Jesse is looking at the /etc/passwd file on a system configured to use
shadowed passwords. What should she expect to see in the password
field of this file?

SYN floods rely on implementations of what protocol to cause denial
of service conditions?

What principle states that an individual should make every effort to
complete his or her responsibilities in an accurate and timely manner?

Cable modems, ISDN, and DSL are all examples of what type of
technology?

What penetration testing technique can best help assess training and
awareness issues?

Bill implemented RAID level 5 on a server that he operates using a
total of three disks. How many disks may fail without the loss of data?

Data is sent as bits at what layer of the OSI model?

Bert is considering the use of an infrastructure as a service cloud
computing partner to provide virtual servers. Which one of the
following would be a vendor responsibility in this scenario?

When Ben records data and then replays it against his test website to
verify how it performs based on a real production workload, what type
of performance monitoring is he undertaking?

What technology ensures that an operating system allocates separate
memory spaces used by each application on a system?

Mark is planning a disaster recovery test for his organization. He
would like to perform a live test of the disaster recovery facility but
does not want to disrupt operations at the primary facility. What type
of test should Mark choose?

Which one of the following is not a principle of the Agile approach to
software development?

During a security audit, Susan discovers that the organization is using
hand geometry scanners as the access control mechanism for their
secure data center. What recommendation should Susan make about
the use of hand geometry scanners?

Colleen is conducting a business impact assessment for her
organization. What metric provides important information about the
amount of time that the organization may be without a service before
causing irreparable harm?

An attack that changes a symlink on a Linux system between the time
that an account’s rights to the file are verified and the file is accessed is
an example of what type of attack?

An authentication factor that is “something you have,” and that
typically includes a microprocessor and one or more certificates, is
what type of authenticator?

What term best describes an attack that relies on stolen or falsified
authentication credentials to bypass an authentication mechanism?

Lisa wants to integrate with a cloud identity provider that uses OAuth
2.0, and she wants to select an appropriate authentication framework.
Which of the following best suits her needs?

Owen recently designed a security access control structure that
prevents a single user from simultaneously holding the role required
to create a new vendor and the role required to issue a check. What
principle is Owen enforcing?

Denise is preparing for a trial relating to a contract dispute between
her company and a software vendor. The vendor is claiming that
Denise made a verbal agreement that amended their written contract.
What rule of evidence should Denise raise in her defense?

While Lauren is monitoring traffic on two ends of a network
connection, she sees traffic that is inbound to a public IP address show
up inside the production network bound for an internal host that uses
an RFC 1918 reserved address. What technology should she expect is
in use at the network border?

Which of the following statements about SSAE-18 is not true?

What does a constrained user interface do?

Greg is building a disaster recovery plan for his organization and
would like to determine the amount of time that it should take to
restore a particular IT service after an outage. What variable is Greg
calculating?

What business process typically requires sign-off from a manager
before modifications are made to a system?

What type of fire extinguisher is useful against liquid-based fires?

The company Chris works for has notifications posted at each door
reminding employees to be careful to not allow people to enter when
they do. Which type of controls best describes this?

Which one of the following principles is not included in the seven EUU.
S. Privacy Shield provisions?

What group is eligible to receive safe harbor protection under the
terms of the Digital Millennium Copyright Act (DMCA)?

Alex is the system owner for the HR system at a major university.
According to NIST SP 800-18, what action should he take when a
significant change occurs in the system?

Robert is reviewing a system that has been assigned the EAL2
evaluation assurance level under the Common Criteria. What is the
highest level of assurance that he may have about the system?

Adam is processing an access request for an end user. What two items
should he verify before granting the access?

During what phase of the electronic discovery reference model does an
organization ensure that potentially discoverable information is
protected against alteration or deletion?

Nessus, OpenVAS, and SAINT are all examples of what type of tool?

Harry would like to access a document owned by Sally stored on a file
server. Applying the subject/object model to this scenario, who or
what is the object of the resource request?

What is the process that occurs when the Session layer removes the
header from data sent by the Transport layer?

Which of the following tools is best suited to testing known exploits
against a system?

What markup language uses the concepts of a Requesting Authority, a
Provisioning Service Point, and a Provisioning Service Target to
handle its core functionality?

MAC models use three types of environments. Which of the following
is not a mandatory access control design?

What level of RAID is also called disk striping with parity?

Sally is wiring a gigabit Ethernet network. What cabling choices
should she make to ensure she can use her network at the full 1000
Mbps she wants to provide to her users?

Which one of the following is typically considered a business
continuity task?

Robert is the network administrator for a small business and recently
installed a new firewall. After seeing signs of unusually heavy network
traffic, he checked his intrusion detection system, which reported that
a smurf attack was under way. What firewall configuration change can
Robert make to most effectively prevent this attack?

Which one of the following types of firewalls does not have the ability
to track connection status between different packets?

Which of the following is used only to encrypt data in transit over a
network and cannot be used to encrypt data at rest?

What type of fuzzing is known as intelligent fuzzing?

Matthew is experiencing issues with the quality of network service on
his organization’s network. The primary symptom is that packets are
occasionally taking too long to travel from their source to their
destination. The length of this delay changes for individual packets.
What term describes the issue Matthew is facing?

Which of the following multifactor authentication technologies
provides both low management overhead and flexibility?

What type of testing would validate support for all the web browsers
that are supported by a web application?

Kathleen is implementing an access control system for her
organization and builds the following array:
Reviewers: update files, delete files
Submitters: upload files
Editors: upload files, update files
Archivists: delete files
What type of access control system has Kathleen implemented?

Alan is installing a fire suppression system that will kick in after a fire
breaks out and protect the equipment in the data center from
extensive damage. What metric is Alan attempting to lower?

Alan’s Wrenches recently developed a new manufacturing process for
its product. They plan to use this technology internally and not share it
with others. They would like it to remain protected for as long as
possible. What type of intellectual property protection is best suited
for this situation?

Ben wants to interface with the National Vulnerability Database using
a standardized protocol. What option should he use to ensure that the
tools he builds work with the data contained in the NVD?

Which of the following is not one of the three components of the
DevOps model?

Kolin is searching for a network security solution that will allow him to
help reduce zero-day attacks while using identities to enforce a
security policy on systems before they connect to the network. What
type of solution should Kolin implement?

Gwen comes across an application that is running under a service
account on a web server. The service account has full administrative
rights to the server. What principle of information security does this
violate?

Which of the following is not a type of structural coverage in a code
review process?

Which of the following tools is best suited to the information gathering
phase of a penetration test?

Which one of the following memory types is considered volatile
memory?

Ursula believes that many individuals in her organization are storing
sensitive information on their laptops in a manner that is unsafe and
potentially violates the organization’s security policy. What control
can she use to identify the presence of these files?

In what cloud computing model does the customer build a cloud
computing environment in his or her own data center or build an
environment in another data center that is for the customer’s exclusive
use?

Which one of the following technologies is designed to prevent a web
server going offline from becoming a single point of failure in a web
application architecture?

Alice wants to send Bob a message with the confidence that Bob will
know the message was not altered while in transit. What goal of
cryptography is Alice trying to achieve?

Monica is developing a software application that calculates an
individual’s body mass index for use in medical planning. She would
like to include a control on the field where the physician enters an
individual’s weight to ensure that the weight falls within an expected
range. What type of control should Monica use?

Your lab manager is preparing to buy all the equipment that has been budgeted for next year. While reviewing the
specifications for several pieces of equipment, he notices that each device has a Mean Time To Repair (MTTR) rating. He
asks you what this means. Which of the following is the best response?

Which of the following would you be least likely to find in a data center?

You are asked to serve as a consultant on the design of a new facility. Which of the following is the best location for the
server room?

Which of the following is not one of the three types of access controls?

Your company has just opened a call center in India to handle nighttime operations, and you are asked to review the site’s
security controls. Specifically, you are asked which of the following is the strongest form of authentication. What will your
answer be?

Your organization has become worried about recent attempts to gain unauthorized access to the R&D facility. Therefore,
you are asked to implement a system that will require individuals to present a password and enter a PIN at the security gate
before gaining access. What is this type of system called?

Which of the following ciphers is/are symmetric?

An employee is leaving your company. You debrief the individual and escort him to the door. After reviewing the materials in
his office, you realize he left with the VPN router that had been configured for him to use when he worked from home. This
router had a certificate issued to that employee, and it is not deemed worth the effort to retrieve it. What action should be
taken in regards to the certificate?

Which algorithm provides for key distribution but does not provide encryption or nonrepudiation?

TCSEC provides levels of security that are classified in a hierarchical manner. Each level has a corresponding set of security
requirements that must be met. Which of the following does Level A correspond to?

TCSEC offers numbered divisions of security that can occur in each category. With this in mind, which of the following
represents the highest level of security?

Jim has been asked to assist with a security evaluation. He has heard other members of the teams speak of TCB. What does
TCB stand for?

Which of the following is considered a connection-oriented protocol?

Which connectionless protocol is used for its low overhead and speed?

Information security is not built on which of the following?

Place the following four elements of the Business Continuity Plan in the proper order.

Risk assessment is a critical component of the BCP process. As such, which risk-assessment method is scenario-driven and
does not assign numeric values to specific assets?

Which of the following best describes the concept and purpose of BCP?

What is not one of the three things that are needed to commit a computer crime?

The IAB (Internet Architecture Board) considers which of the following acts unethical?

What category of attack is characterized by the removal of small amounts of money over long periods of time?

Which of the following is not a valid database management system model?

During which stage of the software development life cycle should security be implemented?

In which software development life cycle phase do the programmers and developers become deeply involved and do the
majority of the work?

You have just won a contract for a small software development firm, which has asked you to perform a risk analysis. The
firm provided you information on previous incidents and has a list of the known environmental threats of the geographic area.
The firm’s president believes that risk is something that can be eliminated. As a CISSP, how should you respond to this
statement?

Which term describes the method of identifying vulnerabilities and threats and assessing the possible damage to determine
where to implement security safeguards?

Proper security management dictates separation of duties for all the following reasons except which one?

Attackers are always looking for ways to identify systems. One such method is to send a TCP SYN to a targeted port.
What would an attacker expect to receive in response to indicate an open port?

Which of the following is an example of a directive control?

Brad uses Telnet to connect to several open ports on a victim computer and capture the banner information. What is the
purpose of his activity?

A closed-circuit TV (CCTV) system has been installed to monitor a bank’s ATM. The lighting has been adjusted to prevent
dark areas, and the depth of field and degree of focus are appropriate for proper monitoring. However, the guard has asked
if it would be possible to provide greater width to the area being monitored to permit a subject to be captured for a longer
stretch of time. Which adjustment is needed?

When you’re choosing the physical location for a new facility, which of the following should you not avoid?

Which of the following is not one of the three primary types of authentication?

While working as a contractor for Widget, Inc., you are asked what the weakest form of authentication is. What will you
say?

A coworker reports that she has lost her public key ring. What does this mean?

What is the risk to an organization when a cryptosystem fails to use the full keyspace available?

Which of the following is not one of the valid states in which a CPU can operate?

Which organization began developing the Common Criteria standard in 1990?

Which data communications solution transmits timing information to the receiver by using a “preamble” of alternating 1s and
0s?

LAN data transmissions can take on several different forms. Which of the following can be both a source and a destination
address?

What are the three goals of a business impact analysis?

Which of the following is the number-one priority for all Business Continuity Plans (BCPs) and Disaster Recovery Plans
(DRPs)?

You are assigned to a team that is investigating a computer crime. You are asked to make sure that the original data remains
unchanged. Which of the following programs can be used to create a cryptographic checksum to verify the data’s integrity?

Paul is concerned about the proper disposal of old hard drives that contain propriety information. Which of the following
techniques ensures that the data cannot be recovered?

In the software development life cycle, what is used to maintain changes to development or production?

What is the most-used type of database management system?

As a potential CISSP, you need to know common RFCs and NIST standards. One such RFC is 2196. This IETF
document provides basic guidance on security in a networked environment. What is the title of this document?

Mr. Hunting, your former college math teacher, hears that you are studying for your CISSP exam and asks if you know the
formula for total risk. What is the correct response?

The attacker waits until his victim establishes a connection to the organization’s FTP server. Then, he executes a program
that allows him to take over the established session. What type of attack has taken place?