the goal of
providing strategic direction, ensuring that objectives are
achieved, ascertaining that risks are managed appropriately,
and verifying that the organization’s resources are used
responsibly. An organization with a security governance
program in place has a board of directors that understands
the importance of security and is aware of the organization’s
security performance and breaches.
C is incorrect because security governance is a coherent
system of integrated security components that includes
products, personnel, training, processes, etc. Thus, an
organization with a security governance program in place is
likely to purchase and deploy security products, managed
services, and consultants in an informed manner. They are
also constantly reviewed to ensure they are cost-effective.
D is incorrect because security governance requires
performance measurement and oversight mechanisms. An
organization with a security governance program in place
continually reviews its processes, including security, with the
goal of continued improvement. On the other hand, an
organization that lacks a security governance program is
likely to march forward without analyzing its performance
and therefore repeatedly makes similar mistakes.
Michael is charged with developing a classification program for
his company. Which of the following should he do first?
A. Understand the different levels of protection that must be
provided.
B. Specify data classification criteria.
C. Identify the data custodians.
D. Determine protection mechanisms for each classification
level.
A. Before Michael begins developing his company’s
classification program, he must understand the different
levels of protection that must be provided. Only then can he
develop the necessary classification levels and their criteria.
One company may choose to use only two layers of
classification, while another may choose to use more.
Regardless, when developing classification levels, he should
keep in mind that too many or too few classification levels
will render the classification ineffective; there should be no
overlap in the criteria definitions between classification
levels; and classification levels should be developed for both
data and software.
B is incorrect because data classification criteria cannot be
established until the classification levels themselves have
been defined. The classification criteria are used by data
owners to know what classification should be assigned to
specific data. Basically, the classifications are defined
buckets and the criteria help data owners determine what
bucket each data set should be put into.
C is incorrect because there is no need to identify the data
custodians until classification levels are defined, criteria are
determined for how data are classified, and the data owner
has indicated the classification of the data she is responsible
for. Remember, the data custodian is responsible for
implementing and maintaining the controls specified by the
data owner.
D is incorrect because protection mechanisms for each
classification level cannot be determined until the
classification levels themselves are defined based on the
different levels of protection that are required. The types of
controls implemented per classification will depend upon the
level of protection that management and the security team
have determined is needed.
- ISO/IEC 27000 is part of a growing family of ISO/IEC
information security management systems (ISMS) standards. It
comprises information security standards published jointly by
the International Organization for Standardization (ISO) and the
International Electrotechnical Commission (IEC). Which of the
following provides an incorrect mapping of the individual
standards that make up this family of standards?
A. ISO/IEC 27002 Code of practice for information security
management
B. ISO/IEC 27003 Guideline for ISMS implementation
C. ISO/IEC 27004 Guideline for information security
management measurement and metrics framework
D. ISO/IEC 27005 Guideline for bodies providing audit and
certification of information security management systems
D. The ISO/IEC 27005 standard is the guideline for
information security risk management. ISO/IEC 27005 is an
international standard for how risk management should be
carried out in the framework of an information security
management system (ISMS).
A is incorrect because ISO/IEC 27002 is the code of practice
for information security management; thus, it has a correct
mapping. ISO/IEC 27002 provides best practice
recommendations and guidelines as they pertain to initiating,
implementing, or maintaining information security
management systems (ISMS).
B is incorrect because ISO/IEC 27003 is the guideline for
ISMS implementation; thus, it has a correct mapping. It
focuses on the critical aspects needed for successful design
and implementation of an information security management
system (ISMS) in accordance with ISO/IEC 27001:2005. It
describes the process of ISMS specification and design from
inception to the production of implementation plans.
C is incorrect because ISO/IEC 27004 is the guideline for
information security management measurement and metrics
framework; thus, it has a correct mapping. It provides
guidance on the development and use of measures and
measurement in order to assess the effectiveness of an
implemented information security management system
(ISMS) and controls or groups of controls, as specified in
ISO/IEC 2700
Barry has just been hired as the company security officer at an
international financial institution. He has reviewed the company’s
data protection policies and procedures. He sees that the company
stores its sensitive data within a secured database. The database is
located in a network segment all by itself, which is monitored by a
network-based intrusion detection system. The database is hosted
on a server kept within a server room, which can only be accessed
by personnel with the correct PIN value and smart card. Barry finds
that the sensitive data backups are not being properly secured and
requests that the company implement a secure courier service that
moves backup tapes to a secured location. His management states
that this option is too expensive, so Barry implements a local
hierarchy storage management system that properly protects the
sensitive data.
Which of the following best describes the control types the
company originally had in place?
A. Administrative preventive controls are the policies and
procedures. Technical preventive controls are securing the
system, network segmentation, and intrusion detection
system. Physical detective controls are the physical location
of the database and PIN and smart card access controls.
B. Administrative preventive controls are the policies. Technical
preventive controls are securing the system and intrusion
detection system. Physical preventive controls are the
physical location of the database and PIN and smart card
access controls.
C. Administrative corrective controls are the policies and
procedures. Technical preventive controls are securing the
system, network segmentation, and intrusion detection
system. Physical preventive controls are the physical location
of the database and PIN and smart card access controls.
D. Administrative preventive controls are the policies and
procedures. Technical preventive controls are securing the
system and network segmentation. The technical detective
control is the intrusion detection system. Physical preventive
controls are the physical location of the database and PIN
and smart card access controls
D
Barry has just been hired as the company security officer at an
international financial institution. He has reviewed the company’s
data protection policies and procedures. He sees that the company
stores its sensitive data within a secured database. The database is
located in a network segment all by itself, which is monitored by a
network-based intrusion detection system. The database is hosted
on a server kept within a server room, which can only be accessed
by personnel with the correct PIN value and smart card. Barry finds
that the sensitive data backups are not being properly secured and
requests that the company implement a secure courier service that
moves backup tapes to a secured location. His management states
that this option is too expensive, so Barry implements a local
hierarchy storage management system that properly protects the
sensitive data.
The storage management system that Barry put into place is
referred to as which of the following?
A. Administrative control
B. Compensating control
C. Physical control
D. Confidentiality control
B
Barry has just been hired as the company security officer at an
international financial institution. He has reviewed the company’s
data protection policies and procedures. He sees that the company
stores its sensitive data within a secured database. The database is
located in a network segment all by itself, which is monitored by a
network-based intrusion detection system. The database is hosted
on a server kept within a server room, which can only be accessed
by personnel with the correct PIN value and smart card. Barry finds
that the sensitive data backups are not being properly secured and
requests that the company implement a secure courier service that
moves backup tapes to a secured location. His management states
that this option is too expensive, so Barry implements a local
hierarchy storage management system that properly protects the
sensitive data.
Which are the two most common situations that require the
type of control covered in the scenario to be implemented?
A. Defense-in-depth is required, and the current controls only
provide one protection layer.
B. Primary control costs too much or negatively affects business
operations.
C. Confidentiality is the highest concern in a situation where
defense-in-depth is required.
D. Availability is the highest concern in a situation where
defense-in-depth is required
B
For intrusion detection and prevention system capabilities,
stateful protocol analysis uses which of the following?
1. Blacklists
2. Whitelists
3. Threshold
4. Program code viewing
a. 1 and 2
b. 1, 2, and 3
c. 3 only
d. 1, 2, 3, and 4
- d. Stateful protocol analysis (also known as deep packet inspection)
is the process of comparing predetermined profiles of generally
accepted definitions of benign protocol activity for each protocol state
against observed events to identify deviations. Stateful protocol
analysis uses blacklists, whitelists, thresholds, and program code
viewing to provide various security capabilities.
A blacklist is a list of discrete entities, such as hosts or applications
that have been previously determined to be associated with malicious
activity. A whitelist is a list of discrete entities, such as hosts or
applications known to be benign. Thresholds set the limits between
normal and abnormal behavior of the intrusion detection and
prevention systems (IDPS). Program code viewing and editing features
are established to see the detection-related programming code in the
IDPS.
Electronic authentication begins with which of the following?
a. Token
b. Credential
c. Subscriber
d. Credential service provider
C. An applicant applies to a registration authority (RA) to become a
subscriber of a credential service provider (CSP) and, as a subscriber,
is issued or registers a secret, called a token, and a credential (public
key certificate) that binds the token to a name and other attributes that
the RA has verified. The token and credential may be used in
subsequent authentication events.
In the electronic authentication process, who performs the
identity proofing?
a. Subscriber
b. Registration authority
c. Applicant
d. Credential service provider
B. The RA performs the identity proofing after registering the
applicant with the CSP. An applicant becomes a subscriber of the CSP.
In electronic authentication, which of the following provides the
authenticated information to the relying party for making access
control decisions?
a. Claimant/subscriber
b. Applicant/subscriber
c. Verifier/claimant
d. Verifier/credential service provider
D. The relying party can use the authenticated information provided
by the verifier/CSP to make access control decisions or authorization
decisions. The verifier verifies that the claimant is the subscriber/applicant through an authentication protocol. The verifier passes on an assertion about the identity of the subscriber to the relying party. The verifier and the CSP may or may not belong to the same identity.
In electronic authentication, an authenticated session is
established between which of the following?
a. Claimant and the relying party
b. Applicant and the registration authority
c. Subscriber and the credential service provider
d. Certifying authority and the registration authority
A. An authenticated session is established between the claimant and
the relying party. Sometimes the verifier is also the relying party. The
other three choices are incorrect because the correct answer is based on
facts.
Under which of the following electronic authentication circumstances does the verifier need to directly communicate with the CSP to complete the authentication activity?
a. Use of a digital certificate
b. A physical link between the verifier and the CSP
c. Distributed functions for the verifier, relying party, and the CSP
d. A logical link between the verifier and the CSP
B. The use of digital certificates represents a logical link between the
verifier and the CSP rather than a physical link. In some implementations, the verifier, relying party, and the CSP functions may be distributed and separated. The verifier needs to directly communicate with the CSP only when there is a physical link between them. In other words, the verifier does not need to directly communicate with the CSP for the other three choices.
In electronic authentication, who maintains the registration records to allow recovery of registration records?
a. Credential service provider
b. Subscriber
c. Relying party
d. Registration authority
A. The CSP maintains registration records for each subscriber to
allow recovery of registration records. Other responsibilities of the
CSP include the following:
The CSP is responsible for establishing suitable policies for renewal
and reissuance of tokens and credentials. During renewal, the usage or
validity period of the token and credential is extended without
changing the subscriber’s identity or token. During reissuance, a new
credential is created for a subscriber with a new identity and/or a new
token.
The CSP is responsible for maintaining the revocation status of
credentials and destroying the credential at the end of its life. For
example, public key certificates are revoked using certificate
revocation lists (CRLs) after the certificates are distributed. The
verifier and the CSP may or may not belong to the same entity.
The CSP is responsible for mitigating threats to tokens and credentials
and managing their operations. Examples of threats include disclosure,
tampering, unavailability, unauthorized renewal or reissuance, delayed
revocation or destruction of credentials, and token use after
decommissioning.
The other three choices are incorrect because the (i) subscriber is a
party who has received a credential or token from a CSP, (ii) relying
party is an entity that relies upon the subscriber’s credentials or
verifier’s assertion of an identity, and (iii) registration authority (RA) is
a trusted entity that establishes and vouches for the identity of a
subscriber to a CSP. The RA may be an integral part of a CSP, or it
may be independent of a CSP, but it has a relationship to the CSP(s).
Which of the following is used in the unique identification of employees and contractors?
a. Personal identity verification card token
b. Passwords
c. PKI certificates
d. Biometrics
A. It is suggested that a personal identity verification (PIV) card
token is used in the unique identification of employees and contractors.
The PIV is a physical artifact (e.g., identity card or smart card) issued
to an individual that contains stored identity credentials (e.g.,
photograph, cryptographic keys, or digitized fingerprint).
The other three choices are used in user authenticator management, not
in user identifier management. Examples of user authenticators include
passwords, tokens, cryptographic keys, personal identification
numbers (PINs), biometrics, public key infrastructure (PKI)
certificates, and key cards. Examples of user identifiers include
internal users, external users, contractors, guests, PIV cards,
passwords, tokens, and biometrics.
In electronic authentication, which of the following produces an authenticator used in the authentication process?
a. Encrypted key and password
b. Token and cryptographic key
c. Public key and verifier
d. Private key and claimant
B. The token may be a piece of hardware that contains a
cryptographic key that produces the authenticator used in the
authentication process to authenticate the claimant. The key is
protected by encrypting it with a password.
The other three choices cannot produce an authenticator. A public key
is the public part of an asymmetric key pair typically used to verify
signatures or encrypt data. A verifier is an entity that verifies a
claimant’s identity. A private key is the secret part of an asymmetric
key pair typically used to digitally sign or decrypt data. A claimant is a
party whose identity is to be verified using an authentication protocol.
In electronic authentication, shared secrets are based on which
of the following?
1. Asymmetric keys
2. Symmetric keys
3. Passwords
4. Public key pairs
a. 1 only
b. 1 or 4
c. 2 or 3
d. 3 or 4
C. Shared secrets are based on either symmetric keys or passwords.
The asymmetric keys are used in public key pairs. In a protocol sense,
all shared secrets are similar and can be used in similar authentication
protocols.
For electronic authentication, which of the following is not an
example of assertions?
a. Cookies
b. Security assertions markup language
c. X.509 certificates
d. Kerberos tickets
C. An assertion is a statement from a verifier to a relying party that
contains identity information about a subscriber. Assertions may be
digitally signed objects, or they may be obtained from a trusted source
by a secure protocol. X.509 certificates are examples of electronic
credentials, not assertions. Cookies, security assertions markup
language (SAML), and Kerberos tickets are examples of assertions.
In electronic authentication, electronic credentials are stored as data in a directory or database. Which of the following refers to when the directory or database is untrusted?
a. Self-authenticating
b. Authentication to the relying party
c. Authentication to the verifier
d. Authentication to the credential service provider
A. When electronic credentials are stored in a directory or database
server, the directory or database may be an untrusted entity because the
data it supplies is self-authenticated. Alternatively, the directory or
database server may be a trusted entity that authenticates itself to the
relying party or verifier, but not to the CSP.
The correct flows and proper interactions between parties
involved in electronic authentication include:
a. Applicant⇒Registration Authority⇒Subscriber⇒Claimant
b. Registration Authority⇒Applicant⇒Claimant⇒Subscriber
c. Subscriber⇒Applicant⇒Registration Authority⇒Claimant
d. Claimant⇒Subscriber⇒Registration Authority⇒Applicant
A. The correct flows and proper interactions between the various
parties involved in electronic authentication include the following:
An individual applicant applies to a registration authority (RA)
through a registration process to become a subscriber of a
credential service provider (CSP) The RA identity proofs that applicant
On successful identity proofing, the RA sends the CSP a
registration confirmation message A secret token and a corresponding credential are established between the CSP and the new subscriber for use in subsequent authentication events The party to be authenticated is called a claimant (subscriber) and the party verifying that identity is called a verifier The other three choices are incorrect be
In electronic authentication, which of the following represents
the correct order of passing information about assertions?
a. Subscriber⇒Credential Service Provider⇒Registration
Authority
b. Verifier⇒Claimant⇒Relying Party
c. Relying Party⇒Claimant⇒Registration Authority
d. Verifier⇒Credential Service Provider⇒Relying Party
B. An assertion is a statement from a verifier to a relying party that
contains identity information about a subscriber (i.e., claimant). These
assertions are used to pass information about the claimant from the
verifier to a relying party. Assertions may be digitally signed objects or
they may be obtained from a trusted source by a secure protocol. When
the verifier and the relying parties are separate entities, the verifier
conveys the result of the authentication protocol to the relying party.
The object created by the verifier to convey the result of the
authentication protocol is called an assertion. The credential service
provider and the registration authority are not part of the assertion
process.
From an access control viewpoint, which of the following are
restricted access control models?
1. Identity-based access control policy
2. Attribute-based access control policy
3. Bell-LaPadula access control model
4. Domain type enforcement access control model
a. 1 and 2
b. 2 and 3
c. 3 and 4
d. 1, 2, 3, and 4
C. Both the Bell-LaPadula model and domain type enforcement
model uses restricted access control models because they are employed
in safety-critical systems, such as military and airline systems. In a
restricted model, the access control policies are expressed only once by
a trusted principal and fixed for the life of the system. The identitybased and attribute-based access control policies are not based on
restricted access control models but based on identities and attributes
respectively.
Regarding password guessing and cracking threats, which of
the following can help mitigate such threats?
a. Passwords with low entropy, larger salts, and smaller stretching
b. Passwords with high entropy, smaller salts, and smaller
stretching
c. Passwords with high entropy, larger salts, and larger stretching
d. Passwords with low entropy, smaller salts, and larger stretching
C. Entropy in an information system is the measure of the disorder
or randomness in the system. Passwords need high entropy because
low entropy is more likely to be recovered through brute force attacks.
Salting is the inclusion of a random value in the password hashing
process that greatly decreases the likelihood of identical passwords
returning the same hash. Larger salts effectively make the use of
Rainbow Tables (lookup tables) by attackers infeasible. Many
operating systems implement salted password hashing mechanisms to
reduce the effectiveness of password cracking.
Stretching, which is another technique to mitigate the use of rainbow
tables, involves hashing each password and its salt thousands of times.
Larger stretching makes the creation of rainbow tables more time consuming, which is not good for the attacker, but good for the
attacked organization. Rainbow tables are lookup tables that contain
precomputed password hashes. Therefore, passwords with high
entropy, larger salts, and larger stretching can mitigate password
guessing and cracking attempts by attackers.
In electronic authentication using tokens, the authenticator in
the general case is a function of which of the following?
a. Token secret and salt or challenge
b. Token secret and seed or challenge
c. Token secret and nonce or challenge
d. Token secret and shim or challenge
C. The authenticator is generated through the use of a token. In the
trivial case, the authenticator may be the token secret itself where the
token is a password. In the general case, an authenticator is generated
by performing a mathematical function using the token secret and one
or more optional token input values such as a nonce or challenge.
A salt is a nonsecret value used in a cryptographic process, usually to
ensure that the results of computations for one instance cannot be
reused by an attacker.
A seed is a starting value to generate initialization vectors. A nonce is
an identifier, a value, or a number used only once. Using a nonce as a
challenge is a different requirement than a random-challenging because
a nonce is predictable.
A shim is a layer of host-based intrusion detection and prevention code
placed between existing layers of code on a host that intercepts data
and analyzes it.
In electronic authentication, using one token to gain access to a
second token is called a:
a. Single-token, multifactor scheme
b. Single-token, single-factor scheme
c. Multitoken, multifactor scheme
d. Multistage authentication scheme
B. Using one token to gain access to a second token is considered a
single token and a single factor scheme because all that is needed to
gain access is the initial token. Therefore, when this scheme is used,
the compound solution is only as strong as the token with the lowest
assurance level. The other choices are incorrect because they are not
applicable to the situation here.
As a part of centralized password management solutions,which of the following statements are true about passwordsynchronization?
1. No centralized directory
2. No authentication server
3. Easier to implement than single sign-on technology
4. Less expensive than single sign-on technology
a. 1 and 3
b. 2 and 4
c. 3 and 4
d. 1, 2, 3, and 4
D. A password synchronization solution takes a password from a
user and changes the passwords on other resources to be the same as
that password. The user then authenticates directly to each resource
using that password. There is no centralized directory or no
authentication server performing authentication on behalf of the
resources. The primary benefit of password synchronization is that it
reduces the number of passwords that users need to remember; this
may permit users to select stronger passwords and remember them
more easily. Unlike single sign-on (SSO) technology, password
synchronization does not reduce the number of times that users need to
authenticate. Password synchronization solutions are typically easier,
less expensive, and less secure to implement than SSO technologies
As a part of centralized password management solutions,
password synchronization becomes a single point-of-failure due to
which of the following?
a. It uses the same password for many resources.
b. It can enable an attacker to compromise a low-security resource
to gain access to a high-security resource.
c. It uses the lowest common denominator approach to password
strength.
d. It can lead passwords to become unsynchronized.
A. All four choices are problems with password synchronization
solution. Because the same password is used for many resources, the
compromise of any one instance of the password compromises all the
instances, therefore becoming a single point-of-failure. Password
synchronization forces the use of the lowest common denominator
approach to password strength, resulting in weaker passwords due to
character and length constraints. Passwords can become
unsynchronized when a user changes a resource password directly with
that resource instead of going through the password synchronization
user interface. A password could also be changed due to a resource
failure that requires restoration of a backup.
RuBAC is rule-based access control; RAdAC is risk adaptive
access control; UDAC is user-directed access control; MAC is
mandatory access control; ABAC is attribute-based access control;
RBAC is role-based access control; IBAC is identity-based access
control; and PBAC is policy-based access control. From an access
control viewpoint, separation of domains is achieved through
which of the following?
a. RuBAC or RAdAC
b. UDAC or MAC
c. ABAC or RBAC
d. IBAC or PBAC
C. Access control policy may benefit from separating Web services
into various domains or compartments. This separation can be
implemented in ABAC using resource attributes or through additional
roles defined in RBAC. The other three choices cannot handle
separation of domains.
Regarding local administrator password selection, which of the
following can become a single point-of-failure?
a. Using the same local root account password across systems
b. Using built-in root accounts
c. Storing local passwords on the local system
d. Authenticating local passwords on the local system
A. Having a common password shared among all local
administrator or root accounts on all machines within a network
simplifies system maintenance, but it is a widespread security
weakness, becoming a single point-of-failure. If a single machine is
compromised, an attacker may recover the password and use it to gain
access to all other machines that use the shared password. Therefore, it
is good to avoid using the same local administrator or root account
passwords across many systems. The other three choices, although
risky in their own way, do not yield a single point-of-failure.
In electronic authentication, which of the following statements is not true about a multistage token scheme?
a. An additional token is used for electronic transaction receipt.
b. Multistage scheme assurance is higher than the multitoken
scheme assurance using the same set of tokens.
c. An additional token is used as a confirmation mechanism.
d. Two tokens are used in two stages to raise the assurance level.
B. In a multistage token scheme, two tokens are used in two stages,
and additional tokens are used for transaction receipt and confirmation
mechanism to achieve the required assurance level. The level of
assurance of the combination of the two stages can be no higher than
that possible through a multitoken authentication scheme using the
same set of tokens.
Online guessing is a threat to the tokens used for electronic
authentication. Which of the following is a countermeasure to
mitigate the online guessing threat?
a. Use tokens that generate high entropy authenticators.
b. Use hardware cryptographic tokens.
c. Use tokens with dynamic authenticators.
d. Use multifactor tokens.
A. Entropy is the uncertainty of a random variable. Tokens that
generate high entropy authenticators prevent online guessing of secret
tokens registered to a legitimate claimant and offline cracking of
tokens. The other three choices cannot prevent online guessing of
tokens or passwords.
Token duplication is a threat to the tokens used for electronic
authentication. Which of the following is a countermeasure to
mitigate the token duplication threat?
a. Use tokens that generate high entropy authenticators.
b. Use hardware cryptographic tokens.
c. Use tokens with dynamic authenticators.
d. Use multifactor tokens.
B. In token duplication, the subscriber’s token has been copied with
or without the subscriber’s knowledge. A countermeasure is to use
hardware cryptographic tokens that are difficult to duplicate. Physical
security mechanisms can also be used to protect a stolen token from
duplication because they provide tamper evidence, detection, and
response capabilities. The other three choices cannot handle a
duplicate tokens problem.
Eavesdropping is a threat to the tokens used for electronic
authentication. Which of the following is a countermeasure to
mitigate the eavesdropping threat?
a. Use tokens that generate high entropy authenticators.
b. Use hardware cryptographic tokens.
c. Use tokens with dynamic authenticators.
d. Use multifactor tokens.
C. A countermeasure to mitigate the eavesdropping threat is to use
tokens with dynamic authenticators where knowledge of one
authenticator does not assist in deriving a subsequent authenticator.
The other choices are incorrect because they cannot provide dynamic
authentication.
Identifier management is applicable to which of the following accounts?
a. Group accounts
b. Local user accounts
c. Guest accounts
d. Anonymous accounts
B. All users accessing an organization’s information systems must
be uniquely identified and authenticated. Identifier management is
applicable to local user accounts where the account is valid only on a
local computer, and its identity can be traced to an individual.
Identifier management is not applicable to shared information system
accounts, such as group, guest, default, blank, anonymous, and
nonspecific user accounts.
Phishing or pharming is a threat to the tokens used for electronic authentication. Which of the following is a countermeasure to mitigate the phishing or pharming threat?
a. Use tokens that generate high entropy authenticators.
b. Use hardware cryptographic tokens.
c. Use tokens with dynamic authenticators.
d. Use multifactor tokens.
C. A countermeasure to mitigate the phishing or pharming threat is
to use tokens with dynamic authenticators where knowledge of one
authenticator does not assist in deriving a subsequent authenticator.
The other choices are incorrect because they cannot provide dynamic
authentication.
Phishing is tricking individuals into disclosing sensitive personal
information through deceptive computer-based means. Phishing
attacks use social engineering and technical subterfuge to steal
consumers’ personal identity data and financial account credentials. It
involves Internet fraudsters who send spam or pop-up messages to lure
personal information (e.g., credit card numbers, bank account
information, social security numbers, passwords, or other sensitive
information) from unsuspecting victims. Pharming is misdirecting
users to fraudulent websites or proxy servers, typically through DNS
hijacking or poisoning.
Theft is a threat to the tokens used for electronic authentication. Which of the following is a countermeasure to mitigate the theft threat?
a. Use tokens that generate high entropy authenticators.
b. Use hardware cryptographic tokens.
c. Use tokens with dynamic authenticators.
d. Use multifactor tokens.
D. A countermeasure to mitigate the threat of token theft is to use
multifactor tokens that need to be activated through a PIN or
biometric. The other choices are incorrect because they cannot provide
multifactor tokens.
Social engineering is a threat to the tokens used for electronic authentication. Which of the following is a countermeasure to mitigate the social engineering threat?
a. Use tokens that generate high entropy authenticators.
b. Use hardware cryptographic tokens.
c. Use tokens with dynamic authenticators.
d. Use multifactor tokens.
C. A countermeasure to mitigate the social engineering threat is to
use tokens with dynamic authenticators where knowledge of one
authenticator does not assist in deriving a subsequent authenticator.
The other choices are incorrect because they cannot provide dynamic
authentication.
In electronic authentication, which of the following is used to verify proof-of-possession of registered devices or identifiers?
a. Lookup secret token
b. Out-of-band token
c. Token lock-up feature
d. Physical security mechanism
B. Out-of-band tokens can be used to verify proof-of-possession of
registered devices (e.g., cell phones) or identifiers (e.g., e-mail IDs).
The other three choices cannot verify proof-of-possession. Lookup
secret tokens can be copied. Some tokens can lock up after a number
of repeated failed activation attempts. Physical security mechanisms
can be used to protect a stolen token from duplication because they
provide tamper evidence, detection, and response capabilities.
In electronic authentication, which of the following are examples of weakly bound credentials?
1. Unencrypted password files
2. Signed password files
3. Unsigned public key certificates
4. Signed public key certificates
a. 1 only
b. 1 and 3
c. 1 and 4
d. 2 and 4
B. Unencrypted password files and unsigned public key certificates
are examples of weakly bound credentials. The association between
the identity and the token within a weakly bound credential can be
readily undone, and a new association can be readily created. For
example, a password file is a weakly-bound credential because anyone
who has “write” access to the password file can potentially update the
association contained within the file.
In electronic authentication, which of the following are examples of strongly bound credentials?
1. Unencrypted password files
2. Signed password files
3. Unsigned public key certificates
4. Signed public key certificates
a. 1 only
b. 1 and 3
c. 1 and 4
d. 2 and 4
.
D. Signed password files and signed public key certificates are
examples of strongly bound credentials. The association between the
identity and the token within a strongly bound credential cannot be
easily undone. For example a digital signature binds the identity to the
public key in a public key certificate; tampering of this signature can
be easily detected through signature verification.
Authorization controls are a part of which of the following?
a. Directive controls
b. Preventive controls
c. Detective controls
d. Corrective controls
B. Authorization controls such as access control matrices and
capability tests are a part of preventive controls because they block
unauthorized access. Preventive controls deter security incidents from
happening in the first place.
Directive controls are broad-based controls to handle security
incidents, and they include management’s policies, procedures, and
directives. Detective controls enhance security by monitoring the
effectiveness of preventive controls and by detecting security incidents
where preventive controls were circumvented. Corrective controls are
procedures to react to security incidents and to take remedial actions
on a timely basis. Corrective controls require proper planning and
preparation as they rely more on human judgment.
In electronic authentication, after a credential has been created, which of the following is responsible for maintaining the credential in storage?
a. Verifier
b. Relying party
c. Credential service provider
d. Registration authority
C. The credential service provider (CSP) is the only one responsible
for maintaining the credential in storage. The verifier and the CSP may
or may not belong to the same entity. The other three choices are
incorrect because they are not applicable to the situation here.
Which of the following is the correct definition of privilege management?
a. Privilege management = Entity attributes + Entity policies
b. Privilege management = Attribute management + Policy
management
c. Privilege management = Resource attributes + Resource policies
d. Privilege management = Environment attributes + Environment
policies
B. Privilege management is defined as a process that creates,
manages, and stores the attributes and policies needed to establish
criteria that can be used to decide whether an authenticated entity’s
request for access to some resource should be granted. Privilege
management is conceptually split into two parts: attribute management
and policy management. The attribute management is further defined
in terms of entity attributes, resource attributes, and environment
attributes. Similarly, the policy management is further defined in terms
of entity policies, resource policies, and environment policies.
The extensible access control markup language (XACML) does
not define or support which of the following?
a. Trust management
b. Privilege management
c. Policy language
d. Query language
A. The extensible access control markup language (XACML) is a
standard for managing access control policy and supports the
enterprise-level privilege management. It includes a policy language
and a query language. However, XACML does not define authority
delegation and trust management.
For intrusion detection and prevention system (IDPS) security capabilities, which of the following prevention actions should be performed first to reduce the risk of inadvertently blocking benign activity?
1. Alert enabling capability.
2. Alert disabling capability.
3. Sensor learning mode ability.
4. Sensor simulation mode ability.
a. 1 and 2
b. 1 and 3
c. 2 and 4
d. 3 and 4
D. Some intrusion detection and prevention system (IDPS) sensors
have a learning mode or simulation mode that suppresses all
prevention actions and instead indicates when a prevention action
should have been performed. This ability enables administrators to
monitor and fine-tune the configuration of the prevention capabilities
before enabling prevention actions, which reduces the risk of
inadvertently blocking benign activity. Alerts can be enabled or
disabled later
In the electronic authentication process, which of the following
is weakly resistant to man-in-the-middle (MitM) attacks?
a. Account lockout mechanism
b. Random data
c. Sending a password over server authenticated TLS
d. Nonce
C. A protocol is said to have weak resistance to MitM attacks if it
provides a mechanism for the claimant to determine whether he is
interacting with the real verifier, but still leaves the opportunity for the
nonvigilant claimant to reveal a token authenticator to an unauthorized
party that can be used to masquerade as the claimant to the real
verifier. For example, sending a password over server authenticated
transport layer security (TLS) is weakly resistant to MitM attacks. The
browser enables the claimant to verify the identity of the verifier;
however, if the claimant is not sufficiently vigilant, the password will
be revealed to an unauthorized party who can abuse the information.
The other three choices do not deal with MitM attacks, but they can
enhance the overall electronic authentication process.
An account lockout mechanism is implemented on the verifier to
prevent online guessing of passwords by an attacker who tries to
authenticate as a legitimate claimant. Random data and nonce can be
used to disguise the real data.
In the electronic authentication process, which of the following is strongly resistant to man-in-the-middle (MitM) attacks?
a. Encrypted key exchange (EKE)
b. Simple password exponential key exchange (SPEKE)
c. Secure remote password protocol (SRP)
d. Client authenticated transport layer security (TLS)
D. A protocol is said to be highly resistant to man-in-the-middle
(MitM) attacks if it does not enable the claimant to reveal, to an
attacker masquerading as the verifier, information (e.g., token secrets
and authenticators) that can be used by the latter to masquerade as the
true claimant to the real verifier. For example, in client authenticated
transport layer security (TLS), the browser and the Web server
authenticate one another using public key infrastructure (PKI)
credentials, thus strongly resistant to MitM attacks. The other three
choices are incorrect, because they are examples of being weakly
resistant to MitM attacks and are examples of zero-knowledge
password protocol where the claimant is authenticated to a verifier
without disclosing the token secret.
In electronic authentication, which of the following controls is
effective against cross site scripting (XSS) vulnerabilities?
a. Sanitize inputs to make them nonexecutable.
b. Insert random data into any linked uniform resource locator.
c. Insert random data into a hidden field.
d. Use a per-session shared secret.
D. In a cross site scripting (XSS) vulnerability, an attacker may use
an extensible markup language (XML) injection to perform the
equivalent of an XSS, in which requesters of a valid Web service have
their requests transparently rerouted to an attacker-controlled Web
service that performs malicious operations. To prevent XSS
vulnerabilities, the relying party should sanitize inputs from claimants
or subscribers to ensure they are not executable, or at the very least not
malicious, before displaying them as content to the subscriber’s
browser. The other three choices are incorrect because they are not
applicable to the situation here.
In electronic authentication, which of the following controls is
not effective against a cross site request forgery (CSRF) attack?
a. Sanitize inputs to make them nonexecutable.
b. Insert random data into any linked uniform resource locator.
c. Insert random data into a hidden field.
d. Generate a per-session shared secret.
A. A cross site request forgery (CSRF) is a type of session
hijacking attack where a malicious website contains a link to the URL
of the legitimate relying party. Web applications, even those protected
by secure sockets layer/transport layer security (SSL/TLS), can still be
vulnerable to the CSRF attack. One control to protect the CSRF attack
is by inserting random data, supplied by the relying party, into any
linked uniform resource locator with side effects and into a hidden
field within any form on the relying party’s website. Generating a persession shared secret is effective against a session hijacking problem.
Sanitizing inputs to make them nonexecutable is effective against cross
site scripting (XSS) attacks, not CSRF attacks.
In electronic authentication, which of the following can mitigate the threat of assertion manufacture and/or modification?
a. Digital signature and TLS/SSL
b. Timestamp and short lifetime of validity
c. Digital signature with a key supporting nonrepudiation
d. HTTP and TLS
A. An assertion is a statement from a verifier to a relying party that
contains identity information about a subscriber. To mitigate the threat
of assertion manufacture and/or modification, the assertion may be
digitally signed by the verifier and the assertion sent over a protected
channel such as TLS/SSL. The other three choices are incorrect
because they are not applicable to the situation here.
In electronic authentication, which of the following can mitigate the threat of assertion reuse?
a. Digital signature and TLS/SSL
b. Timestamp and short lifetime of validity
c. Digital signature with a key supporting nonrepudiation
d. HTTP and TLS
B. An assertion is a statement from a verifier to a relying party that
contains identity information about a subscriber. To mitigate the threat
of assertion reuse, the assertion should include a timestamp and a short
lifetime of validity. The other three choices are incorrect because they
are not applicable to the situation here.
In electronic authentication, which of the following can mitigate the threat of assertion repudiation?
a. Digital signature and TLS/SSL
b. Timestamp and short lifetime of validity
c. Digital signature with a key supporting nonrepudiation
d. HTTP and TLS
C. An assertion is a statement from a verifier to a relying party that
contains identity information about a subscriber. To mitigate the threat
of assertion repudiation, the assertion may be digitally signed by the
verifier using a key that supports nonrepudiation. The other three
choices are incorrect because they are not applicable to the situation
here.
In electronic authentication, which of the following can mitigate the threat of assertion substitution?
a. Digital signature and TLS/SSL
b. Timestamp and short lifetime of validity
c. Digital signature with a key supporting nonrepudiation
d. HTTP and TLS
D. An assertion is a statement from a verifier to a relying party that
contains identity information about a subscriber. To mitigate the threat
of assertion substitution, the assertion may include a combination of
HTTP to handle message order and TLS to detect and disallow
malicious reordering of packets. The other three choices are incorrect
because they are not applicable to the situation here.
In mobile device authentication, password and personal identification number (PIN) authentication is an example of which of the following?
a. Proof-by-possession
b. Proof-by-knowledge
c. Proof-by-property
d. Proof-of-origin
B. Proof-by-knowledge is where a claimant authenticates his
identity to a verifier by the use of a password or PIN (i.e., something
you know) that he has knowledge of.
Proof-by-possession and proof-by-property, along with proof-byknowledge, are used in mobile device authentication and robust
authentication. Proof-of-origin is the basis to prove an assertion. For
example, a private signature key is used to generate digital signatures
as a proof-of-origin.
Serious vulnerabilities exist when:
a. An untrusted individual has been granted an unauthorized
access.
b. A trusted individual has been granted an authorized access.
c. An untrusted individual has been granted an authorized access.
d. A trusted individual has been granted an unauthorized access.
A. Vulnerabilities typically result when an untrusted individual is
granted unauthorized access to a system. Granting unauthorized access
is riskier than granting authorized access to an untrusted individual,
and trusted individuals are better than untrusted individuals. Both trust
and authorization are important to minimize vulnerabilities. The other
three choices are incorrect because serious vulnerabilities may not
exist with them.
In mobile device authentication, fingerprint authentication is an example of which of the following?
a. Proof-by-possession
b. Proof-by-knowledge
c. Proof-by-property
d. Proof-of-origin
C. Proof-by-property is where a claimant authenticates his identity
to a verifier by the use of a biometric sample such as fingerprints (i.e.,
something you are).
Proof-by-possession and proof-by-knowledge, along with proof-by property, are used in mobile device authentication and robust
authentication. Proof-of-origin is the basis to prove an assertion. For
example, a private signature key is used to generate digital signatures
as a proof-of-origin.
Which of the following actions is effective for reviewing guest/anonymous accounts, temporary accounts, inactive accounts,
and emergency accounts?
a. Disabling
b. Auditing
c. Notifying
d. Terminating
B. All the accounts mentioned in the question can be disabled,
notified, or terminated, but it is not effective. Auditing of account
creation, modification, notification, disabling, and termination (i.e., the
entire account cycle) is effective because it can identify anomalies in
the account cycle process.
Regarding access enforcement, which of the following mechanisms should not be employed when an immediate response is necessary to ensure public and environmental safety?
a. Dual cable
b. Dual authorization
c. Dual use certificate
d. Dual backbone
B. Dual authorization mechanisms require two forms of approval to
execute. The organization should not employ a dual authorization
mechanism when an immediate response is necessary to ensure public
and environmental safety because it could slow down the needed
response. The other three choices are appropriate when an immediate
response is necessary.
Which of the following is not an example of nondiscretionary access control?
a. Identity-based access control
b. Mandatory access control
c. Role-based access control
d. Temporal constraints
A. Nondiscretionary access control policies have rules that are not
established at the discretion of the user. These controls can be changed
only through administrative action and not by users. An identity-based
access control (IBAC) decision grants or denies a request based on the
presence of an entity on an access control list (ACL). IBAC and
discretionary access control are considered equivalent and are not
examples of nondiscretionary access controls.
The other three choices are examples of nondiscretionary access
controls. Mandatory access control deals with rules, role-based access
control deals with job titles and functions, and temporal constraints
deal with time-based restrictions and control time-sensitive activities.
Encryption is used to reduce the probability of unauthorized disclosure and changes to information when a system is in which of the following secure, non-operable system states?
a. Troubleshooting
b. Offline for maintenance
c. Boot-up
d. Shutdown
B. Secure, non-operable system states are states in which the
information system is not performing business-related processing.
These states include offline for maintenance, troubleshooting, bootup,
and shutdown. Offline data should be stored with encryption in a
secure location. Removing information from online storage to offline
storage eliminates the possibility of individuals gaining unauthorized
access to that information via a network.
Bitmap objects and textual objects are part of which of the following security policy filters?
a. File type checking filters
b. Metadata content filters
c. Unstructured data filters
d. Hidden content filters
C. Unstructured data consists of two basic categories: bitmap
objects (e.g., image, audio, and video files) and textual objects (e.g., emails and spreadsheets). Security policy filters include file type
checking filters, dirty word filters, structured and unstructured data
filters, metadata content filters, and hidden content filters.
Information flow control enforcement employing rulesets to restrict information system services provides:
1. Structured data filters
2. Metadata content filters
3. Packet filters
4. Message filters
a. 1 and 2
b. 2 and 3
c. 3 and 4
d. 1, 2, 3, and 4
C. Packet filters are based on header information whereas message
filters are based on content using keyword searches. Both packet filters
and message filters use rulesets. Structured data filters and metadata
content filters do not use rulesets.
For information flow enforcement, what are explicit security attributes used to control?
a. Release of sensitive data
b. Data content
c. Data structure
d. Source objects
A. Information flow enforcement using explicit security attributes
are used to control the release of certain types of information such as
sensitive data. Data content, data structure, and source and destination
objects are examples of implicit security attributes.
What do policy enforcement mechanisms, used to transfer information between different security domains prior to transfer,
include?
1. Embedding rules
2. Release rules
3. Filtering rules
4. Sanitization rules
a. 1 and 2
b. 2 and 3
c. 3 and 4
d. 1, 2, 3, and 4
C. Policy enforcement mechanisms include the filtering and/or
sanitization rules that are applied to information prior to transfer to a
different security domain. Embedding rules and release rules do not
handle information transfer.
Which of the following is not an example of policy rules for cross domain transfers?
a. Prohibiting more than two-levels of embedding
b. Facilitating policy decisions on source and destination
c. Prohibiting the transfer of archived information
d. Limiting embedded components within other components
B. Parsing transfer files facilitates policy decisions on source,
destination, certificates, classification subject, or attachments. The
other three choices are examples of policy rules for cross domain
transfers.
- Which of the following are the ways to reduce the range of potential malicious content when transferring information between different security domains?
- Constrain file lengths
- Constrain character sets
- Constrain schemas
- Constrain data structures
a. 1 and 3
b. 2 and 3
c. 3 and 4
d. 1, 2, 3, and 4
D. The information system, when transferring information between
different security domains, implements security policy filters that
constrain file lengths, character sets, schemas, data structures, and
allowed enumerations to reduce the range of potential malicious and/or
unsanctioned content.
Which of the following cannot detect unsanctioned information and prohibit the transfer of such information between different security domains (i.e., domain-type enforcement)?
a. Implementing one-way flows
b. Checking information for malware
c. Implementing dirty word list searches
d. Applying security attributes to metadata
A. One-way flows are implemented using hardware mechanisms for
controlling the flow of information within a system and between
interconnected systems. As such they cannot detect unsanctioned
information.
The other three choices do detect unsanctioned information and
prohibit the transfer with actions such as checking all transferred
information for malware, implementing dirty word list searches on
transferred information, and applying security attributes to metadata
that are similar to information payloads.
Which of the following binds security attributes to information to facilitate information flow policy enforcement?
a. Security labels
b. Resolution labels
c. Header labels
d. File labels
B. Means to bind and enforce the information flow include
resolution labels that distinguish between information systems and
their specific components, and between individuals involved in
preparing, sending, receiving, or disseminating information. The other
three types of labels cannot bind security attributes to information.
Which of the following access enforcement mechanisms provides increased information security for an organization?
a. Access control lists
b. Business application system
c. Access control matrices
d. Cryptography
B. Normal access enforcement mechanisms include access control
lists, access control matrices, and cryptography. Increased information
security is provided at the application system level (i.e., accounting
and marketing systems) due to the use of password and PIN.
What policies about information on interconnected systems include?
1. Implementing access-only mechanisms
2. Implementing one-way transfer mechanisms
3. Employing hardware mechanisms to provide unitary flow
directions
4. Implementing regrading mechanisms to reassign security attributes
a. 1 only
b. 2 only
c. 3 only
d. 1, 2, 3, and 4
D. Specific architectural security solutions can reduce the potential
for undiscovered vulnerabilities. These solutions include all four items
mentioned.
From an access control point of view, separation of duty is of two types: static and dynamic. Which of the following are examples of static separation of duties?
1. Role-based access control
2. Workflow policy
3. Rule-based access control
4. Chinese Wall policy
a. 1 and 2
b. 1 and 3
c. 2 and 4
d. 3 and 4
B. Separation of duty constraints require that two roles be mutually
exclusive because no user should have the privileges from both roles.
Both role-based and rule-based access controls are examples of static
separation of duty.
Dynamic separation of duty is enforced at access time, and the
decision to grant access refers to the past access history. Examples of
dynamic separation of duty include workflow policy and the Chinese
Wall policy.
In biometrics-based identification and authentication techniques, which of the following statements are true about biometric errors?
1. High false rejection rate is preferred.
2. Low false acceptance rate is preferred.
3. High crossover error rate represents low accuracy.
4. Low crossover error rate represents low accuracy.
a. 1 and 3
b. 1 and 4
c. 2 and 3
d. 2 and 4
C. The goal of biometrics-based identification and authentication
techniques about biometric errors is to obtain low numbers for both
false rejection rate and false acceptance rate errors. Another goal is to
obtain a low crossover error rate because it represents high accuracy or
a high crossover error rate because it represents low accuracy.
C. The goal of biometrics-based identification and authentication
techniques about biometric errors is to obtain low numbers for both
false rejection rate and false acceptance rate errors. Another goal is to
obtain a low crossover error rate because it represents high accuracy or
a high crossover error rate because it represents low accuracy.
For password management, user-selected passwords generally contain which of the following?
1. Less entropy
2. Easier for users to remember
3. Weaker passwords
4. Easier for attackers to guess
a. 2 only
b. 2 and 3
c. 2, 3, and 4
d. 1, 2, 3, and 4
D. User-selected passwords generally contain less entropy, are easier for users to remember, use weaker passwords, and at the same time are easier for attackers to guess or crack.
As a part of centralized password management solution, which of the following architectures for single sign-on technology becomes a single point-of-failure?
a. Kerberos authentication service
b. Lightweight directory access protocol
c. Domain passwords
d. Centralized authentication server
D. A common architecture for single sign-on (SSO) is to have an
authentication service, such as Kerberos, for authenticating SSO users,
and a database or directory service such as lightweight directory access
protocol (LDAP) that stores authentication information for the
resources the SSO handles authentication for. By definition, the SSO
technology uses a password, and an SSO solution usually includes one
or more centralized servers containing authentication credentials for
many users. Such a server becomes a single point-of-failure for
authentication to many resources, so the availability of the server
affects the availability of all the resources that rely on that server.
If proper mutual authentication is not performed, what is the single sign-on technology vulnerable to?
a. Man-in-the-middle attack
b. Replay attack
c. Social engineering attack
d. Phishing attack
A. User authentication to the single sign-on (SSO) technology is
important. If proper mutual authentication is not performed, the SSO
technology using passwords is vulnerable to a man-in-the-middle
(MitM) attack. Social engineering and phishing attacks are based on
passwords, and replay attacks do not use passwords.
From an access control point of view, separation of duty is of two types: static and dynamic. Which of the following are examples of dynamic separation of duties?
1. Two-person rule
2. History-based separation of duty
3. Design-time
4. Run-time
a. 1 and 2
b. 1 and 3
c. 2 and 4
d. 3 and 4
A. The two-person rule states that the first user can be any
authorized user, but the second user can be any authorized user
different from the first. History-based separation of duty regulates that
the same subject (role or user) cannot access the same object (program
or device) for a variable number of times. Design-time and run-time
are used in the workflow policy.
From an access control point of view, the Chinese Wall policy focuses on which of the following?
a. Confidentiality
b. Integrity
c. Availability
d. Assurance
A. The Chinese Wall policy is used where company sensitive
information (i.e., confidentiality) is divided into mutually disjointed
conflict-of-interest categories. The Biba model focuses on integrity.
Availability, assurance, and integrity are other components of security
principles that are not relevant to the Chinese Wall policy.
From an access control point of view, which of the following maintains consistency between the internal data and users’ expectations of that data?
a. Security policy
b. Workflow policy
c. Access control policy
d. Chinese Wall policy
B. The goal of workflow policy is to maintain consistency between
the internal data and external (users’) expectations of that data. This is
because the workflow is a process, consisting of tasks, documents, and
data. The Chinese Wall policy deals with dividing sensitive data into
separate categories. The security policy and the access control policy
are too general to be of any importance here.
From an access control point of view, separation of duty is not related to which of the following?
a. Safety
b. Reliability
c. Fraud
d. Security
B. Computer systems must be designed and developed with
security and safety in mind because unsecure and unsafe systems can
cause injury to people and damage to assets (e.g., military and airline
systems). With separation of duty (SOD), fraud can be minimized
when sensitive tasks are separated from each other (e.g., signing a
check from requesting a check). Reliability is more of an engineering
term in that a computer system is expected to perform with the
required precision on a consistent basis. On the other hand, SOD deals
with people and their work-related actions, which are not precise and
consistent.
Which of the following statements are true about access controls, safety, trust, and separation of duty?
1. No leakage of access permissions are allowed to an unauthorized
principal.
2. No access privileges can be escalated to an unauthorized principal.
3. No principals’ trust means no safety.
4. No separation of duty means no safety.
a. 1 only
b. 2 only
c. 1, 2, and 3
d. 1, 2, 3, and 4
D. If complete trust by a principal is not practical, there is a
possibility of a safety violation. The separation of duty concept is used
to enforce safety and security in some access control models. In an
event where there are many users (subjects), objects, and relations
between subjects and objects, safety needs to be carefully considered.
From a safety configuration viewpoint, the separation of duty concept is not enforced in which of the following?
a. Mandatory access control policy
b. Bell-LaPadula access control model
c. Access control matrix model
d. Domain type enforcement access control model
C. The separation of duty concept is not enforced by the access
control matrix model because it is not safety configured and is based
on an arbitrary constraint. The other three choices use restricted access
control models with access constraints that describe the safety
requirements of any configuration.
The purpose of static separation of duty is to address problems,
such as static exclusivity and the assurance principle. Which of the
following refers to the static exclusivity problem?
1. To reduce the likelihood of fraud.
2. To prevent the loss of user objectivity.
3. One user is less likely to commit fraud when this user is a part of
many users involved in a business transaction.
4. Few users are less likely to commit collusion when these users are
a part of many users involved in a business transaction.
a. 1 and 2
b. 2 and 3
c. 3 and 4
d. 1, 2, 3, and 4
A. A static exclusivity problem is the condition for which it is
considered dangerous for any user to gain authorization for a
conflicting set of access capabilities. The motivation for exclusivity
relations includes reducing the likelihood of fraud or preventing the
loss of user objectivity. The assurance principle deals with committing
fraud or collusion when many users are involved in handling a
business transaction.
Role-based access control and the least privilege principle do not enable which of the following?
a. Read access to a specified file
b. Write access to a specified directory
c. Connect access to a given host computer
d. One administrator with super-user access permissions
D. The concept of limiting access or least privilege is simply to
provide no more authorization than necessary to perform required
functions. Best practice suggests it is better to have several
administrators with limited access to security resources rather than one
administrator with super-user access permissions. The principle of
least privilege is connected to the role-based access control in that each
role is assigned those access permissions needed to perform its
functions, as mentioned in the other three choices.
From an access control viewpoint, which of the following requires an audit the most?
a. Public access accounts
b. Nonpublic accounts
c. Privileged accounts
d. Non-privileged accounts
C. The goal is to limit exposure due to operating from within a
privileged account or role. A change of role for a user or process
should provide the same degree of assurance in the change of access
authorizations for that user or process. The same degree of assurance is
also needed when a change between a privileged account and nonprivileged account takes place. Auditing of privileged accounts is
required mostly to ensure that privileged account users use only the
privileged accounts and that non-privileged account users use only the
non-privileged accounts. An audit is not required for public access
accounts due to little or no risk involved. Privileged accounts are
riskier than nonpublic accounts.
From an information flow policy enforcement viewpoint, which of the following allows forensic reconstruction of events?
1. Security attributes
2. Security policies
3. Source points
4. Destination points
a. 1 and 2
b. 2 and 3
c. 3 and 4
d. 1, 2, 3, and 4
C. The ability to identify source and destination points for
information flowing in an information system allows for forensic
reconstruction of events and increases compliance to security policies.
Security attributes are critical components of the operations security
concept.
From an access control policy enforcement viewpoint, which of
the following should not be given a privileged user account to
access security functions during the course of normal operations?
1. Network administration department
2. Security administration department
3. End user department
4. Internal audit department
a. 1 and 2
b. 3 only
c. 4 only
d. 3 and 4
D. Privileged user accounts should be established and administered
in accordance with a role-based access scheme to access security
functions. Privileged roles include network administration, security
administration, system administration, database administration, and
Web administration, and should be given access to security functions.
End users and internal auditors should not be given a privileged
account to access security functions during the course of normal
operations.
From an access control account management point of view, service-oriented architecture implementations rely on which of the
following?
a. Dynamic user privileges
b. Static user privileges
c. Predefined user privileges
d. Dynamic user identities
A. Service-oriented architecture (SOA) implementations rely on
run-time access control decisions facilitated by dynamic privilege
management. In contrast, conventional access control implementations
employ static information accounts and predefined sets of user
privileges. Although user identities remain relatively constant over
time, user privileges may change more frequently based on the
ongoing business requirements and operational needs of the
organization.
For privilege management, which of the following is the correct
order?
a. Access control⇒Access management⇒Authentication
management⇒Privilege management
b. Access management⇒Access control⇒Privilege
management⇒Authentication management
c. Authentication management⇒Privilege management⇒Access
control⇒Access management
d. Privilege management⇒Access management⇒Access
control⇒Authentication management
C. Privilege management is defined as a process that creates,
manages, and stores the attributes and policies needed to establish
criteria that can be used to decide whether an authenticated entity’s
request for access to some resource should be granted. Authentication
management deals with identities, credentials, and any other
authentication data needed to establish an identity. Access
management, which includes privilege management and access
control, encompasses the science and technology of creating,
assigning, storing, and accessing attributes and policies. These
attributes and policies are used to decide whether an entity’s request
for access should be allowed or denied. In other words, a typical access
decision starts with authentication management and ends with access
management, whereas privilege management falls in between.
From an access control viewpoint, which of the following are examples of super user accounts?
a. Root and guest accounts
b. Administrator and root accounts
c. Anonymous and root accounts
d. Temporary and end-user accounts
B. Super user accounts are typically described as administrator or
root accounts. Access to super user accounts should be limited to
designated security and system administration staff only, and not to the
end-user accounts, guest accounts, anonymous accounts, or temporary
accounts. Security and system administration staff use the super user
accounts to access key security/system parameters and commands.
Responses to unsuccessful login attempts and session locks are Implemented with which of the following?
a. Operating system and firmware
b. Application system and hardware
c. Operating system and application system
d. Hardware and firmware
C. Response to unsuccessful login attempts can be implemented at
both the operating system and the application system levels. The
session lock is implemented typically at the operating system level but
may be at the application system level. Hardware and firmware are not
used for unsuccessful login attempts and session lock.
