Flashcards ISC2

Question 1

What are the phases of incident response?

Answer 1

Detection, characterization, containment, eradication, restoration, after‐action reporting/debriefing to produce lessons learned. Preparation, of course, precedes first detection.

Question 2

What are hierarchies of trust?

Answer 2

Collections of trust relationship in which one trust anchor provides the central authority for all chains of trust in the collection via transitive trust relationships with other nodes. Provides for clear ways to revoke trustworthiness of lower‐level nodes.

Question 3

What is the most common attack technique used against business or private sector use of encryption?

Answer 3

Social engineering

Question 4

Why does a collision indicate a weakness in a cryptographic algorithm?

Answer 4

A collision happens if encrypting two different plaintexts results in the same ciphertext or if two different ciphertexts are decrypted to produce the same plaintext. This ambiguity means that attackers could use intercepted ciphertexts or plaintexts to possibly decrypt other ciphertexts or to inject their own spurious ciphertexts into the system.

Question 5

From an identity management and access control perspective, what is a session?

Answer 5

The set of activities performed by systems elements, which work together to ensure that a logical connection between user and server remains uninterrupted, while assuring the protection of all resources from setup through teardown of that connection and session.

Question 6

What are POP, IMAP and SMTP, and what ports do they use?

Answer 6

1. Post Office Protocol (POP), TCP 110 - SSL/TLS 995 (POP3);
2. Internet Mail Protocol (lMAP), (IMAP4), TCP 143, SSL/TLS 993.
3. Simple Mail Transfer Protocol (SMTP) 25, SSL/TLS 465.

*Note that all email ports can be changed if both parties agree.

Question 7

Can Common Vulnerabilities and Exposures (CVE) data provide everything you need to secure your systems?

Answer 7

No, because it will not contain information about customized software, processes, or procedures that you use

Question 8

What are the steps in identity management?

Answer 8

Provisioning, review, revocation, deletion

Question 9

Which layer does IPSec operate at?

Answer 9

Layer 3, the internetworking (or network) layer

Question 10

A thunderstorm and its disruption of commercial electrical power and communications is a risk event. Is it a threat?

Answer 10

No; natural events or accidents are classed as hazards. That said, systems security planning still needs to properly assess their potential impacts and mitigate them as required.

Question 11

Which layer does IPSec operate at?

Answer 11

Layer 3, the internetworking (or network) layer

Question 12

What is media access control (MAC) address allowed listing?

Answer 12

Access control restricted to devices with matching MAC addresses; typically done by routers or firewalls

Question 13

What kind of subjects should be authenticated before being granted access?

Answer 13

All types—devices, people, and software processes

Question 14

How do edge and fog computing relate to cloud computing and operational technology systems?

Answer 14

Edge computing are cloud systems where the majority of data processing happens near the interface between the cloud system and the external users or real world systems. Fog computing breaks that edge down into layers, with each successive layer (from outside in) add in concentrators, analytic, or other processing layers to combine results from multiple fog subsystems. Both edge and fog systems are used to directly interface with OT control systems (such as regional controllers in ICS or SCADA architectures).

Question 15

How does shared responsibility for cloud security work?

Answer 15

Depending upon the cloud service model in use (SaaS, PaaS, IaaS, etc.), the service level agreement (SLA) specifies what services the cloud services provider (CSP) is responsible for and what services the user organization must take responsibility for. The SLA will (or should) specify what security tasks, functions, and support are provided by each party, what limits on testing are imposed, and what notification requirements are in force, among other aspects.

Question 16

Describe the difference between cleartext and plaintext.

Answer 16

Cleartext is text or data that is never meant to be encrypted. Plaintext is the original data, file, message content, or meaning that needs to be protected by means of encryption.

Question 17

What are HIDSs or HIPSs?

Answer 17

Host‐based intrusion detection or prevention systems

Question 18

How do ad hoc and infrastructure mode differ?

Answer 18

Ad hoc mode provides a simple peer‐to‐peer wireless connection devices, with no central management.

Question 19

What is a zero day exploit?

Answer 19

Exploitation of an unreported vulnerability in commercial or widely available software or firmware

Question 20

Which wireless security protocols should no longer be used?

Answer 20

Wired Equivalency Protocol (WEP), Wi‐Fi Protected Access (WPA)

Question 21

Common Port Numbers
FTP

Answer 21

File Transfer Protocol 21

Question 22

Common Port Numbers
SSH

Answer 22

Secure Shell 22

Question 23

Common Port Numbers
DNS

Answer 23

Domain Name System 53

Question 24

Common Port Numbers
HTTP/HTTPS

Answer 24

Hypertext Transfer Protocol 80/
Hypertext Transfer Protocol 443 - part of TLS (Transport Layer Security)

Question 25

Common Port Numbers SMTP

Answer 25

Simple Mail Transfer Protocol 25

Question 26

Common Port Numbers RDP

Answer 26

Remote Desktop Protocol 338

Question 27

Common Port Numbers NetBIOS

Answer 27

NetaBIOS 137, 138, 139

Question 28

Common Port Numbers POP

Answer 28

Post Office Protocol 110

Question 29

Common Port Numbers IMAP

Answer 29

Internet Message Access Protocol 143

Question 30

Well known ports

Answer 30

0 - 1023 • reserved for common apps like web servers (80) & secure servers (443)

Question 31

Registred ports

Answer 31

1024 - 49151 • Use by specific app registered by vendors, such as SQL server (port 1443) & Oracle databases (port 1521)

Question 32

Registered ports

Answer 32

1024 - 49151 Use by specific app registered by vendors, such as SQL Server (port 1443) & Oracle databases (port 1521)

Question 33

Port ranges

Answer 33

Well-known ports 0 - 1023 • reserved for common app like web servers (port 80) & secure web servers (port 443) Registered ports 1024 - 49151 • Use by specific app registered by vendors, such as SQL server (port 1443) & Oracle databases (port 1521) • Dynamic Ports Used temporarily by apps

Question 34

ICMP

Answer 34

Internet Control Message Protocol It is the housekeeping protocol, performs important administrative functions. *PING command: Confirms connectivity, * TRACE ROUTE command: identify the path between two systems on a network, providing troubleshooting information, * ADMINISTRATIVE functions: handles messages like: - Destination unreachable, - Redirect, - Time Exceeded, - Address Mark Request & Replies

Question 35

TCP flags

Answer 35

3 way-handshake SYN: open a connection, FIN: closes a connection, ACK: acknowledges a SYN or FIN

Question 36

OSI Model

Answer 36

1 Physical - wires, radios & optics 2 Data link - data transfers between 2 nodes 3 Network - internet protocol (IP) 4 Transport - TCP & UDP 5 Session - exchanges between systems 6 Presentation - data translation & encryption 7 Application - user programs

Question 37

DHCP

Answer 37

Dynamic Host Configurations Protocol Automatic assignment of IP addresses from an administrative-configured pool. Otherwise, they are assigned manually.

Question 38

Public health measures often require that immunization or treatment records would be made available to travel operators to use in determining if each passenger or crew member was safe to be allowed on board. Which of the following would be the best description of this process? A. Data processing B. Information management C. Knowledge management D. Information processing E. None of the above

Answer 38

D. Information processing. Each person’s immunization or test records represent a set of data; gathering a lot of data together to determine a higher‐level, more abstract finding (is that person safe to board, or should boarding be denied?) is creating new information. Option A might take each individual’s records and extract the fields that contain specific data that the operator needs to use (such as name, vaccination type and date, and so on). Option C might be appropriate for the way that the operator determines if a particular voyage’s total crew and passenger manifest is safe. Option B refers to a general process of organizing, directing, and controlling the ways that information is gathered, used, stored, and disposed of.

Question 39

Public health measures often require that a travel operator gather and maintain current government‐issued criteria or guidelines for making a board/no‐board decision about each passenger. These change frequently and often contradict each other. At one airline, managers relied on informal, verbal means of directing their passenger agents as to how to make sense of these instructions. This is a process that relied on: A. Explicit knowledge B. Data smoothing C. Tacit knowledge D. Business logic E. None of the above

Answer 39

C. Tacit knowledge. Collecting all of the current versions of government guidance and turning it into useful, meaningful direction to a team of workers is generating knowledge. If that knowledge is written down, it is made explicit. If it’s left to human memory of a conversation or an experience, that knowledge is tacit—skills and experience possessed but not codified. Thus, option A is incorrect. Option B is incorrect, as this refers to taking many samples of the same kind of measurement (such as a person’s skin temperature) and using a mathematical process to eliminate false readings and find the reading with the greatest likelihood of being correct. Option D is incorrect, as this is a general name for the set of steps used in completing a set of tasks, including the criteria used by workers at each step if necessary to make decisions required as part of that task.

Question 40

During public health emergencies such as pandemics, government‐issued guidance to travel operators such as airlines and cruise ships can change frequently. Suppose one cruise ship operator has well‐defined, written guidance to its passenger agents, which they update as quickly as possible when circumstances change. Which ethical or legal duty or duties would this be fulfilling? (Choose all that apply.) A. Due process B. Due care C. Due diligence D. Accountability

Answer 40

A. Due process B. Due care They have clearly defined a process for making each board/no‐board decision, and they control that process with detailed, written instructions and guidance. Their attention to detail in this suggests taking due care. As described, however, nothing indicates that they monitor the execution of that process to make sure instructions are being used correctly and that this produces correct results; thus, option C is incorrect. No mention is made of holding individual passenger agents, their supervisors, or the company itself responsible for incorrect decisions; thus, option D is incorrect (has not been addressed in the scenario thus far).

Question 41

Government regulations may require that travel operators verify that each passenger have full and current immunizations in order to travel. Suppose that one airline fails to put in place controls or processes to validate that immunization or test results sent to them by a prospective passenger are not, in fact, counterfeit or forgeries. This would mean their information security approach is failing to achieve which of the following? A. Confidentiality B. Integrity C. Availability D. Nonrepudiation E. Authenticity

Answer 41

Correct answer is E. Authenticity. Ascertaining that a set of input data comes from a trustworthy source and is true and correct is part of establishing the authenticity of that data. The other attributes (options A, B, C, and D) are important, but do not directly bear on whether the source of the data is recognized as being the “authoritative” voice to provide that data in the first place.

Question 42

Your company uses computer‐controlled machine tools on the factory floor as part of its assembly line. This morning, you’ve discovered that somebody erased a key set of machine control parameter files, and the backups you have will need to be restored and verified before you can use them. This may take most of the day to accomplish. What information security attribute is involved here? A. Confidentiality B. Integrity C. Availability D. Due care

Answer 42

B. Integrity. Although it is clear that the necessary parameter files are not available, this seems to have been caused because somebody could violate the integrity requirements of those files—deleting them does not seem to have been an authorized change. That unauthorized change led to (caused) option (C), availability, to be compromised; but lack of availability is not the best statement of the problem. Improper change management and security may have resulted from lack of due care (option D), but that does not identify what needs to be fixed to get machines back into operation.

Question 43

Suppose that you are employed by a business or that as a consultant you have a business as one of your clients. As an SSCP, which of the following groups do you have responsibilities to? A. Co‐workers, managers, and owners of the business that employs you (or is your client) B. Competitors of the business that employs you or is your client C. Customers, suppliers, or other companies that work with this business D. People and groups that have nothing to do with this business

Answer 43

C. Customers, suppliers, or other companies that work with this business. Explanation Options A and B are both examples of due care; due diligence is the verification that all is being done well and that nothing is not done properly. Option D can be an important part of due diligence but is missing the potential for follow‐up action.

Question 44

Yoshi works as a security analyst for an online merchant. Their systems are reporting a dramatic increase in customer complaints about charges the merchant has made to their accounts for orders that the customers say they have never made. Which information security functions or systems elements should Yoshi investigate first? A. Integrity B. Privacy C. Nonrepudiation D. Authenticity

Answer 44

C. Nonrepudiation. Explanation Start with the specifics of the complaints by confirming whether these customers are mistakenly or fraudulently trying to claim they never made the orders in question or whether some other system error may be responsible. After that’s been eliminated, it’s time to investigate whether the security of these customers’ accounts was compromised (option D). If so, that may indicate a failure of the privacy protections (option B). While it’s easy to think this is a data integrity problem (option A), that is a result; Yoshi needs to investigate to find what systems function(s) failed to operate correctly to make that result happen.

Question 45

Use the following scenario to answer the question. You live in Singapore, but you work remotely for an online merchant based in Berlin, Germany. Which GDPR role best applies to the merchant regarding the data about you, as an employee of the merchant? A. No roles apply B. Owner C. Processor D. Subject

Answer 45

C. Processor. Explanation The merchant has to organize, use, and update their records about you as an employee, regardless of where you live or how you do work for them. Option A is incorrect, as it seems to assume that GDPR doesn’t apply to you somehow. Option B is not a defined GDPR role with respect to data protection. Option D is incorrect, as you (in this case) are the subject of the data in question.

Question 46

Use the following scenario to answer the question. You live in Singapore, but you work remotely for an online merchant based in Berlin, Germany. The merchant in Berlin uses a third‐party firm to handle all of its personnel files. With respect to your data in those files, which GDPR role best describes the merchant? A. Custodian B. Controller C. Processor D. Subject

Answer 46

b. Controller. Explanation The controller has ultimate responsibility for protecting the data, even when it is in the hands of another who performs processing tasks on it. Option A refers to one who stores the data, but does nothing with it. Option D refers to you, as the data is about you.

Question 47

Which of the following shows the major steps of the information risk management process in the correct order? A. Assess risks across the organization; identify information security and privacy risks; implement countermeasures; establish security and privacy posture; review supply chain for IT security risk elements B. Establish basic security posture; review risks; implement countermeasures; perform ongoing monitoring and assessment, testing, and training C. Set priorities; assess risks; select controls and countermeasures; implement controls; validate correct operation; monitor D. Develop business impact analysis; establish risk tolerance levels; implement damage control choices; monitor

Answer 47

C. Set priorities; assess risks; select controls and countermeasures; implement controls; validate correct operation; monitor Explanation Option D incorrectly has the BIA first, but the BIA has to come after the organization’s leadership has agreed to risk tolerance and set priorities. Option B is incorrect partly because the basic “common sense” posture is not part of a formal risk management process but a bare‐minimum immediate set of actions to take if needed. Option A has establishing a posture (which consists of policies and decisions that drive implementation and operation steps) and implementation in the wrong order.

Question 48

How does information risk relate to information systems risk or information technology risk? A. These three terms all mean much the same thing, although with a greater or lesser degree of emphasis on securing the underlying computers and networks. B. They express the logical flow of making decisions about risk: first, what information do you need; second, how you get it, use it, and share it with others in the decision process; and third, what technologies help make all of that happen. The probability of an event causing a disruption to any step of that decision process is a risk. C. They reflect the need to think about risks in outcomes‐based, process‐based, asset‐based, or threat‐based terms. D. They suggest the levels of organizational leadership and management that need to be part of managing each risk: senior leaders with information risk, tactical unit managers with information systems risks, and the IT department with information technology risks.

Answer 48

B. They express the logical flow of making decisions about risk: first, what information do you need; second, how you get it, use it, and share it with others in the decision process; and third, what technologies help make all of that happen. The probability of an event causing a disruption to any step of that decision process is a risk. Explanation Option B correctly shows the use of information to make decisions, as well as the roles of processes and technologies in doing so. Option A mistakenly suggests that the IT risks are more important; IT risks may be how important information is lost or compromised, but it is that information loss or impact that puts businesses out of business and not the failure of their IT systems. Option C confuses risk management with information risk. Option D also mistakes the role of information and the roles of processes and technologies, both in achieving objectives and in risk management.

Question 49

What does it mean to have an integrated information risk management system? A. You choose controls and countermeasures that provide all‐risk coverage, have graceful degradation or fallback capabilities, and provide end‐to‐end visibility and management via built‐in command, control, and communications capabilities. B. You avoid point defense countermeasures or controls, as they tend to make you overlook gaps between them. C. You provide the communications capabilities to bring status, state, and health information from all countermeasures and controls, and all systems elements, to information security managers, who can then direct timely changes in these controls in real time as required to respond to an incident. D. Vendors of security information and event managers claim that their products are “integrated,” but they often do not clearly say what this means or help customers achieve greater security because of this.

Answer 49

C. You provide the communications capabilities to bring status, state, and health information from all countermeasures and controls, and all systems elements, to information security managers, who can then direct timely changes in these controls in real time as required to respond to an incident Explanation Option C shows both the purpose of an integrated approach (timely incident characterization and management) and the use of communications capabilities in doing so. Options A and D demonstrate that vendor self‐description of their products can sound good but does not really address key needs. Option B is true, and partially addresses how point solutions need to be mutually supportive, but does not go far enough.

Question 50

Tom is the chief information security officer for a medium‐sized business. It’s been brought to his attention that the company has been storing its backup systems images and database backups in an offsite facility that has no alarm system and no way of knowing whether there were any unauthorized persons entering that facility. Which of the following might apply to this situation? A. This could be a failure of due care in that security requirements for the backup information should have been specified and implemented in the storage plan and contracts. B. Since there are no records to check to see if any unauthorized persons had access to these backups, there has been no due diligence lapse. C. This is at least a failure of due diligence, since there seems to have been no systematic or periodic check of the storage facility or the backup media stored in it. D. This could be a case of failing to perform both due care and due diligence.

Answer 50

D. This could be a case of failing to perform both due care and due diligence. Explanation Options A and C highlight what seem to be Tom’s failures to adequately plan for or implement offsite backup storage of system images and data, and his failures to institute effective verification of the security of that storage. Option B is incorrect—the lack of records does not relieve Tom of the burden to check that things are working correctly anyway.

Question 51

What kind of information is part of an information risk assessment process? (Choose all that apply.) A. Lost revenues during the downtime caused by the risk incident, including the time it takes to get things back to normal B. Damage to equipment or facilities, or injury or death to people C. Estimated costs to implement chosen solutions, remediations, controls, or countermeasures D. Total costs to create an asset that is damaged or disrupted by the risk event

Answer 51

A. Lost revenues during the downtime caused by the risk incident, including the time it takes to get things back to normal & B. Damage to equipment or facilities, or injury or death to people Explanation Option C is the safeguard value, which we cannot compute until we have completed a risk assessment and a vulnerability assessment, and then designed, specified, or selected such controls or countermeasures. Option D is typically not the loss incurred by damage of an asset; of greater interest regarding impact to an asset would be the cost to repair it (if repairable), replace it, or design and implement new processes to do without the damaged or disrupted asset.

Question 52

The acronym BIA refers to which of the following? A. A document identifying all of the impacts to the business due to the risks it has chosen to assess; forms the basis for risk mitigation planning and implementation B. The basic information security needs to provide for the privacy, integrity, and availability of business information C. The budgeted implementation and accreditation plan for information security, often required by insurers and financial authorities of businesses dealing with sensitive or safety‐related information D. The budgeted cost of information availability, which when compared with the actual cost of information availability, lets management assess planned versus actual success of their information risk management programs

Answer 52

A. A document identifying all of the impacts to the business due to the risks it has chosen to assess; forms the basis for risk mitigation planning and implementation Explanation The business impact analysis (BIA) is an integrated view of the prioritized risks and the projected impacts they could have on the business. Option B is a misstatement of the confidentiality, integrity, and availability (CIA) needs for information security. Options C and D suggest realistic management needs for bringing together plans, costs, budgets, and timelines, but they are incomplete as stated and may not even exist.

Question 53

How do you use RTO, MAO, and RPO in planning information risk management activities? Select the statements that are correct. A. Return to operations (RTO) is the desired time to get all business processes back into operation, whether on backup or workaround systems or on production systems. The recovery point objective (RPO) sets priorities for which systems to bring up first, or for which business processes to get back into operation before others (of lower priority). B. The recovery point objective (RPO) establishes the maximum amount of data that is lost due to a risk event. This could be in numbers of transactions or in units of time, and it indicates the amount of rework of information that is acceptable to get systems back into normal operation. C. The recovery time objective (RTO) must be less than or equal to the maximum acceptable outage. The MAO sets a maximum downtime (outage time) before mission impact becomes unacceptable; the RTO can be used to emphasize faster than MAO restoration. D. The maximum acceptable outage (MAO) relates to the mission or business objectives; if multiple systems support those objectives, then all of their recovery time objectives (RTOs) must be less than or equal to the MAO.

Answer 53

B. The recovery point objective (RPO) establishes the maximum amount of data that is lost due to a risk event. This could be in numbers of transactions or in units of time, and it indicates the amount of rework of information that is acceptable to get systems back into normal operation. C. The recovery time objective (RTO) must be less than or equal to the maximum acceptable outage. The MAO sets a maximum downtime (outage time) before mission impact becomes unacceptable; the RTO can be used to emphasize faster than MAO restoration. D. The maximum acceptable outage (MAO) relates to the mission or business objectives; if multiple systems support those objectives, then all of their recovery time objectives (RTOs) must be less than or equal to the MAO. Explanation Option A is a misstatement of RTO and RPO.

Question 54

Threat modeling and threat assessment: A. Should be done during risk management so that the threat modeling and assessment can drive the detailed work of risk mitigation planning B. Refer to the boundaries of a system and look to identify, understand, assess, and manage anything that attempts to cross that boundary as a way to identify possible threats C. Involves highly mathematical approaches, such as predictive code analysis, to produce meaningful results D. Is best done using modeling and simulation tools

Answer 54

B. Refer to the boundaries of a system and look to identify, understand, assess, and manage anything that attempts to cross that boundary as a way to identify possible threats Explanation Whether the system is small and simple or large and complex, its owners, builders, and users have to treat it like a “black box” and know what can happen across every interface it has with the outside world. Thus Option B is correct. Option A has the steps in the wrong order; detailed threat modeling and assessment needs detailed system architectural information to be valid. Option C misstates how threat modeling is done. While Option D may address a useful set of tools, it does not explain what threat modeling and assessment are or how to do them.

Question 55

Why do SSCPs need to appreciate the culture of the organization they are working with in order to be effective as information risk managers? (Choose all that apply.) A. Organizational culture determines how willingly managers and workers at all levels will accept greater responsibilities and accountability, which can severely limit the SSCP’s ability to get a risk management plan enacted. B. “Old‐boy” networks and informal information and decision paths may make anything written down in business processes, manuals, and so forth somewhat suspect. C. Privately held companies tend to be run more loosely than publicly held ones, because shareholder protection law and regulations dictate limits on what executives and board members can do or how they can do it. D. Larger companies have probably had more different people in key positions over time, and so the effect of one domineering personality (as might happen in small entrepreneurial organizations) is probably not as pronounced.

Answer 55

A. Organizational culture determines how willingly managers and workers at all levels will accept greater responsibilities and accountability, which can severely limit the SSCP’s ability to get a risk management plan enacted. B. “Old‐boy” networks and informal information and decision paths may make anything written down in business processes, manuals, and so forth somewhat suspect. Explanation Options C and D may or may not be true in fact, but it’s not clear whether these have any bearing on how the company determines priorities and risk tolerance, or what its decision‐making processes and styles are. Options A and B are key elements of organizational culture that can impede or facilitate implementation of a risk management approach.

Question 56

As chief risk officer, you are asked if ignoring a risk is the same thing as accepting it. Which of the following might be part(s) of your reply? A. Yes, because in both cases you have decided to do nothing different and just keep on with business as usual. B. No, because quite often you choose to ignore something without first really understanding it or assessing its possible impacts to you. C. No, because in ignoring a risk you may be violating your own responsibilities for due care or due diligence. D. Yes, because as the responsible manager, you still have due care and due diligence responsibilities here.

Answer 56

A. Yes, because in both cases you have decided to do nothing different and just keep on with business as usual. Explanation All are correct as far as they go in comparing “ignore” and “accept.” However, the key to due care and due diligence is the standard of reasonable and prudent effort. You would not be prudent if you spent millions of dollars to relocate your business from Atlanta, Georgia (1,050 feet above mean sea level [MSL]) to Boulder, Colorado (5,328 feet above MSL) simply to avoid the risk of a tsunami flooding out your facility, given how astronomically huge that tidal wave would have to be! Thus, Options C and D do not apply, and Option B merely restates the due care or due diligence argument.

Question 57

Kim manages risk for an online publishing company on the island of St. Kitts, which currently uses an on‐premises datacenter as its content development facility; it e‐ships content to customers who are then responsible for hosting it wherever they want. Kim’s division vice president is concerned about risks, and so Kim has done some estimating. The datacenter has enough backup power supply capacity to do a graceful shutdown, but normal round‐the‐clock, seven‐day‐per‐week development operations must have commercial power available. Recent experience shows that at least once per month, a brownout or blackout lasting at least eight hours occurs. Each disruption costs the company an additional two hours to restore operations. Which statements about risk assessment are not correct? (Choose all that apply.) A. Risk appetite should determine the MAO, which can then be used as part of estimating SLE. B. If the SLE exceeds the safeguard value, Kim should advise that the company implement that safeguard. C. If the ALE exceeds the safeguard value, Kim should advise that thee company implement that safeguard. D. Once she has estimated the ALE, Kim can assess different safeguards to see how long their payback period might be so that she can advise her management regarding these alternatives.

Answer 57

B. If the SLE exceeds the safeguard value, Kim should advise that the company implement that safeguard. C. If the ALE exceeds the safeguard value, Kim should advise that thee company implement that safeguard. Explanation Option A is correct in that tolerance or appetite for risk should drive setting the maximum allowable outage time; the costs incurred during a maximum outage are part of computing single loss expectancy. Option B is incorrect, since the power outages seem to be happening monthly, so SLE alone overstates the potential losses. Option C annualizes the expected losses, but comparing it to the safeguard value assumes a one‐year payback period is required. Option D reflects that management may be willing to spend significant money on a safeguard that requires more than one year to justify (pay back) its expense in anticipated savings.

Question 58

Which of the following statements best describes security classification? A. A security classification is a label attached to a storage device that contains sensitive information, and indicates the required protection and handling methods. B. Security classification is a process that determines possible loss or impact if information of a given type suffers any kind of security compromise. C. Security classification is a process that determines possible loss or impact if information of a given type is disclosed to an unauthorized person or entity. D. Security classification groups together information types that have comparable loss or impacts if compromised to help optimize the choice of protection techniques.

Answer 58

B. Security classification is a process that determines possible loss or impact if information of a given type suffers any kind of security compromise. Explanation Option A confuses the results of establishing a security baseline (and thus a labeling and handling procedure) with the classification determination itself. Option C is partly correct, but compromise must consider impacts to more than just confidentiality (i.e., to all of the CIANA+PS characteristics). Option D confuses classification with categorization.

Question 59

Which of the following statements best describes security categorization? A. A security categorization is a label attached to a storage device that contains sensitive information, and indicates the required protection and handling methods. B. Security categorization groups together information types that have comparable loss or impacts if compromised, along with any compliance‐required security protection requirements for that type of data. C. Security categorization is a process that determines possible loss or impact if information of a given type is disclosed to an unauthorized person or entity. D. Security categorization groups together information types that have comparable loss or impacts if compromised, to help optimize the choice of protection techniques.

Answer 59

B. Security categorization groups together information types that have comparable loss or impacts if compromised, along with any compliance‐required security protection requirements for that type of data. Explanation Option A confuses the results of establishing a security baseline (and thus a labeling and handling procedure) with the classification determination itself. Option C confuses classification with categorization. Option D confuses categorization with security baselining.

Question 60

Which of the following events are threats? A. A thunderstorm that interrupts commercial electrical power B. A user who copies data that they do not need for work‐related tasks onto a removable storage device C. A systems administrator who leaves their workstation logged in to their privileged account, while they take a coffee break D. A network firewall that malfunctions, sporadically blocking some but not all traffic, due to its power supply overheating

Answer 60

B. A user who copies data that they do not need for work‐related tasks onto a removable storage device Explanation This is an intentional act caused by a human being, which may lead to loss or impact to the organization. Options A and D represent hazards. Option C, which is an intentional act, is not in and of itself a potential risk event (if, for example, the workstation is in a secured work area that only systems administrators can access); however, it may represent one or more exploitable vulnerabilities in the overall security posture of the organization.

Question 61

What’s the most secure way to authenticate device identity prior to authorizing it to connect to the network? A. MAC address allowed listing B. Multifactor authentication that considers device identification, physical location, and other attributes C. Verifying that the device meets system policy constraints as to software and malware updates D. Devices don’t authenticate, but the people using them do.

Answer 61

B. Multifactor authentication that considers device identification, physical location, and other attributes Explanation Option D is high risk, and therefore incorrect; plugging a device into an empty network connection should start a connection handshake that is an opportunity to block an unknown or unauthorized device from joining the network. Options A and C are parts of how Option B performs such an authentication, and therefore B is the most correct answer and the most secure approach of the three.

Question 62

Which statement about federated access systems is most correct? A. SSO and federated access provide comparable capabilities and security. B. By making identity more portable, federated access allows multiple organizations to collaborate, but it does require greater attention to access control for each organization and its systems. C. Once you’ve established the proper trust architecture, federated access systems are simple to implement and keep secure. D. Most federated access systems need to use a digital identity platform or IDaaS to provide proper authentication.

Answer 62

B. By making identity more portable, federated access allows multiple organizations to collaborate, but it does require greater attention to access control for each organization and its systems. Explanation Option A is incorrect; SSO is a subset of both the capabilities and security (issues and security solutions) that federated access can support. Option C correctly raises the issue of the trust architecture, but going from there to a full federated access control system, and keeping that secure, can be challenging. Keeping it secure will always require monitoring, analysis, and testing. Option D is incorrect; federated access, like SSO, can use any means of identity authentication that meets the organization’s CIANA needs.

Question 63

Which statement about extranets and trust architectures is most correct? A. Proper implementation of federated access provides safe and secure ways to bring an extranet into an organization’s overall network system; thus an internetwork trust architecture is not needed. B. Extranets present high‐risk ways for those outside of an organization to collaborate with the organization and thus need to be kept separate from the trust architecture used for other internetwork activities. C. Extranets provide extensions to an organization’s intranet and thus need to use the same trust architecture as implemented in the main organizational network. D. Trust architectures are the integrated set of capabilities, connections, systems, and devices that provide different organizations safe, contained, and secure ways to collaborate together by sharing networks, platforms, and data as required; thus, extranets are an example of a trust architecture.

Answer 63

D. Trust architectures are the integrated set of capabilities, connections, systems, and devices that provide different organizations safe, contained, and secure ways to collaborate together by sharing networks, platforms, and data as required; thus, extranets are an example of a trust architecture. Explanation Option A demonstrates misunderstanding of the concept of a trust architecture, which Option D clarifies. Option B also misstates the purpose and intent of trust architectures and their role in reducing the risk of an unconstrained (or totally trusted) extranet. Option C does not correctly state what an extranet is (it allows those external to the organization to share in using the sponsoring organization’s internal systems and data); it also is mistaken in saying that the same systems, technologies, connections, etc., that are the internal trust architecture would therefore be appropriate to secure and protect the extranet.

Question 64

Which of the following statements are true about discretionary access control policies? (Choose all that apply.) A. Subjects cannot be allowed to pass information about the object to another subject. B. Changing or creating new security attributes for an object or another subject can only be done by the access control system. C. Subjects can change rules pertaining to access control but only if this is uniformly permitted across the system for all subjects. D. Subjects can be permitted to pass on or grant their own privileges to other subjects.

Answer 64

C. Subjects can change rules pertaining to access control but only if this is uniformly permitted across the system for all subjects. D. Subjects can be permitted to pass on or grant their own privileges to other subjects. Explanation Discretionary access control policies allow the systems administrators to grant capabilities (permissions) to subjects to modify aspects of access control restraints, but these must be uniformly defined for all subjects. Thus, Option C is correct, as is Option D. Options A and B apply to mandatory or nondiscretionary access control policies.

Question 65

Which form of access control is probably best for zero trust architectures to use? A. Role‐based B. Subject‐based C. Object‐based D. Attribute‐based

Answer 65

D. Attribute‐based Explanation Option D, attribute‐based, can use complex Boolean logic statements to conditionally evaluate almost any criteria, environmental or situational conditions, and so forth, to authorize an access request. Each of the others provides limited capabilities by comparison; zero trust typically requires the most rigorous access control possible.

Question 66

Your IT director has asked you for a recommendation about which access control standard your team should be looking to implement. He’s suggested either Diameter or XTACACS, as they used those in his last job. Which of the following gives you the best information to use in replying to your boss? A. The standard is IEEE 802.1X; Diameter and XTACACS are implementations of the standard. B. Diameter is an enhanced RADIUS and has been quite successful. C. XTACACS replaced TACACS+, which could be a good solution for you. D. RADIUS is the standard to work with.

Answer 66

A. The standard is IEEE 802.1X; Diameter and XTACACS are implementations of the standard. Explanation Option B is partly correct, but Diameter never caught on in the market for a variety of reasons and is probably out of date by now. Option C is also incorrect—first came TACACS, which gave rise to both XTACACS, a proprietary product, and TACAC+, not the other way around. Option D is incorrect, since systems may be de facto “standards” (because a lot of companies use them), but they are not published standards by appropriate standards agencies.

Question 67

Why do we need IPSec? A. Now that IPv6 is here, we don’t, since its built‐in functions replace IPsec, which was for IPv4. B. Since more and more apps are moving to PKI for encryption of data on the move, we no longer need IPSec. C. IPSec provides key protocols and services that use encryption to provide confidentiality, authentication, integrity, and nonrepudiation at the packet level; without it, many of the Layer 2, 3, and 4 protocols are still unprotected from attack. D. Since IPv6 encrypts all traffic at all layers, once you’ve transitioned your systems to IPv6, you won’t need IPSec, except for those legacy IPv4 systems you communicate with.

Answer 67

C. IPSec provides key protocols and services that use encryption to provide confidentiality, authentication, integrity, and nonrepudiation at the packet level; without it, many of the Layer 2, 3, and 4 protocols are still unprotected from attack. Explanation Option A is false; not only does IPv6 contain and support IPSec, it also makes it mandatory. Option B is false; app‐level encryption does not protect lower‐layer traffic from being snooped or spoofed. Thus Option C is correct. Option D is false; IPv6 doesn’t do this encryption, but it builds the features into the protocol stack so that user organizations can choose to implement it. IPv6 and IPv4 are not compatible, so a gateway of some kind will be required anyway, and the issue of security through the gateway will still need to be addressed.

Question 68

Which relationship between nodes provides the greatest degree of control over service delivery? A. VPN tunnel B. Peer‐to‐peer C. Client‐server D. Peer‐to‐server

Answer 68

C. Client‐server Explanation Option A is incorrect; VPNs provide connectivity but have no more role in service delivery than other Layer 1 or Layer 2 network elements do. Option B is incorrect, as neither peer controls the other in service sharing. Option D is incorrect; in such a case, either the server is a peer to the other server or the peer is actually a client. Option C correctly identifies that most services need one node to control the service delivery process, and the other node, requesting the service, follows the first node’s control of the conversation.

Question 69

You’re trying to diagnose why a system is not connecting to the Internet. You’ve been able to find out that your system’s IP address is 169.254.0.0. Which of the following statements correctly suggests the next best step? A. It sounds like you’ve got a corrupted local DNS cache, which you should flush and then reset the connection. B. Try connecting via another browser. C. Check the DHCP server on your LAN to see if it’s functioning correctly. D. Check to see if any router and modem between your system and your ISP are functioning correctly; you may need to do a hardware (cold) reset of them.

Answer 69

C. Check the DHCP server on your LAN to see if it’s functioning correctly. Explanation This IP address is the link local address, which is assigned to your system by the operating system and its network protocol stack when a DHCP server does not respond. Check the configuration settings for any switches, routers, and modems between your system and your ISP so that you know where the DHCP service resides; then find that device. Thus, Options A and B are incorrect. Option D may be a good step after you determine which device is supposed to be your DHCP server. Option C is your best next step. Ping it or use tracert it to see if it responds.

Question 69

What happens to datagrams as they are passed through the protocol stack from the Data Link layer to the Transport layer? A. They get shorter as the headers and footers are removed as the datagrams move from one layer to the next. B. They get longer as more header and footer information is wrapped around the datagram. C. They get converted from character or graphic information and formatting into byte formats. D. If an encryption protocol is being used, they get encrypted.

Answer 69

A. They get shorter as the headers and footers are removed as the datagrams move from one layer to the next. Explanation Option A is correct; this is “unwrapping” as datagrams have their headers and footers removed on their way up the stack. Option B is incorrect—wrapping happens on the way down from Transport (or higher) to Physical (by way of Data Link). Options C and D describe what the presentation layer does as it passes datagrams to applications, which is beyond the Transport layer and going up, not down, the stack.

Question 69

Your IT team has a limited budget for intrusion detection and prevention systems and wants to start with a central server and a small number of remote IDS / IPS devices. Your team lead asks you where you think the remote devices should go. Which answer would you suggest? A. Place them in the datacenter on the key access paths to its switch fabric. B. Place them on the links between your ISP’s point of presence and your internal systems. C. Identify the links between high‐risk internal systems (such as software development) and mission‐critical systems (such as customer order processing, manufacturing control, or finance), and put them on the links between those systems. D. The central server is a good start, and you can save even more money by skipping the remote devices for right now.

Answer 69

B. Place them on the links between your ISP’s point of presence and your internal systems. Explanation In almost all circumstances, the boundary between an organization’s information infrastructure and the outside world of the Internet is the highest‐risk threat surface. Any channel crossing this boundary should be rigorously assessed for vulnerabilities, and all access via should be it well controlled and well monitored. Thus Option B is probably the best recommendation. Internal systems links, such as Options A and C, might help in containment of intrusions, but there may be other ways to do this than with IDS/IPS remotes. Option D restricts the effectiveness of the IPS or IDS to just those network segments and resources it can directly see and control, which may be a very small subset of your network.

Question 69

Which measures would you recommend be used to reduce the security risks of allowing Wi‐Fi, Bluetooth, and NFC devices to be used to access your company’s networks and information systems? (Choose all that apply.) A. MDM systems B. Effective access control and identity management, including device‐level control C. Because the Physical layer is wireless, there is no need to protect anything at this layer. D. Allowed listing of authorized devices

Answer 69

A. MDM systems & B. Effective access control and identity management, including device‐level control Explanation Option C is false; the physical access point itself needs to be protected from somebody attacking it with an unauthorized firmware update, for example, or simply plugging into an unblocked network jack on it. Option D is one component of mobile device management, but it is not sufficient. Option B can reduce exposure to many threats related to mobile device access, whereas a mobile device management system can help track, force compliance, block, or lock down a device reported lost or stolen.

Question 70

What can traffic shaping, traffic management, or load balancing systems do to help identify or solve information security problems? (Choose all that apply.) A. Nothing, since they work autonomously to accomplish their assigned functions. B. Log data they generate and keep during operation may provide some useful insight after an incident, but nothing in real time would be helpful. C. Such tools usually can generate alarms on out‐of‐limits conditions, which may be indicative of a system or component failure or an attack or intrusion in progress. D. Given sufficient historical data, such systems may help network administrators see that greater‐than‐normal systems usage is occurring, which may be worthy of closer attention or investigation.

Answer 70

B. Log data they generate and keep during operation may provide some useful insight after an incident, but nothing in real time would be helpful. & C. Such tools usually can generate alarms on out‐of‐limits conditions, which may be indicative of a system or component failure or an attack or intrusion in progress. & D. Given sufficient historical data, such systems may help network administrators see that greater‐than‐normal systems usage is occurring, which may be worthy of closer attention or investigation. Explanation Options B, C, and D all describe ways that having better insight into how your systems and networks are being used, right now, can help you determine if they might be suffering some kind of problems. And if they are, that data can help you resolve whether this is a security event or not. Option A is false and also lacks the insight to apply these systems to your overall information systems security strategy.

Question 71

Which of the following statements about a NOC and a SOC is correct? (Choose all that apply.) A. Both perform essentially the same functions. B. With the increased emphasis on security, senior managers and stakeholders may feel that not having a security operations center is not taking the risks seriously enough. C. The focus of a NOC is different than that of a SOC. D. It’s usually a mistake to try to overload the NOC with the security functions the SOC has to take on.

Answer 71

B. With the increased emphasis on security, senior managers and stakeholders may feel that not having a security operations center is not taking the risks seriously enough. & C. The focus of a NOC is different than that of a SOC. Explanation Option A shows a conceptual misunderstanding about network operations and security operations, regardless of who conducts them or is responsible for them. Option D is also incorrect; many smaller organizations can easily and affordably have their network operations team handle the key security operations functions. Option B may indeed be true in some organizations and in some marketplaces, but the organization should always let its business case for security drive the decision. Option C is correct; NOC focuses on design, deployment, operation, and maintenance of the network and changes to it, and the SOC focus is on keeping it secure, detecting events and characterizing them, and containing and responding to them if necessary.

Question 72

Which of the following types of actions or responses would you not expect to see in an information security incident response plan? (Choose all that apply.) A. Relocation of business operations to alternate sites B. Temporary staffing C. Using off‐site systems and data archives D. Engaging with senior organizational leadership

Answer 72

A. Relocation of business operations to alternate sites B. Temporary staffing Explanation Option A is incorrect; relocation of business operations is typically part of disaster recovery plans. Option B is incorrect, as temporary staffing implies that existing staff are not available to work or cannot work for some reason, and this is more in the scope of disaster recovery. Option C, off‐site systems and data archives, may well be used in the restoration phase of an information security incident response. Option D is part of all incident response, continuity, and recovery planning.

Question 73

Various security devices, technologies, and systems seem to have evolved from each other, with each step on that pathway added new, more powerful capabilities to that which was already available. Choose the option which places these systems or technologies in the correct sequence, from most capable to least capable. A. SOAR, SIEM, SDN, SDS B. SIEM, SDS, SDN, SOAR C. SIEM, SDN, SOAR, SDS D. SIEM, SDN, SDS, SOAR

Answer 73

D. SIEM, SDN, SDS, SOAR Explanation The correct sequence is SIEM, SDN, SDS, and then SOAR. SOAR depends upon centralized, virtualized control of security (SDS), which is built on top of network virtualization (SDN). SIEM systems do not in general require network virtualization. This reflects integration of data from physical network and systems security devices, virtualized networks providing for scripted configuration (and reconfiguration) of network VMs, including their security characteristics; specialized applications that integrate security monitoring and configuration for virtual and physical systems; and process and activity workflow management and execution.

Question 74

The COVID‐19 pandemic caused many organizations to substantially increase the percentage of their employees that worked remotely (from home or other locations). What physical information security issues should these organizations have addressed? Choose one or more selections as appropriate. A. Ergometrics and other physiological safety and security aspects of each employee’s remote work locations and arrangements. B. Physical protection of network infrastructure and endpoint devices, at each employee’s remote location, from loss or compromise. C. More thorough enforcement of appropriate use policies and restrictions for endpoints and network access used by these employees. D. Ensure that each remote work location had suitable backup power and connectivity.

Answer 74

B. Physical protection of network infrastructure and endpoint devices, at each employee’s remote location, from loss or compromise. & D. Ensure that each remote work location had suitable backup power and connectivity. Explanation Option A addresses a worker health and safety issue that is legitimate, but not normally in the scope of an information systems security plan or activity. Option C is primarily implemented by technical, not physical, security controls. Option D does address physical availability and might be necessary on a case‐by‐case basis for individual workers or workgroups requiring high availability.

Question 75

You work with a small startup company that is building dynamic mashups that combine the search results of user’s web queries, map data, and results from analytics run in real time in order to create unique software to meet the user’s needs. This software may be a game, an applet or widget, or some other small software appliance, for use with the user’s IoT devices. The mashups can also include code from web‐hosted code libraries and repositories, most of which are open source and unrestricted for reuse. Which statement best captures the supply chain risks that are unique to this business process that the organization should consider? (Select all that apply.) A. Inbound supply chain risks B. Outbound supply chain risks C. Development risks D. Data integrity risks

Answer 75

A. Inbound supply chain risks B. Outbound supply chain risks Explanation In effect, this organization is creating new things (the mashups) from the inputs selected in response to user inputs. Option A addresses how many different threats can cause search results to be tainted (misdirected or contaminated with malformed data) or that code libraries selected for reuse are infected with malware of many types. Option B addresses the passing on of these risks to customers, who then use those mashups for business or leisure use. Options C and D are not unique to this business model.

Question 76

A new employee is familiarizing themselves with the company’s parts catalog system. They discover that they can enter an SQL query such as a SELECT statement into a part number field, and sometimes the application responds by displaying selected data followed with a database command prompt. Which statement best identifies what kind of attack technique this might be? A. Cross‐site scripting B. Buffer overflow C. SQL injection D. Arbitrary code execution

Answer 76

C. SQL injection Explanation Option C best describes the improper entry of a query instead of data values, and having the application process that query as a query, rather than as data field values. Options B and D might describe parts of the problem in this situation, but they are too broad to focus attention on the specific problem. Option A is false, as this incident does not involve the attacker placing bogus scripts into web pages for other users to execute.

Question 77

Which of the following might be the most effective means of detecting malformed data attacks? A. User and entity behavior analytics, applied to ongoing activities B. Ethical penetration testing to detect vulnerabilities with data typing, validation, and reasonableness checks in software and procedure designs C. Periodic audit of processed transactions, accounts, and related records D. Trending analysis of errors encountered during user entry and use of forms, workflows, or other data input processes

Answer 77

A. User and entity behavior analytics, applied to ongoing activities Explanation Each of these answers is a valid technique to reduce the risk that malformed data attacks can occur; only option A provides a real‐time opportunity to check user and entity actions, across the organization’s systems and infrastructures, for behaviors that are suspicious and might be exploiting a malformed data vulnerability. Option B simulates such attacks and is valuable in finding such vulnerabilities or stress‐testing the controls put in place to mitigate them. Option C can identify attacks that have happened during the audit period, but not usually in real time. It may still be the only way to detect that your systems were successfully invaded weeks or months ago and might reveal where they are currently abusing your resources and assets. Option D, trending, will highlight types of errors, if the systems and applications generate log entries or other telemetry when these events happen; this may be useful in highlighting vulnerabilities, but not in identifying that a specific attack has been made.

Question 77

Which statement best describes the relationship between continuous assessment and vulnerability management? A. Vulnerability management should drive continuous assessment, setting the priority or urgency for assessment activities based on the risks associated with that vulnerability. B. Vulnerability management informs the planning and conduct of continuous assessment, the results of which are used as updates to vulnerability management. C. There is no direct link between these two sets of processes; rather, they come together via continuous monitoring. D. Vulnerability management helps inform and prioritize continuous assessment planning, but it is the results of continuous compliance that closes the loop back to vulnerability management.

Answer 77

B. Vulnerability management informs the planning and conduct of continuous assessment, the results of which are used as updates to vulnerability management. Explanation Option A is incorrect, in that other operational, compliance, and the current risk and threat context may be better sources of priority and urgency to use for assessment activity planning and conduct. Option B correctly refers to the one process informing, but not driving, the other. Option C is incorrect and misstates the relationship of monitoring with assessment and compliance. Option D is incorrect, as the successful validation of an assessment activity actually drives both the close‐out of the vulnerability and the completion of a compliance check.

Question 77

Why is allowed listing a better approach to applications security than blocked listing? Choose the most correct statement. A. Allowed listing depends on government‐certified lists of trusted software providers, whereas blocked listing needs to recognize patterns of malicious code behavior, or malware signatures, to block the malware from being installed and executed. B. For most organizations, the list of applications they have chosen to trust is far smaller and easier to administer than huge lists of malware signatures and behavioral models. C. Administering an allowed listing system can require a lot of effort, but when an unknown program is trying to execute (or be installed), you know it is not yet trusted and can prevent harm. D. With blocked listing only, new malware may not be recognized as such before it installs, executes, and begins to harm your systems and information.

Answer 77

C. Administering an allowed listing system can require a lot of effort, but when an unknown program is trying to execute (or be installed), you know it is not yet trusted and can prevent harm. Explanation Option C is correct in terms of the major benefit of allowed listing; Option D, its logical opposite, addresses the zero day risks of blocked listing approaches without saying why any other approach (such as allowed listing) is better. Option A is false on its face; no such program (thankfully!) exists to “trust‐mark” applications. However, digitally signed installation kits do give some assurance that the software came from the vendor you thought provided it. Option B is true on its face but does not say why one approach provides better security than the other.

Question 77

Many issues are involved when planning for a third party to perform services involving data storage, backup and restore, and destruction or processing services for your company. Which of the following statements is not correct with regard to such planning or to your actual conduct of operations with that third party? (Choose all that apply.) A. Your data protection responsibilities remain with you; you need to be able to actively verify that such third parties are doing what you’ve contracted with them to do. Otherwise, you are blindly trusting them. B. Your contracts with these third parties should use a shared responsibility model to clearly delineate which party has which responsibilities; this will, in most cases, hold you harmless when the third party goes outside of the contract C. Since third parties are by definition on a contract with you, as your subcontractor, you are not liable or responsible for mistakes they make in performing their duties. D. What your third party providers, subcontractors, or employees (for that matter) do in your name and in your service, you are ultimately responsible for.

Answer 77

B. Your contracts with these third parties should use a shared responsibility model to clearly delineate which party has which responsibilities; this will, in most cases, hold you harmless when the third party goes outside of the contract C. Since third parties are by definition on a contract with you, as your subcontractor, you are not liable or responsible for mistakes they make in performing their duties. Explanation Option D most correctly states the bottom line to most organizations in terms of how stakeholders, investors, legal and regulatory authorities, customers, and others will judge responsibility when things go wrong. Option A is a specific example; due care requires that you have the contractual, technical, and administrative ways to do such verifications, while due diligence requires that you actually do such verifications and hold the third party to task. Option B can only set day‐to‐day expectations; when a major data breach happens, Option D suggests that even if the service provider failed to fulfill their contract, your stakeholders will still hold you responsible. Option C is false.

Question 77

Fred is on the IT team migrating his company’s business systems into a public cloud provider, which will host the company’s processes and data on its datacenters in three different countries to provide load balancing, failover/restart, and backup and restore capabilities. Which statement or statements best addresses key legal and regulatory concerns about this plan? (Choose all that apply.) A. Because Fred’s company does not have a business office or presence in the countries where the cloud host’s datacenters are, those countries do not have legal or regulatory jurisdiction over company data. B. The countries where the cloud host’s datacenters are located, plus all of the countries in which Fred’s company has a business presence, office, or other facility, have jurisdiction over company data. C. In addition to staying compliant with all of those different countries’ laws and regulations, Fred’s company must also ensure that it does not violate cultural, religious, or political taboos in any of those countries. D. These jurisdictional arguments only apply to data stored on servers or systems within a given country, or that is being used in that country; nations do not control the movement of data across their borders.

Answer 77

B. The countries where the cloud host’s datacenters are located, plus all of the countries in which Fred’s company has a business presence, office, or other facility, have jurisdiction over company data. C. In addition to staying compliant with all of those different countries’ laws and regulations, Fred’s company must also ensure that it does not violate cultural, religious, or political taboos in any of those countries. Explanation Option A is false; the laws of the host nation apply to the cloud datacenter operator in that country, and that means they apply to all of the data and processing performed on that cloud datacenter. Option D is false, as nearly all countries claim the right to control the import and export of information, particularly (as in Option C) where that information violates, attacks, or ridicules a strong cultural, religious, or political value in that country. Options B and C are true.

Question 78

Which statements about the role(s) of archiving, backup, and restore in meeting information security needs are most correct? (Choose all that apply.) A. These each contribute to availability in similar ways. B. These each contribute to availability and nonrepudiation. C. As part of an incident response or disaster recovery plan, prompt restore to a known good data configuration may prevent other data from being compromised or breached, thus contributing to confidentiality. D. These have no role to play in achieving authentication needs.

Answer 78

A. These each contribute to availability in similar ways. B. These each contribute to availability and nonrepudiation. C. As part of an incident response or disaster recovery plan, prompt restore to a known good data configuration may prevent other data from being compromised or breached, thus contributing to confidentiality. Explanation Option D is incorrect. Authentication data, which defines user and process privileges, identity verification, and so forth, is as subject to being wiped out, corrupted, lost, or stolen as any other data on any information system.

Question 79

The “garbage‐in, garbage‐out” (GIGO) problem means: A. Noise on power supplies or signal cables can corrupt data in motion, which if processed can result in abnormal or incorrect “garbage” results. B. Most information processes involve a set of related data items that represent or model a real person, activity, or part of the world. When that set of data is mutually inconsistent, or inconsistent with other data on hand about that real entity, each field may be within range but the overall meaning of the data set is corrupt. This “garbage,” when processed (as input) by apps, produces equally meaningless but valid‐looking outputs. C. Organizations that just throw away damaged storage devices; printed copies of their data, application source code, design notes; and so forth are putting this “garbage” right where a “dumpster diver” hacker attack can collect it, examine it, and possibly find exploitable vulnerabilities. D. Data input attacks can cause some applications to abort or execute abnormally, sometimes in ways that allow the garbage data that was input to be executed as if it is command strings or machine language instructions.

Answer 79

B. Most information processes involve a set of related data items that represent or model a real person, activity, or part of the world. When that set of data is mutually inconsistent, or inconsistent with other data on hand about that real entity, each field may be within range but the overall meaning of the data set is corrupt. This “garbage,” when processed (as input) by apps, produces equally meaningless but valid‐looking outputs. Explanation Option A is a real risk but not what GIGO is about. Option C may involve throwing things in the “garbage” that should have been destroyed or zeroized first, but it’s also incorrect. Option D is a very common attack attempt against many apps, but it usually does not lead to the application producing what looks like correctly formed outputs with distorted meanings. GIGO processing, as in Option B, can result in incorrect transactions being posted to an account, such as when a patient billing record has too many copies of the same lab procedure billed incorrectly to it.

Question 80

Your boss tells you that securing the endpoints should consider all of the measures you would use to secure the information infrastructures themselves. Is she correct? Which statement best confirms or refutes her statement? A. False. Many of the things we do to secure operating systems and networks, for example, just don’t apply to an endpoint device, the apps on it, and the user’s interactions with it. B. True. After all, each endpoint is (by definition) embedded in or part of one or more threat surfaces; from there, the same threat modeling and assessment processes will lead us through the same risk management and mitigation processes, with choices tailored as needed. C. True. All of the same risk management, vulnerability assessment, risk mitigation, and operational risk management processes apply to each node of our system and to the system as a whole, tailored to the specific risks, vulnerabilities, technologies, and operational needs. D. False. What happens at the endpoints is a special case of information security and needs special attention that is very different than how we assess risk to servers, networks, or applications platforms.

Answer 80

B. True. After all, each endpoint is (by definition) embedded in or part of one or more threat surfaces; from there, the same threat modeling and assessment processes will lead us through the same risk management and mitigation processes, with choices tailored as needed. Explanation Option A glosses over the growing “BYOx,” where x can be infrastructure, device, or most any service; you might argue that Option A also ignores the blurring of the boundary between an endpoint and the information system itself. Option B reminds us to do integrated, coherent threat modeling and analysis across our total systems environment. Option C just echoes what the boss said, although it does add a minor bit about tailoring; overall, it doesn’t contribute much to the conversation with the boss. Option D offers no support for this rather unusual viewpoint.

Question 81

When choosing your countermeasures and tactics to protect hardware and systems software, you should start with which of the following? A. Published Current Vulnerabilities and Exposures (CVE) databases B. The information systems baseline that documents the systems your organization uses C. Your organization’s business impact analysis D. Your organization’s IT vulnerabilities assessment

Answer 81

D. Your organization’s IT vulnerabilities assessment Explanation Starting with Option A is a common sense approach to quickly implementing some reasonable and prudent protection, but it lacks any judgment as to which vulnerabilities are important to your organization’s risk management strategy and which are not. Option B is the systems inventory, and you will need it, as it describes the as‐built systems. Option C is what drives Option D. Therefore, start shopping for countermeasures with Option D in hand.

Question 82

The most important security vulnerability to your IT infrastructure’s hardware elements would be which of the following? A. Being “orphaned” when the manufacturer no longer provides technical support, spare parts, or firmware updates B. Electrical power fluctuations, air conditioning issues, or other workplace environmental issues C. Unauthorized devices or software installed during maintenance by an off‐site maintenance vendor or computer store D. Theft, or being misplaced or lost

Answer 82

D. Theft, or being misplaced or lost Explanation All of these are legitimate risks to worry about; some big box stores’ computer repair services are known to do full scans and voluntarily report what they find to law enforcement, or possibly others, for example. Option A happens frequently, but it’s more of an impact to ongoing availability than it is an exploitable vulnerability. Option B can cause equipment to fail or behave erratically. Option D is far and away the most prevalent hardware‐related cause of data loss, systems breach, or information security failures, of the items on this list.

Question 83

Trusted platform modules provide which of the following benefits to an organization’s IT infrastructure? A. By means of hardware implementations of encryption, hashing and key generation, they greatly simplify the use of certificate authorities and PKI. B. As a trust root, a TPM can make hierarchies of trust more reliable. C. The TPM replaces the host system’s random number generators and hash routines with its hardware‐accelerated, more secure versions. This enhances system security as well as runtime performance. D. As a signed part of operating systems kernels, TPMs make it possible to validate software updates more reliably.

Answer 83

B. As a trust root, a TPM can make hierarchies of trust more reliable Explanation Since trusted platform modules (TPMs) are special, sealed hardware modules added to the motherboards of computers or phones by their manufacturers, Option D is incorrect, even though TPM device driver software must be incorporated into most OSs to enable their use. Option A is incorrect; the TPM doesn’t simplify this but allows for a more trustworthy hardware storage and management of certificates, digital signatures, and so forth. Option C is not correct; these functions in the OS and host hardware remain, while all the TPM provides is its own implementations with which it secures keys, manages certificates, and hashes (preserves) machine identification information.

Question 91

FTP port

Answer 91

FTP 21 File Transfer Protocol

Question 92

SSH port

Answer 92

SSH 22 Secure Shell

Question 93

DNS port

Answer 93

DNS UDP 53 Domain Name Service

Question 94

HTTP port

Answer 94

HTTP 80 HyperText Transfer Protocol

Question 95

HTTPS port

Answer 95

HTTPS 443 HyperText Transfer Protocol

Question 96

SMTP protocol

Answer 96

SMTP 25 Simple Mail Transfer Protocol

Question 97

RDP port

Answer 97

RDP 338 Remote Desktop Protocol

Question 98

NetBios ports

Answer 98

NetBios 137, 138, 139

Question 99

POP port

Answer 99

POP 110 Post Office Protocol

Question 100

IMAP port

Answer 100

IMAP 143 Internet Message Access Protocol

Question 101

What is a reference monitor?

Answer 101

Security function that checks every action, specifically access attempts, to see if it is properly authorized; if it is not, the action will be blocked. Reference monitors can also force a system into a secure shutdown if they determine that system security may be fatally compromised.

Question 102

What are mantraps?

Answer 102

Physical security controls that can restrict entry to a protected area; can also detain a potential intruder between their entry and exit doors

Question 103

What is ARP, what layer does it run at, and what does it use for addressing?

Answer 103

Address Resolution Protocol (ARP) provides a way to query other network devices so as to resolve a device’s media access control (MAC) address into its corresponding Internet Protocol (IP) address. It is a cross‐layer protocol and can work across Layers 2, 3, and 4.

Question 104

What is access control based on job functions or duties?

Answer 104

Role‐based access control

Question 105

What does “garbage in, garbage out” mean?

Answer 105

Most information processes involve a set of related data items that represent or model a real person, activity, or part of the world. When that set of data is mutually inconsistent, or inconsistent with other data on hand about that real entity, each field may be within range but the overall meaning of the data set as a whole has an incorrect or possibly harmful meaning. This “garbage,” when processed (as input) by apps, produces equally meaningless but valid‐looking outputs.

Question 106

Security for collaboration environments most depends on what?

Answer 106

Education and training of the users so that they know how, why, and when to protect what should not be shared

Question 107

What is centralized access control?

Answer 107

All identity management and access control decisions for an organization are handled by one server system.

Question 108

Email typically uses which ports and protocols?

Answer 108

Simple Mail Transfer Protocol (SMTP), transmission control protocol (TCP) 25; post office protocol 3 (POP3, via TCP 110.

Question 109

How can attacks against device‐level firmware be conducted?

Answer 109

(a) Remote or onsite device management (or mismanagement) attacks that allow a hacker to initiate a firmware update using a hacked firmware file

Question 110

What is the negative security model?

Answer 110

Explicitly naming or identifying subjects, addresses, identities, and actions that are prohibited from taking actions with systems resources and assets.

Question 111

What is Institute of Electrical and Electronics Engineers (IEEE) 802.1X?

Answer 111

Access control standard that defines the port‐based network access controller (PNAC) and its use of Extensible Authentication Protocol over 802.11, known as EAPOL (“EAP over LAN”).

Question 112

What is IPSec, what layer does it run at, and what does it use for addressing?

Answer 112

Internet Protocol Security (IPSec) is a set of security protocols added to Internet Protocol version 4 and built into the design of Internet Protocol version 6. It uses Internet Protocol (IP) addresses and thus runs at Layer 3.

Question 113

What is ICMP, what layer does it run at, and what does it use for addressing?

Answer 113

Internet Control Message Protocol is used to communicate control information between network devices and can perform some network and device management functions. It uses Internet Protocol (IP) addresses and thus runs at Layer 3.

Question 114

What is * (star) security?

Answer 114

A security model property that prohibits writing down to a process at a lower security level; from the Bell‐LaPadula model

Question 115

How do operational technologies differ from information technologies?

Answer 115

Operational technologies (OT) use information from physical sensors to make physical actions happen, such as opening a valve or moving a mechanism. As a result, OT systems can directly damage property, inflict injury, or kill people. IT systems move, shape, store, create, and share information; they do not directly interact with the physical world (except through the humans that use them). To interact directly, IT needs an OT endpoint system, whether directly connected, mobile, or autonomous, such as a UAV or robot.

Question 116

What is identity proofing?

Answer 116

Establishes the truthfulness of documents or other information that attest to a person’s claim to be that person, and is used during the identity provisioning process

Question 117

Why use a honeypot?

Answer 117

To allow an attacker a limited, controlled access to the organization’s systems so that more can be learned about systems vulnerabilities by watching the attacker attempt to exploit vulnerabilities in those systems

Question 118

What is a Type 1 access control error?

Answer 118

False negative, denying an authorized subject or user to gaining access

Question 119

Why are hashes one‐way?

Answer 119

An effective hash algorithm has no mathematical inverse; you cannot take the resulting hash value and unencrypt it to reproduce the original plaintext.

Question 120

Why does “disaster” have two meanings to information security professionals?

Answer 120

Traditionally, the IT community considered loss of IT and communications as the “disaster,” as these were the only services they had responsibilities for. IT disaster recovery planning, for example, often uses this narrow view. As recent cyberattacks have demonstrated, the general public, investors, governments, and organizational leaders consider “disasters” as including any and all aspects of the functions of the organization. SSCPs and others need to recognize the need for and benefit from using the larger view.

Question 121

What is the difference between a cryptographic system, a cryptographic algorithm, and a cryptographic protocol?

Answer 121

A cryptographic system is the full set of components necessary to use encryption to achieve security needs. A cryptographic algorithm (one part of a system) provides the process for transforming plaintext into ciphertext (encryption) or the reverse (decryption); the algorithm uses a cryptographic key and other cryptovariables (parameters) to accomplish and control this. A cryptographic protocol is a process that uses encryption in order to achieve a specific purpose, such as digitally signing a file or an email.

Question 122

What is the major cause of software vulnerabilities?

Answer 122

Human error. All software vulnerabilities result from errors introduced during the lifecycle of design, development, test, and use of that software. Compromises between schedule, cost, and performance can introduce or fail to detect errors in processes, tools, libraries, and systems. Data quality programs that should enforce data consistency, completeness, and correctness are often not robust enough. Configuration management is often lacking or poorly done. Hardware may fail, but software doesn’t. It’s just built vulnerable.

Question 123

What is the best protection if a mobile endpoint device is lost or stolen?

Answer 123

Mobile device management (MDM) systems that are used to configure and control the device, prior to its being lost or stolen; the MDM systems can then lock or zeroize the device if it is reported lost or stolen

Question 124

What are the different categories of security control functions?

Answer 124

Directive, deterrent, preventative, detective, reactive, corrective, compensating, and recovery

Question 125

What is the AAA of access control?

Answer 125

Authentication (validate a subject is legitimate); authorization (validate that the access request itself is permitted for that subject, object, and conditions); and accounting (keep records of every attempt and what it resulted in)

Question 126

How can supply chain attacks disrupt an organization?

Answer 126

Attacks on any element of inward supply or outbound consumption of the organization’s goods and services can disrupt its business activities. Inbound attacks on its IT and OT supply chains can cause security compromises and possibly lead to safety problems. Inbound attacks that ripple through the organization can get passed on to its own customers as well, causing additional disruption through reputational damage.

Question 127

What are TCP and UDP, what layer to they run at, and what do they use for addressing?

Answer 127

Transmission Control Protocol (TCP) is a connection‐oriented protocol that provides a degree of error correction, lost packet retransmission, and other quality services. It uses sender and recipient port numbers as addresses. User Datagram Protocol (UDP) is a connectionless protocol and uses sender and recipient port numbers as addresses. These both run at Layer 4.

Question 128

What is an acceptable use policy?

Answer 128

Administrative statement of what uses of company‐provided information systems and assets are allowed and what uses are prohibited

Question 129

What is ARP?

Answer 129

Address Resolution Protocol, which discovers the corresponding IP address for a given media access control (MAC) address by asking other devices for it. Failing to find it, it will seek it from a Dynamic Host Configuration Protocol (DHCP) server.

Question 130

How can you protect the integrity of a file, but have its contents remain as plaintext?

Answer 130

(a) Digitally sign the file

Question 131

What is confidentiality?

Answer 131

Keeping sensitive, private, or proprietary data from being revealed to or accessed by an unauthorized subject

Question 132

What is the main difference between WIPS and WIDS as compared with NIPS and NIDS?

Answer 132

Wireless Intrusion Detection System (WIDS): This focuses on monitoring wireless networks for unauthorized access points, rogue devices, and suspicious activities. Its primary role is detecting potential security threats specific to wireless communications and alerting administrators. Typically operates at Layer 1 (Physical) and Layer 2 (Data Link) of the OSI model. It monitors wireless signals and activity, including MAC addresses, Wi-Fi frames, and other wireless-specific data. Network Intrusion Detection System (NIDS): This is designed to monitor wired network traffic. It analyzes data packets flowing through the network to detect malicious activities, such as viruses, malware, or hacking attempts. NIDS works across the whole network and is protocol-agnostic—it’s not limited to wireless environments. Operates at Layer 3 (Network) and Layer 4 (Transport) of the OSI model. It examines network packets and protocols such as IP, TCP, UDP, and others to detect unauthorized or malicious traffic. Some advanced systems may also analyze Layer 7 (Application) traffic for deeper insights. In short, WIDS is specific to wireless environments, while NIDS monitors network traffic across various infrastructures. WIDS is tailored to protect against Wi-Fi-based threats, whereas NIDS offers broader protection against intrusions on traditional networks.

Question 133

Can you unhash a digital signature, to derive the file content it is associated with, or the private key used in the signature process?

Answer 133

No. A cryptographic hash (which is what a digital signature is) can take an arbitrarily large file and reduce it to a fixed‐length hash value (perhaps 512 bits). It is mathematically impossible to derive what all of the other bits in the original file must be. The same is true for the keys used in the signature.

Question 134

What kind of things might be an indicator of compromise?

Answer 134

Recognizable malware signatures, attempts to access IP addresses or URLs known or suspected to be of hostile or compromising intent, or domain names associated with known or suspected botnet control servers.

Question 135

Domain Name System (DNS) uses which port and protocol?

Answer 135

UDP port 53 for name queries; TCP port 53 for zone transfers

Question 136

What is an orphan?

Answer 136

A device or software program no longer supported by its vendor or manufacturer; no more upgrades, updates, or support to migrate to a new operating system is available.

Question 137

What is the difference between key exchange and key distribution?

Answer 137

Key exchange involves using asymmetric encryption to generate and exchange session keys with someone you might not know. The key exchange process does not require exchanging secret or private individual data. Key distribution is used to transmit or provide symmetric encryption keys to authorized users, which does require the sending of secret information (the keys themselves).

Question 138

What is a Type 2 access control error?

Answer 138

Linked to FAR (False Acceptance Rate), this happens when an unauthorized user is mistakenly granted access. A high FAR indicates a security risk, as it reflects the system’s leniency in wrongly accepting invalid attempts.

Question 139

What is subnetting in IPv4 and IPv6?

Answer 139

Subnetting provides the network designer with a way to logically group hosts on a network segment by treating the host address field as two sets of bits: one for subnetwork number, the other for host number. Both IPv4 and IPv6 provide for subnetting, but the much larger IPv6 address field makes this a lot simpler to design and manage.

Question 140

What is * (star) integrity?

Answer 140

A security model property that prohibits “write up” from a lower to a higher security level; from the Biba model

Question 141

Describe the difference between safety and reliability.

Answer 141

Safety requires that when systems are in use or when they fail, they do no unauthorized harm or injury to other systems, people, or property. Reliability requires them to produce accurate, on‐time answers as and when required.

Question 142

What are covert paths?

Answer 142

Unintended and unauthorized channels, within a system, for the transfer of information in ways that violates security policies.

Question 143

How do you provide incident response support to forensics investigations?

Answer 143

Secure the scene, protect evidence, establish and maintain chain of custody of evidence

Question 144

What is MPLS, what layer does it run at, and what does it use for addressing?

Answer 144

MultiProtocol Label Switching (MPLS) provides routing based on shortest paths within a network and is often used in virtual private network (VPN) implementations. It uses Internet Protocol (IP) addresses and thus runs at Layer 3.

Question 145

What is due care?

Answer 145

Taking steps to ensure that all of your responsibilities can be accomplished satisfactorily

Question 146

What is the difference between an identity and an entity?

Answer 146

An entity is a single, unique person, physical device, or instance of a software task or virtual machine. An identity is a label or name for an entity, valid for a particular context. Just as a biological person has multiple identities (in work, social, family, online, or business and commerce settings), each copy of a VM or each instance of a software task running on a device may have multiple identities. All these identities may be legitimate, just different.

Question 147

How do identity assurance levels (IALs) relate to just‐in‐time identity?

Answer 147

Standardized IALs enable systems to use just‐in‐time or self‐provisioning identity and account creation to meet their overall system security needs. IALs describe third‐party identity service providers’ validation processes. IAL1, the lowest level, does nothing to validate an entity’s claim to an identity. IAL2 requires validation by means of another online identity provider such as LinkedIn or Facebook. IAL3 requires physical verification of the authenticity and correctness of documents that attest to the identity being claimed.

Question 148

Describe the difference between Transmission Control Protocol (TCP) and User Datagram Protocol (UDP).

Answer 148

TCP: reliable, connection‐oriented, segment retransmission and sequencing; segments acknowledged. UDP: unreliable, connectionless, no windowing, retransmission, sequencing or acknowledgment.

Question 149

How do LANs, WANs, and PANs differ?

Answer 149

A local area network (LAN) is an instance of an intranet, typically connecting devices physically nearby each other. Wide area networks (WANs) connect LANs, WANS, or other networks, and can span cities or even globally. Personal area networks (PANs) connect devices carried by, worn by, or implanted into a person’s body; PANs often use other communications technologies such as Near‐Field Communication (NFC) or Bluetooth and require one device in the PAN to act as a gateway to IP networks if required.

Question 150

What is a separation of duties?

Answer 150

Policies that allocate parts of sensitive or critical job functions to different systems elements (people, systems, or processes) so that no one single element performs all tasks and can see or modify all data associated with it.

Question 151

What is existential risk?

Answer 151

A risk of such significant or extensive impact that it can put the organization or business out of business (cause it to cease to exist as a legal, functioning entity)

Question 152

What is due diligence?

Answer 152

Checking to make sure that all of your due care tasks are actually getting the job done correctly and completely

Question 153

What's the cryptographic lifecycle?

Answer 153

1. Initiation 2. Development/Acquisition 3. Implementation/Assessment 4. Operations/Maintenance 5. Sunset

Question 154

A new customer at a bank that uses fingerprint scanners to authenticate its users is surprised when he scans his fingerprint and is logged in to another customer’s account. What type of biometric factor error occurred? A. A registration error B. A Type 1 error C. A Type 2 error D. A time‐of‐use, method‐of‐use error

Answer 154

Type 2 errors occur in biometric systems when an invalid subject is incorrectly authenticated as a valid user. In this case, nobody except the actual customer should be validated when fingerprints are scanned. Type 2 errors are also known as false positive errors. Type 1 (or false negative) errors occur when a valid subject is not authenticated; if the existing customer was rejected, it would be a Type 1 error. Registration is the process of adding users, but registration errors and time‐of‐use, method‐of‐use errors are not specific biometric authentication terms.

Question 155

Ben is working on integrating a federated identity management system and needs to exchange authentication and authorization information for browser‐based single sign‐on. What technology is his best option? A. HTML B. XACML C. SAML D. SPML

Answer 155

C. Security Assertion Markup Language (SAML) is the best choice for providing authentication and authorization information, particularly for browser‐based SSO. HTML is primarily used for web pages, SPML is used to exchange user information for SSO, and XACML is used for access control policy markup.

Question 156

Mandatory access control is based on what type of model? A. Discretionary B. Group‐based C. Lattice‐based D. Rule‐based

Answer 156

C. Mandatory access control systems are based on a lattice‐based model. Lattice‐based models use a matrix of classification labels to compartmentalize data. Discretionary access models allow object owners to determine access to the objects they control, role‐based access controls are often group‐based, and rule‐based access controls like firewall ACLs apply rules to all subjects they apply to.

Question 157

In which phase or phases of a typical data exfiltration attack would an attacker probably not make use of phishing? (Choose all that apply.) A. Reconnaissance and characterization B. Data gathering, clumping, masking, and aggregating C. Installing and using covert command and control capabilities D. Initial access

Answer 157

B. Data gathering, clumping, masking, and aggregating C. Installing and using covert command and control capabilities Explanation Phishing and many other social engineering tactics have played a major role in more than 60 percent of major data breaches in the past few years. Such tactics have high payoff to the attacker during their search for a possible target, gathering information about its systems and security, and then their initial entry into the target’s systems. Thus, options A and D are likely phases for phishing attacks, and incorrect answers to this question (note the “not make use”). Options B and C are almost exclusively done surreptitiously, exploiting information that social engineering may have revealed to the attacker; few if any signs of phishing in these activities have been noted.

Question 158

What kind of malware attacks can corrupt or infect device‐level firmware? (Choose all that apply.) A. SNMP‐based attacks that can trigger the device to download and install a firmware update remotely B. Remote or onsite device management (or mismanagement) attacks that allow a hacker to initiate a firmware update using a hacked firmware file C. Phishing or misdirection attacks that fool operators or users into initiating an upload of a hacked firmware file D. None, because firmware updates require operator intervention to download trusted updates and patch files from the manufacturer’s or vendor’s websites, and then initiate and monitor the update and restart of the device

Answer 158

B. Remote or onsite device management (or mismanagement) attacks that allow a hacker to initiate a firmware update using a hacked firmware file C. Phishing or misdirection attacks that fool operators or users into initiating an upload of a hacked firmware file Explanation Option A is false; Simple Network Management Protocol (SNMP) by itself cannot trigger a device to download and install a firmware patch file. Option D is false, because that operator action can be misdirected to use the wrong file as the update. Option B may be true in some cases, if the device is set to allow remote management from other than a connected endpoint system such as a laptop or smartphone. Attacks like those in option C happen a lot!

Question 159

Which of the following statements best summarizes the benefits of using trusted platform modules (TPMs) as part of an organization’s IT infrastructure? A. Because they have onboard hardware implementations of encryption, hashing, and key generation, they greatly simplify the use of certificate authorities and the public key infrastructure (PKI). B. As a trust root, a TPM can make hierarchies of trust more reliable. C. The TPM replaces the host system’s random number generators and hash routines with its hardware‐accelerated, more secure versions. This enhances system security as well as runtime performance. D. As a signed part of operating systems kernels, TPMs make it possible to validate software updates more reliably.

Answer 159

B. As a trust root, a TPM can make hierarchies of trust more reliable. Explanation Since TPMs are special, sealed hardware modules added to the motherboards of computers or phones by their manufacturers, option D is incorrect, even though TPM device driver software must be incorporated into most OSs to enable their use. Option A is incorrect; the TPM doesn’t simplify this but allows for a more trustworthy hardware storage and management of certificates, digital signatures, and so forth. Option C is not correct; these functions in the OS and host hardware remain, while all the TPM provides is its own implementations with which it secures keys, manages certificates, and hashes (preserves) machine identification information.

Question 160

Which statement about a reference monitor in an identity management and access control system is correct? A. It should be tamper‐resistant. B. Its design and implementation should be complex so as to defeat reverse engineering attacks. C. It’s an abstract design concept, which is not actually built into real hardware, operating systems, or access control implementations. D. It is part of the secure kernel in the accounting server or services provided by strong access control systems.

Answer 160

A. It should be tamper‐resistant. Explanation The reference monitor is the functionality that checks every access attempt to see if it should be authorized or denied. As a result, option D is false (accounting is a recordkeeping function, necessary to access control but done after the access request is granted or denied). Option C is false, since the reference monitor is in fact implemented in operating systems (typically in their security kernel) or as part of a trusted computing base (TCB) module on a motherboard. Option B is the reverse of what’s required; we need to be able to inspect, analyze, and verify that the logic and code of the reference monitor does its job completely and correctly and that it does nothing else if we are to consider it highly trustworthy.

Question 161

Incorrect What kinds of privileges should be part of what your mandatory access control policies can grant or deny to a requesting subject? (Choose all that apply.) A. Any privilege relating to reading from, writing to, modifying, or deleting the object in question if it was created or is owned by the requesting subject B. Reading or writing/modifying the metadata associated with an object C. Modifying access control system constraints, rules, or policies D. Reading, writing, deleting, or asking the system to load the object as an executable task or thread and run it

Answer 161

B. Reading or writing/modifying the metadata associated with an object D. Reading, writing, deleting, or asking the system to load the object as an executable task or thread and run it Explanation Mandatory access control policies do not allow subjects or objects to modify the security‐related aspects of the system, its subjects, and its objects; thus, granting the privileges in option A or C cannot be allowed. Options B and D reflect reasonable and prudent access control checks that all systems should perform before granting access but that are not part of mandatory access control policies.

Question 162

In access control authentication systems, which is riskier, false positive or false negative errors? A. False negative, because they lead to a threat actor being granted access B. False positive, because they lead to a threat actor being granted access C. False negative, because they lead to legitimate subjects being denied access, which impacts business processes D. False positive, because they lead to legitimate subjects being denied access, which impacts business processes

Answer 162

B. False positive, because they lead to a threat actor being granted access Explanation A positive result of an authentication test means that the claimant is who (or what) they claim to be. Thus, a false positive is allowing an incorrect identity to access the system, which probably is a threat actor. A negative result denies an identity’s claim to be who (or what) they claim to be. Therefore, a false negative denies a legitimate identity from system access. As a result, options A and D incorrectly use the concept of negative and positive authentication results (correct and false). While option C is true, option B indicates the situation of greatest risk—a threat actor has been legitimized and granted access.

Question 163

Which statement about single‐factor versus multifactor authentication is most correct? A. Single‐factor is easiest to implement but with strong authentication is the hardest to attack. B. Multifactor requires greater implementation, maintenance, and management but can be extremely hard to spoof as a result. C. Multifactor authentication requires additional hardware devices to make authentication properly secure. D. Multifactor authentication should be reserved for those high‐risk functions that require extra security.

Answer 163

B. Multifactor requires greater implementation, maintenance, and management but can be extremely hard to spoof as a result. Explanation B. Option A is false; each additional factor checked increases the challenge an attacker has to overcome to spoof an identity claim. Option C is false; hardware is needed only for factors involving what the subject has, such as a keyfob code generator or biometric factors. Option D is tempting, and high‐risk functions might be best protected with additional security measures, but compared to option B, it is not as compellingly correct.

Question 164

Is IPv6 backward compatible with IPv4? A. No, because the differences in addressing, packet header structure, and other features would not allow an IPv4 packet to successfully travel on an IPv6 network B. No, because IPv4 packets cannot meet the new security considerations built into IPv6 C. Yes, because IPv6 has services built into the protocol stacks to convert IPv4 packets into IPv6 compatible structures D. Yes, because the transport and routing protocols are the same

Answer 164

A. No, because the differences in addressing, packet header structure, and other features would not allow an IPv4 packet to successfully travel on an IPv6 network Explanation Option B is incorrect, because the changes in address field sizes, and therefore packet header structures, have nothing to do with security (although IPv6 does provide enhancements to security). Option C is incorrect; such a conversion could be done by a gateway, but that is not part of IPv6, although IPv6 supports it. Option D is incorrect, although the transport protocols (like TCP and UDP) have not changed, but this is not where the incompatibility comes from.

Question 165

Which statement about subnetting is correct? A. Subnetting applies only to IPv4 networks, unless you are using classless interdomain routing. B. Both IPv4 and IPv6 provide for subnetting, but the much larger IPv6 address field makes this a lot simpler to design and manage. C. Subnetting in IPv4 involves the CIDR protocol, which runs at layer 3; in IPv6, this protocol, and hence subnetting, is not used. D. Because the subnet mask field is so much larger in IPv6, it is easier to subnet in this newer protocol stack than in IPv4.

Answer 165

B. Both IPv4 and IPv6 provide for subnetting, but the much larger IPv6 address field makes this a lot simpler to design and manage. Explanation Options A and C both incorrectly leave out subnetting in IPv6 and misstate what classless inter‐domain routing (CIDR) is about, even though the two options say different incorrect things about CIDR. Option D is partly correct in that IPv6 does have a 16‐bit subnet field, and as option B says, the overall address field size makes subnetting much easier to do, but there is no subnet field in IPv4.

Question 166

Which statement or statements about ports and the Internet is not correct? (Choose all that apply.) A. Using port numbers as part of addressing and routing was necessary during the early days of the Internet, largely because of the small size of the address field, but IPv6 makes most port usage obsolete. B. Standard ports are defined for a number of protocols, and these ports allow the sender and receiver to establish connectivity for specific services. C. Standardized port assignments cannot be changed, or things won’t work right, but they can be mapped to other port numbers by the protocol stacks on senders’ and recipients’ systems. D. Many modern devices, such as those using Android, cannot support ports, and so apps have to be redesigned to use alternate service connection strategies.

Answer 166

A. Using port numbers as part of addressing and routing was necessary during the early days of the Internet, largely because of the small size of the address field, but IPv6 makes most port usage obsolete & D. Many modern devices, such as those using Android, cannot support ports, and so apps have to be redesigned to use alternate service connection strategies. Explanation Ports are a fundamental part of the way apps request services from processes running on other nodes on the Internet. Standardized port numbers make applications designs easier to manage; thus, port 80 and HTTP are associated with each other. Therefore, options A and D show a misunderstanding of what ports are and why they are necessary.

Question 167

Which of the following might be legitimate ways to transfer a risk? (Choose all that apply.) A. Recognize that government agencies have the responsibility to contain, control, or prevent this risk, which your taxes pay them to do. B. Pay insurance premiums for a policy that provides for payment of claims and liabilities in the event the risk does occur. C. Shift the affected business processes to a service provider, along with contractually making sure they are responsible for controlling that risk or have countermeasures in place to address it. D. Change the underlying business process to use more secure software and hardware systems.

Answer 167

A, B & C Explanation Option D is typically an example of remediating, sometimes called fixing or mitigating the risk.

Question 168

Which of the following activities are not part of information risk mitigation? A. Implementing new systems features or capabilities to enhance product quality B. Incident management and investigation, after a suspected information security breach C. Installing and testing new firewall, switch, and router systems and settings D. Developing an information classification policy and process

Answer 168

D. Developing an information classification policy and process Explanation Improving product quality is a laudable goal, but in and of itself it is not related to information systems security; thus option A is incorrect. Option B refers to activities after an incident; mitigation activities happen before an incident occurs or result from lessons learned because of the incident. Option C is most likely being done to implement new or revised security policies. Option D is part of information risk management and should precede information risk mitigation.

Question 169

Which of the following shows the major steps of the information risk management process in the correct order? A. Assess risks across the organization; identify information security and privacy risks; implement countermeasures; establish security and privacy posture; review supply chain for IT security risk elements B. Establish basic security posture; review risks; implement countermeasures; ongoing monitoring and assessment; testing; training C. Set priorities; assess risks; select controls and countermeasures; implement controls; validate correct operation; monitor D. Develop business impact analysis (BIA); establish risk tolerance levels; implement damage control choices; monitor

Answer 169

C. Set priorities; assess risks; select controls and countermeasures; implement controls; validate correct operation; monitor Explanation Option D incorrectly has the BIA first when it has to come after the organization’s leadership has agreed to risk tolerance and set priorities. Option B is incorrect, partly because the basic “commonsense” posture is not part of a formal risk management process but a bare minimum immediate set of actions to take if needed. Option A has establishing a posture (which is policy and decisions that drive implementation and operation steps) and implementation in the wrong order.

Question 170

What is information risk? A. The threat that your computers, online storage, or cloud‐hosted or other data could be hacked into and data stolen or changed B. The probability of an event occurring that disrupts your information and the business processes and systems that use it C. Vulnerabilities in your information systems that can be exploited by a threat actor and cause harmful impacts D. The probability that management and leadership’s directions and communications will be misunderstood, causing the wrong actions to be taken by stakeholders, possibly causing financial loss, injury, or death

Answer 170

B. The probability of an event occurring that disrupts your information and the business processes and systems that use it Explanation Option B is the simplest and most effective definition of information risk. Options A and C do not include probability of occurrence (risks are not certain to happen) and describe how risks become events rather than what the risk actually is. Option D is one example, but it does not define information risk.

Question 171

What kind of information is part of an information risk assessment process? (Choose all that apply.) A. Lost revenues during the downtime caused by the risk incident, including time it takes to get things back to normal B. Damage to equipment or facilities, or injury or death to people C. Estimated costs to implement chosen solutions, remediations, controls, or countermeasures D. Total costs to create an asset that is damaged or disrupted by the risk event

Answer 171

A. Lost revenues during the downtime caused by the risk incident, including time it takes to get things back to normal & B. Damage to equipment or facilities, or injury or death to people Explanation Option C is the safeguard value, which we cannot compute until we have completed risk assessment and vulnerability assessment and then designed, specified, or selected such controls or countermeasures. Option D is typically not the loss incurred by damage of an asset; of greater interest regarding impact to an asset would be the cost to repair it (if repairable), replace it, or design and implement new processes to do without it.

Question 172

Which statement is incorrect as to how you should use RTO, MAO, and RPO in planning information risk management activities? A. Return to operations (RTO) is the desired time to get all business processes back into operation, whether on backup or workaround systems or on production systems brought back to normal. The recovery priority objective (RPO) sets priorities for which systems to bring up first or which business processes to get back into operation before others (of lower priority). B. Recovery point objective (RPO) establishes the maximum amount of data that is lost due to a risk event. This could be in numbers of transactions or in units of time and indicates the amount of rework of information that is acceptable to get systems back into normal operation. C. Recovery time objective (RTO) must be less than or equal to the maximum acceptable outage. MAO sets a maximum downtime (outage time) before mission impact becomes unacceptable; RTO can be used to emphasize faster‐than‐MAO restoration. D. Maximum acceptable outage (MAO) relates to the mission or business objectives; if multiple systems support those objectives, then all of their recovery time objectives (RTOs) must be less than or equal to the MAO.

Answer 172

Explanation Option A is a misstatement of RTO and RPO.

Question 173

Darlene was recently offered a consulting opportunity as a side job. She is concerned that the opportunity might constitute a conflict of interest. Which one of the following sources is most likely to provide her with appropriate guidance? A. Organizational code of ethics B. (ISC)2 code of ethics C. Organizational security policy D. (ISC)2 security policy

Answer 173

A. Organizational code of ethics Explanation The situation Darlene finds herself in is an ethical dilemma, and a code of ethics would be the best place to look for guidance. This situation is specific to her employer, so she should turn to her organization’s code of ethics, rather than the more general (ISC)2 Code of Ethics.

Question 174

The (ISC)2 code of ethics applies to all SSCP holders. Which of the following is not one of the four mandatory canons of the code? A. Protect society, the common good, the necessary public trust and confidence, and the infrastructure. B. Disclose breaches of privacy, trust, and ethics. C. Provide diligent and competent service to the principles. D. Advance and protect the profession.

Answer 174

B. Disclose breaches of privacy, trust, and ethics. Explanation The (ISC)2 code of ethics also includes “Act honorably, honestly, justly, responsibly, and legally” but does not specifically require credential holders to disclose all breaches of privacy, trust, or ethics.

Question 175

Juniper Content is a web content development company with 40 employees located in two offices: one in New York and a smaller office in the San Francisco Bay Area. Each office has a local area network protected by a perimeter firewall. The local area network (LAN) contains modern switch equipment connected to both wired and wireless networks. Each office has its own file server, and the information technology (IT) team runs software every hour to synchronize files between the two servers, distributing content between the offices. These servers are primarily used to store images and other files related to web content developed by the company. The team also uses a SaaS‐based email and document collaboration solution for much of their work. You are the newly appointed IT manager for Juniper Content, and you are working to augment existing security controls to improve the organization’s security. You are also concerned about the availability of data stored on each office’s server. You would like to add technology that would enable continued access to files located on the server even if a hard drive in a server fails. What integrity control allows you to add robustness without adding additional servers? A. Server clustering B. Load balancing C. RAID D. Scheduled backups

Answer 175

C. RAID Explanation RAID uses additional hard drives to protect the server against the failure of a single device. Load balancing and server clustering do add robustness but require the addition of a server. Scheduled backups protect against data loss but do not provide immediate access to data in the event of a hard drive failure.

Question 176

Juniper Content is a web content development company with 40 employees located in two offices: one in New York and a smaller office in the San Francisco Bay Area. Each office has a local area network protected by a perimeter firewall. The local area network (LAN) contains modern switch equipment connected to both wired and wireless networks. Each office has its own file server, and the information technology (IT) team runs software every hour to synchronize files between the two servers, distributing content between the offices. These servers are primarily used to store images and other files related to web content developed by the company. The team also uses a SaaS‐based email and document collaboration solution for much of their work. You are the newly appointed IT manager for Juniper Content, and you are working to augment existing security controls to improve the organization’s security. Finally, there are historical records stored on the server that are extremely important to the business and should never be modified. You would like to add an integrity control that allows you to verify on a periodic basis that the files were not modified. What control can you add? A. Hashing B. ACLs C. Read‐only attributes D. Firewalls

Answer 176

A. Hashing Explanation Hashing allows you to computationally verify that a file has not been modified between hash evaluations. ACLs and read‐only attributes are useful controls that may help you prevent unauthorized modification, but they cannot verify that files were not modified. Firewalls are network security controls and do not verify file integrity.

Question 177

Jasper Diamonds is a jewelry manufacturer that markets and sells custom jewelry through their website. Bethany is the manager of Jasper’s software development organization, and she is working to bring the company into line with industry standard practices. She is developing a new change management process for the organization and wants to follow commonly accepted approaches. During what phase of the change management process does the organization conduct peer review of the change for accuracy and completeness? A. Recording B. Analysis/Impact Assessment C. Approval D. Decision Making and Prioritization

Answer 177

B. Analysis/Impact Assessment Explanation During the Analysis/Impact Assessment phase, the organization subjects the change to peer review. In the peer review, technologists verify the accuracy and completeness of the change request and attempt to uncover any impact on other systems that might occur as result of the change.

Question 178

Ben is assessing the compliance of his organization with credit card security requirements. He finds payment card information stored in a database. Policy directs that he remove the information from the database, but he cannot do this for operational reasons. He obtained an exception to policy and is seeking an appropriate compensating control to mitigate the risk. What would be his best option? A. Purchasing insurance B. Encrypting the database contents C. Removing the data D. Objecting to the exception

Answer 178

B. Encrypting the database contents Explanation Ben should encrypt the data to provide an additional layer of protection as a compensating control. The organization has already made a policy exception, so he should not react by objecting to the exception or removing the data without authorization. Purchasing insurance may transfer some of the risk but is not a mitigating control.

Question 179

Which one of the following security programs is designed to establish a minimum standard common denominator of security understanding? A. Training B. Education C. Indoctrination D. Awareness

Answer 179

D. Awareness Explanation Awareness establishes a minimum standard of information security understanding. It is designed to accommodate all personnel in an organization, regardless of their assigned tasks.

Question 180

Chris is responsible for workstations throughout his company and knows that some of the company’s workstations are used to handle proprietary information. Which option best describes what should happen at the end of their lifecycle for workstations he is responsible for? A. Erasing B. Clearing C. Sanitization D. Destruction

Answer 180

C. Sanitization Explanation Sanitization is a combination of processes that ensure that data from a system cannot be recovered by any means. Erasing and clearing are both prone to mistakes and technical problems that can result in remnant data and don’t make sense for systems that handled proprietary information. Destruction is the most complete method of ensuring that data cannot be exposed, and some organizations opt to destroy the entire workstation, but that is not a typical solution because of the cost involved.

Question 181

What term is used to describe a set of common security configurations, often provided by a third party? A. Security policy B. Baseline C. DSS D. NIST SP 800‐53

Answer 181

B. Baseline Explanation A baseline is a set of security configurations that can be adopted and modified to fit an organization’s security needs. A security policy is written to describe an organization’s approach to security, while DSS is the second half of the Payment Card Industry Data Security Standard. The NIST SP‐800 series of documents address computer security in a variety of areas.

Question 182

What type of fire suppression system fills with water when the initial stages of a fire are detected and then requires a sprinkler head heat activation before dispensing water? A. Wet pipe B. Dry pipe C. Deluge D. Preaction

Answer 182

D. Preaction Explanation A preaction fire suppression system activates in two steps. The pipes fill with water once the early signs of a fire are detected. The system does not dispense water until heat sensors on the sprinkler heads trigger the second phase.

Question 183

Betty is concerned about the use of buffer overflow attacks against a custom application developed for use in her organization. What security control would provide the strongest defense against these attacks? A. Firewall B. Intrusion detection system C. Parameter checking D. Vulnerability scanning

Answer 183

C. Parameter checking Explanation Parameter checking, or input validation, is used to ensure that input provided by users to an application matches the expected parameters for the application. Developers may use parameter checking to ensure that input does not exceed the expected length, preventing a buffer overflow attack.

Question 184

Which one of the following facilities would have the highest level of physical security requirements? A. Data center B. Network closet C. SCIF D. Cubicle work areas

Answer 184

C. SCIF Explanation Sensitive compartmented information facilities (SCIFs) are highly secure government facilities designed for processing classified information. They would have stricter physical security requirements than any other type of facility.

Question 185

Which of the following is not true about the (ISC)2 code of ethics? A. Adherence to the code is a condition of certification. B. Failure to comply with the code may result in revocation of certification. C. The code applies to all members of the information security profession. D. Members who observe a breach of the code are required to report the possible violation.

Answer 185

C. The code applies to all members of the information security profession. Explanation The (ISC)2 code of ethics applies only to information security professionals who are members of (ISC)2. Adherence to the code is a condition of certification, and individuals found in violation of the code may have their certifications revoked. (ISC)2 members who observe a breach of the code are required to report the possible violation by following the ethics complaint procedures.

Question 186

Tracy is preparing to apply a patch to her organization’s enterprise resource planning system. She is concerned that the patch may introduce flaws that did not exist in prior versions, so she plans to conduct a test that will compare previous responses to input with those produced by the newly patched application. What type of testing is Tracy planning? A. Unit testing B. Acceptance testing C. Regression testing D. Vulnerability testing

Answer 186

C Explanation Regression testing is software testing that runs a set of known inputs against an application and then compares the results to those produced by an earlier version of the software. It is designed to capture unanticipated consequences of deploying new code versions prior to introducing them into a production environment.

Question 187

The large business that Jack works for has been using noncentralized logging for years. They have recently started to implement centralized logging, however, and as they reviewed logs, they discovered a breach that appeared to have involved a malicious insider. How can Jack best ensure accountability for actions taken on systems in his environment? A. Review the logs and require digital signatures for each log. B. Require authentication for all actions taken and capture logs centrally. C. Log the use of administrative credentials and encrypt log data in transit. D. Require authorization and capture logs centrally.

Answer 187

B. Require authentication for all actions taken and capture logs centrally. Explanation Requiring authentication can help provide accountability by ensuring that any action taken can be tracked back to a specific user. Storing logs centrally ensures that users can’t erase the evidence of actions that they have taken. Reviewing the logs can be useful when identifying issues, but digital signatures are not a typical part of a logging environment. Logging the use of administrative credentials helps for users with privileged access but won’t cover all users, and encrypting the logs doesn’t help with accountability. Authorization helps, but being able to specifically identify users through authentication is more important.

Question 188

Jasper Diamonds is a jewelry manufacturer that markets and sells custom jewelry through their website. Bethany is the manager of Jasper’s software development organization, and she is working to bring the company into line with industry standard practices. She is developing a new change management process for the organization and wants to follow commonly accepted approaches. During what phase of the change management process does the organization conduct peer review of the change for accuracy and completeness? A. Recording B. Analysis/Impact Assessment C. Approval D. Decision Making and Prioritization

Answer 188

B. Analysis/Impact Assessment Explanation During the Analysis/Impact Assessment phase, the organization subjects the change to peer review. In the peer review, technologists verify the accuracy and completeness of the change request and attempt to uncover any impact on other systems that might occur as result of the change.

Question 189

Jasper Diamonds is a jewelry manufacturer that markets and sells custom jewelry through their website. Bethany is the manager of Jasper’s software development organization, and she is working to bring the company into line with industry standard practices. She is developing a new change management process for the organization and wants to follow commonly accepted approaches. Who should the organization appoint to manage the policies and procedures surrounding change management? A. Project manager B. Change manager C. System security officer D. Architect

Answer 189

B. Change manager Explanation Organizations adopting change management practices should appoint a change manager who will be responsible for managing policies and procedures. The change manager is also responsible for developing and maintaining the processes for requesting, approving, testing, and controlling changes.

Question 190

Which one of the following is not a goal of a formal change management program? A. Implement change in an orderly fashion. B. Test changes prior to implementation. C. Provide rollback plans for changes. D. Inform stakeholders of changes after they occur.

Answer 190

D. Inform stakeholders of changes after they occur. Explanation Stakeholders should be informed of changes before, not after, they occur. The other items listed are goals of change management programs.

Question 191

What term is used to describe a set of common security configurations, often provided by a third party? A. Security policy B. Baseline C. DSS D. NIST SP 800‐53

Answer 191

B. Baseline Explanation A baseline is a set of security configurations that can be adopted and modified to fit an organization’s security needs. A security policy is written to describe an organization’s approach to security, while DSS is the second half of the Payment Card Industry Data Security Standard. The NIST SP‐800 series of documents address computer security in a variety of areas.

Question 192

Javier is verifying that only IT system administrators have the ability to log on to servers used for administrative purposes. What principle of information security is he enforcing? A. Need to know B. Least privilege C. Two‐person control D. Transitive trust

Answer 192

B. Least privilege Explanation The principle of least privilege says that an individual should only have the privileges necessary to complete their job functions. Removing administrative privileges from non administrative users is an example of least privilege.

Question 193

Which one of the following tools helps system administrators by providing a standard, secure template of configuration settings for operating systems and applications? A. Security guidelines B. Security policy C. Baseline configuration D. Running configuration

Answer 193

C. Baseline configuration configuration D. Running configuration Explanation Baseline configurations serve as the starting point for configuring secure systems and applications. They contain the security settings necessary to comply with an organization’s security policy and may then be customized to meet the specific needs of an implementation. While security policies and guidelines may contain information needed to secure a system, they do not contain a set of configuration settings that may be applied to a system. The running configuration of a system is the set of currently applied settings, which may or may not be secure.

Question 194

Tracy is preparing to apply a patch to her organization’s enterprise resource planning system. She is concerned that the patch may introduce flaws that did not exist in prior versions, so she plans to conduct a test that will compare previous responses to input with those produced by the newly patched application. What type of testing is Tracy planning? A. Unit testing B. Acceptance testing C. Regression testing D. Vulnerability testing

Answer 194

C. Regression testing Explanation Regression testing is software testing that runs a set of known inputs against an application and then compares the results to those produced by an earlier version of the software. It is designed to capture unanticipated consequences of deploying new code versions prior to introducing them into a production environment.

Question 195

The large business that Jack works for has been using noncentralized logging for years. They have recently started to implement centralized logging, however, and as they reviewed logs, they discovered a breach that appeared to have involved a malicious insider. How can Jack best ensure accountability for actions taken on systems in his environment? A. Review the logs and require digital signatures for each log. B. Require authentication for all actions taken and capture logs centrally. C. Log the use of administrative credentials and encrypt log data in transit. D. Require authorization and capture logs centrally.

Answer 195

B. Require authentication for all actions taken and capture logs centrally. Explanation Requiring authentication can help provide accountability by ensuring that any action taken can be tracked back to a specific user. Storing logs centrally ensures that users can’t erase the evidence of actions that they have taken. Reviewing the logs can be useful when identifying issues, but digital signatures are not a typical part of a logging environment. Logging the use of administrative credentials helps for users with privileged access but won’t cover all users, and encrypting the logs doesn’t help with accountability. Authorization helps, but being able to specifically identify users through authentication is more important.

Question 196

What is the best method for dealing with data remanence on SSDs? A. Physical destruction B. Degaussing C. Formatting D. Overwriting

Answer 196

The correct answer is A. Degaussing only works on magnetic media and formatting doesn’t permanently delete data, as it may still be recovered forensically. Overwriting is not effective on SSDs

Question 197

Whenever an organization chooses to perform risk mitigation to address a particular risk, what other form of risk management will also be included? A. Risk transference B. Risk avoidance C. Risk capture D. Risk acceptance

Answer 197

The correct answer is D. Risk mitigation always leaves some residual risk; the purpose of risk mitigation is to get risk down to an acceptable level.

Question 198

10. What is the main goal of a risk assessment program? A. To calculate annualized loss expectancy (ALE) formulas B. To develop a disaster recovery plan (DRP) C. To evaluate risk mitigation D. To help balance the cost between risk and countermeasures

Answer 198

The correct answer is D. A is a process to calculate risk. C is a testing process and B is a different business process.

Question 199

Raul is creating a trust relationship between his company and a vendor. He is implementing the system so that it will allow users from the vendor’s organization to access his accounts payable system using the accounts created for them by the vendor. What type of authentication is Raul implementing? A. Federated authentication B. Transitive trust C. Multifactor authentication D. Single sign‐on

Answer 199

A. Federated authentication Explanation This type of authentication, where one domain trusts users from another domain, is called federation. Federation may involve transitive trusts, where the trusts may be followed through a series of domains, but this scenario only describes the use of two domains. The scenario only describes use of credentials for a single system and does not describe a multiple‐system scenario where single sign‐on would be relevant. There is no requirement described for the use of multifactor authentication, which would require the use of two or more diverse authentication techniques.

Question 200

When you input a user ID and password, you are performing what important identity and access management activity? A. Authorization B. Validation C. Authentication D. Login

Answer 200

C. Authentication Explanation When you input a username and password, you are authenticating yourself by providing a unique identifier and a verification that you are the person who should have that identifier (the password). Authorization is the process of determining what a user is allowed to do. Validation and login both describe elements of what is happening in the process; however, they aren’t the most important identity and access management activity.

Question 201

Which of the following is a ticket‐based authentication protocol designed to provide secure communication? A. RADIUS B. OAuth C. SAML D. Kerberos

Answer 201

D. Kerberos Explanation Kerberos is an authentication protocol that uses tickets and provides secure communications between the client, key distribution center (KDC), ticket‐granting service (TGS), authentication server (AS), and endpoint services. RADIUS does not provide the same level of security by default, SAML is a markup language, and OAuth is designed to allow third‐party websites to rely on credentials from other sites like Google or Microsoft.

Question 202

What type of token‐based authentication system uses a challenge/response process in which the challenge must be entered on the token? A. Asynchronous B. Smart card C. Synchronous D. RFID

Answer 202

A. Asynchronous Explanation Asynchronous tokens use a challenge/response process in which the system sends a challenge and the user responds with a PIN and a calculated response to the challenge. The server performs the same calculations, and if both match, it authenticates the user. Synchronous tokens use a time‐based calculation to generate codes. Smart cards are paired with readers and don’t need to have challenges entered, and RFID devices are not used for challenge/response tokens.

Question 203

The U.S. government CAC is an example of what form of Type 2 authentication factor? A. A token B. A biometric identifier C. A smart card D. A PIV

Answer 203

C. A smart card Explanation The U.S. government’s Common Access Card is a smart card. The U.S. government also issues PIV cards, or personal identity verification cards.

Question 204

Which objects and subjects have a label in a MAC model? A. Objects and subjects that are classified as Confidential, Secret, or Top Secret have a label. B. All objects have a label, and all subjects have a compartment. C. All objects and subjects have a label. D. All subjects have a label and all objects have a compartment.

Answer 204

C. All objects and subjects have a label. Explanation In a mandatory access control system, all subjects and objects have a label. Compartments may or may not be used, but there is not a specific requirement for either subjects or objects to be compartmentalized. The specific labels of Confidential, Secret, and Top Secret are not required by MAC.

Question 205

Jack’s organization is a government agency that handles very sensitive information. They need to implement an access control system that allows administrators to set access rights but does not allow the delegation of those rights to other users. What is the best type of access control design for Jack’s organization? A. Discretionary access control B. Mandatory access control C. Decentralized access control D. Rule‐based access control

Answer 205

B. Mandatory access control Explanation Mandatory access control systems allow an administrator to configure access permissions but do not allow users to delegate permission to others. Discretionary access control systems do allow this delegation. The scenario does not provide information to indicate whether a decentralized or rule‐based approach is appropriate.

Question 206

Kathleen works for a data center hosting facility that provides physical data center space for individuals and organizations. Until recently, each client was given a magnetic‐strip‐based keycard to access the section of the facility where their servers are located, and they were also given a key to access the cage or rack where their servers reside. In the past month, several servers have been stolen, but the logs for the pass cards show only valid IDs. What is Kathleen’s best option to make sure that the users of the pass cards are who they are supposed to be? A. Add a reader that requires a PIN for passcard users. B. Add a camera system to the facility to observe who is accessing servers. C. Add a biometric factor. D. Replace the magnetic stripe keycards with smartcards.

Answer 206

C. Add a biometric factor. Explanation Kathleen should implement a biometric factor. The cards and keys are an example of a Type 2 factor, or “something you have.” Using a smart card replaces this with another Type 2 factor, but the cards could still be loaned out or stolen. Adding a PIN suffers from the same problem: A PIN can be stolen. Adding cameras doesn’t prevent access to the facility and thus doesn’t solve the immediate problem (but it is a good idea!).

Question 207

What term is used to describe the default set of privileges assigned to a user when a new account is created? A. Aggregation B. Transitivity C. Baseline D. Entitlement

Answer 207

D. Entitlement Explanation Entitlement refers to the privileges granted to users when an account is first provisioned. Aggregation is the accumulation of privileges over time. Transitivity is the inheritance of privileges and trust through relationships. Baselines are snapshots of a system or application’s security that allow analysts to detect future modifications.

Question 208

When a user attempts to log into their online account, Google sends a text message with a code to their cell phone. What type of verification is this? A. Knowledge‐based authentication B. Dynamic knowledge‐based authentication C. Out‐of‐band identity proofing D. Risk‐based identity proofing

Answer 208

C. Out‐of‐band identity proofing Explanation Identity proofing that relies on a type of verification outside the initial environment that required the verification is out‐of‐band identity proofing. This type of verification relies on the owner of the phone or phone number having control of it but removes the ability for attackers to use only Internet‐based resources to compromise an account. Knowledge‐based authentication relies on answers to preselected information, whereas dynamic knowledge–based authentication builds questions using facts or data about the user. Risk‐based identity proofing uses risk‐based metrics to determine whether identities should be permitted or denied access. It is used to limit fraud in financial transactions, such as credit card purchases. This is a valid form of proofing but does not necessarily use an out‐of‐band channel, such as SMS.

Question 209

In a zero‐trust network architecture, what criterion is used to make trust decisions? A. Identity of a user or device B. IP address C. Network segment D. VLAN membership

Answer 209

A. Identity of a user or device

Question 210

MAC models use three types of environments. Which of the following is not a mandatory access control design? A. Hierarchical B. Bracketed C. Compartmentalized D. Hybrid

Answer 210

B. Bracketed Explanation Mandatory access control systems can be hierarchical, where each domain is ordered and related to other domains above and below it; compartmentalized, where there is no relationship between each domain; or hybrid, where both hierarchy and compartments are used. There is no concept of bracketing in mandatory access control design.

Question 211

Which of the following is best described as an access control model that focuses on subjects and identifies the objects that each subject can access? A. An access control list B. An implicit denial list C. A capability table D. A rights management matrix

Answer 211

C. A capability table Explanation Capability tables list the privileges assigned to subjects and identify the objects that subjects can access. Access control lists are object‐focused rather than subject‐focused. Implicit deny is a principle that states that anything that is not explicitly allowed is denied, and a rights management matrix is not an access control model.

Question 212

Susan wants to integrate her website to allow users to use accounts from sites like Google. What technology should she adopt? A. Kerberos B. LDAP C. OpenID

Answer 212

C. OpenID Explanation OpenID is a widely supported standard that allows a user to use a single account to log into multiple sites, and Google accounts are frequently used with OpenID.

Question 213

Ben uses a software‐based token that changes its code every minute. What type of token is he using? A. Asynchronous B. Smart card C. Synchronous D. Static

Answer 213

C. Synchronous Explanation Synchronous soft tokens, such as Google Authenticator, use a time‐based algorithm that generates a constantly changing series of codes. Asynchronous tokens typically require a challenge to be entered on the token to allow it to calculate a response, which the server compares to the response it expects. Smartcards typically present a certificate but may have other token capabilities built in. Static tokens are physical devices that can contain credentials and include smart cards and memory cards.

Question 214

Which of the following multifactor authentication technologies provides both low management overhead and flexibility? A. Biometrics B. Software tokens C. Synchronous hardware tokens D. Asynchronous hardware tokens

Answer 214

B. Software tokens Explanation Software tokens are flexible, with delivery options including mobile applications, SMS, and phone delivery. They have a relatively low administrative overhead, as users can typically self‐manage. Biometrics require significant effort to register users and to deploy and maintain infrastructure, and they require hardware at each authentication location. Both types of hardware tokens can require additional overhead for distribution and maintenance, and token failure can cause support challenges.

Question 215

Jim wants to allow a partner organization’s Active Directory forest (B) to access his domain forest’s (A)’s resources but doesn’t want to allow users in his domain to access B’s resources. He also does not want the trust to flow upward through the domain tree as it is formed. What should he do? A. Set up a two‐way transitive trust. B. Set up a one‐way transitive trust. C. Set up a one‐way nontransitive trust. D. Set up a two‐way nontransitive trust.

Answer 215

B. Set up a one‐way transitive trust. Explanation A trust that allows one forest to access another’s resources without the reverse being possible is an example of a one‐way trust. Since Jim doesn’t want the trust path to flow as the domain tree is formed, this trust has to be nontransitive.

Question 216

Lauren’s team of system administrators each deal with hundreds of systems with varying levels of security requirements and find it difficult to handle the multitude of usernames and passwords they each have. What type of solution should she recommend to ensure that passwords are properly handled and that features such as logging and password rotation occur? A. A credential management system B. A strong password policy C. Separation of duties D. Single sign‐on

Answer 216

A. A credential management system Explanation Lauren’s team would benefit from a credential management system. Credential management systems offer features such as password management, multifactor authentication to retrieve passwords, logging, audit, and password rotation capabilities. A strong password policy would only make maintenance of passwords for many systems a more difficult task if done manually. Single sign‐on would help if all of the systems had the same sensitivity levels, but different credentials are normally required for higher‐sensitivity systems.

Question 217

What type of trust relationship extends beyond the two domains participating in the trust to one or more of their subdomains? A. Transitive trust B. Inheritable trust C. Nontransitive trust D. Noninheritable trust

Answer 217

A. Transitive trust Explanation Transitive trusts go beyond the two domains directly involved in the trust relationship and extend to their subdomains. Nontransitive trusts are not inheritable to other domains. The terms inheritable trust and noninheritable trust are not normally used.

Question 218

Adam is accessing a standalone file server using a username and password provided to him by the server administrator. Which one of the following entities is guaranteed to have information necessary to complete the authorization process? A. Adam B. File server C. Server administrator D. Adam’s supervisor

Answer 218

B. File server Explanation We know that both Adam and the server administrator have the username and password, but this is information used for identification and authentication, not authorization. We do not know what information Adam’s supervisor might have. The server is a standalone file server, so it must have information about the activities that Adam is authorized to perform.

Question 219

Susan has been asked to recommend whether her organization should use a MAC scheme or a DAC scheme. If flexibility and scalability are important requirements for implementing access controls, which scheme should she recommend and why? A. MAC, because it provides greater scalability and flexibility because you can simply add more labels as needed B. DAC, because allowing individual administrators to make choices about the objects they control provides scalability and flexibility C. MAC, because compartmentalization is well suited to flexibility and adding compartments will allow it to scale well D. DAC, because a central decision process allows quick responses and will provide scalability by reducing the number of decisions required and flexibility by moving those decisions to a central authority

Answer 219

B. DAC, because allowing individual administrators to make choices about the objects they control provides scalability and flexibility Explanation Discretionary access control (DAC) can provide greater scalability by leveraging many administrators, and those administrators can add flexibility by making decisions about access to their objects without fitting into an inflexible mandatory access control (MAC) system. MAC is more secure because of the strong set of controls it provides, but it does not scale as well as DAC and is relatively inflexible in comparison.

Question 220

Which of the following tools is not typically used to verify that a provisioning process was followed in a way that ensures that the organization’s security policy is being followed? A. Log review B. Manual review of permissions C. Signature‐based detection D. Review the audit trail

Answer 220

C. Signature‐based detection Explanation While signature‐based detection is used to detect attacks, review of provisioning processes typically involves checking logs, reviewing the audit trail, or performing a manual review of permissions granted during the provisioning process.

Question 221

Joe is the security administrator for an ERP system. He is preparing to create accounts for several new employees. What default access should he give to all of the new employees as he creates the accounts? A. Read only B. Editor C. Administrator D. No access

Answer 221

D. No access Explanation The principle of least privilege should guide Joe in this case. He should apply no access permissions by default and then give each user the necessary permissions to perform their job responsibilities. Read‐only, editor, and administrator permissions may be necessary for one or more of these users, but those permissions should be assigned based upon business need and not by default.

Question 222

A new customer at a bank that uses fingerprint scanners to authenticate its users is surprised when he scans his fingerprint and is logged in to another customer’s account. What type of biometric factor error occurred? A. A registration error B. A Type 1 error C. A Type 2 error D. A time‐of‐use, method‐of‐use error

Answer 222

C. A Type 2 error Explanation Type 2 errors occur in biometric systems when an invalid subject is incorrectly authenticated as a valid user. In this case, nobody except the actual customer should be validated when fingerprints are scanned. Type 2 errors are also known as false positive errors. Type 1 (or false negative) errors occur when a valid subject is not authenticated; if the existing customer was rejected, it would be a Type 1 error. Registration is the process of adding users, but registration errors and time‐of‐use, method‐of‐use errors are not specific biometric authentication terms.

Question 223

Kelly is adjusting her organization’s password requirements to make them consistent with best practice guidance from NIST. What should she choose as the most appropriate time period for password expiration? A. 30 days B. 90 days C. 180 days D. No expiration

Answer 223

D. No expiration Explanation Current best practice guidance from NIST, published in NIST Special Publication 800‐63b, suggests that organizations should not impose password expiration requirements on end users.

Question 224

Ben is working on integrating a federated identity management system and needs to exchange authentication and authorization information for browser‐based single sign‐on. What technology is his best option? A. HTML B. XACML C. SAML D. SPML

Answer 224

C. SAML Explanation Security Assertion Markup Language (SAML) is the best choice for providing authentication and authorization information, particularly for browser‐based SSO. HTML is primarily used for web pages, SPML is used to exchange user information for SSO, and XACML is used for access control policy markup.

Question 225

Mandatory access control is based on what type of model? A. Discretionary B. Group‐based C. Lattice‐based D. Rule‐based

Answer 225

C. Lattice‐based Explanation Mandatory access control systems are based on a lattice‐based model. Lattice‐based models use a matrix of classification labels to compartmentalize data. Discretionary access models allow object owners to determine access to the objects they control, role‐based access controls are often group‐based, and rule‐based access controls like firewall ACLs apply rules to all subjects they apply to.

Question 226

Raul is creating a trust relationship between his company and a vendor. He is implementing the system so that it will allow users from the vendor’s organization to access his accounts payable system using the accounts created for them by the vendor. What type of authentication is Raul implementing? A. Federated authentication B. Transitive trust C. Multifactor authentication D. Single sign‐on

Answer 226

A. Federated authentication Explanation This type of authentication, where one domain trusts users from another domain, is called federation. Federation may involve transitive trusts, where the trusts may be followed through a series of domains, but this scenario only describes the use of two domains. The scenario only describes use of credentials for a single system and does not describe a multiple‐system scenario where single sign‐on would be relevant. There is no requirement described for the use of multifactor authentication, which would require the use of two or more diverse authentication techniques.

Question 227

Which one of the following is not an example of a technical control? A. Session timeout B. Password aging C. Encryption D. Data classification

Answer 227

D. Data classification Explanation Session timeouts, password aging, and encryption are all examples of technical controls. Data classification is an administrative control.

Question 228

What's the formula for ARO?

Answer 228

Annual Rate of Ocurrence = how many times the event is expected to happen in a year / total of the given years ie. ARO = 1 (the event happens once a year) / 200 (the event happens once every 200 years) = 0.005 it means the expectancy is very low

Question 229

What's the formula for EF?

Answer 229

Exposure Factor = amount of damage / total of the asset value ie. EF=$5.000.000/$10.000.000 = 50%

Question 230

What's the formula for ALE?

Answer 230

Annual Loss Expectancy = single loss expectancy x ARO ie. ALE = $5.000.000 x 0.005 = $25.000 per year in a total of 200 years

Question 231

What are the UTP wire categories:

Answer 231

CAT 1 - Voice only, no data CAT 2 - 4 Mbps CAT 3 - 10 Mbps CAT 4 - 16 Mbps CAT 5 - 100 Mbps CAT 5e - 1 Gbps CAT 6 - 1 Gbps over 100m - 10 Gbps over 5 m (used in data centers, networks & racks) CAT 6a - 10 Gbps Cat 7 - 10 Gbps CAT 7a - 25 to 40 Gbps CAT 8 - 25 to 40 Gbps over 30 to 26m (used in data centers and short runs)

Question 232

Access Control Type 1, 2 & 3

Answer 232

Type 1: Something you know (e.g., passwords or PINs). Type 2 Access Control refers to an access control system that involves the use of something you have as a means of authentication. This generally includes physical objects or tokens that grant access to a resource, such as: Smart cards Key fobs ID badges Physical keys Type 3: Something you are (e.g., biometric data like fingerprints or iris scans).