The Structured Query Language (SQL) implements Discretionary Access Controls (DAC) using
Which of the following actions will reduce risk to a laptop before traveling to a high risk area?
All of the following items should be included in a Business Impact Analysis (BIA) questionnaire EXCEPT questions that
What is the MOST important consideration from a data security perspective when an organization plans to relocate?
At a MINIMUM, audits of permissions to individual or group accounts should be scheduled
Which of the following would BEST support effective testing of patch compatibility when patches are applied to an organization’s systems?
A company receives an email threat informing of an Imminent Distributed Denial of Service (DDoS) attack
targeting its web application, unless ransom is paid. Which of the following techniques BEST addresses that threat?
Which of the following is a common feature of an Identity as a Service (IDaaS) solution?
The process of mutual authentication involves a computer system authenticating a user and authenticating the
Which of the following is a limitation of the Common Vulnerability Scoring System (CVSS) as it relates to conducting code review?
A disadvantage of an application filtering firewall is that it can lead to
An organization is selecting a service provider to assist in the consolidation of multiple computing sites including development, implementation and ongoing support of various computer systems. Which of the following MUST be verified by the Information Security Department?
What would be the PRIMARY concern when designing and coordinating a security assessment for an Automatic Teller Machine (ATM) system?
Which of the following MUST be done when promoting a security awareness program to senior management?
During an audit of system management, auditors find that the system administrator has not been trained. What actions need to be taken at once to ensure the integrity of systems?
Which of the following does the Encapsulating Security Payload (ESP) provide?
The BEST method of demonstrating a company's security level to potential customers is
By allowing storage communications to run on top of Transmission Control Protocol/Internet Protocol (TCP/IP) with a Storage Area Network (SAN), the
Which of the following System and Organization Controls (SOC) report types should an organization request if they require a period of time report covering security and availability for a particular system?
Organization A is adding a large collection of confidential data records that it received when it acquired Organization B to its data store. Many of the users and staff from Organization B are no longer available. Which of the following MUST Organization A 0do to property classify and secure the acquired data?
Which of the following will help identify the source internet protocol (IP) address of malware being exected on a computer?
Which of the following processes has the PRIMARY purpose of identifying outdated software versions, missing patches, and lapsed system updates?
When implementing a data classification program, why is it important to avoid too much granularity?
Which one of the following can be used to detect an anomaly in a system by keeping track of the state of files that do not normally change?\
The use of private and public encryption keys is fundamental in the implementation of which of the following?
Who in the organization is accountable for classification of data information assets?
Which security service is served by the process of encryption plaintext with the sender’s private key and decrypting cipher text with the sender’s public key?
Which technique can be used to make an encryption scheme more resistant to a known plaintext attack?
What is the second phase of Public Key Infrastructure (PKI) key/certificate life-cycle management?
An external attacker has compromised an organization’s network security perimeter and installed a sniffer onto an inside computer. Which of the following is the MOST effective layer of security the organization could have implemented to mitigate the attacker’s ability to gain further information?
Which of the following factors contributes to the weakness of Wired Equivalent Privacy (WEP) protocol?
Which of the following is the BEST network defense against unknown types of attacks or stealth attacks in progress?
In a Transmission Control Protocol/Internet Protocol (TCP/IP) stack, which layer is responsible for negotiating and establishing a connection with another node?
At what level of the Open System Interconnection (OSI) model is data at rest on a Storage Area Network (SAN) located?
Which of the following is used by the Point-to-Point Protocol (PPP) to determine packet formats?
Which of the following operates at the Network Layer of the Open System Interconnection (OSI) model?
An input validation and exception handling vulnerability has been discovered on a critical web-based system. Which of the following is MOST suited to quickly implement a control?
Refer to the information below to answer the question.
A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive e-mail, search the web, and use instant messaging. The organization’s Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee's access.
Which of the following could have MOST likely prevented the Peer-to-Peer (P2P) program from being installed on the computer?
Which of the following is the MOST effective attack against cryptographic hardware modules?
In which of the following programs is it MOST important to include the collection of security process data?
Which of the following could cause a Denial of Service (DoS) against an authentication system?
Which of the following is the MOST important consideration when developing a Disaster Recovery Plan (DRP)?
When designing a vulnerability test, which one of the following is likely to give the BEST indication of what components currently operate on the network?
In which identity management process is the subject’s identity established?
When writing security assessment procedures, what is the MAIN purpose of the test outputs and reports?
A vulnerability in which of the following components would be MOST difficult to detect?
During which of the following processes is least privilege implemented for a user account?
An organization regularly conducts its own penetration tests. Which of the following scenarios MUST be covered for the test to be effective?
How should an organization determine the priority of its remediation efforts after a vulnerability assessment has been conducted?
In the Software Development Life Cycle (SDLC), maintaining accurate hardware and software inventories is a critical part of
A company was ranked as high in the following National Institute of Standards and Technology (NIST) functions: Protect, Detect, Respond and Recover. However, a low maturity grade was attributed to the Identify function. In which of the following the controls categories does this company need to improve when analyzing its processes individually?
Which of the following adds end-to-end security inside a Layer 2 Tunneling Protocol (L2TP) Internet Protocol Security (IPSec) connection?
Which of the following is MOST important when deploying digital certificates?
Although code using a specific program language may not be susceptible to a buffer overflow attack,
A continuous information security monitoring program can BEST reduce risk through which of the following?
Which of the following types of business continuity tests includes assessment of resilience to internal and external risks without endangering live operations?
An organization is found lacking the ability to properly establish performance indicators for its Web hosting solution during an audit. What would be the MOST probable cause?
A Business Continuity Plan/Disaster Recovery Plan (BCP/DRP) will provide which of the following?
What should be the FIRST action to protect the chain of evidence when a desktop computer is involved?
What is the MOST important step during forensic analysis when trying to learn the purpose of an unknown application?
Intellectual property rights are PRIMARY concerned with which of the following?
An important principle of defense in depth is that achieving information security requires a balanced focus on which PRIMARY elements?
Which of the following represents the GREATEST risk to data confidentiality?
Which of the following types of technologies would be the MOST cost-effective method to provide a reactive control for protecting personnel in public areas?
A company whose Information Technology (IT) services are being delivered from a Tier 4 data center, is preparing a companywide Business Continuity Planning (BCP). Which of the following failures should the IT manager be concerned with?
When assessing an organization’s security policy according to standards established by the International Organization for Standardization (ISO) 27001 and 27002, when can management responsibilities be defined?
Which of the following is the MOST appropriate action when reusing media that contains sensitive data?
Which of the following MUST be scalable to address security concerns raised by the integration of third-party
identity services?
An organization has outsourced its financial transaction processing to a Cloud Service Provider (CSP) who will provide them with Software as a Service (SaaS). If there was a data breach who is responsible for monetary losses?
What is the BEST location in a network to place Virtual Private Network (VPN) devices when an internal review reveals network design flaws in remote access?
An organization’s security policy delegates to the data owner the ability to assign which user roles have access
to a particular resource. What type of authorization mechanism is being used?
In a High Availability (HA) environment, what is the PRIMARY goal of working with a virtual router address as the gateway to a network?
What is the correct order of steps in an information security assessment?
Place the information security assessment steps on the left next to the numbered boxes on the right in the
correct order.
Which of the following is the BEST reason for writing an information security policy?
Which of the following could elicit a Denial of Service (DoS) attack against a credential management system?
For privacy protected data, which of the following roles has the highest authority for establishing dissemination rules for the data?
During a fingerprint verification process, which of the following is used to verify identity and authentication?
Sensitive customer data is going to be added to a database. What is the MOST effective implementation for ensuring data privacy?
What security risk does the role-based access approach mitigate MOST effectively?
Retaining system logs for six months or longer can be valuable for what activities?
Which of the following entities is ultimately accountable for data remanence vulnerabilities with data replicated by a cloud service provider?
In which order, from MOST to LEAST impacted, does user awareness training reduce the occurrence of the events below?
The BEST example of the concept of "something that a user has" when providing an authorized user access to a computing system is
Which of the following is a function of Security Assertion Markup Language (SAML)?
Which of the following command line tools can be used in the reconnaisance phase of a network vulnerability assessment?
What is the PRIMARY reason for ethics awareness and related policy implementation?
If an attacker in a SYN flood attack uses someone else's valid host address as the source address, the system under attack will send a large number of Synchronize/Acknowledge (SYN/ACK) packets to the
During an investigation of database theft from an organization's web site, it was determined that the Structured Query Language (SQL) injection technique was used despite input validation with client-side scripting. Which of the following provides the GREATEST protection against the same attack occurring again?
Refer to the information below to answer the question.
A large, multinational organization has decided to outsource a portion of their Information Technology (IT) organization to a third-party provider’s facility. This provider will be responsible for the design, development, testing, and support of several critical, customer-based applications used by the organization.
What additional considerations are there if the third party is located in a different country?
Which of the following is a PRIMARY benefit of using a formalized security testing report format and structure?
Which of the following is of GREATEST assistance to auditors when reviewing system configurations?
A Virtual Machine (VM) environment has five guest Operating Systems (OS) and provides strong isolation. What MUST an administrator review to audit a user’s access to data files?
An organization needs a general purpose document to prove that its internal controls properly address security, availability, processing integrity, confidentiality or privacy risks. Which of the following reports is required?
Which of the following BEST describes the purpose of the reference monitor when defining access control to enforce the security model?
The security architect is designing and implementing an internal certification authority to generate digital certificates for all employees. Which of the following is the BEST solution to securely store the private keys?
How does security in a distributed file system using mutual authentication differ from file security in a multi-user host?
a large organization uses biometrics to allow access to its facilities. It adjusts the biometric value for incorrectly granting or denying access so that the two numbers are the same.
What is this value called?
Which of the following VPN configurations should be used to separate Internet and corporate traffic?
Which of the following is the FIRST requirement a data owner should consider before implementing a data retention policy?
Which of the following is the top barrier for companies to adopt cloud technology?
Which of the following is MOST important to follow when developing information security controls for an organization?
How should the retention period for an organization's social media content be defined?
Which part of an operating system (OS) is responsible for providing security interfaces among the hardware, OS, and other parts of the computing system?
Which of the following BEST describes an access control method utilizing cryptographic keys derived from a smart card private key that is embedded within mobile devices?
What is the BEST approach for controlling access to highly sensitive information when employees have the same level of security clearance?
Users require access rights that allow them to view the average salary of groups of employees. Which control would prevent the users from obtaining an individual employee’s salary?
A manufacturing organization wants to establish a Federated Identity Management (FIM) system with its 20 different supplier companies. Which of the following is the BEST solution for the manufacturing organization?
What is the BEST approach to addressing security issues in legacy web applications?
Which of the following is a web application control that should be put into place to prevent exploitation of Operating System (OS) bugs?
Which of the following is the PRIMARY risk with using open source software in a commercial software construction?
When in the Software Development Life Cycle (SDLC) MUST software security functional requirements be defined?
Which of the following is the BEST method to prevent malware from being introduced into a production environment?
The configuration management and control task of the certification and accreditation process is incorporated in which phase of the System Development Life Cycle (SDLC)?
A Java program is being developed to read a file from computer A and write it to computer B, using a third computer C. The program is not working as expected. What is the MOST probable security feature of Java preventing the program from operating as intended?
Which of the following BEST describes the responsibilities of a data owner?
Which of the following is an effective control in preventing electronic cloning of Radio Frequency Identification (RFID) based access cards?
Which of the following is MOST important when assigning ownership of an asset to a department?
Which of the following is an initial consideration when developing an information security management system?