Cyber Security Flashcards by BENJAMIN GEORGE TEODORO

For which of the following assets is integrity probably the most important security aspect?

A. “One frame of a streaming video”
B. “The file that contains passwords used to authenticate users”
C. “The color scheme of a marketing website”
D. “Software that checks the spelling of product descriptions for a retail website”

“The file that contains passwords used to authenticate users” (B)

How well did you know this?

Not at all

Perfectly

Glen is an ISC2 member. Glen receives an email from a company offering a set of answers for an ISC2 certification exam. What should Glen do?

A. “Nothing”
B. “Inform ISC2”
C. “Inform law enforcement”
D. “Inform Glen’s employer”

“Inform ISC2” (B)

How well did you know this?

Not at all

Perfectly

In risk management concepts, a(n) ___________ is something or someone that poses risk to an organization or asset.

A. “Fear”
B. “Threat”
C. “Control”
D. “Asset”

“Threat” (B)

How well did you know this?

Not at all

Perfectly

Steve is a security practitioner assigned to come up with a protective measure for ensuring cars don’t collide with pedestrians. What is probably the most effective type of control for this task?

A. “Administrative”
B. “Technical”
C. “Physical”
D. “Nuanced”

“Physical” ｩ

How well did you know this?

Not at all

Perfectly

The city of Grampon wants to know where all its public vehicles (garbage trucks, police cars, etc.) are at all times, so the city has GPS transmitters installed in all the vehicles. What kind of control is this?

A. “Administrative”
B. “Entrenched”
C. “Physical”
D. “Technical”

“Technical” (D)

How well did you know this?

Not at all

Perfectly

Zarma is an ISC2 member and a security analyst for Triffid Corporation. One of Zarma’s colleagues is interested in getting an ISC2 certification and asks Zarma what the test questions are like. What should Zarma do?

A. “Inform ISC2”
B. “Explain the style and format of the questions, but no detail”
C. “Inform the colleague’s supervisor”
D. “Nothing”

“Explain the style and format of the questions, but no detail” (B)

How well did you know this?

Not at all

Perfectly

Which of the following probably poses the most risk?

A. “A high-likelihood, high-impact event”
B. “A high-likelihood, low-impact event”
C. “A low-likelihood, high-impact event”
D. “A low-likelihood, low-impact event”

“A high-likelihood, high-impact event” (A)

How well did you know this?

Not at all

Perfectly

Tina is an ISC2 member and is invited to join an online group of IT security enthusiasts. After attending a few online sessions, Tina learns that some participants in the group are sharing malware with each other, in order to use it against other organizations online. What should Tina do?

A. “Nothing”
B. “Stop participating in the group”
C. “Report the group to law enforcement”
D. “Report the group to ISC2”

“Stop participating in the group” (B)

How well did you know this?

Not at all

Perfectly

ISC2 publishes a Common Body of Knowledge (CBK) that IT security practitioners should be familiar with; this is recognized throughout the industry as a set of material that is useful for practitioners to refer to. Certifications can be issued for demonstrating expertise in this Common Body of Knowledge. What kind of document is the Common Body of Knowledge?

A. “Policy”
B. “Procedure”
C. “Standard”
D. “Law”

“Standard” (C)

How well did you know this?

Not at all

Perfectly

Siobhan is an ISC2 member who works for Triffid Corporation. Yesterday, Siobhan got a parking ticket while shopping after work. What should Siobhan do?

A. “Inform ISC2”
B. “Pay the parking ticket”
C. “Inform supervisors at Triffid”
D. “Resign employment from Triffid”

“Pay the parking ticket” (B)

How well did you know this?

Not at all

Perfectly

Kerpak works in the security office of a medium-sized entertainment company. Kerpak is asked to assess a particular risk, and he suggests that the best way to counter this risk would be to purchase and implement a particular security solution. This is an example of _______.

A. “Acceptance”
B. “Avoidance”
C. “Mitigation”
D. “Transference”

“Mitigation” (C)

How well did you know this?

Not at all

Perfectly

The city of Grampon wants to ensure that all of its citizens are protected from malware, so the city council creates a rule that anyone caught creating and launching malware within the city limits will receive a fine and go to jail. What kind of rule is this?

A. “Policy”
B. “Procedure”
C. “Standard”
D. “Law”

“Law” (D)

How well did you know this?

Not at all

Perfectly

A system that collects transactional information and stores it in a record in order to show which users performed which actions is an example of providing _________.

A. “Non-repudiation”
B. “Multifactor authentication”
C. “Biometrics”
D. “Privacy”

“Non-repudiation” (A)

How well did you know this?

Not at all

Perfectly

Aphrodite is a member of ISC2 and a data analyst for Triffid Corporation. While Aphrodite is reviewing user log data, Aphrodite discovers that another Triffid employee is violating the acceptable use policy and watching streaming videos during work hours. What should Aphrodite do?

A. “Inform ISC2”
B. “Inform law enforcement”
C. “Inform Triffid management”
D. “Nothing”

“Inform Triffid management” (C)

How well did you know this?

Not at all

Perfectly

Druna is a security practitioner tasked with ensuring that laptops are not stolen from the organization’s offices. Which sort of security control would probably be best for this purpose?

A. “Technical”
B. “Obverse”
C. “Physical”
D. “Administrative”

“Physical” (C)

How well did you know this?

Not at all

Perfectly

Olaf is a member of ISC2 and a security analyst for Triffid Corporation. During an audit, Olaf is asked whether Triffid is currently following a particular security practice. Olaf knows that Triffid is not adhering to that standard in that particular situation, but that saying this to the auditors will reflect poorly on Triffid. What should Olaf do?

A. “Tell the auditors the truth”
B. “Ask supervisors for guidance”
C. “Ask ISC2 for guidance”
D. “Lie to the auditors”

“Tell the auditors the truth” (A)

How well did you know this?

Not at all

Perfectly

A bollard is a post set securely in the ground to prevent a vehicle from entering an area or driving past a certain point. Bollards are an example of ______ controls.

A. “Physical”
B. “Administrative”
C. “Drastic”
D. “Technical”

“Physical” (A)

How well did you know this?

Not at all

Perfectly

Within the organization, who can identify risk?

A. “The security manager”
B. “Any security team member”
C. “Senior management”
D. “Anyone”

“Anyone” (D)

How well did you know this?

Not at all

Perfectly

The Payment Card Industry (PCI) Council is a committee made up of representatives from major credit card providers (Visa, Mastercard, American Express) in the United States. The PCI Council issues rules that merchants must follow if the merchants choose to accept payment via credit card. These rules describe best practices for securing credit card processing technology, activities for securing credit card information, and how to protect customers’ personal data. This set of rules is a ____.

A. “Law”
B. “Policy”
C. “Standard”
D. “Procedure”

“Standard” ｩ

How well did you know this?

Not at all

Perfectly

The Triffid Corporation publishes a strategic overview of the company’s intent to secure all the data the company possesses. This document is signed by Triffid senior management. What kind of document is this?

A. “Policy”
B. “Procedure”
C. “Standard”
D. “Law”

“Policy” (A)

How well did you know this?

Not at all

Perfectly

What is the goal of Business Continuity efforts?

A. “Save money”
B. “Impress customers”
C. “Ensure all IT systems continue to operate”
D. “Keep critical business functions operational”

“Keep critical business functions operational” (D)

How well did you know this?

Not at all

Perfectly

What is the overall objective of a disaster recovery (DR) effort?

A. “Save money”
B. “Return to normal, full operations”
C. “Preserve critical business functions during a disaster”
D. “Enhance public perception of the organization”

“Return to normal, full operations” (B)

How well did you know this?

Not at all

Perfectly

What is the risk associated with delaying resumption of full normal operations after a disaster?

A. “People might be put in danger”
B. “The impact of running alternate operations for extended periods”
C. “A new disaster might emerge”
D. “Competition”

“The impact of running alternate operations for extended periods” (B)

How well did you know this?

Not at all

Perfectly

What is the goal of an incident response effort?

A. “No incidents ever happen”
B. “Reduce the impact of incidents on operations”
C. “Punish wrongdoers”
D. “Save money”

“Reduce the impact of incidents on operations” (B)

How well did you know this?

Not at all

Perfectly

When should a business continuity plan (BCP) be activated? A. "As soon as possible" B. "At the very beginning of a disaster" C. "When senior management authorizes" D. "When instructed to do so by regulators"

"When senior management authorizes" (C)

Which of the following are not typically involved in incident detection? A. "Users" B. "Security analysts" C. "Automated tools" D. "Regulators"

"Regulators" (D)

Suvid works at Triffid, Inc. When Suvid attempts to log in to the production environment, a message appears stating that Suvid has to reset the password. What may have occurred to cause this? A. "Suvid broke the law" B. "Suvid's password has expired" C. "Suvid made the manager angry" D. "Someone hacked Suvid's machine"

"Suvid's password has expired" (B)

Which of the following would be considered a logical access control? A. "An iris reader that allows an employee to enter a controlled area" B. "A fingerprint reader that allows an employee to enter a controlled area" C. "A fingerprint reader that allows an employee to access a laptop computer" D. "A chain attached to a laptop computer that connects it to furniture so it cannot be taken"

"A fingerprint reader that allows an employee to access a laptop computer" ｩ

In this situation, what is the ACL? A. "The subject" B. "The object" C. "The rule" D. "The firmware"

"The rule" ｩ

Which of the following is probably most useful at the perimeter of a property? A. "A safe" B. "A fence" C. "A data center" D. "A centralized log storage facility"

"A fence" (B)

All visitors to a secure facility should be _______. A. "Fingerprinted" B. "Photographed" C. "Escorted" D. "Required to wear protective equipment

"Escorted" ｩ

Which of these is an example of a physical access control mechanism? A. "Software-based firewall at the perimeter of the network" B. "A lock on a door" C. "Network switches that filter according to MAC addresses" D. "A process that requires two people to act at the same time to perform a function"

"A lock on a door" (B)

Which of the following will have the most impact on determining the duration of log retention? A. "Personal preference" B. "Applicable laws" C. "Industry standards" D. "Type of storage media"

"Applicable laws" (B)

A human guard monitoring a hidden camera could be considered a ______ control. A. "Detective" B. "Preventive" C. "Deterrent" D. "Logical"

"Detective" (A)

Tekila works for a government agency. All data in the agency is assigned a particular sensitivity level, called a "classification." Every person in the agency is assigned a "clearance" level, which determines the classification of data each person can access. What is the access control model being implemented in Tekila's agency? A. "MAC (mandatory access control)" B. "DAC (discretionary access control)" C. "RBAC (role-based access control)" D. "FAC (formal access control)"

"MAC (mandatory access control)" (A)

Prachi works as a database administrator for Triffid, Inc. Prachi is allowed to add or delete users, but is not allowed to read or modify the data in the database itself. When Prachi logs onto the system, an access control list (ACL) checks to determine which permissions Prachi has. In this situation, what is the database? A. "The subject" B. "The object" C. "The rule" D. "The site"

"The object" (A)

Visitors to a secure facility need to be controlled. Controls useful for managing visitors include all of the following except: A. "Sign-in sheet/tracking log" B. "Fence" C. "Badges that differ from employee badges" D. "Receptionist"

"Fence" (B)

Which of the following is a biometric access control mechanism? A. "A badge reader" B. "A copper key" C. "A fence with razor tape on it" D. "A door locked by a voiceprint identifier"

"A door locked by a voiceprint identifier" (D)

Guillermo logs onto a system and opens a document file. In this example, Guillermo is: A. "The subject" B. "The object" C. "The process" D. "The software"

"The subject" (A)

Which of the following roles does not typically require privileged account access? A. "Security administrator" B. "Data entry professional" C. "System administrator" D. "Help Desk technician"

"Data entry professional" (B)

Gary is unable to log in to the production environment. Gary tries three times and is then locked out of trying again for one hour. Why? A. "Gary is being punished" B. "The network is tired" C. "Users remember their credentials if they are given time to think about it" D. "Gary's actions look like an attack"

"Gary's actions look like an attack" (D)

Prina is a database manager. Prina is allowed to add new users to the database, remove current users and create new usage functions for the users. Prina is not allowed to read the data in the fields of the database itself. This is an example of: A. "Role-based access controls (RBAC)" B. "Mandatory access controls (MAC)" C. "Discretionary access controls (DAC)" D. "Alleviating threat access controls (ATAC)"

"Role-based access controls (RBAC)" (A)

What is the common term for systems that ensure proper temperature and humidity in the data center? A. "RBAC" B. "HVAC" C. "MAC"

"HVAC" (B) "heating, ventilation and air conditioning"

A tool that filters inbound traffic to reduce potential threats. A. "NIDS (network-based intrusion-detection systems)" B. "Anti-malware" C. "DLP (data loss prevention)" D. "Firewall"

"Firewall" (D)

Which of the following is one of the common ways potential attacks are often identified? A. "The attackers contact the target prior to the attack, in order to threaten and frighten the target" B. "Victims notice excessive heat coming from their systems" C. "The power utility company warns customers that the grid will be down and the internet won't be accessible" D. "Users report unusual systems activity/response to Help Desk or the security office"

"Users report unusual systems activity/response to Help Desk or the security office" (D)

A device that is commonly useful to have on the perimeter between two networks. A. "User laptop" B. "IoT" C. "Camera" D. "Firewall"

"Firewall" (D)

An IoT (Internet of Things) device is typified by its effect on or use of the _____ environment. A. "Philosophical" B. "Remote" C. "Internal" D. "Physical"

"Physical" (D)

Which common cloud service model only offers the customer access to a given application? A. "Lunch as a service (LaaS)" B. "Infrastructure as a service (IaaS)" C. "Platform as a service (PaaS)" D. "Software as a service (SaaS)"

"Software as a service (SaaS)" (D)

Which of the following would be best placed in the DMZ of an IT environment? A. "User's workplace laptop" B. "Mail server" C. "Database engine" D. "SIEM log storage"

"Mail server" (B)

Bert wants to add a flashlight capability to a smartphone. What kind of app is this? A. "DDOS" B. "Trojan" C. "Side channel" D. "On-path"

"Trojan" (B)

A tool that monitors local devices to reduce potential threats from hostile software. A. "NIDS (network-based intrusion-detection systems)" B. "Anti-malware" C. "DLP (data loss prevention)" D. "Firewall"

"Anti-malware" (B)

A VLAN is a _____ method of segmenting networks. A. "Secret" B. "Physical" C. "Regulated" D. "Logical"

"Logical" (D)

Which of the following activities is usually part of the configuration management process, but is also extremely helpful in countering potential attacks? A. "Annual budgeting" B. "Conferences with senior leadership" C. "Updating and patching systems" D. "The annual shareholders' meeting"

"Updating and patching systems" ｩ

To adequately ensure availability for a data center, it is best to plan for both resilience and _______ of the elements in the facility. A. "Uniqueness" B. "Destruction" C. "Redundancy" D. "Hue"

"Redundancy" (C)

A tool that aggregates log data from multiple sources, and typically analyzes it and reports potential threats. A. "HIDS" B. "Anti-malware" C. "Router" D. "SIEM"

"SIEM" (D)

"Wiring _____" is a common term meaning "a place where wires/conduits are often run, and equipment can be placed, in order to facilitate the use of local networks." A. "Shelf" B. "Closet" C. "Bracket" D. "House"

"Closet" (B)

Cyril wants to ensure all the devices on his company's internal IT environment are properly synchronized. Which of the following protocols would aid in this effort? A. "FTP (File Transfer Protocol)" B. "NTP (Network Time Protocol)" C. "SMTP (Simple Mail Transfer Protocol)" D. "HTTP (Hypertext Transfer Protocol)"

"NTP (Network Time Protocol)" (B)

Triffid, Inc., has deployed anti-malware solutions across its internal IT environment. What is an additional task necessary to ensure this control will function properly? A. "Pay all employees a bonus for allowing anti-malware solutions to be run on their systems" B. "Update the anti-malware solution regularly" C. "Install a monitoring solution to check the anti-malware solution" D. "Alert the public that this protective measure has been taken"

"Update the anti-malware solution regularly" (B)

The concept that the deployment of multiple types of controls provides better security than using a single type of control. A. "VPN" B. "Least privilege" C. "Internet" D. "Defense in depth"

"Defense in depth" (D)

Ludwig is a security analyst at Triffid, Inc. Which of the following might be the attack Ludwig sees? A. "DDOS (distributed denial of service)" B. "Spoofing" C. "Exfiltrating stolen data" D. "An insider sabotaging the power supply"

"DDOS (distributed denial of service)" (A)

Data retention periods apply to ____ data. A. "Medical" B. "Sensitive" C. "All" D. "Secret"

"All" ｩ

Security needs to be provided to ____ data. A. "Restricted" B. "Illegal" C. "Private" D. "All"

"All" (D)

Archiving is typically done when _________. A. "Data is ready to be destroyed" B. "Data has lost all value" C. "Data is not needed for regular work purposes" D. "Data has become illegal"

"Data is not needed for regular work purposes" ｩ

Which of these is the most important reason to conduct security instruction for all employees. A. "Reduce liability" B. "Provide due diligence" C. "It is a moral imperative" D. "An informed user is a more secure user"

"An informed user is a more secure user" (D)

If two people want to use symmetric encryption to conduct a confidential conversation, how many keys do they need? A. "1" B. "3" C. "8" D. "None"

"1" (A)

Which of the following is probably the main purpose of configuration management? A. "Keeping out intruders" B. "Ensuring the organization adheres to privacy laws" C. "Keeping secret material protected" D. "Ensuring only authorized modifications are made to the IT environment"

"Ensuring only authorized modifications are made to the IT environment" (D)

The output of any given hashing algorithm is always _____. A. "The same length" B. "The same characters" C. "The same language" D. "Different for the same inputs"

"The same length" (A)

Log data should be kept ______. A. "On the device that the log data was captured from" B. "In an underground bunker" C. "In airtight containers" D. "On a device other than where it was captured"

"On a device other than where it was captured" (D)

Proper alignment of security policy and business goals within the organization is important because: A. "Security should always be as strict as possible" B. "Security policy that conflicts with business goals can inhibit productivity" C. "Bad security policy can be illegal" D. "Security is more important than business"

"Security policy that conflicts with business goals can inhibit productivity" (B)

If two people want to use asymmetric communication to conduct a confidential conversation, how many keys do they need? A. "1" B. "4" C. "8" D. "11"

"4" (B)

Triffid, Inc., wants to host streaming video files for the company's remote users. Which of the following methods are probably best for this purpose? A. "Symmetric encryption" B. "Hashing" C. "Asymmetric encryption" D. "VLANs"

"Symmetric encryption" (A)

Bluga works for Triffid, Inc. What type of encryption should Bluga use? A. "Symmetric encryption" B. "Asymmetric encryption" C. "Small-scale encryption" D. "Hashing"

"Asymmetric encryption" (B)

"Every document owned by Triffid, Inc., whether hardcopy or electronic, has a clear, 24-point word at the top and bottom. Only three words can be used: 'Sensitive,' 'Proprietary' and 'Public.'" This is an example of _____. A. "Secrecy" B. "Privacy" C. "Inverting" D. "Labeling"

"Labeling" (D)

A chief information security officer (CISO) at a large organization documented a policy that establishes the acceptable use of cloud environments for all staff. This is an example of a: A. "Management/Administrative control" B. "Technical control" C. "Physical control" D. "Cloud control"

"Management/Administrative control" (A)

Is it possible to avoid risk? A. "Yes" B. "No" C. "Sometimes" D. "Never"

"Yes" (A)

What is meant by non-repudiation? A. "If a user does something, they can't later claim that they didn't do it." B. "Controls to protect the organization's reputation from harm due to inappropriate social media postings by employees, even if on their private accounts and personal time." C. "It is part of the rules set by administrative controls." D. "It is a security feature that prevents session replay attacks."

"If a user does something, they can't later claim that they didn't do it." (A)

Which of the following is NOT one of the four typical ways of managing risk? A. "Avoid" B. "Accept" C. "Mitigate" D. "Conflate"

"Conflate" (D)

Siobhan is deciding whether to make a purchase online; the vendor wants Siobhan to create a new user account, and is requesting Siobhan's full name, home address, credit card number, phone number, email address, the ability to send marketing messages to Siobhan, and permission to share this data with other vendors. Siobhan decides that the item for sale is not worth the value of Siobhan's personal information, and decides to not make the purchase. What kind of risk management approach did Siobhan make? A. "Avoidance" B. "Acceptance" C. "Mitigation" D. "Transfer"

"Avoidance" (A)

Guillermo is the system administrator for a midsized retail organization. Guillermo has been tasked with writing a document that describes, step-by-step, how to securely install the operating system on a new laptop. This document is an example of a ________. A. "Policy" B. "Standard" C. "Procedure" D. "Guideline"

"Procedure" (C)

Lankesh is the security administrator for a small food-distribution company. A new law is published by the country in which Lankesh's company operates; the law conflicts with the company's policies. Which governance element should Lankesh's company follow? A. "The Law" B. "The Policy" C. "Any procedures the company has created for the particular activities affected by the law" D. "Lankesh should be allowed to use personal and professional judgment to make the determination of how to proceed"

"The Law" (A)

Kristal is the security administrator for a large online service provider. Kristal learns that the company is harvesting personal data of its customers and sharing the data with local governments where the company operates, without the knowledge of the users, to allow the governments to persecute users on the basis of their political and philosophical beliefs. The published user agreement states that the company will not share personal user data with any entities without the users' explicit permission. According to the ISC2 Code of Ethics, to whom does Kristal ultimately owe a duty in this situation? A. "The governments of the countries where the company operates" B. "The company Kristal works for" C. "The users" D. "ISC2"

"The users" ｩ

While taking the certification exam for this certification, you notice another candidate for the certification cheating. What should you do? A. "Nothing容ach person is responsible for their own actions." B. "Yell at the other candidate for violating test security." C. "Report the candidate to ISC2." D. "Call local law enforcement."

"Report the candidate to ISC2." (C)

The concept of "secrecy" is most related to which foundational aspect of security? A. "Confidentiality" B. "Integrity" C. "Availability" D. "Plausibility"

"Confidentiality" (A)

You are working in your organization's security office. You receive a call from a user who has tried to log in to the network several times with the correct credentials, with no success. This is an example of a(n)_______. A. "Emergency" B. "Event" C. "Policy" D. "Disaster"

"Event" (B)

You are working in your organization's security office. You receive a call from a user who has tried to log in to the network several times with the correct credentials, with no success. After a brief investigation, you determine that the user's account has been compromised. This is an example of a(n)_______. A. "Risk management" B. "Incident Detection" C. "Malware" D. "Disaster"

"Incident Detection" (B)

An external entity has tried to gain access to your organization's IT environment without proper authorization. This is an example of a(n) _________. A. "Exploit" B. "Intrusion" C. "Event" D. "Malware"

"Intrusion" (B)

When responding to a security incident, your team determines that the vulnerability that was exploited was not widely known to the security community, and that there are no currently known definitions/listings in common vulnerability databases or collections. This vulnerability and exploit might be called ______. A. "Malware" B. "Critical" C. "Fractal" D. "Zero-day"

"Zero-day" (D)

True or False? The IT department is responsible for creating the organization's business continuity plan. A. "True" B. "False"

"False" (B)

The Business Continuity effort for an organization is a way to ensure critical ______ functions are maintained during a disaster, emergency, or interruption to the production environment. A. "Business" B. "Technical" C. "IT" D. "Financial"

"Business" (A)

Which of the following is very likely to be used in a disaster recovery (DR) effort? A. "Guard dogs" B. "Data backups" C. "Contract Personnel" D. "Anti-malware solutions"

"Data backups" (B)

Which of the following is often associated with DR planning? A. "Checklists" B. "Firewalls" C. "Motion Detectors" D. "Non-Repudiation"

"Checklists" (A)

Which of these activities is often associated with DR efforts? A. "Employees returning to the primary production location" B. "Running anti-malware solutions" C. "Scanning the IT environment for vulnerabilities" D. "Zero-day Exploits"

"Employees returning to the primary production location" (A)

Which of these components is very likely to be instrumental to any disaster recovery (DR) effort? A. "Routers" B. "Laptops" C. "Firewall" D. "Backup"

"Backup" (D)

Which of the following is a subject? A. "File" B. "Fence" C. "Filename" D. "User"

"User" (D)

Lia works in the security office. During research, Lia learns that a configuration change could better protect the organization's IT environment. Lia makes a proposal for this change, but the change cannot be implemented until it is approved, tested, and then cleared for deployment by the Change Control Board. This is an example of __________. A. "Defense in depth" B. "Holistic security" C. "Threat intelligence" D. "Segregation of duties"

"Segregation of duties" (D)

Duncan and Mira both work in the data center at Triffid, Inc. There is a policy in place that requires both of them to be present in the data center at the same time; if one of them has to leave for any reason, the other has to step out, too, until they can both re-enter. This is called ________. A. "Blockage" B. "Multifactor authentication" C. "Two-person integrity" D. "Defense in depth"

"Two-person integrity" ｩ

Clyde is the security analyst tasked with finding an appropriate physical control to reduce the possibility that unbadged people will follow badged employees through the entrance of the organization's facility. Which of the following can address this risk? A. "Fences" B. "Dogs" C. "Bollards" D. "Turnstiles"

"Turnstiles" (D)

Sinka is considering a physical deterrent control to dissuade unauthorized people from entering the organization's property. Which of the following would serve this purpose? A. "A wall" B. "Razor tape" C. "A sign" D. "A hidden camera"

"Razor tape" (B)

Which of these combinations of physical security controls share a single point of failure? A. "Guards and fences" B. "Badge readers and walls" C. "Dogs and bollards" D. "High-illumination lighting and cameras"

"High-illumination lighting and cameras" (D)

Lakshmi presents a userid and a password to a system in order to log on. Which of the following characteristics must the userid have? A. "Confidential" B. "Complex" C. "Unique" D. "Long"

"Unique" ｩ

Lakshmi presents a userid and a password to a system in order to log on. Which of the following characteristics must the password have? A. "Confidential" B. "Unique" C. "Mathematical" D. "Shared"

"Confidential" (A)

Derrick logs on to a system in order to read a file. In this example, Derrick is the ______. A. "Subject" B. "Object" C. "Process" D. "Predicate"

"Subject" (A)

Which is a physical control that prevents "piggybacking" or "tailgating"; that is, an unauthorized person following an authorized person into a controlled area? A. "Bollard" B. "Turnstile" C. "Fence" D. "Wall"

"Turnstile" (B)

Common network device used to connect networks. A. "Server" B. "Endpoint" C. "Router" D. "Switch"

"Router" ｩ

A common network device used to filter traffic. A. "Server" B. "Endpoint" C. "Ethernet" D. "Firewall"

"Firewall" (D)

"Endpoint <------>?Web?server?? Which port number is associated with the protocol typically used in this connection?" A. "21" B. "53" C. "80" D. "161"

"80" ｩ

An attack against the availability of a network/system; typically uses many attacking machines to direct traffic against a given target. A. "Worm" B. "Virus" C. "Stealth" D. "DDOS"

"DDOS" (D)

A security solution installed on an endpoint?in order to?detect potentially anomalous activity. A. "Router" B. "Host-based intrusion prevention system" C. "Switch" D. "Security incident and event management system (SIEM)"

"Host-based intrusion prevention system" (B)

A security solution that detects, identifies and often quarantines potentially hostile software. A. "Firewall" B. "Guard" C. "Camera" D. "Anti-malware"

"Anti-malware" (D)

The common term used to describe the mechanisms that control the temperature and humidity in a data center. A. "VLAN (virtual local area network)" B. "HVAC (heating, ventilation and air conditioning)" C. "STAT (system temperature and timing)" D. "TAWC (temperature and water control)"

"HVAC (heating, ventilation and air conditioning)" (B)

A cloud arrangement whereby the provider owns and manages the hardware, operating system, and applications in the cloud, and the customer owns the data. A. "Infrastructure as a service (IaaS)" B. "Morphing as a service (MaaS)" C. "Platform as a service (PaaS)" D. "Software as a service (SaaS)"

"Platform as a service (PaaS)" (D)

A portion of the organization's network that interfaces directly with the outside world; typically, this exposed area has more security controls and restrictions than the rest of the internal IT environment. A. "National Institute of Standards and Technology (NIST)" B. "Demilitarized zone (DMZ)" C. "Virtual private network (VPN)" D. "Virtual local area network (VLAN)"

"Demilitarized zone (DMZ)" (B)

Which of the following tools can be used to grant remote users access to the internal IT environment? A. "VLAN (virtual local area network)" B. "VPN (virtual private network)" C. "DDOS (distributed denial-of-service)" D. "MAC (media access control)"

"VPN (virtual private network)" (B)

Which of the following can be used to map data flows through an organization and the relevant security controls used at each point along the way? A. "Encryption" B. "Hashing" C. "Hard copy" D. "Data life cycle"

D. "Data life cycle"

Why is an asset inventory so important? A. "It tells you what to encrypt" B. "You can't protect what you don't know you have" C. "The law requires it" D. "It contains a price list"

B. "You can't protect what you don't know you have"

Who is responsible for publishing and signing the organization's policies? A. "The security office" B. "Human Resources" C. "Senior management" D. "The legal department"

C. "Senior management"

Which of the following is always true about logging? A. "Logs should be very detailed" B. "Logs should be in English" C. "Logs should be concise" D. "Logs should be stored separately from the systems they're logging"

D. "Logs should be stored separately from the systems they're logging"

A mode of encryption for ensuring confidentiality efficiently, with a minimum amount of processing overhead A. "Asymmetric" B. "Symmetric" C. "Hashing" D. "Covert"

B. "Symmetric"

A ready visual cue to let anyone in contact with the data know what the classification is. A. "Encryption" B. "Label" C. "Graphics" D. "Photos"

B. "Label"

A set of security controls or system settings used to ensure uniformity of configuration throughout the IT environment. A. "Patches" B. "Inventory" C. "Baseline" D. "Policy"

C. "Baseline"

What is the most important aspect of security awareness/training? A. "Protecting assets" B. "Maximizing business capabilities" C. "Ensuring the confidentiality of data" D. "Protecting health and human safety"

A. "Protecting assets"

Which entity is most likely to be tasked with monitoring and enforcing security policy? A. "The Human Resources office" B. "The legal department" C. "Regulators" D. "The security office"

D. "The security office"

Which organizational policy is most likely to indicate which types of smartphones can be used to connect to the internal IT environment? A. "The CM policy (change management)" B. "The password policy" C. "The AUP (acceptable use policy)" D. "The BYOD policy (bring your own device)"

D. "The BYOD policy (bring your own device)"

Preenka works at an airport. There are red lines painted on the ground next to the runway; Preenka has been instructed that nobody can step or drive across a red line unless they request, and get specific permission from, the control tower. This is an example of a(n)______ control. A. "Physical" B. "Administrative" C. "Critical" D. "Technical"

B. "Administrative"

Phrenal is selling a used laptop in an online auction. Phrenal has estimated the value of the laptop to be $100, but has seen other laptops of similar type and quality sell for both more and less than that amount. Phrenal hopes that the laptop will sell for $100 or more, but is prepared to take less for it if nobody bids that amount. This is an example of ___________. A. "Risk tolerance" B. "Risk inversion" C. "Threat" D. "Vulnerability"

A. "Risk tolerance"

Hoshi is an ISC2 member who works for the Triffid Corporation as a data manager. Triffid needs a new firewall solution, and Hoshi is asked to recommend a product for Triffid to acquire and implement. Hoshi's cousin works for a firewall vendor; that vendor happens to make the best firewall available. What should Hoshi do? A. "Recommend a different vendor/product" B. "Recommend the cousin's product" C. "Hoshi should ask to be recused from the task" D. "Disclose the relationship, but recommend the vendor/product"

D. "Disclose the relationship, but recommend the vendor/product"

Grampon municipal code requires that all companies that operate within city limits will have a set of processes to ensure employees are safe while working with hazardous materials. Triffid Corporation creates a checklist of activities employees must follow while working with hazardous materials inside Grampon city limits. The municipal code is a ______, and the Triffid checklist is a ________. A. "Law, procedure" B. "Standard, law" C. "Law, standard" D. "Policy, law"

A. "Law, procedure"

A vendor sells a particular operating system (OS). In order to deploy the OS securely on different platforms, the vendor publishes several sets of instructions on how to install it, depending on which platform the customer is using. This is an example of a ________. A. "Law" B. "Procedure" C. "Standard" D. "Policy"

B. "Procedure"

In risk management concepts, a(n) _________ is something a security practitioner might need to protect. A. "Vulnerability" B. "Asset" C. "Threat" D. "Likelihood"

B. "Asset"

Chad is a security practitioner tasked with ensuring that the information on the organization's public website is not changed by anyone outside the organization. This task is an example of ensuring _________. A. "Confidentiality" B. "Integrity" C. "Availability" D. "Confirmation"

B. "Integrity"

Triffid Corporation has a rule that all employees working with sensitive hardcopy documents must put the documents into a safe at the end of the workday, where they are locked up until the following workday. What kind of control is the process of putting the documents into the safe? A. "Administrative" B. "Tangential" C. "Physical" D. "Technical"

A. "Administrative"

All of the following are important ways to practice an organization disaster recovery (DR) effort; which one is the most important? A. "Practice restoring data from backups" B. "Facility evacuation drills" C. "Desktop/tabletop testing of the plan" D. "Running the alternate operating site to determine if it could handle critical functions in times of emergency"

B. "Facility evacuation drills"

What is the risk associated with resuming full normal operations too soon after a DR effort? A. "The danger posed by the disaster might still be present" B. "Investors might be upset" C. "Regulators might disapprove" D. "The organization could save money"

A. "The danger posed by the disaster might still be present"

Which of the following is likely to be included in the business continuity plan? A. "Alternate work areas for personnel affected by a natural disaster" B. "The organization's strategic security approach" C. "Last year's budget information" D. "Log data from all systems"

A. "Alternate work areas for personnel affected by a natural disaster"

What is the most important goal of a business continuity effort? A. "Ensure all IT systems function during a potential interruption" B. "Ensure all business activities are preserved during a potential disaster" C. "Ensure the organization survives a disaster" D. "Preserve health and human safety"

D. "Preserve health and human safety"

Network traffic originating from outside the organization might be admitted to the internal IT environment or blocked at the perimeter by a ________. A. "Turnstile" B. "Fence" C. "Vacuum" D. "Firewall"

D. "Firewall"

Prachi works as a database administrator for Triffid, Inc. Prachi is allowed to add or delete users, but is not allowed to read or modify the data in the database itself. When Prachi logs onto the system, an access control list (ACL) checks to determine which permissions Prachi has. In this situation, what is Prachi? A. "The subject" B. "The rule" C. "The file" D. "The object"

A. "The subject"

Trina is a security practitioner at Triffid, Inc. Trina has been tasked with selecting a new product to serve as a security control in the environment. Before that product can be purchased, a manager must review Trina's selection and determine whether to approve the purchase. This is a description of: A. "Two-person integrity" B. "Segregation of duties" C. "Software" D. "Defense in depth"

B. "Segregation of duties"

Handel is a senior manager at Triffid, Inc., and is in charge of implementing a new access control scheme for the company. Handel wants to ensure that employees transferring from one department to another, getting promoted, or cross-training to new positions can get access to the different assets they'll need for their new positions, in the most efficient manner. Which method should Handel select? A. "Role-based access controls (RBAC)" B. "Mandatory access controls (MAC)" C. "Discretionary access controls (DAC)" D. "Barbed wire"

A. "Role-based access controls (RBAC)"

A _____ is a record of something that has occurred. A. "Biometric" B. "Law" C. "Log" D. "Firewall"

C. "Log"

"Larry and Fern both work in the data center. In order to enter the data center to begin their workday, they must both present their own keys (which are different) to the key reader, before the door to the data center opens. Which security concept is being applied in this situation? A. "Defense in depth" B. "Segregation of duties" C. "Least privilege" D. "Dual control"

D. "Dual control"

Which of the following statements is true? A. "Logical access controls can protect the IT environment perfectly; there is no reason to deploy any other controls" B. "Physical access controls can protect the IT environment perfectly; there is no reason to deploy any other controls" C. "Administrative access controls can protect the IT environment perfectly; there is no reason to deploy any other controls" D. "It is best to use a blend of controls to provide optimum security"

D. "It is best to use a blend of controls to provide optimum security"

Which of the following is not an appropriate control to add to privileged accounts? A. "Increased logging" B. "Multifactor authentication" C. "Increased auditing" D. "Security deposit"

D. "Security deposit"

Gelbi is a Technical Support analyst for Triffid, Inc. Gelbi sometimes is required to install or remove software. Which of the following could be used to describe Gelbi's account? A. "Privileged" B. "Internal" C. "External" D. "User"

A. "Privileged"

Handel is a senior manager at Triffid, Inc., and is in charge of implementing a new access control scheme for the company. Handel wants to ensure that operational managers have the utmost personal choice in determining which employees get access to which systems/data. Which method should Handel select? A. "Role-based access controls (RBAC)" B. "Mandatory access controls (MAC)" C. "Discretionary access controls (DAC)" D. "Security policy"

C. "Discretionary access controls (DAC)"

All of the following are typically perceived as drawbacks to biometric systems, except: A. "Lack of accuracy" B. "Potential privacy concerns" C. "Retention of physiological data past the point of employment" D. "Legality"

A. "Lack of accuracy"

"Prachi works as a database administrator for Triffid, Inc. Prachi is allowed to add or delete users, but is not allowed to read or modify the data in the database itself. When Prachi logs onto the system, an access control list (ACL) checks to determine which permissions Prachi has. In this situation, what is Prachi? A. "The subject" B. "The rule" C. "The file" D. "The object"

A. "The subject"

Garfield is a security analyst at Triffid, Inc. Garfield notices that a particular application in the production environment is being copied very quickly, across systems and devices utilized by many users. What kind of attack could this be? A. "Spoofing" B. "Side channel" C. "Trojan" D. "Worm"

D. "Worm"

Barry wants to upload a series of files to a web-based storage service, so that people Barry has granted authorization can retrieve these files. Which of the following would be Barry's preferred communication protocol if he wanted this activity to be efficient and secure? A. "SMTP (Simple Mail Transfer Protocol)" B. "FTP (File Transfer Protocol)" C. "SFTP (Secure File Transfer Protocol)" D. "SNMP (Simple Network Management Protocol)

C. "SFTP (Secure File Transfer Protocol)"

Which type of fire-suppression system is typically the least expensive? A. "Water" B. "Dirt" C. "Oxygen-depletion" D. "Gaseous"

A. "Water"

Which type of fire-suppression system is typically the safest for humans? A. "Water" B. "Dirt" C. "Oxygen-depletion" D. "Gaseous"

A. "Water"

Dieter wants to send a message to Lupa and wants to be sure that Lupa knows the message has not been modified in transit. What technique/tool could Dieter use to assist in this effort? A. "Hashing" B. "Clockwise rotation" C. "Symmetric encryption" D. "Asymmetric encryption"

A. "Hashing"

Security controls on log data should reflect ________. A. "The organization's commitment to customer service" B. "The local culture where the log data is stored" C. "The price of the storage device" D. "The sensitivity of the source device"

D. "The sensitivity of the source device"

When data has reached the end of the retention period, it should be _______. A. "Destroyed" B. "Archived" C. "Enhanced" D. "Sold"

A. "Destroyed"

Logs should be reviewed ______. A. "Every Thursday" B. "Continually" C. "Once per calendar year" D. "Once per fiscal year"

B. "Continually"

Data _____ is data left behind on systems/media after normal deletion procedures have been attempted. A. "Fragments" B. "Packets" C. "Remanence" D. "Residue"

C. "Remanence"

An organization must always be prepared to ______ when applying a patch. A. "Pay for the updated content" B. "Buy a new system" C. "Settle lawsuits" D. "Rollback"

D. "Rollback"

Inbound traffic from an external source seems to indicate much higher rates of communication than normal, to the point where the internal systems might be overwhelmed. Which security solution can often identify and potentially counter this risk? A. "Firewall" B. "Turnstile" C. "Anti-Malware" D. "Badge System"

A. "Firewall"