Quix17 - 125Q

Question 1 of 125

1

Jesse is looking at the /etc/passwd file on a system configured to use
shadowed passwords. What should she expect to see in the password
field of this file?

Select one of the following:

A. Plaintext passwords
B. Encrypted passwords
C. Hashed passwords
D. x

Explanation

Question 2 of 125

1

SYN floods rely on implementations of what protocol to cause denial
of service conditions?

Select one of the following:

A. IGMP
B. UDP
C. TCP
D. ICMP

Explanation

Question 3 of 125

1

What principle states that an individual should make every effort to
complete his or her responsibilities in an accurate and timely manner?

Select one of the following:

A. Least privilege
B. Separation of duties
C. Due care
D. Due diligence

Explanation

Question 4 of 125

1

Cable modems, ISDN, and DSL are all examples of what type of
technology?

Select one of the following:

A. Baseband
B. Broadband
C. Digital
D. Broadcast

Explanation

Question 5 of 125

1

What penetration testing technique can best help assess training and
awareness issues?

Select one of the following:

A. Port scanning
B. Discovery
C. Social engineering
D. Vulnerability scanning

Explanation

Question 6 of 125

1

Bill implemented RAID level 5 on a server that he operates using a
total of three disks. How many disks may fail without the loss of data?

Select one of the following:

A. 0
B. 1
C. 2
D. 3

Explanation

Question 7 of 125

1

Data is sent as bits at what layer of the OSI model?

Select one of the following:

A. Transport
B. Network
C. Data Link
D. Physical

Explanation

Question 8 of 125

1

Bert is considering the use of an infrastructure as a service cloud
computing partner to provide virtual servers. Which one of the
following would be a vendor responsibility in this scenario?

Select one of the following:

A. Maintaining the hypervisor
B. Managing operating system security settings
C. Maintaining the host firewall
D. Configuring server access control

Explanation

Question 9 of 125

1

When Ben records data and then replays it against his test website to
verify how it performs based on a real production workload, what type
of performance monitoring is he undertaking?

Select one of the following:

A. Passive
B. Proactive
C. Reactive
D. Replay

Explanation

Question 10 of 125

1

What technology ensures that an operating system allocates separate
memory spaces used by each application on a system?

Select one of the following:

A. Abstraction
B. Layering
C. Data hiding
D. Process isolation

Explanation

Question 11 of 125

1

Alan is considering the use of new identification cards in his
organization that will be used for physical access control. He comes
across a sample card and is unsure of the technology. He breaks it
open and sees the following internal construction. What type of card is
this?

Select one of the following:

A. Smart card
B. Proximity card
C. Magnetic stripe
D. Phase-two card

Explanation

Question 12 of 125

1

Mark is planning a disaster recovery test for his organization. He
would like to perform a live test of the disaster recovery facility but
does not want to disrupt operations at the primary facility. What type
of test should Mark choose?

Select one of the following:

A. Full interruption test
B. Checklist review
C. Parallel test
D. Tabletop exercise

Explanation

Question 13 of 125

1

Which one of the following is not a principle of the Agile approach to
software development?

Select one of the following:

A. The best architecture, requirements, and designs emerge from self-organizing teams.
B. Deliver working software infrequently, with an emphasis on creating accurate code over longer timelines.
C. Welcome changing requirements, even late in the development process.
D. Simplicity is essential.

Explanation

Question 14 of 125

1

During a security audit, Susan discovers that the organization is using
hand geometry scanners as the access control mechanism for their
secure data center. What recommendation should Susan make about
the use of hand geometry scanners?

Select one of the following:

A. They have a high FRR and should be replaced.
B. A second factor should be added because they are not a good way to reliably distinguish individuals.
C. The hand geometry scanners provide appropriate security for the data center and should be considered for other high-security areas.
D. They may create accessibility concerns, and an alternate biometric system should be considered.

Explanation

Question 15 of 125

1

Colleen is conducting a business impact assessment for her
organization. What metric provides important information about the
amount of time that the organization may be without a service before
causing irreparable harm?

Select one of the following:

A. MTD
B. ALE
C. RPO
D. RTO

Explanation

Question 16 of 125

1

An attack that changes a symlink on a Linux system between the time
that an account’s rights to the file are verified and the file is accessed is
an example of what type of attack?

Select one of the following:

A. Unlinking
B. Tick/tock
C. setuid
D. TOCTOU

Explanation

Question 17 of 125

1

An authentication factor that is “something you have,” and that
typically includes a microprocessor and one or more certificates, is
what type of authenticator?

Select one of the following:

A. A smart card
B. A token
C. A Type I validator
D. A Type III authenticator

Explanation

Question 18 of 125

1

What term best describes an attack that relies on stolen or falsified
authentication credentials to bypass an authentication mechanism?

Select one of the following:

A. Spoofing
B. Replay
C. Masquerading
D. Modification

Explanation

Question 19 of 125

1

Lisa wants to integrate with a cloud identity provider that uses OAuth
2.0, and she wants to select an appropriate authentication framework.
Which of the following best suits her needs?

Select one of the following:

A. OpenID Connect
B. SAML
C. RADIUS
D. Kerberos

Explanation

Question 20 of 125

1

Owen recently designed a security access control structure that
prevents a single user from simultaneously holding the role required
to create a new vendor and the role required to issue a check. What
principle is Owen enforcing?

Select one of the following:

A. Two-person control
B. Least privilege
C. Separation of duties
D. Job rotation

Explanation

Question 21 of 125

1

Denise is preparing for a trial relating to a contract dispute between
her company and a software vendor. The vendor is claiming that
Denise made a verbal agreement that amended their written contract.
What rule of evidence should Denise raise in her defense?

Select one of the following:

A. Real evidence rule
B. Best evidence rule
C. Parol evidence rule
D. Testimonial evidence rule

Explanation

Question 22 of 125

1

While Lauren is monitoring traffic on two ends of a network
connection, she sees traffic that is inbound to a public IP address show
up inside the production network bound for an internal host that uses
an RFC 1918 reserved address. What technology should she expect is
in use at the network border?

Select one of the following:

A. NAT
B. VLANs
C. S/NAT
D. BGP

Explanation

Question 23 of 125

1

Which of the following statements about SSAE-18 is not true?

Select one of the following:

A. It mandates a specific control set.
B. It is an attestation standard.
C. It is used for external audits.
D. It uses a framework, including SOC 1, SOC 2, and SOC 3 reports.

Explanation

Question 24 of 125

1

What does a constrained user interface do?

Select one of the following:

A. It prevents unauthorized users from logging in.
B. It limits the data visible in an interface based on the content.
C. It limits the access a user is provided based on what activity they are performing.
D. It limits what users can do or see based on privileges.

Explanation

Question 25 of 125

1

Greg is building a disaster recovery plan for his organization and
would like to determine the amount of time that it should take to
restore a particular IT service after an outage. What variable is Greg
calculating?

Select one of the following:

A. MTD
B. RTO
C. RPO
D. SLA

Explanation

Question 26 of 125

1

What business process typically requires sign-off from a manager
before modifications are made to a system?

Select one of the following:

A. SDN
B. Release management
C. Change management
D. Versioning

Explanation

Question 27 of 125

1

What type of fire extinguisher is useful against liquid-based fires?

Select one of the following:

A. Class A
B. Class B
C. Class C
D. Class D

Explanation

Question 28 of 125

1

The company Chris works for has notifications posted at each door
reminding employees to be careful to not allow people to enter when
they do. Which type of controls best describes this?

Select one of the following:

A. Detective
B. Physical
C. Preventive
D. Directive

Explanation

Question 29 of 125

1

Which one of the following principles is not included in the seven EUU.
S. Privacy Shield provisions?

Select one of the following:

A. Access
B. Security
C. Recourse
D. Nonrepudiation

Explanation

Question 30 of 125

1

What group is eligible to receive safe harbor protection under the
terms of the Digital Millennium Copyright Act (DMCA)?

Select one of the following:

A. Music producers
B. Book publishers
C. Internet service providers
D. Banks

Explanation

Question 31 of 125

1

Alex is the system owner for the HR system at a major university.
According to NIST SP 800-18, what action should he take when a
significant change occurs in the system?

Select one of the following:

A. He should develop a data confidentiality plan.
B. He should update the system security plan.
C. He should classify the data the system contains.
D. He should select custodians to handle day-to-day operational tasks.

Explanation

Question 32 of 125

1

Alex has been with the university he works at for over 10 years.
During that time, he has been a system administrator and a
database administrator, and he has worked in the university’s help
desk. He is now a manager for the team that runs the university’s
web applications. Using the provisioning diagram shown here,
answer the following questions.

If Alex hires a new employee and the employee’s account is
provisioned after HR manually inputs information into the
provisioning system based on data Alex provides via a series of forms,
what type of provisioning has occurred?

Select one of the following:

A. Discretionary account provisioning
B. Workflow-based account provisioning
C. Automated account provisioning
D. Self-service account provisioning

Explanation

Question 33 of 125

1

Alex has been with the university he works at for over 10 years.
During that time, he has been a system administrator and a
database administrator, and he has worked in the university’s help
desk. He is now a manager for the team that runs the university’s
web applications. Using the provisioning diagram shown here,
answer the following questions.

Alex has access to B, C, and D. What concern should he raise to the
university’s identity management team?

Select one of the following:

A. The provisioning process did not give him the rights he needs.
B. He has excessive privileges.
C. Privilege creep may be taking place.
D. Logging is not properly enabled.

Explanation

Question 34 of 125

1

Alex has been with the university he works at for over 10 years.
During that time, he has been a system administrator and a
database administrator, and he has worked in the university’s help
desk. He is now a manager for the team that runs the university’s
web applications. Using the provisioning diagram shown here,
answer the following questions.

When Alex changes roles, what should occur?

Select one of the following:

A. He should be de-provisioned and a new account should be created.
B. He should have his new rights added to his existing account.
C. He should be provisioned for only the rights that match his role.
D. He should have his rights set to match those of the person he is replacing.

Explanation

Question 35 of 125

1

Robert is reviewing a system that has been assigned the EAL2
evaluation assurance level under the Common Criteria. What is the
highest level of assurance that he may have about the system?

Select one of the following:

A. It has been functionally tested.
B. It has been structurally tested.
C. It has been formally verified, designed, and tested.
D. It has been semiformally designed and tested.

Explanation

Question 36 of 125

1

Adam is processing an access request for an end user. What two items
should he verify before granting the access?

Select one of the following:

A. Separation and need to know
B. Clearance and endorsement
C. Clearance and need to know
D. Second factor and clearance

Explanation

Question 37 of 125

1

During what phase of the electronic discovery reference model does an
organization ensure that potentially discoverable information is
protected against alteration or deletion?

Select one of the following:

A. Identification
B. Preservation
C. Collection
D. Processing

Explanation

Question 38 of 125

1

Nessus, OpenVAS, and SAINT are all examples of what type of tool?

Select one of the following:

A. Port scanners
B. Patch management suites
C. Port mappers
D. Vulnerability scanners

Explanation

Question 39 of 125

1

Harry would like to access a document owned by Sally stored on a file
server. Applying the subject/object model to this scenario, who or
what is the object of the resource request?

Select one of the following:

A. Harry
B. Sally
C. File server
D. Document

Explanation

Question 40 of 125

1

What is the process that occurs when the Session layer removes the
header from data sent by the Transport layer?

Select one of the following:

A. Encapsulation
B. Packet unwrapping
C. De-encapsulation
D. Payloading

Explanation

Question 41 of 125

1

Which of the following tools is best suited to testing known exploits
against a system?

Select one of the following:

A. Nikto
B. Ettercap
C. Metasploit
D. THC Hydra

Explanation

Question 42 of 125

1

What markup language uses the concepts of a Requesting Authority, a
Provisioning Service Point, and a Provisioning Service Target to
handle its core functionality?

Select one of the following:

A. SAML
B. SAMPL
C. SPML
D. XACML

Explanation

Question 43 of 125

1

What type of risk assessment uses tools such as the one shown here?

Select one of the following:

A. Quantitative
B. Loss expectancy
C. Financial
D. Qualitative

Explanation

Question 44 of 125

1

MAC models use three types of environments. Which of the following
is not a mandatory access control design?

Select one of the following:

A. Hierarchical
B. Bracketed
C. Compartmentalized
D. Hybrid

Explanation

Question 45 of 125

1

What level of RAID is also called disk striping with parity?

Select one of the following:

A. RAID 0
B. RAID 1
C. RAID 5
D. RAID 10

Explanation

Question 46 of 125

1

Sally is wiring a gigabit Ethernet network. What cabling choices
should she make to ensure she can use her network at the full 1000
Mbps she wants to provide to her users?

Select one of the following:

A. Cat 5 and Cat 6
B. Cat 5e and Cat 6
C. Cat 4e and Cat 5e
D. Cat 6 and Cat 7

Explanation

Question 47 of 125

1

Which one of the following is typically considered a business
continuity task?

Select one of the following:

A. Business impact assessment
B. Alternate facility selection
C. Activation of cold sites
D. Restoration of data from backup

Explanation

Question 48 of 125

1

Robert is the network administrator for a small business and recently
installed a new firewall. After seeing signs of unusually heavy network
traffic, he checked his intrusion detection system, which reported that
a smurf attack was under way. What firewall configuration change can
Robert make to most effectively prevent this attack?

Select one of the following:

A. Block the source IP address of the attack.
B. Block inbound UDP traffic.
C. Block the destination IP address of the attack.
D. Block inbound ICMP traffic.

Explanation

Question 49 of 125

1

Which one of the following types of firewalls does not have the ability
to track connection status between different packets?

Select one of the following:

A. Stateful inspection
B. Application proxy
C. Packet filter
D. Next generation

Explanation

Question 50 of 125

1

Which of the following is used only to encrypt data in transit over a
network and cannot be used to encrypt data at rest?

Select one of the following:

A. TKIP
B. AES
C. 3DES
D. RSA

Explanation

Question 51 of 125

1

What type of fuzzing is known as intelligent fuzzing?

Select one of the following:

A. Zzuf
B. Mutation
C. Generational
D. Code based

Explanation

Question 52 of 125

1

Matthew is experiencing issues with the quality of network service on
his organization’s network. The primary symptom is that packets are
occasionally taking too long to travel from their source to their
destination. The length of this delay changes for individual packets.
What term describes the issue Matthew is facing?

Select one of the following:

A. Latency
B. Jitter
C. Packet loss
D. Interference

Explanation

Question 53 of 125

1

Which of the following multifactor authentication technologies
provides both low management overhead and flexibility?

Select one of the following:

A. Biometrics
B. Software tokens
C. Synchronous hardware tokens
D. Asynchronous hardware tokens

Explanation

Question 54 of 125

1

What type of testing would validate support for all the web browsers
that are supported by a web application?

Select one of the following:

A. Regression testing
B. Interface testing
C. Fuzzing
D. White box testing

Explanation

Question 55 of 125

1

Kathleen is implementing an access control system for her
organization and builds the following array:
Reviewers: update files, delete files
Submitters: upload files
Editors: upload files, update files
Archivists: delete files
What type of access control system has Kathleen implemented?

Select one of the following:

A. Role-based access control
B. Task-based access control
C. Rule-based access control
D. Discretionary access control

Explanation

Question 56 of 125

1

Alan is installing a fire suppression system that will kick in after a fire
breaks out and protect the equipment in the data center from
extensive damage. What metric is Alan attempting to lower?

Select one of the following:

A. Likelihood
B. RTO
C. RPO
D. Impact

Explanation

Question 57 of 125

1

Alan’s Wrenches recently developed a new manufacturing process for
its product. They plan to use this technology internally and not share it
with others. They would like it to remain protected for as long as
possible. What type of intellectual property protection is best suited
for this situation?

Select one of the following:

A. Patent
B. Copyright
C. Trademark
D. Trade secret

Explanation

Question 58 of 125

1

Ben wants to interface with the National Vulnerability Database using
a standardized protocol. What option should he use to ensure that the
tools he builds work with the data contained in the NVD?

Select one of the following:

A. XACML
B. SCML
C. VSML
D. SCAP

Explanation

Question 59 of 125

1

Which of the following is not one of the three components of the
DevOps model?

Select one of the following:

A. Software development
B. Change management
C. Quality assurance
D. Operations

Explanation

Question 60 of 125

1

In the figure shown here, Harry’s request to read the data file is
blocked. Harry has a Secret security clearance, and the data file has a
Top Secret classification. What principle of the Bell-LaPadula model
blocked this request?

Select one of the following:

A. Simple Security Property
B. Simple Integrity Property
C. *-Security Property
D. Discretionary Security Property

Explanation

Question 61 of 125

1

Norm is starting a new software project with a vendor that uses an
SDLC approach to development. When he arrives on the job, he
receives a document that has the sections shown here. What type of
planning document is this?

Select one of the following:

A. Functional requirements
B. Work breakdown structure
C. Test analysis report
D. Project plan

Explanation

Question 62 of 125

1

Kolin is searching for a network security solution that will allow him to
help reduce zero-day attacks while using identities to enforce a
security policy on systems before they connect to the network. What
type of solution should Kolin implement?

Select one of the following:

A. A firewall
B. A NAC system
C. An intrusion detection system
D. Port security

Explanation

Question 63 of 125

1

Gwen comes across an application that is running under a service
account on a web server. The service account has full administrative
rights to the server. What principle of information security does this
violate?

Select one of the following:

A. Need to know
B. Separation of duties
C. Least privilege
D. Job rotation

Explanation

Question 64 of 125

1

Which of the following is not a type of structural coverage in a code
review process?

Select one of the following:

A. Statement
B. Trace
C. Loop
D. Data flow

Explanation

Question 65 of 125

1

Which of the following tools is best suited to the information gathering
phase of a penetration test?

Select one of the following:

A. Whois
B. zzuf
C. Nessus
D. Metasploit

Explanation

Question 66 of 125

1

During a web application vulnerability scanning test, Steve runs
Nikto against a web server he believes may be vulnerable to
attacks. Using the Nikto output shown here, answer the following
questions.

Why does Nikto flag the /test directory?

Select one of the following:

A. The /test directory allows administrative access to PHP.
B. It is used to store sensitive data.
C. Test directories often contain scripts that can be misused.
D. It indicates a potential compromise.

Explanation

Question 67 of 125

1

During a web application vulnerability scanning test, Steve runs
Nikto against a web server he believes may be vulnerable to
attacks. Using the Nikto output shown here, answer the following
questions.

Why does Nikto identify directory indexing as an issue?

Select one of the following:

A. It lists files in a directory.
B. It may allow for XDRF.
C. Directory indexing can result in a denial of service attack.
D. Directory indexing is off by default, potentially indicating
compromise.

Explanation

Question 68 of 125

1

During a web application vulnerability scanning test, Steve runs
Nikto against a web server he believes may be vulnerable to
attacks. Using the Nikto output shown here, answer the following
questions.

Nikto lists OSVDB-877, noting that the system may be vulnerable to
XST. What would this type of attack allow an attacker to do?

Select one of the following:

A. Use cross-site targeting.
B. Steal a user’s cookies.
C. Counter SQL tracing.
D. Modify a user’s TRACE information.

Explanation

Question 69 of 125

1

Which one of the following memory types is considered volatile
memory?

Select one of the following:

A. Flash
B. EEPROM
C. EPROM
D. RAM

Explanation

Question 70 of 125

1

Ursula believes that many individuals in her organization are storing
sensitive information on their laptops in a manner that is unsafe and
potentially violates the organization’s security policy. What control
can she use to identify the presence of these files?

Select one of the following:

A. Network DLP
B. Network IPS
C. Endpoint DLP
D. Endpoint IPS

Explanation

Question 71 of 125

1

In what cloud computing model does the customer build a cloud
computing environment in his or her own data center or build an
environment in another data center that is for the customer’s exclusive
use?

Select one of the following:

A. Public cloud
B. Private cloud
C. Hybrid cloud
D. Shared cloud

Explanation

Question 72 of 125

1

Which one of the following technologies is designed to prevent a web
server going offline from becoming a single point of failure in a web
application architecture?

Select one of the following:

A. Load balancing
B. Dual-power supplies
C. IPS
D. RAID

Explanation

Question 73 of 125

1

Alice wants to send Bob a message with the confidence that Bob will
know the message was not altered while in transit. What goal of
cryptography is Alice trying to achieve?

Select one of the following:

A. Confidentiality
B. Nonrepudiation
C. Authentication
D. Integrity

Explanation

Question 74 of 125

1

What network topology is shown here?

Select one of the following:

A. A ring
B. A bus
C. A star
D. A mesh

Explanation

Question 75 of 125

1

Monica is developing a software application that calculates an
individual’s body mass index for use in medical planning. She would
like to include a control on the field where the physician enters an
individual’s weight to ensure that the weight falls within an expected
range. What type of control should Monica use?

Select one of the following:

A. Fail open
B. Fail secure
C. Limit check
D. Buffer bounds

Explanation

Question 76 of 125

1

Your lab manager is preparing to buy all the equipment that has been budgeted for next year. While reviewing the
specifications for several pieces of equipment, he notices that each device has a Mean Time To Repair (MTTR) rating. He
asks you what this means. Which of the following is the best response?

Select one of the following:

○ A. The MTTR is used to determine the expected time before the repair can be completed. Higher numbers are better.
○ B. The MTTR is used to determine the expected time before the repair can be completed. Lower numbers are better.
○ C. The MTTR is used to determine the expected time between failures. Higher numbers are better.
○ D. The MTTR is used to determine the expected time between failures. Lower numbers are better.

Explanation

Question 77 of 125

1

Which of the following would you be least likely to find in a data center?

Select one of the following:

○ A. Dry pipe fire control
○ B. Smoke detectors
○ C. Drop ceilings
○ D. Surge protection

Explanation

Question 78 of 125

1

You are asked to serve as a consultant on the design of a new facility. Which of the following is the best location for the
server room?

Select one of the following:

○ A. Near the outside of the building
○ B. Near the center of the building
○ C. In an area that has plenty of traffic so that equipment can be observed by other employees and guests
○ D. In an area that offers easy access

Explanation

Question 79 of 125

1

Which of the following is not one of the three types of access controls?

Select one of the following:

○ A. Administrative
○ B. Personnel
○ C. Technical
○ D. Physical

Explanation

Question 80 of 125

1

Your company has just opened a call center in India to handle nighttime operations, and you are asked to review the site’s
security controls. Specifically, you are asked which of the following is the strongest form of authentication. What will your
answer be?

Select one of the following:

○ A. Something you know
○ B. Something you are
○ C. Passwords
○ D. Tokens

Explanation

Question 81 of 125

1

Your organization has become worried about recent attempts to gain unauthorized access to the R&D facility. Therefore,
you are asked to implement a system that will require individuals to present a password and enter a PIN at the security gate
before gaining access. What is this type of system called?

Select one of the following:

○ A. Authorization
○ B. Two-factor authentication
○ C. Authentication
○ D. Three-factor authentication

Explanation

Question 82 of 125

1

Which of the following ciphers is/are symmetric?

Select one of the following:

○ A. DES
○ B. DES and Skytale
○ C. DES, Skytale, and Caesar’s cipher
○ D. DES, Skytale, Caesar’s cipher, and RSA

Explanation

Question 83 of 125

1

An employee is leaving your company. You debrief the individual and escort him to the door. After reviewing the materials in
his office, you realize he left with the VPN router that had been configured for him to use when he worked from home. This
router had a certificate issued to that employee, and it is not deemed worth the effort to retrieve it. What action should be
taken in regards to the certificate?

Select one of the following:

○ A. Suspend it.
○ B. Destroy it.
○ C. Revoke it.
○ D. Transfer it.

Explanation

Question 84 of 125

1

Which algorithm provides for key distribution but does not provide encryption or nonrepudiation?

Select one of the following:

○ A. Diffie-Hellman
○ B. ElGamal
○ C. RSA
○ D. Elliptic Curve Cryptosystem (ECC)

Explanation

Question 85 of 125

1

TCSEC provides levels of security that are classified in a hierarchical manner. Each level has a corresponding set of security
requirements that must be met. Which of the following does Level A correspond to?

Select one of the following:

○ A. Mandatory protection
○ B. Required protection
○ C. Verified protection
○ D. Validated protection

Explanation

Question 86 of 125

1

TCSEC offers numbered divisions of security that can occur in each category. With this in mind, which of the following
represents the highest level of security?

Select one of the following:

○ A. B2
○ B. D2
○ C. B1
○ D. D1

Explanation

Question 87 of 125

1

Jim has been asked to assist with a security evaluation. He has heard other members of the teams speak of TCB. What does
TCB stand for?

Select one of the following:

○ A. Taking care of business
○ B. Total computer base
○ C. Trusted computer base
○ D. Total communication bandwidth

Explanation

Question 88 of 125

1

Which of the following is considered a connection-oriented protocol?

Select one of the following:

○ A. UDP
○ B. TCP
○ C. ICMP
○ D. ARP

Explanation

Question 89 of 125

1

Which connectionless protocol is used for its low overhead and speed?

Select one of the following:

○ A. UDP
○ B. TCP
○ C. ICMP
○ D. ARP

Explanation

Question 90 of 125

1

Information security is not built on which of the following?

Select one of the following:

○ A. Confidentiality
○ B. Availability
○ C. Accessibility
○ D. Integrity

Explanation

Question 91 of 125

1

Place the following four elements of the Business Continuity Plan in the proper order.

Select one of the following:

○ A. Scope and plan initiation, plan approval and implementation, business impact assessment, business continuity plan development
B. Scope and plan initiation, business impact assessment, business continuity plan development, plan approval and
implementation
○ C. Business impact assessment, scope and plan initiation, business continuity plan development, plan approval and implementation
○ D. Plan approval and implementation, business impact assessment, scope and plan initiation, business continuity plan development

Explanation

Question 92 of 125

1

Risk assessment is a critical component of the BCP process. As such, which risk-assessment method is scenario-driven and
does not assign numeric values to specific assets?

Select one of the following:

○ A. Qualitative Risk Assessment
○ B. Statistical Weighted Risk Assessment
○ C. Quantitative Risk Assessment
○ D. Asset-Based Risk Assessment

Explanation

Question 93 of 125

1

Which of the following best describes the concept and purpose of BCP?

Select one of the following:

○ A. BCPs are used to reduce outage times.
○ B. BCPs and procedures are put in place for the response to an emergency.
○ C. BCPs guarantee the reliability of standby systems.
○ D. BCPs are created to prevent interruptions to normal business activity.

Explanation

Question 94 of 125

1

What is not one of the three things that are needed to commit a computer crime?

Select one of the following:

○ A. Means
○ B. Skill
○ C. Motive
○ D. Opportunity

Explanation

Question 95 of 125

1

The IAB (Internet Architecture Board) considers which of the following acts unethical?

Select one of the following:

○ A. Disrupting the intended use of the Internet
○ B. Rerouting Internet traffic
○ C. Writing articles about security exploits
○ D. Developing security patches

Explanation

Question 96 of 125

1

What category of attack is characterized by the removal of small amounts of money over long periods of time?

Select one of the following:

○ A. Slicing attack
○ B. Skimming attack
○ C. Bologna attack
○ D. Salami attack

Explanation

Question 97 of 125

1

Which of the following is not a valid database management system model?

Select one of the following:

○ A. The hierarchical database management system
○ B. The structured database management system
○ C. The network database management system
○ D. The relational database management system

Explanation

Question 98 of 125

1

During which stage of the software development life cycle should security be implemented?

Select one of the following:

○ A. Development
○ B. Project initiation
○ C. Deployment
○ D. Installation

Explanation

Question 99 of 125

1

In which software development life cycle phase do the programmers and developers become deeply involved and do the
majority of the work?

Select one of the following:

○ A. System Design Specifications
○ B. Software Development
○ C. Operation and Maintenance
○ D. Functional Design Analysis and Planning

Explanation

Question 100 of 125

1

You have just won a contract for a small software development firm, which has asked you to perform a risk analysis. The
firm provided you information on previous incidents and has a list of the known environmental threats of the geographic area.
The firm’s president believes that risk is something that can be eliminated. As a CISSP, how should you respond to this
statement?

Select one of the following:

○ A. Although it can be prohibitively expensive, risk can be eliminated.
○ B. Risk can be reduced but cannot be eliminated.
○ C. A qualitative risk analysis can eliminate risk.
○ D. A quantitative risk assessment can eliminate risk.

Explanation

Question 101 of 125

1

Which term describes the method of identifying vulnerabilities and threats and assessing the possible damage to determine
where to implement security safeguards?

Select one of the following:

○ A. Information management
○ B. Risk analysis
○ C. Countermeasure selection
○ D. Classification controls

Explanation

Question 102 of 125

1

Proper security management dictates separation of duties for all the following reasons except which one?

Select one of the following:

○ A. It reduces the possibility of fraud.
○ B. It reduces dependency on individual workers.
○ C. It reduces the need for personnel.
○ D. It provides integrity.

Explanation

Question 103 of 125

1

Attackers are always looking for ways to identify systems. One such method is to send a TCP SYN to a targeted port.
What would an attacker expect to receive in response to indicate an open port?

Select one of the following:

○ A. SYN
○ B. SYN ACK
○ C. ACK
○ D. ACK FIN

Explanation

Question 104 of 125

1

Which of the following is an example of a directive control?

Select one of the following:

○ A. Policies
○ B. Data validation
○ C. Job rotation
○ D. Fault-tolerant systems

Explanation

Question 105 of 125

1

Brad uses Telnet to connect to several open ports on a victim computer and capture the banner information. What is the
purpose of his activity?

Select one of the following:

○ A. Scanning
○ B. Fingerprinting
○ C. Attempting a DoS
○ D. Privilege escalation

Explanation

Question 106 of 125

1

A closed-circuit TV (CCTV) system has been installed to monitor a bank’s ATM. The lighting has been adjusted to prevent
dark areas, and the depth of field and degree of focus are appropriate for proper monitoring. However, the guard has asked
if it would be possible to provide greater width to the area being monitored to permit a subject to be captured for a longer
stretch of time. Which adjustment is needed?

Select one of the following:

○ A. Decrease the focal length
○ B. Increase the focal length
○ C. Decrease the iris
○ D. Increase the iris

Explanation

Question 107 of 125

1

When you’re choosing the physical location for a new facility, which of the following should you not avoid?

Select one of the following:

○ A. Airport flight paths
○ B. Chemical refineries
○ C. Railway freight lines
○ D. Hospitals

Explanation

Question 108 of 125

1

Which of the following is not one of the three primary types of authentication?

Select one of the following:

○ A. Something you remember
○ B. Something you know
○ C. Something you are
○ D. Something you have

Explanation

Question 109 of 125

1

While working as a contractor for Widget, Inc., you are asked what the weakest form of authentication is. What will you
say?

Select one of the following:

○ A. Passwords
○ B. Retina scans
○ C. Facial recognition
○ D. Tokens

Explanation

Question 110 of 125

1

A coworker reports that she has lost her public key ring. What does this mean?

Select one of the following:

○ A. This is a security violation. You need to revoke her digital certificate.
○ B. She can regenerate it.
○ C. She will be unable to decrypt her stored files.
○ D. The PKI is gone.

Explanation

Question 111 of 125

1

What is the risk to an organization when a cryptosystem fails to use the full keyspace available?

Select one of the following:

○ A. Keys are too short.
○ B. Keys cause a collision.
○ C. Keys are clustered.
○ D. Keys repeat.

Explanation

Question 112 of 125

1

Which of the following is not one of the valid states in which a CPU can operate?

Select one of the following:

○ A. Processor
○ B. Supervisor
○ C. Problem
○ D. Wait

Explanation

Question 113 of 125

1

Which organization began developing the Common Criteria standard in 1990?

Select one of the following:

○ A. IEEE
○ B. ISC2
○ C. ISO
○ D. NIST

Explanation

Question 114 of 125

1

Which data communications solution transmits timing information to the receiver by using a “preamble” of alternating 1s and
0s?

Select one of the following:

○ A. Modem communication
○ B. Ethernet communication
○ C. Instant messaging
○ D. Serial communication

Explanation

Question 115 of 125

1

LAN data transmissions can take on several different forms. Which of the following can be both a source and a destination
address?

Select one of the following:

○ A. Unicast
○ B. Multicast
○ C. Broadcast
○ D. Anycast

Explanation

Question 116 of 125

1

What are the three goals of a business impact analysis?

Select one of the following:

○ A. Downtime estimation, resource requirements, defining the continuity strategy
○ B. Defining the continuity strategy, criticality prioritization, resource requirements
○ C. Criticality prioritization, downtime estimation, documenting the continuity strategy
○ D. Criticality prioritization, downtime estimation, resource requirements

Explanation

Question 117 of 125

1

Which of the following is the number-one priority for all Business Continuity Plans (BCPs) and Disaster Recovery Plans
(DRPs)?

Select one of the following:

○ A. The reduction of potential critical outages
○ B. The minimization of potential outages
○ C. The elimination of potential outages
○ D. The protection and welfare of employees

Explanation

Question 118 of 125

1

You are assigned to a team that is investigating a computer crime. You are asked to make sure that the original data remains
unchanged. Which of the following programs can be used to create a cryptographic checksum to verify the data’s integrity?

Select one of the following:

○ A. PKZip
○ B. MD5sum
○ C. DES
○ D. PGP

Explanation

Question 119 of 125

1

Paul is concerned about the proper disposal of old hard drives that contain propriety information. Which of the following
techniques ensures that the data cannot be recovered?

Select one of the following:

○ A. Formatting
○ B. FDISK
○ C. Drive wiping
○ D. Data parsing

Explanation

Question 120 of 125

1

In the software development life cycle, what is used to maintain changes to development or production?

Select one of the following:

○ A. Certification
○ B. Audit control team
○ C. Manufacturing review board
○ D. Change control

Explanation

Question 121 of 125

1

What is the most-used type of database management system?

Select one of the following:

○ A. The hierarchical database management system
○ B. The structured database management system
○ C. The network database management system
○ D. The relational database management system

Explanation

Question 122 of 125

1

As a potential CISSP, you need to know common RFCs and NIST standards. One such RFC is 2196. This IETF
document provides basic guidance on security in a networked environment. What is the title of this document?

Select one of the following:

○ A. “Ethics and the Internet”
○ B. “Site Security Handbook”
○ C. “Cracking and Hacking TCP/IP”
○ D. “Security Policies and Procedures”

Explanation

Question 123 of 125

1

Mr. Hunting, your former college math teacher, hears that you are studying for your CISSP exam and asks if you know the
formula for total risk. What is the correct response?

Select one of the following:

○ A. Annual Loss Expectancy * Vulnerability = Total Risk
○ B. Threat * Vulnerability * Asset Value = Total Risk
○ C. Residual Risk / Asset Value * Vulnerability = Total Risk
○ D. Asset Value / Residual Risk = Total Risk

Explanation

Question 124 of 125

1

An access-control matrix can be used to associate permissions of a subject to an object. Permissions can be tied to a lattice
of control. If the lattice of control for Cindy and Bob is read and read/write, which of the following is true?

Select one of the following:

○ A. Bob will be able to read File X.
○ B. Bob has full control of File X.
○ C. Bob cannot access File X.
○ D. Alice has full access on File Y.

Explanation

Question 125 of 125

1

The attacker waits until his victim establishes a connection to the organization’s FTP server. Then, he executes a program
that allows him to take over the established session. What type of attack has taken place?

Select one of the following:

○ A. Password attack
○ B. Spoofing
○ C. Session hijack
○ D. ARP redirection

	Created by Requiemdust Sheena about 4 years ago

Good Luck!

Quix17 - 125Q

Question 1 of 125

Jesse is looking at the /etc/passwd file on a system configured to use shadowed passwords. What should she expect to see in the password field of this file?

Select one of the following:

Explanation

Question 2 of 125

SYN floods rely on implementations of what protocol to cause denial of service conditions?

Select one of the following:

Explanation

Question 3 of 125

What principle states that an individual should make every effort to complete his or her responsibilities in an accurate and timely manner?

Select one of the following:

Explanation

Question 4 of 125

Cable modems, ISDN, and DSL are all examples of what type of technology?

Select one of the following:

Explanation

Question 5 of 125

What penetration testing technique can best help assess training and awareness issues?

Select one of the following:

Explanation

Question 6 of 125

Bill implemented RAID level 5 on a server that he operates using a total of three disks. How many disks may fail without the loss of data?

Select one of the following:

Explanation

Question 7 of 125

Data is sent as bits at what layer of the OSI model?

Select one of the following:

Explanation

Question 8 of 125

Bert is considering the use of an infrastructure as a service cloud computing partner to provide virtual servers. Which one of the following would be a vendor responsibility in this scenario?

Select one of the following:

Explanation

Question 9 of 125

When Ben records data and then replays it against his test website to verify how it performs based on a real production workload, what type of performance monitoring is he undertaking?

Select one of the following:

Explanation

Question 10 of 125

What technology ensures that an operating system allocates separate memory spaces used by each application on a system?

Select one of the following:

Explanation

Question 11 of 125

Alan is considering the use of new identification cards in his organization that will be used for physical access control. He comes across a sample card and is unsure of the technology. He breaks it open and sees the following internal construction. What type of card is this?

Select one of the following:

Explanation

Question 12 of 125

Mark is planning a disaster recovery test for his organization. He would like to perform a live test of the disaster recovery facility but does not want to disrupt operations at the primary facility. What type of test should Mark choose?

Select one of the following:

Explanation

Question 13 of 125

Which one of the following is not a principle of the Agile approach to software development?

Select one of the following:

Explanation

Question 14 of 125

During a security audit, Susan discovers that the organization is using hand geometry scanners as the access control mechanism for their secure data center. What recommendation should Susan make about the use of hand geometry scanners?

Select one of the following:

Explanation

Question 15 of 125

Colleen is conducting a business impact assessment for her organization. What metric provides important information about the amount of time that the organization may be without a service before causing irreparable harm?

Select one of the following:

Explanation

Question 16 of 125

An attack that changes a symlink on a Linux system between the time that an account’s rights to the file are verified and the file is accessed is an example of what type of attack?

Select one of the following:

Explanation

Question 17 of 125

An authentication factor that is “something you have,” and that typically includes a microprocessor and one or more certificates, is what type of authenticator?

Select one of the following:

Explanation

Question 18 of 125

What term best describes an attack that relies on stolen or falsified authentication credentials to bypass an authentication mechanism?

Select one of the following:

Explanation

Question 19 of 125

Lisa wants to integrate with a cloud identity provider that uses OAuth 2.0, and she wants to select an appropriate authentication framework. Which of the following best suits her needs?

Select one of the following:

Explanation

Question 20 of 125

Owen recently designed a security access control structure that prevents a single user from simultaneously holding the role required to create a new vendor and the role required to issue a check. What principle is Owen enforcing?

Jesse is looking at the /etc/passwd file on a system configured to use
shadowed passwords. What should she expect to see in the password
field of this file?

SYN floods rely on implementations of what protocol to cause denial
of service conditions?

What principle states that an individual should make every effort to
complete his or her responsibilities in an accurate and timely manner?

Cable modems, ISDN, and DSL are all examples of what type of
technology?

What penetration testing technique can best help assess training and
awareness issues?

Bill implemented RAID level 5 on a server that he operates using a
total of three disks. How many disks may fail without the loss of data?

Bert is considering the use of an infrastructure as a service cloud
computing partner to provide virtual servers. Which one of the
following would be a vendor responsibility in this scenario?

When Ben records data and then replays it against his test website to
verify how it performs based on a real production workload, what type
of performance monitoring is he undertaking?

What technology ensures that an operating system allocates separate
memory spaces used by each application on a system?

Alan is considering the use of new identification cards in his
organization that will be used for physical access control. He comes
across a sample card and is unsure of the technology. He breaks it
open and sees the following internal construction. What type of card is
this?

Mark is planning a disaster recovery test for his organization. He
would like to perform a live test of the disaster recovery facility but
does not want to disrupt operations at the primary facility. What type
of test should Mark choose?

Which one of the following is not a principle of the Agile approach to
software development?

During a security audit, Susan discovers that the organization is using
hand geometry scanners as the access control mechanism for their
secure data center. What recommendation should Susan make about
the use of hand geometry scanners?

Colleen is conducting a business impact assessment for her
organization. What metric provides important information about the
amount of time that the organization may be without a service before
causing irreparable harm?

An attack that changes a symlink on a Linux system between the time
that an account’s rights to the file are verified and the file is accessed is
an example of what type of attack?

An authentication factor that is “something you have,” and that
typically includes a microprocessor and one or more certificates, is
what type of authenticator?

What term best describes an attack that relies on stolen or falsified
authentication credentials to bypass an authentication mechanism?

Lisa wants to integrate with a cloud identity provider that uses OAuth
2.0, and she wants to select an appropriate authentication framework.
Which of the following best suits her needs?

Owen recently designed a security access control structure that
prevents a single user from simultaneously holding the role required
to create a new vendor and the role required to issue a check. What
principle is Owen enforcing?

Denise is preparing for a trial relating to a contract dispute between
her company and a software vendor. The vendor is claiming that
Denise made a verbal agreement that amended their written contract.
What rule of evidence should Denise raise in her defense?

While Lauren is monitoring traffic on two ends of a network
connection, she sees traffic that is inbound to a public IP address show
up inside the production network bound for an internal host that uses
an RFC 1918 reserved address. What technology should she expect is
in use at the network border?

Greg is building a disaster recovery plan for his organization and
would like to determine the amount of time that it should take to
restore a particular IT service after an outage. What variable is Greg
calculating?

What business process typically requires sign-off from a manager
before modifications are made to a system?

The company Chris works for has notifications posted at each door
reminding employees to be careful to not allow people to enter when
they do. Which type of controls best describes this?

Which one of the following principles is not included in the seven EUU.
S. Privacy Shield provisions?

What group is eligible to receive safe harbor protection under the
terms of the Digital Millennium Copyright Act (DMCA)?

Alex is the system owner for the HR system at a major university.
According to NIST SP 800-18, what action should he take when a
significant change occurs in the system?

Robert is reviewing a system that has been assigned the EAL2
evaluation assurance level under the Common Criteria. What is the
highest level of assurance that he may have about the system?

Adam is processing an access request for an end user. What two items
should he verify before granting the access?

During what phase of the electronic discovery reference model does an
organization ensure that potentially discoverable information is
protected against alteration or deletion?