Group 12 Flashcards
What is the PRIMARY reason that a bit-level copy is more desirable than a file-level copy when replicating a hard drive’s contents for an e-discovery investigation?
A. Files that have been deleted will be transferred.
B. The file and directory structure is retained.
C. File-level security settings will be preserved.
D. The corruption of files is less likely.
Answer: A
While reviewing the financial reporting risks of a third-party application, which of the following Service Organization Control (SOC) reports will be the MOST useful?
A. ISIsOC 1
B. SOC 2
C. SOC 3
D. SOC for cybersecurity
Answer: A
A large manufacturing organization arranges to buy an industrial machine system to produce a new line of products. The system includes software provided to the vendor by a thirdparty organization. The financial risk to the manufacturing organization starting production is high. What step should the manufacturing organization take to minimize its financial risk in
the new venture prior to the purchase?
A. Hire a performance tester to execute offline tests on a system.
B. Calculate the possible loss in revenue to the organization due to software bugs and vulnerabilities, and compare that to the system’s overall price.
C. Place the machine behind a Layer 3 firewall.
D. Require that the software be thoroughly tested by an accredited independent software testing company.
Answer: B
Which of the following types of hosts should be operating in the demilitarized zone (DMZ)?
A. Hosts intended to provide limited access to public resources
B. Database servers that can provide useful information to the public
C. Hosts that store unimportant data such as demographical information
D. File servers containing organizational data
Answer: A
In systems security engineering, what does the security principle of modularity provide?
A. Documentation of functions
B. Isolated functions and data
C. Secure distribution of programs and data
D. Minimal access to perform a function
Answer: A
Which of the following is MOST appropriate to collect evidence of a zero-day attack?
A. Firewall
B. Honeypot
C. Antispam
D. Antivirus
Answer: A
Which of the following is required to verify the authenticity of a digitally signed document?
A. Digital hash of the signed document
B. Sender’s private key
C. Recipient’s public key
D. Agreed upon shared secret
Answer: A
Which of the following is the BEST method to gather evidence from a computer’s hard drive?
A. Disk duplication
B. Disk replacement
C. Forensic signature
D. Forensic imaging
Answer: D
Who should perform the design review to uncover security design flaws as part of the Software Development Life Cycle (SDLC)?
A. The business owner
B. security subject matter expert (SME)
C. The application owner
D. A developer subject matter expert (SME)
Answer: B
During a penetration test, what are the three PRIMARY objectives of the planning phase?
A. Determine testing goals, identify rules of engagement, and conduct an initial discovery scan.
B. Finalize management approval, determine testing goals, and gather port and service information.
C. Identify rules of engagement, finalize management approval, and determine testing goals.
D. Identify rules of engagement, document management approval, and collect system and application information.
Answer: D
What term is commonly used to describe hardware and software assets that are stored in a configuration management database (CMDB)?
A. Configuration element
B. Asset register
C. Ledger item
D. Configuration item
Answer: D
Which of the following Disaster recovery (DR) testing processes is LEAST likely to disrupt normal business operations?’
A. Parallel
B. Simulation
C. Table-top
D. Cut-over
Answer: C
The Open Web Application Security Project’s (OWASP) Software Assurance Maturity Model (SAMM) allows organizations to implement a flexible software security strategy to
measure organizational impact based on what risk management aspect?
A. Risk tolerance
B. Risk exception
C. Risk treatment
D. Risk response
Answer: D
The security architect is designing and implementing an internal certification authority to generate digital certificates for all employees. Which of the following is the BEST solution to securely store the private keys?
A. Physically secured storage device
B. Encrypted flash drive
C. Public key infrastructure (PKI)
D. Trusted Platform Module (TPM)
Answer: C
Which of the following is a common risk with fiber optical communications, and what is the associated mitigation measure?
A. Data emanation, deploying Category (CAT) 6 and higher cable wherever feasible
B. Light leakage, deploying shielded cable wherever feasible
C. Cable damage, deploying ring architecture wherever feasible
D. Electronic eavesdropping, deploying end-to-end encryption wherever feasible
Answer: B
During an internal audit of an organizational Information Security Management System (ISMS), nonconformities are identified. In which of the following management stages are nonconformities reviewed, assessed and/or corrected by the organization?
A. Planning
B. Operation
C. Assessment
D. Improvement
Answer: B
What is the BEST reason to include supply chain risks in a corporate risk register?
A. Risk registers help fund corporate supply chain risk management (SCRM) systems.
B. Risk registers classify and categorize risk and allow risks to be compared to corporate risk appetite.
C. Risk registers can be used to illustrate residual risk across the company.
D. Risk registers allow for the transfer of risk to third parties.
Answer: B
An employee’s home address should be categorized according to which of the following references?
A. The consent form terms and conditions signed by employees
B. The organization’s data classification model
C. Existing employee data classifications
D. An organization security plan for human resources
Answer: B
Why is authentication by ownership stronger than authentication by knowledge?
A. It is easier to change.
B. It can be kept on the user’s person.
C. It is more difficult to duplicate.
D. It is simpler to control.
Answer: B
A network security engineer needs to ensure that a security solution analyzes traffic for protocol manipulation and various sorts of common attacks. In addition, all Uniform Resource Locator (URL) traffic must be inspected and users prevented from browsing inappropriate websites. Which of the following solutions should be implemented to enable administrators the capability to analyze traffic, blacklist external sites, and log user traffic for later analysis?
A. Intrusion detection system (IDS)
B. Circuit-Level Proxy
C. Application-Level Proxy
D. Host-based Firewall
Answer: B
Which of the following is the BEST way to protect an organization’s data assets?
A. Monitor and enforce adherence to security policies.
B. Encrypt data in transit and at rest using up-to-date cryptographic algorithms.
C. Create the Demilitarized Zone (DMZ) with proxies, firewalls and hardened bastion hosts.
D. Require Multi-Factor Authentication (MFA) and Separation of Duties (SoD).
Answer: B
Which of the following would qualify as an exception to the “right to be forgotten” of the General Data Protection Regulation’s (GDPR)?
A. For the establishment, exercise, or defense of legal claims
B. The personal data has been lawfully processed and collected
C. The personal data remains necessary to the purpose for which it was collected
D. For the reasons of private interest
Answer: C
Which of the following is the name of an individual or group that is impacted by a change?
A. Change agent
B. Stakeholder
C. Sponsor
D. End User
Answer: B
What is the MINIMUM standard for testing a disaster recovery plan (DRP)?
A. Semi-annually and in alignment with a fiscal half-year business cycle
B. Annually or less frequently depending upon audit department requirements
C. Quarterly or more frequently depending upon the advice of the information security manager
D. As often as necessary depending upon the stability of the environment and business requirements
Answer: D
What is the MOST significant benefit of role-based access control (RBAC)?
A. Reduction in authorization administration overhead
B. Reduces inappropriate access
C. Management of least privilege
D. Most granular form of access control
Answer: A
A software development company found odd behavior in some recently developed software, creating a need for a more thorough code review. What is the MOST effective argument for a more thorough code review?
A. It will increase flexibility of the applications developed.
B. It will increase accountability with the customers.
C. It will impede the development process.
D. lt will reduce the potential for vulnerabilities.
Answer: D
A new site’s gateway isn’t able to form a tunnel to the existing site-to-site Internet Protocol Security (IPsec) virtual private network (VPN) device at headquarters. Devices at the new site have no problem accessing resources on the Internet. When testing connectivity between the remote site’s gateway, it was observed that the external Internet Protocol (IP) address of the gateway was set to 192.168.1.1. and was configured to send outbound traffic to the Internet Service Provider (ISP) gateway at4 192.168.1.2. Which of the following would be the BEST way to resolve the issue and get the remote site connected?
A. Enable IPSec tunnel mode on the VPN devices at the new site and the corporate headquarters.
B. Enable Layer 2 Tunneling Protocol (L2TP) on the VPN devices at the new site and the corporate headquarters.
C. Enable Point-to-Point Tunneling Protocol (PPTP) on the VPN devices at the new site and the corporate headquarters.
D. Enable Network Address Translation (NAT) - Traversal on the VPN devices at the new site and the corporate headquarters.
Answer: A
Which of the following examples is BEST to minimize the attack surface for a customer’s private information?
A. Obfuscation
B. Collection limitation
C. Authentication
D. Data masking
Answer: A
What are the essential elements of a Risk Assessment Report (RAR)?
A. Table of contents, testing criteria, and index
B. Table of contents, chapters, and executive summary
C. Executive summary, graph of risks, and process
D. Executive summary, body of the report, and appendices
Answer: D
What is the PRIMARY benefit of incident reporting and computer crime investigations?
A. Providing evidence to law enforcement
B. Repairing the damage and preventing future occurrences
C. Appointing a computer emergency response team
D. Complying with security policy
Answer: D
Which of the following determines how traffic should flow based on the status of the infrastructure layer?
A. Traffic plane
B. Application plane
C. Data plane
D. Control plane
Answer: A
In a multi-tenant cloud environment, what approach will secure logical access to assets?
A. Hybrid cloud
B. Transparency/Auditability of administrative access
C. Controlled configuration management (CM)
D. Virtual private cloud (VPC)
Answer: D
A company hired an external vendor to perform a penetration test ofa new payroll system. The company’s internal test team had already performed an in-depth application
and security test of the system and determined that it met security requirements. However, the external vendor uncovered significant security weaknesses where sensitive
personal data was being sent unencrypted to the tax processing systems. What is the MOST likely cause of the security issues?
A. Failure to perform interface testing
B. Failure to perform negative testing
C. Inadequate performance testing
D. Inadequate application level testing
Answer: A
Which of the following is the MOST effective method of detecting vulnerabilities in web-based applications early in the secure Software Development Life Cycle (SDLC)?
A. Web application vulnerability scanning
B. Application fuzzing
C. Code review
D. Penetration testing
Answer: C
A malicious user gains access to unprotected directories on a web server. Which of the following is MOST likely the cause for this information disclosure?
A. Security misconfiguration
B. Cross-site request forgery (CSRF)
C. Structured Query Language injection (SQLi)
D. Broken authentication management
Answer: A
Which of the following security objectives for industrial control systems (ICS) can be adapted to securing any Internet of Things (IoT) system?
A. Prevent unauthorized modification of data.
B. Restore the system after an incident.
C. Detect security events and incidents.
D. Protect individual components from exploitation
Answer: D
Wi-Fi Protected Access 2 (WPA2) provides users with a higher level of assurance that their data will remain protected by using which protocol?
A. Secure Shell (SSH)
B. Internet Protocol Security (IPsec)
C. Secure Sockets Layer (SSL)
D. Extensible Authentication Protocol (EAP)
Answer: A
A software development company has a short timeline in which to deliver a software product. The software development team decides to use open-source software libraries to reduce the development time. What concept should software developers consider when using open-source software libraries?
A. Open source libraries contain known vulnerabilities, and adversaries regularly exploit those vulnerabilities in the wild.
B. Open source libraries can be used by everyone, and there is a common understanding that the vulnerabilities in these libraries will not be exploited.
C. Open source libraries are constantly updated, making it unlikely that a vulnerability exists for an adversary to exploit.
D. Open source libraries contain unknown vulnerabilities, so they should not be used.
Answer: A
According to the (ISC)? ethics canon “act honorably, honestly, justly, responsibly, and legally,” which order should be used when resolving conflicts?
A. Public safety and duties to principals, individuals, and the profession
B. Individuals, the profession, and public safety and duties to principals
C. Individuals, public safety and duties to principals, and the profession
D. The profession, public safety and duties to principals, and individuals
Answer: A
When conducting a remote access session using Internet Protocol Security (IPSec), which Open Systems Interconnection (OSI) model layer does this connection use?
A. Transport
B. Network
C. Data link
D. Presentation
Answer: B
