Quix15 - 125Q

Questão 1

Questão

Fred’s data role requires him to maintain system security plans and to ensure that system users and support staff get the training they need about security practices and acceptable use. What is the role that Fred is most likely to hold in the organization?

Responda

A. Data owner
B. System owner
C. User
D. Custodian

Questão 2

Questão

Sally is using IPsec’s ESP component in transport mode. What important information should she be aware of about transport mode?

Responda

A. Transport mode provides full encryption of the entire IP packet.
B. Transport mode adds a new, unencrypted header to ensure that packets reach their destination.
C. Transport mode does not encrypt the header of the packet.
D. Transport mode provides no encryption; only tunnel mode provides encryption.

Questão 3

Questão

Which one of the following is not a key process area for the Repeatable phase of the Software Capability Maturity Model (SWCMM)?

Responda

A. Software Project Planning
B. Software Quality Management
C. Software Project Tracking
D. Software Subcontract Management

Questão 4

Questão

Ben wants to provide predictive information about his organization’s risk exposure in an automated way as part of an ongoing organizational risk management plan. What should he use to do this?

Responda

A. KRIs
B. Quantitative risk assessments
C. KPIs
D. Penetration tests

Questão 5

Questão

In the image shown here, what does system B send to system A at step 2 of the three-way TCP handshake?

Image:

66 (binary/octet-stream)

Responda

A. SYN
B. ACK
C. FIN/ACK
D. SYN/ACK

Questão 6

Questão

Chris is conducting reconnaissance on a remote target and discovers that pings are allowed through his target’s border firewall. What can he learn by using ping to probe the remote network?

Responda

A. Which systems respond to ping, a rough network topology, and potentially the location of additional firewalls
B. A list of all of the systems behind the target’s firewall
C. The hostnames and time to live (TTL) for each pingable system, and the ICMP types allowed through the firewall
D. Router advertisements, echo request responses, and potentially which hosts are tarpitted

Questão 7

Questão

What access management concept defines what rights or privileges a user has?

Responda

A. Identification
B. Accountability
C. Authorization
D. Authentication

Questão 8

Questão

Which one of the following is not a classification level commonly found in commercial data classification schemes?

Responda

A. Secret
B. Sensitive
C. Confidential
D. Public

Questão 9

Questão

Files, databases, computers, programs, processes, devices, and media are all examples of what?

Responda

A. Subjects
B. Objects
C. File stores
D. Users

Questão 10

Questão

Danielle is testing tax software, and part of her testing process requires her to input a variety of actual tax forms to verify that the software produces the right answers. What type of testing is Danielle performing?

Responda

A. Use case testing
B. Dynamic testing
C. Fuzzing
D. Misuse testing

Questão 11

Questão

After 10 years working in her organization, Cassandra is moving into her fourth role, this time as a manager in the accounting department. What issue is likely to show up during an account review if her organization does not have strong account maintenance practices?

Responda

A. An issue with least privilege
B. Privilege creep
C. Account creep
D. Account termination

Questão 12

Questão

IP addresses like 10.10.10.10 and 172.19.24.21 are both examples of what type of IP address?

Responda

A. Public IP addresses
B. Prohibited IP addresses
C. Private IP addresses
D. Class B IP ranges

Questão 13

Questão

What flaw is a concern with preset questions for cognitive passwords?

Responda

A. It prevents the use of tokens.
B. The question’s answer may be easy to find on the Internet.
C. Cognitive passwords require users to think to answer the question, and not all users may be able to solve the problems presented.
D. Cognitive passwords don’t support long passwords.

Questão 14

Questão

Megan needs to create a forensic copy of a hard drive that will be used in an investigation. Which of the following tools is best suited to her work?

Responda

A. xcopy
B. dd
C. DBAN
D. ImageMagik

Questão 15

Questão

Kay is selecting an application management approach for her organization. Employees need the flexibility to install software on their systems, but Kay wants to prevent them from installing certain prohibited packages. What type of approach should she use?

Responda

A. Antivirus
B. Whitelist
C. Blacklist
D. Heuristic

Questão 16

Questão

Data relating to the past, present, or future payment for the provision of healthcare to an individual is what type of data per HIPAA?

Responda

A. PCI
B. Personal billing data
C. PHI
D. Personally identifiable information (PII)

Questão 17

Questão

Yagis, panel, cantennas, and parabolic antennas are all examples of what type of antenna?

Responda

A. Omnidirectional
B. Rubber duck or base antenna
C. Signal boosting
D. Directional

Questão 18

Questão

While traveling, James is held at knifepoint and forced to log into his laptop. What is this called?

Responda

A. Duress
B. Antisocial engineering
C. Distress
D. Knifepoint hacking

Questão 19

Questão

What is the minimum number of people who should be trained on any specific business continuity plan implementation task?

Responda

A. 1
B. 2
C. 3
D. 5

Questão 20

Questão

Cameron is responsible for backing up his company’s primary file server. He configured a backup schedule that performs full backups every Monday evening at 9 p.m. and incremental backups on other days of the week at that same time. How many files will be copied in Wednesday’s backup?

Image:

67 (binary/octet-stream)

Responda

A. 1
B. 2
C. 5
D. 6

Questão 21

Questão

Susan uses a span port to monitor traffic to her production website and uses a monitoring tool to identify performance issues in real time. What type of monitoring is she conducting?

Responda

A. Passive monitoring
B. Active monitoring
C. Synthetic monitoring
D. Signature-based monitoring

Questão 22

Questão

The type of access granted to an object and the actions that you can take on or with the object are examples of what?

Responda

A. Permissions
B. Rights
C. Privileges
D. Roles

Questão 23

Questão

Which one of the following would be considered an example of infrastructure as a service cloud computing?

Responda

A. Payroll system managed by a vendor and delivered over the web
B. Application platform managed by a vendor that runs customer code
C. Servers provisioned by customers on a vendor-managed virtualization platform
D. Web-based email service provided by a vendor

Questão 24

Questão

Darcy is an information security risk analyst for Roscommon Agricultural Products. She is currently trying to decide whether the company should purchase an upgraded fire suppression system for their primary data center. The data center facility has a replacement cost of $2 million. After consulting with actuaries, data center managers, and fire subject matter experts, Darcy determined that a typical fire would likely require the replacement of all equipment inside the building but not cause significant structural damage. Together, they estimated that recovering from the fire would cost $750,000. They also determined that the company can expect a fire of this magnitude once every 50 years. Based on the information in this scenario, what is the exposure factor for the effect of a fire on the Roscommon Agricultural Products data center?

Responda

A. 7.5%
B. 15.0%
C. 27.5%
D. 37.5%

Questão 25

Questão

Darcy is an information security risk analyst for Roscommon Agricultural Products. She is currently trying to decide whether the company should purchase an upgraded fire suppression system for their primary data center. The data center facility has a replacement cost of $2 million. After consulting with actuaries, data center managers, and fire subject matter experts, Darcy determined that a typical fire would likely require the replacement of all equipment inside the building but not cause significant structural damage. Together, they estimated that recovering from the fire would cost $750,000. They also determined that the company can expect a fire of this magnitude once every 50 years. Based on the information in this scenario, what is the annualized rate of occurrence for a fire at the Roscommon Agricultural Products data center?

Responda

A. 0.002
B. 0.005
C. 0.02
D. 0.05

Questão 26

Questão

Darcy is an information security risk analyst for Roscommon Agricultural Products. She is currently trying to decide whether the company should purchase an upgraded fire suppression system for their primary data center. The data center facility has a replacement cost of $2 million. After consulting with actuaries, data center managers, and fire subject matter experts, Darcy determined that a typical fire would likely require the replacement of all equipment inside the building but not cause significant structural damage. Together, they estimated that recovering from the fire would cost $750,000. They also determined that the company can expect a fire of this magnitude once every 50 years. Based on the information in this scenario, what is the annualized loss expectancy for a fire at the Roscommon Agricultural Products data center?

Responda

A. $15,000
B. $25,000
C. $75,000
D. $750,000

Questão 27

Questão

Two TCP header flags are rarely used. Which two are you unlikely to see in use in a modern network?

Responda

A. CWR and ECE
B. URG and FIN
C. ECE and RST
D. CWR and URG

Questão 28

Questão

Mike wants to ensure that third-party users of his service’s API can be tracked to prevent abuse of the API. What should he implement to help with this?

Responda

A. Session IDs
B. An API firewall
C. API keys
D. An API buffer

Questão 29

Questão

Fran is a web developer who works for an online retailer. Her boss asked her to create a way that customers can easily integrate themselves with Fran’s company’s site. They need to be able to check inventory in real time, place orders, and check order status programmatically without having to access the web page. What can Fran create to most directly facilitate this interaction?

Responda

A. API
B. Web scraper
C. Data dictionary
D. Call center

Questão 30

Questão

What type of power issue occurs when a facility experiences a momentary loss of power?

Responda

A. Fault
B. Blackout
C. Sag
D. Brownout

Questão 31

Questão

Lauren’s team of system administrators each deal with hundreds of systems with varying levels of security requirements and find it difficult to handle the multitude of usernames and passwords they each have. What type of solution should she recommend to ensure that passwords are properly handled and that features like logging and password rotation occur?

Responda

A. A credential management system
B. A strong password policy
C. Separation of duties
D. Single sign-on

Questão 32

Questão

Ed’s Windows system can’t connect to the network and ipconfig shows the following: What has occurred on the system?

Image:

68 (binary/octet-stream)

Responda

A. The system has been assigned an invalid IP address by its DHCP server.
B. The system has a manually assigned IP address.
C. The system has failed to get a DHCP address and has assigned itself an address.
D. The subnet mask is set incorrectly and the system cannot communicate with the gateway.

Questão 33

Questão

What term is commonly used to describe initial creation of a user account in the provisioning process?

Responda

A. Enrollment
B. Clearance verification
C. Background checks
D. Initialization

Questão 34

Questão

What type of forensic investigation typically has the highest evidentiary standards?

Responda

A. Administrative
B. Criminal
C. Civil
D. Industry

Questão 35

Questão

There is a significant conflict between the drive for profit and the security requirements that Olivia’s organization has standardized. Olivia’s role means that decreased usability and loss of profit due to her staff’s inability to use the system is her major concern. What is the most likely role that Olivia plays in her organization?

Responda

A. Business manager
B. Information security analyst
C. Data processor
D. Mission owner

Questão 36

Questão

Tom believes that a customer of his Internet service provider has been exploiting a vulnerability in his system to read the email messages of other customers. If true, what law did the customer most likely violate?

Responda

A. ECPA
B. CALEA
C. HITECH
D. Privacy Act

Questão 37

Questão

In the ring protection model shown here, what ring contains user programs and applications?

Image:

69 (binary/octet-stream)

Responda

A. Ring 0
B. Ring 1
C. Ring 2
D. Ring 3

Questão 38

Questão

Metrics like the attack vector, complexity, exploit maturity, and how much user interaction is required are all found in what scoring system?

Responda

A. CVE
B. CVSS
C. CNA
D. NVD

Questão 39

Questão

In which of the following circumstances does an individual not have a reasonable expectation of privacy?

Responda

A. Placing a telephone call on your cell phone
B. Sending a letter through the US mail
C. Sending an email at work
D. Retrieving your personal voicemail

Questão 40

Questão

During which of the following disaster recovery tests does the team sit together and discuss the response to a scenario but not actually activate any disaster recovery controls?

Responda

A. Checklist review
B. Full interruption test
C. Parallel test
D. Tabletop exercise

Questão 41

Questão

Susan wants to integrate her website to allow users to use accounts from sites like Google. What technology should she adopt?

Responda

A. Kerberos
B. LDAP
C. OpenID
D. SESAME

Questão 42

Questão

Tom is conducting a business continuity planning effort for Orange Blossoms, a fruit orchard located in Central Florida. During the assessment process, the committee determined that there is a small risk of snow in the region but that the cost of implementing controls to reduce the impact of that risk is not warranted. They elect to not take any specific action in response to the risk. What risk management strategy is Orange Blossoms pursuing?

Responda

A. Risk mitigation
B. Risk transference
C. Risk avoidance
D. Risk acceptance

Questão 43

Questão

What root security issue causes the following issues? Cross-site scripting SQL injection Buffer overflows Cross-site request forgery

Responda

A. Lack of API security
B. Improper error handling
C. Improper or missing input validation
D. Source code design issues

Questão 44

Questão

Jack’s organization is a multinational nonprofit that has small offices in many developing countries throughout the world. They need to implement an access control system that allows flexibility and that can work despite poor Internet connectivity at their locations. What is the best type of access control design for Jack’s organization?

Responda

A. Centralized access control
B. Mandatory access control
C. Decentralized access control
D. Rule-based access control

Questão 45

Questão

What US government classification label is applied to information that, if disclosed, could cause serious damage to national security and also requires that the damage that would be caused is able to be described or identified by the classification authority?

Responda

A. Classified
B. Secret
C. Confidential
D. Top Secret

Questão 46

Questão

Mike and Renee would like to use an asymmetric cryptosystem to communicate with each other. They are located in different parts of the country but have exchanged encryption keys by using digital certificates signed by a mutually trusted certificate authority. When the certificate authority (CA) created Renee’s digital certificate, what key was contained within the body of the certificate?

Responda

A. Renee’s public key
B. Renee’s private key
C. CA’s public key
D. CA’s private key

Questão 47

Questão

Mike and Renee would like to use an asymmetric cryptosystem to communicate with each other. They are located in different parts of the country but have exchanged encryption keys by using digital certificates signed by a mutually trusted certificate authority. When the certificate authority created Renee’s digital certificate, what key did it use to digitally sign the completed certificate?

Responda

A. Renee’s public key
B. Renee’s private key
C. CA’s public key
D. CA’s private key

Questão 48

Questão

Mike and Renee would like to use an asymmetric cryptosystem to communicate with each other. They are located in different parts of the country but have exchanged encryption keys by using digital certificates signed by a mutually trusted certificate authority. When Mike receives Renee’s digital certificate, what key does he use to verify the authenticity of the certificate?

Responda

A. Renee’s public key
B. Renee’s private key
C. CA’s public key
D. CA’s private key

Questão 49

Questão

Mike and Renee would like to use an asymmetric cryptosystem to communicate with each other. They are located in different parts of the country but have exchanged encryption keys by using digital certificates signed by a mutually trusted certificate authority. Mike would like to send Renee a private message using the information gained during this exchange. What key should he use to encrypt the message?

Responda

A. Renee’s public key
B. Renee’s private key
C. CA’s public key
D. CA’s private key

Questão 50

Questão

Which one of the following tools may be used to directly violate the confidentiality of communications on an unencrypted VoIP network?

Responda

A. Nmap
B. Nessus
C. Wireshark
D. Nikto

Questão 51

Questão

How does single sign-on increase security?

Responda

A. It decreases the number of accounts required for a subject.
B. It helps decrease the likelihood that users will write down their passwords.
C. It provides logging for each system that it is connected to.
D. It provides better encryption for authentication data.

Questão 52

Questão

Which one of the following cryptographic algorithms supports the goal of nonrepudiation?

Responda

A. Blowfish
B. DES
C. AES
D. RSA

Questão 53

Questão

Microsoft’s STRIDE threat assessment framework uses six categories for threats: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. If a penetration tester is able to modify audit logs, what STRIDE categories best describe this issue?

Responda

A. Tampering and information disclosure
B. Elevation of privilege and tampering
C. Repudiation and denial of service
D. Repudiation and tampering

Questão 54

Questão

RIP, OSPF, and BGP are all examples of protocols associated with what type of network device?

Responda

A. Switches
B. Bridges
C. Routers
D. Gateways

Questão 55

Questão

AES-based CCMP and 802.1x replaced what security protocol that was designed as part of WPA to help fix the significant security issues found in WEP?

Responda

A. TLS
B. TKIP
C. EAP
D. PEAP

Questão 56

Questão

The government agency that Ben works at installed a new access control system. The system uses information such as Ben’s identity, department, normal working hours, job category, and location to make authorization. What type of access control system did Ben’s employer adopt?

Responda

A. Role-based access control
B. Attribute-based access control
C. Administrative access control
D. System discretionary access control

Questão 57

Questão

The Low Orbit Ion Cannon (LOIC) attack tool used by Anonymous leverages a multitude of home PCs to attack its chosen targets. This is an example of what type of network attack?

Responda

A. DDoS
B. Ionization
C. Zombie horde
D. Teardrop

Questão 58

Questão

Andrew believes that a digital certificate belonging to his organization was compromised and would like to add it to a Certificate Revocation List. Who must add the certificate to the CRL?

Responda

A. Andrew
B. The root authority for the top-level domain
C. The CA that issued the certificate
D. The revocation authority for the top-level domain

Questão 59

Questão

Amanda is considering the implementation of a database recovery mechanism recommended by a consultant. In the recommended approach, an automated process will move records of transactions from the primary site to a backup site on an hourly basis. What type of database recovery technique is the consultant describing?

Responda

A. Electronic vaulting
B. Transaction logging
C. Remote mirroring
D. Remote journaling

Questão 60

Questão

A process on a system needs access to a file that is currently in use by another process. What state will the process scheduler place this process in until the file becomes available?

Responda

A. Running
B. Ready
C. Waiting
D. Stopped

Questão 61

Questão

Which one of the following investigation types has the loosest standards for the collection and preservation of information?

Responda

A. Civil investigation
B. Operational investigation
C. Criminal investigation
D. Regulatory investigation

Questão 62

Questão

Sue was required to sign an NDA when she took a job at her new company. Why did the company require her to sign it?

Responda

A. To protect the confidentiality of their data
B. To ensure that Sue did not delete their data
C. To prevent Sue from directly competing with them in the future
D. To require Sue to ensure the availability for their data as part of her job

Questão 63

Questão

Susan is concerned about the FAR associated with her biometric technology. What is the best method to deal with the FAR?

Responda

A. Adjust the CER.
B. Change the sensitivity of the system to lower the FRR.
C. Add a second factor.
D. Replace the biometric system.

Questão 64

Questão

What type of virus is characterized by the use of two or more different propagation mechanisms to improve its likelihood of spreading between systems?

Responda

A. Stealth virus
B. Polymorphic virus
C. Multipartite virus
D. Encrypted virus

Questão 65

Questão

Which of the following is not a code review process?

Responda

A. Email pass-around
B. Over the shoulder
C. Pair programming
D. IDE forcing

Questão 66

Questão

Which one of the following attack types depends on precise timing?

Responda

A. TOCTOU
B. SQL injection
C. Pass the hash
D. Cross-site scripting

Questão 67

Questão

What process adds a header and a footer to data received at each layer of the OSI model?

Responda

A. Attribution
B. Encapsulation
C. TCP wrapping
D. Data hiding

Questão 68

Questão

Attackers who compromise websites often acquire databases of hashed passwords. What technique can best protect these passwords against automated password cracking attacks that use precomputed values?

Responda

A. Using the MD5 hashing algorithm
B. Using the SHA-1 hashing algorithm
C. Salting
D. Double-hashing

Questão 69

Questão

Jim starts a new job as a system engineer, and his boss provides him with a document entitled “Forensic Response Guidelines.” Which one of the following statements is not true?

Responda

A. Jim must comply with the information in this document.
B. The document contains information about forensic examinations.
C. Jim should read the document thoroughly.
D. The document is likely based on industry best practices.

Questão 70

Questão

Which one of the following tools is most often used for identification purposes and is not suitable for use as an authenticator?

Responda

A. Password
B. Retinal scan
C. Username
D. Token

Questão 71

Questão

Ben needs to verify that the most recent patch for his organization’s critical application did not introduce issues elsewhere. What type of testing does Ben need to conduct to ensure this?

Responda

A. Unit testing
B. White box
C. Regression testing
D. Black box

Questão 72

Questão

Tamara recently decided to purchase cyber-liability insurance to cover her company’s costs in the event of a data breach. What risk management strategy is she pursuing?

Responda

A. Risk acceptance
B. Risk mitigation
C. Risk transference
D. Risk avoidance

Questão 73

Questão

Which of the following is not one of the four canons of the (ISC)2 code of ethics?

Responda

A. Avoid conflicts of interest that may jeopardize impartiality.
B. Protect society, the common good, necessary public trust and confidence, and the infrastructure.
C. Act honorably, honestly, justly, responsibly, and legally.
D. Provide diligent and competent service to principals.

Questão 74

Questão

Jim wants to allow a partner organization’s Active Directory forest (B) to access his domain forest’s (A)’s resources but doesn’t want to allow users in his domain to access B’s resources. He also does not want the trust to flow upward through the domain tree as it is formed. What should he do?

Responda

A. Set up a two-way transitive trust.
B. Set up a one-way transitive trust.
C. Set up a one-way nontransitive trust.
D. Set up a two-way nontransitive trust.

Questão 75

Questão

Susan’s team is performing code analysis by manually reviewing the code for flaws. What type of analysis are they performing?

Responda

A. Gray box
B. Static
C. Dynamic
D. Fuzzing

Questão 76

Questão

The IP address 201.19.7.45 is what type of address?

Responda

A. A public IP address
B. An RFC 1918 address
C. An APIPA address
D. A loopback address

Questão 77

Questão

Sam is a security risk analyst for an insurance company. He is currently examining a scenario where a hacker might use a SQL injection attack to deface a web server due to a missing patch in the company’s web application. In this scenario, what is the vulnerability?

Responda

A. Unpatched web application
B. Web defacement
C. Hacker
D. Operating system

Questão 78

Questão

Which one of the following categories of secure data removal techniques would include degaussing?

Responda

A. Clear
B. Shrink
C. Purge
D. Destroy

Questão 79

Questão

What type of alternate processing facility includes all of the hardware and data necessary to restore operations in a matter of minutes or seconds?

Responda

A. Hot site
B. Warm site
C. Cold site
D. Mobile site

Questão 80

Questão

What UDP port is typically used by the syslog service?

Responda

A. 443
B. 514
C. 515
D. 445

Questão 81

Questão

Fred finds a packet that his protocol analyzer shows with both PSH and URG set. What type of packet is he looking at, and what do the flags mean?

Responda

A. A UDP packet; PSH and URG are used to indicate that the data should be sent at high speed
B. A TCP packet; PSH and URG are used to clear the buffer and indicate that the data is urgent
C. A TCP packet; PSH and URG are used to preset the header and indicate that the speed of the network is unregulated
D. A UDP packet; PSH and URG are used to indicate that the UDP buffer should be cleared and that the data is urgent

Questão 82

Questão

What code review process is shown here?

Image:

70 (binary/octet-stream)

Responda

A. Static inspection
B. Fagan inspection
C. Dynamic inspection
D. Interface testing

Questão 83

Questão

During a log review, Karen discovers that the system she needs to gather logs from has the log setting shown here. What problem is Karen likely to encounter?

Image:

71 (binary/octet-stream)

Responda

A. Too much log data will be stored on the system.
B. The system is automatically purging archived logs.
C. The logs will not contain the information needed.
D. The logs will only contain the most recent 20 MB of log data.

Questão 84

Questão

While investigating a widespread distributed denial of service attack, Matt types in the IP address of one of the attacking systems into his browser and sees the following page. What type of devices is the botnet likely composed of?

Image:

72 (binary/octet-stream)

Responda

A. SCADA
B. Cloud infrastructure
C. Web servers
D. IoT

Questão 85

Questão

Alejandro is an incident response analyst for a large corporation. He is on the midnight shift when an intrusion detection system alerts him to a potential brute-force password attack against one of the company’s critical information systems. He performs an initial triage of the event before taking any additional action. What stage of the incident response process is Alejandro currently conducting?

Responda

A. Detection
B. Response
C. Recovery
D. Mitigation

Questão 86

Questão

Alejandro is an incident response analyst for a large corporation. He is on the midnight shift when an intrusion detection system alerts him to a potential brute-force password attack against one of the company’s critical information systems. He performs an initial triage of the event before taking any additional action. If Alejandro’s initial investigation determines that a security incident is likely taking place, what should be his next step?

Responda

A. Investigate the root cause.
B. File a written report.
C. Activate the incident response team.
D. Attempt to restore the system to normal operations.

Questão 87

Questão

Alejandro is an incident response analyst for a large corporation. He is on the midnight shift when an intrusion detection system alerts him to a potential brute-force password attack against one of the company’s critical information systems. He performs an initial triage of the event before taking any additional action. As the incident response progresses, during which stage should the team conduct a root cause analysis?

Responda

A. Response
B. Reporting
C. Remediation
D. Lessons Learned

Questão 88

Questão

Barry recently received a message from Melody that Melody encrypted using symmetric cryptography. What key should Barry use to decrypt the message?

Responda

A. Barry’s public key
B. Barry’s private key
C. Melody’s public key
D. Shared secret key

Questão 89

Questão

After you do automated functional testing with 100 percent coverage of an application, what type of error is most likely to remain?

Responda

A. Business logic errors
B. Input validation errors
C. Runtime errors
D. Error handling errors

Questão 90

Questão

During what phase of the incident response process would security professionals analyze the process itself to determine whether any improvements are warranted?

Responda

A. Lessons Learned
B. Remediation
C. Recovery
D. Reporting

Questão 91

Questão

What law prevents the removal of protection mechanisms placed on a copyrighted work by the copyright holder?

Responda

A. HIPAA
B. DMCA
C. GLBA
D. ECPA

Questão 92

Questão

Linda is selecting a disaster recovery facility for her organization, and she wishes to retain independence from other organizations as much as possible. She would like to choose a facility that balances cost and recovery time, allowing activation in about one week after a disaster is declared. What type of facility should she choose?

Responda

A. Cold site
B. Warm site
C. Mutual assistance agreement
D. Hot site

Questão 93

Questão

Purchasing insurance is a form of what type of risk response?

Responda

A. Transfer
B. Avoid
C. Mitigate
D. Accept

Questão 94

Questão

What type of penetration testing provides detail on the scope of a penetration test—including items like what systems would be targeted—but does not provide full visibility into the configuration or other details of the systems or networks the penetration tester must test?

Responda

A. Crystal box
B. White box
C. Black box
D. Gray box

Questão 95

Questão

Test coverage is computed using which of the following formulas?

Responda

A. Number of use cases tested/total number of use cases
B. Number of lines of code tested/total number of lines of code
C. Number of functions tested/total number of functions
D. Number of conditional branches tested/Total number of testable branches

Questão 96

Questão

TCP and UDP both operate at what layer of the OSI model?

Responda

A. Layer 2
B. Layer 3
C. Layer 4
D. Layer 5

Questão 97

Questão

Which one of the following goals of physical security environments occurs first in the functional order of controls?

Responda

A. Delay
B. Detection
C. Deterrence
D. Denial

Questão 98

Questão

In what type of trusted recovery process is the system able to recover without administrator intervention but the system may suffer some loss of data?

Responda

A. Automated recovery
B. Manual recovery
C. Automated recovery without undue data loss
D. Function recovery

Questão 99

Questão

Skip needs to transfer files from his PC to a remote server. What protocol should he use instead of FTP?

Responda

A. SCP
B. SSH
C. HTTP
D. Telnet

Questão 100

Questão

Ben’s New York–based commercial web service collects personal information from California residents. What does the California Online Privacy Protection Act require Ben to do to be compliant?

Responda

A. Ben must encrypt all personal data he receives.
B. Ben must comply with the EU GDPR.
C. Ben must have a conspicuously posted privacy policy on his site.
D. Ben must provide notice and choice for users of his website.

Questão 101

Questão

What process is used to verify that a dial-up user is connecting from the phone number they are preauthorized to use in a way that avoids spoofing?

Responda

A. CallerID
B. Callback
C. CHAP
D. PPP

Questão 102

Questão

The Meltdown bug announced in early 2018 exposed kernel data to user application space. What two rings are these referred to as for x86 PCs?

Responda

A. Rings 0 and 1
B. Rings 1 and 2
C. Rings 1 and 3
D. Rings 0 and 3

Questão 103

Questão

What advantage do iris scans have over most other types of biometric factors?

Responda

A. Iris scanners are harder to deceive.
B. Irises don’t change as much as other factors.
C. Iris scanners are cheaper than other factors.
D. Iris scans cannot be easily replicated.

Questão 104

Questão

Alex would like to ask all of his staff to sign an agreement that they will not share his organization’s intellectual property with unauthorized individuals. What type of agreement should Alex ask employees to sign?

Responda

A. SLA
B. NDA
C. OLA
D. DLP

Questão 105

Questão

Matthew, Richard, and Christopher would like to exchange messages with each other using symmetric cryptography. They want to ensure that each individual can privately send a message to another individual without the third person being able to read the message. How many keys do they need?

Responda

A. 1
B. 2
C. 3
D. 6

Questão 106

Questão

Which one of the following is not an example of criminal law?

Responda

A. Gramm-Leach-Bliley Act
B. Computer Fraud and Abuse Act
C. Electronic Communications Privacy Act
D. Identity Theft and Assumption Deterrence Act

Questão 107

Questão

What is the best way to ensure email confidentiality in motion?

Responda

A. Use TLS between the client and server.
B. Use SSL between the client and server.
C. Encrypt the email content.
D. Use a digital signature.

Questão 108

Questão

Brenda is analyzing the web server logs after a successful compromise of her organization’s web-based order processing application. She finds an entry in the log file showing that a user entered the following information as his last name when placing an order: Smith’;DROP TABLE orders;-- What type of attack was attempted?

Responda

A. Buffer overflow
B. Cross-site scripting
C. Cross-site request forgery
D. SQL injection

Questão 109

Questão

What type of policy describes how long data is kept before destruction?

Responda

A. Classification
B. Audit
C. Record retention
D. Availability

Questão 110

Questão

What is the goal of the BCP process?

Responda

A. RTO < MTD
B. MTD < RTO
C. RPO < MTD
D. MTD < RPO

Questão 111

Questão

During which phase of the incident response process would administrators design new security controls intended to prevent a recurrence of the incident?

Responda

A. Reporting
B. Recovery
C. Remediation
D. Lessons Learned

Questão 112

Questão

Bethany received an email from one of her colleagues with an unusual attachment named smime.p7s. She does not recognize the attachment and is unsure what to do. What is the most likely scenario?

Responda

A. This is an encrypted email message.
B. This is a phishing attack.
C. This is embedded malware.
D. This is a spoofing attack.

Questão 113

Questão

Kim is the database security administrator for Aircraft Systems, Inc. (ASI). ASI is a military contractor engaged in the design and analysis of aircraft avionics systems and regularly handles classified information on behalf of the government and other government contractors. Kim is concerned about ensuring the security of information stored in ASI databases. Kim’s database is a multilevel security database, and different ASI employees have different security clearances. The database contains information on the location of military aircraft containing ASI systems to allow ASI staff to monitor those systems. Kim learned that the military is planning a classified mission that involves some ASI aircraft. She is concerned that employees not cleared for the mission may learn of it by noticing the movement of many aircraft to the region. Individual employees are cleared to know about the movement of an individual aircraft, but they are not cleared to know about the overall mission. What type of attack is Kim concerned about?

Responda

A. Aggregation
B. SQL injection
C. Inference
D. Multilevel security

Questão 114

Questão

Kim is the database security administrator for Aircraft Systems, Inc. (ASI). ASI is a military contractor engaged in the design and analysis of aircraft avionics systems and regularly handles classified information on behalf of the government and other government contractors. Kim is concerned about ensuring the security of information stored in ASI databases. Kim’s database is a multilevel security database, and different ASI employees have different security clearances. The database contains information on the location of military aircraft containing ASI systems to allow ASI staff to monitor those systems. What technique can Kim employ to prevent employees not cleared for the mission from learning the true location of the aircraft?

Responda

A. Input validation
B. Polyinstantiation
C. Parameterization
D. Server-side validation

Questão 115

Questão

Kim is the database security administrator for Aircraft Systems, Inc. (ASI). ASI is a military contractor engaged in the design and analysis of aircraft avionics systems and regularly handles classified information on behalf of the government and other government contractors. Kim is concerned about ensuring the security of information stored in ASI databases. Kim’s database is a multilevel security database, and different ASI employees have different security clearances. The database contains information on the location of military aircraft containing ASI systems to allow ASI staff to monitor those systems. Kim’s database uniquely identifies aircraft by using their tail number. Which one of the following terms would not necessarily accurately describe the tail number?

Responda

A. Database field
B. Foreign key
C. Primary key
D. Candidate key

Questão 116

Questão

Kim is the database security administrator for Aircraft Systems, Inc. (ASI). ASI is a military contractor engaged in the design and analysis of aircraft avionics systems and regularly handles classified information on behalf of the government and other government contractors. Kim is concerned about ensuring the security of information stored in ASI databases. Kim’s database is a multilevel security database, and different ASI employees have different security clearances. The database contains information on the location of military aircraft containing ASI systems to allow ASI staff to monitor those systems. Kim would like to create a key that enforces referential integrity for the database. What type of key does she need to create?

Responda

A. Primary key
B. Foreign key
C. Candidate key
D. Master key

Questão 117

Questão

Doug is choosing a software development life-cycle model for use in a project he is leading to develop a new business application. He has very clearly defined requirements and would like to choose an approach that places an early emphasis on developing comprehensive documentation. He does not have a need for the production of rapid prototypes or iterative improvement. Which model is most appropriate for this scenario?

Responda

A. Agile
B. Waterfall
C. Spiral
D. DevOps

Questão 118

Questão

What should be true for salts used in password hashes?

Responda

A. A single salt should be set so passwords can be de-hashed as needed.
B. A single salt should be used so the original salt can be used to check passwords against their hash.
C. Unique salts should be stored for each user.
D. Unique salts should be created every time a user logs in.

Questão 119

Questão

Which individual bears the ultimate responsibility for data protection tasks?

Responda

A. Data owner
B. Data custodian
C. User
D. Auditor

Questão 120

Questão

What type of assessment methods are associated with mechanisms and activities based on the recommendations of NIST SP800-53A, the Guide for Assessing Security Controls in Federal Information Systems?

Responda

A. Examine and interview
B. Test and assess
C. Test and interview
D. Examine and test

Questão 121

Questão

Which one of the following controls would be most effective in detecting zero-day attack attempts?

Responda

A. Signature-based intrusion detection
B. Anomaly-based intrusion detection
C. Strong patch management
D. Full-disk encryption

Questão 122

Questão

The ability to store and generate passwords, provide logging and auditing capabilities, and allow password check-in and check-out are all features of what type of system?

Responda

A. AAA
B. Credential management
C. Two-factor authentication
D. Kerberos

Questão 123

Questão

Which one of the following components should be included in an organization’s emergency response guidelines?

Responda

A. Secondary response procedures for first responders
B. Long-term business continuity protocols
C. Activation procedures for the organization’s cold sites
D. Contact information for ordering equipment

Questão 124

Questão

When Jim enters his organization’s data center, he has to use a smart card and code to enter and is allowed through one set of doors. The first set of doors closes, and he must then use his card again to get through a second set, which locks behind him. What type of control is this, and what is it called?

Responda

A. A physical control; a one-way trapdoor
B. A logical control; a dual-swipe authorization
C. A directive control; a one-way access corridor
D. A preventive access control; a mantrap

Questão 125

Questão

What security control may be used to implement a concept known as two-person control?

Responda

A. Mandatory vacation
B. Separation of duties
C. Least privilege
D. Defense in depth

	Criado por Requiemdust Sheena mais de 4 anos atrás

Próximo

Quix15 - 125Q

Descrição

Resumo de Recurso

Questão 1

Questão 2

Questão 3

Questão 4

Questão 5

Questão 6

Questão 7

Questão 8

Questão 9

Questão 10

Questão 11

Questão 12

Questão 13

Questão 14

Questão 15

Questão 16

Questão 17

Questão 18

Questão 19

Questão 20

Questão 21

Questão 22

Questão 23

Questão 24

Questão 25

Questão 26

Questão 27

Questão 28

Questão 29

Questão 30

Questão 31

Questão 32

Questão 33

Questão 34

Questão 35

Questão 36

Questão 37

Questão 38

Questão 39

Questão 40

Questão 41

Questão 42

Questão 43

Questão 44

Questão 45

Questão 46

Questão 47

Questão 48

Questão 49

Questão 50

Questão 51

Questão 52

Questão 53

Questão 54

Questão 55

Questão 56

Questão 57

Questão 58

Questão 59

Questão 60

Questão 61

Questão 62

Questão 63

Questão 64

Questão 65

Questão 66

Questão 67

Questão 68

Questão 69

Questão 70

Questão 71

Questão 72

Questão 73

Questão 74

Questão 75

Questão 76