Group 6 Flashcards
In the Software Development Life Cycle (SDLC), maintaining accurate hardware and software inventories is a critical part of
A. systems integration.
B. risk management.
C. quality assurance.
D. change management.
Answer: D
As a best practice, the Security Assessment Report (SAR) should include which of the following sections?
A. Data classification policy
B. Software and hardware inventory
C. Remediation recommendations
D. Names of participants
Answer: B
The application of a security patch to a product previously validate at Common Criteria (CC) Evaluation Assurance Level (EAL) 4 would
A. require an update of the Protection Profile (PP).
B. require recertification.
C. retain its current EAL rating.
D. reduce the product to EAL 3.
Answer: B
Which of the following media sanitization techniques is MOST likely to be effective for an organization using public cloud services?
A. Low-level formatting
B. Secure-grade overwrite erasure
C. Cryptographic erasure
D. Drive degaussing
Answer: B
What type of wireless network attack BEST describes an Electromagnetic Pulse (EMP) attack?
A. Radio Frequency (RF) attack
B. Denial of Service (DoS) attack
C. Data modification attack
D. Application-layer attack
Answer: B
Which of the following is a remote access protocol that uses a static authentication?
A. Point-to-Point Tunneling Protocol (PPTP)
B. Routing Information Protocol (RIP)
C. Password Authentication Protocol (PAP)
D. Challenge Handshake Authentication Protocol (CHAP)
Answer: C
Which of the following sets of controls should allow an investigation if an attack is not blocked by preventive controls or detected by monitoring?
A. Logging and audit trail controls to enable forensic analysis
B. Security incident response lessons learned procedures
C. Security event alert triage done by analysts using a Security Information and Event Management (SIEM) system
D. Transactional controls focused on fraud prevention
Answer: C
Determining outage costs caused by a disaster can BEST be measured by the
A. cost of redundant systems and backups.
B. cost to recover from an outage.
C. overall long-term impact of the outage.
D. revenue lost during the outage.
Answer: C
Which of the following is considered a secure coding practice?
A. Use concurrent access for shared variables and resources
B. Use checksums to verify the integrity of libraries
C. Use new code for common tasks
D. Use dynamic execution functions to pass user supplied data
Answer: B
As part of the security assessment plan, the security professional has been asked to use a negative testing strategy on a new website. Which of the following actions would be performed?
A. Use a web scanner to scan for vulnerabilities within the website.
B. Perform a code review to ensure that the database references are properly addressed.
C. Establish a secure connection to the web server to validate that only the approved ports are open.
D. Enter only numbers in the web form and verify that the website prompts the user to enter a valid input.
Answer: D
Who has the PRIMARY responsibility to ensure that security objectives are aligned with organization goals?
A. Senior management
B. Information security department
C. Audit committee
D. All users
Answer: C
Which of the following alarm systems is recommended to detect intrusions through windows in a high-noise, occupied environment?
A. Acoustic sensor
B. Motion sensor
C. Shock sensor
D. Photoelectric sensor
Answer: C
Which of the following is the MOST effective practice in managing user accounts when an employee is terminated?
A. Implement processes for automated removal of access for terminated employees.
B. Delete employee network and system IDs upon termination.
C. Manually remove terminated employee user-access to all systems and applications.
D. Disable terminated employee network ID to remove all access.
Answer: B
Which of the following is the MOST important part of an awareness and training plan to prepare employees for emergency situations?
A. Having emergency contacts established for the general employee population to get information
B. Conducting business continuity and disaster recovery training for those who have a direct role in the recovery
C. Designing business continuity and disaster recovery training programs for different audiences
D. Publishing a corporate business continuity and disaster recovery plan on the corporate website
Answer: C
What is the process of removing sensitive data from a system or storage device with the intent that the data cannot be reconstructed by any known technique?
A. Purging
B. Encryption
C. Destruction
D. Clearing
Answer: A
The security accreditation task of the System Development Life Cycle (SDLC) process is completed at the end of which phase?
A. System acquisition and development
B. System operations and maintenance
C. System initiation
D. System implementation
Answer: B
Drag the following Security Engineering terms on the left to the BEST definition on the right.
Risk - A measure of the extent to which an entity is threatened by a potential circumstance of event, the adverse impacts that would arise if the circumstance or event occurs, and the likelihood of occurrence.
Protection Needs Assessment - The method used to identify the confidentiality, integrity, and availability requirements for organizational and system assets and to characterize the adverse impact or consequences should be asset be lost, modified, degraded, disrupted, compromised, or become unavailable.
Threat assessment - The method used to identify and characterize the dangers anticipated throughout the life cycle of the system.
Security Risk Treatment - The method used to identify feasible security risk mitigation options and plans.
Which of the following is the BEST reason for the use of security metrics?
A. They ensure that the organization meets its security objectives.
B. They provide an appropriate framework for Information Technology (IT) governance.
C. They speed up the process of quantitative risk assessment.
D. They quantify the effectiveness of security processes.
Answer: B
Which of the following is a benefit in implementing an enterprise Identity and Access Management (IAM) solution?
A. Password requirements are simplified.
B. Risk associated with orphan accounts is reduced.
C. Segregation of duties is automatically enforced.
D. Data confidentiality is increased.
Answer: A
A control to protect from a Denial-of-Service (DoS) attach has been determined to stop 50% of attacks, and additionally reduces the impact of an attack by 50%. What is the residual risk?
A. 25%
B. 50%
C. 75%
D. 100%
Answer: B
Which of the following entails identification of data and links to business processes, applications, and data
stores as well as assignment of ownership responsibilities?
A. Security governance
B. Risk management
C. Security portfolio management
D. Risk assessment
Answer: B
Which of the following mandates the amount and complexity of security controls applied to a security risk?
A. Security vulnerabilities
B. Risk tolerance
C. Risk mitigation
D. Security staff
Answer: C
When determining who can accept the risk associated with a vulnerability, which of the following is MOST
important?
A. Countermeasure effectiveness
B. Type of potential loss
C. Incident likelihood
D. Information ownership
Answer: C
A security professional determines that a number of outsourcing contracts inherited from a previous merger do not adhere to the current security requirements. Which of the following BEST minimizes the risk of this
happening again?
A. Define additional security controls directly after the merger
B. Include a procurement officer in the merger team
C. Verify all contracts before a merger occurs
D. Assign a compliancy officer to review the merger conditions
Answer: D
Which of the following is a direct monetary cost of a security incident?
A. Morale
B. Reputation
C. Equipment
D. Information
Answer: C
Which of the following would MINIMIZE the ability of an attacker to exploit a buffer overflow?
A. Memory review
B. Code review
C. Message division
D. Buffer division
Answer: B
Which of the following mechanisms will BEST prevent a Cross-Site Request Forgery (CSRF) attack?
A. parameterized database queries
B. whitelist input values
C. synchronized session tokens
D. use strong ciphers
Answer: C
Which factors MUST be considered when classifying information and supporting assets for risk management, legal discovery, and compliance?
A. System owner roles and responsibilities, data handling standards, storage and secure development lifecycle requirements
B. Data stewardship roles, data handling and storage standards, data lifecycle requirements
C. Compliance office roles and responsibilities, classified material handling standards, storage system lifecycle requirements
D. System authorization roles and responsibilities, cloud computing standards, lifecycle requirements
Answer: B
When network management is outsourced to third parties, which of the following is the MOST effective method of protecting critical data assets?
A. Log all activities associated with sensitive systems
B. Provide links to security policies
C. Confirm that confidentially agreements are signed
D. Employ strong access controls
Answer: D
Which of the following is the MOST appropriate action when reusing media that contains sensitive data?
A. Erase
B. Sanitize
C. Encrypt
D. Degauss
Answer: B
An organization recently conducted a review of the security of its network applications. One of the vulnerabilities found was that the session key used in encrypting sensitive information to a third party server had been hard-coded in the client and server applications. Which of the following would be MOST effective in mitigating this vulnerability?
A. Diffle-Hellman (DH) algorithm
B. Elliptic Curve Cryptography (ECC) algorithm
C. Digital Signature algorithm (DSA)
D. Rivest-Shamir-Adleman (RSA) algorithm
Answer: D
Which of the following methods of suppressing a fire is environmentally friendly and the MOST appropriate for a data center?
A. Inert gas fire suppression system
B. Halon gas fire suppression system
C. Dry-pipe sprinklers
D. Wet-pipe sprinklers
Answer: A
Unused space in a disk cluster is important in media analysis because it may contain which of the following?
A. Residual data that has not been overwritten
B. Hidden viruses and Trojan horses
C. Information about the File Allocation table (FAT)
D. Information about patches and upgrades to the system
Answer: A
A company seizes a mobile device suspected of being used in committing fraud. What would be the BEST method used by a forensic examiner to isolate the powered-on device from the network and preserve the evidence?
A. Put the device in airplane mode
B. Suspend the account with the telecommunication provider
C. Remove the SIM card
D. Turn the device off
Answer: A
Which of the following is MOST appropriate for protecting confidentially of data stored on a hard drive?
A. Triple Data Encryption Standard (3DES)
B. Advanced Encryption Standard (AES)
C. Message Digest 5 (MD5)
D. Secure Hash Algorithm 2(SHA-2)
Answer: B
Which of the following is the MOST effective method to mitigate Cross-Site Scripting (XSS) attacks?
A. Use Software as a Service (SaaS)
B. Whitelist input validation
C. Require client certificates
D. Validate data output
Answer: B
What is the MOST significant benefit of an application upgrade that replaces randomly generated session keys with certificate based encryption for communications with backend servers?
A. Non-repudiation
B. Efficiency
C. Confidentially
D. Privacy
Answer: A
A user has infected a computer with malware by connecting a Universal Serial Bus (USB) storage device.
Which of the following is MOST effective to mitigate future infections?
A. Develop a written organizational policy prohibiting unauthorized USB devices
B. Train users on the dangers of transferring data in USB devices
C. Implement centralized technical control of USB port connections
D. Encrypt removable USB devices containing data at rest
Answer: C
Which of the following MUST be in place to recognize a system attack?
A. Stateful firewall
B. Distributed antivirus
C. Log analysis
D. Passive honeypot
Answer: C
