Question 1

Risk is defined as:

Accepted Answer

A)  Quantitative plus qualitative impact 
B)  Asset loss times likelihood of event 
C)  Advisory plus capability plus vulnerability 
D)  Threat times vulnerability divided by control 
A)  Quantitative plus qualitative impact 
B)  Asset loss times likelihood of event 
C)  Advisory plus capability plus vulnerability 
D)  Threat times vulnerability divided by control

Question 2

You have used a newly released forensic investigation tool, which doesn't meet the Daubert Test, during a case. The case has ended-up in court. What argument could the defense make to weaken your case?

Accepted Answer

A)  The tool hasn't been tested by the International Standards Organization (ISO) 
B)  Only the local law enforcement should use the tool 
C)  The total has not been reviewed and accepted by your peers 
D)  You are not certified for using the tool 
A)  The tool hasn't been tested by the International Standards Organization (ISO) 
B)  Only the local law enforcement should use the tool 
C)  The total has not been reviewed and accepted by your peers 
D)  You are not certified for using the tool

Question 3

The MOST common method to get an unbiased measurement of the effectiveness of an Information Security Management System (ISMS) is to_________________________.

Accepted Answer

A)  assign the responsibility to the information security team 
B)  assign the responsibility to the team responsible for the management of the controls 
C)  perform an independent audit of the security controls 
D)  create operational reports on the effectiveness of the controls. 
A)  assign the responsibility to the information security team 
B)  assign the responsibility to the team responsible for the management of the controls 
C)  perform an independent audit of the security controls 
D)  create operational reports on the effectiveness of the controls.

Question 4

Your incident handling manager detects a virus attack in the network of your company. You develop a signature based on the characteristics of the detected virus. Which of the following phases in the incident handling process will utilize the signature to resolve this incident?

Accepted Answer

A)  Eradication 
B)  Containment 
C)  Recovery 
D)  Identification 
A)  Eradication 
B)  Containment 
C)  Recovery 
D)  Identification

Question 5

You are assigned to work in the computer forensics lab of a state police agency. While working on a high profile criminal case, you have followed every applicable procedure, however your boss is still concerned that the defense attorney might question whether evidence has been changed while at the lab. What can you do to prove that the evidence is the same as it was when it first entered the lab?

Accepted Answer

A)  make an MD5 hash of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab 
B)  make an MD5 hash of the evidence and compare it to the standard database developed by NIST 
C)  there is no reason to worry about this possible claim because state labs are certified 
D)  sign a statement attesting that the evidence is the same as it was when it entered the lab 
A)  make an MD5 hash of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab 
B)  make an MD5 hash of the evidence and compare it to the standard database developed by NIST 
C)  there is no reason to worry about this possible claim because state labs are certified 
D)  sign a statement attesting that the evidence is the same as it was when it entered the lab

Question 6

The amount of risk an organization is willing to accept in pursuit of its mission is known as______________.

Accepted Answer

A)  risk transfer 
B)  risk mitigation 
C)  risk acceptance 
D)  risk tolerance 
A)  risk transfer 
B)  risk mitigation 
C)  risk acceptance 
D)  risk tolerance

Question 7

The Information Security Management program MUST protect:

Accepted Answer

A)  Audit schedules and findings 
B)  Intellectual property released into the public domain 
C)  all organizational assets 
D)  critical business processes and revenue streams 
A)  Audit schedules and findings 
B)  Intellectual property released into the public domain 
C)  all organizational assets 
D)  critical business processes and revenue streams

Question 8

The MD5 program is used to:

Accepted Answer

A)  wipe magnetic media before recycling it 
B)  make directories on an evidence disk 
C)  view graphics files on an evidence drive 
D)  verify that a disk is not altered when you examine it 
A)  wipe magnetic media before recycling it 
B)  make directories on an evidence disk 
C)  view graphics files on an evidence drive 
D)  verify that a disk is not altered when you examine it

Question 9

Quantitative Risk Assessments have the following advantages over qualitative risk assessments:

Accepted Answer

A)  They are subjective and can be completed more quickly 
B)  They are objective and express risk / cost in approximates 
C)  They are subjective and can express risk / cost in real numbers 
D)  They are objective and can express risk / cost in real numbers 
A)  They are subjective and can be completed more quickly 
B)  They are objective and express risk / cost in approximates 
C)  They are subjective and can express risk / cost in real numbers 
D)  They are objective and can express risk / cost in real numbers

Question 10

On Linux/Unix based Web servers, what privilege should the daemon service be run under?

Accepted Answer

A)  Guest 
B)  Root 
C)  You cannot determine what privilege runs the daemon service 
D)  Something other than root 
A)  Guest 
B)  Root 
C)  You cannot determine what privilege runs the daemon service 
D)  Something other than root

Question 11

What should an organization do to ensure that they have a sound Business Continuity (BC) Plan?

Accepted Answer

A)  Conduct a Disaster Recovery (R
D)  exercise every year to test the plan 
B)  Conduct periodic tabletop exercises to refine the BC plan 
C)  Test every three years to ensure that things work as planned 
D)  Outsource the creation and execution of the BC plan to a third party vendor 
A)  Conduct a Disaster Recovery (R
D)  exercise every year to test the plan 
B)  Conduct periodic tabletop exercises to refine the BC plan 
C)  Test every three years to ensure that things work as planned 
D)  Outsource the creation and execution of the BC plan to a third party vendor

Question 12

When conducting computer forensic analysis, you must guard against ______________ So that you remain focused on the primary job and insure that the level of work does not increase beyond what was originally expected.

Accepted Answer

A)  Hard Drive Failure 
B)  Scope Creep 
C)  Unauthorized expenses 
D)  Overzealous marketing 
A)  Hard Drive Failure 
B)  Scope Creep 
C)  Unauthorized expenses 
D)  Overzealous marketing

Question 13

Software firewalls work at which layer of the OSI model?

Accepted Answer

A)  Application 
B)  Network 
C)  Transport 
D)  Data Link 
A)  Application 
B)  Network 
C)  Transport 
D)  Data Link

Question 14

Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years. Which of the following frameworks and standards will BEST fit the organization as a baseline for their security program?

Accepted Answer

A)  NIST and Privacy Regulations 
B)  NIST and data breach notification laws 
C)  ISO 27000 and Payment Card Industry Data Security Standards 
D)  ISO 27000 and Human resources best practices 
A)  NIST and Privacy Regulations 
B)  NIST and data breach notification laws 
C)  ISO 27000 and Payment Card Industry Data Security Standards 
D)  ISO 27000 and Human resources best practices

Question 15

In General, __________________ Involves the investigation of data that can be retrieved from the hard disk or other disks of a computer by applying scientific methods to retrieve the data.

Accepted Answer

A)  Network Forensics 
B)  Data Recovery 
C)  Disaster Recovery 
D)  Computer Forensics 
A)  Network Forensics 
B)  Data Recovery 
C)  Disaster Recovery 
D)  Computer Forensics

Question 16

Which of the following best describes the purpose of the International Organization for Standardization (ISO) 27002 standard?

Accepted Answer

A)  To provide effective security management practice and to provide confidence in interorganizational dealings 
B)  To established guidelines and general principles for initiating, implementing, maintaining and improving information security management within an organization 
C)  To give information security management recommendations to those who are responsible for initiating, implementing, or maintaining security in their organization. 
D)  To provide a common basis for developing organizational security standards 
A)  To provide effective security management practice and to provide confidence in interorganizational dealings 
B)  To established guidelines and general principles for initiating, implementing, maintaining and improving information security management within an organization 
C)  To give information security management recommendations to those who are responsible for initiating, implementing, or maintaining security in their organization. 
D)  To provide a common basis for developing organizational security standards

Question 17

Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs. When formulating the remediation plan, what is a required input?

Accepted Answer

A)  Board of directors 
B)  Latest virus definitions file 
C)  Patching history 
D)  Risk assessment 
A)  Board of directors 
B)  Latest virus definitions file 
C)  Patching history 
D)  Risk assessment

Question 18

Why should you note all cable connections for a computer you want to seize as evidence?

Accepted Answer

A)  to know what outside connections existed 
B)  in case other devices were connected 
C)  to know what peripheral devices exist 
D)  to know what hardware existed 
A)  to know what outside connections existed 
B)  in case other devices were connected 
C)  to know what peripheral devices exist 
D)  to know what hardware existed

Question 19

What is the BEST way to achieve on-going compliance monitoring in an organization?

Accepted Answer

A)  Outsource compliance to a 3 rd party vendor and let them manage the program. Outsource compliance to a 3 rd party vendor and let them manage the program. 
B)  Have Compliance Direct Information Security to fix issues after the auditor's report. 
C)  Only check compliance right before the auditors are scheduled to arrive onsite. 
D)  Have Compliance and Information Security partner to correct issues as they arise. 
A)  Outsource compliance to a 3 rd party vendor and let them manage the program. Outsource compliance to a 3 rd party vendor and let them manage the program. 
B)  Have Compliance Direct Information Security to fix issues after the auditor's report. 
C)  Only check compliance right before the auditors are scheduled to arrive onsite. 
D)  Have Compliance and Information Security partner to correct issues as they arise.

Question 20

Scenario: A CISO has several two-factor authentication systems under review and selects the one that is most sufficient and least costly. The implementation project planning is completed and the teams are ready to implement the solution. The CISO then discovers that the product it is not as scalable as originally thought and will not fit the organization's needs. The CISO discovers the scalability issue will only impact a small number of network segments. What is the next logical step to ensure the proper application of risk management methodology within the two-factor implementation project?

Accepted Answer

A)  Decide to accept the risk on behalf of the impacted business units 
B)  Create new use cases for operational use of the solution 
C)  Report the deficiency to the audit team and create process exceptions 
D)  Determine if sufficient mitigating controls can be applied 
A)  Decide to accept the risk on behalf of the impacted business units 
B)  Create new use cases for operational use of the solution 
C)  Report the deficiency to the audit team and create process exceptions 
D)  Determine if sufficient mitigating controls can be applied

Risk is defined as:

You have used a newly released forensic investigation tool, which doesn't meet the Daubert Test, during a case. The case has ended-up in court. What argument could the defense make to weaken your case?

The MOST common method to get an unbiased measurement of the effectiveness of an Information Security Management System (ISMS) is to_________________________.

Your incident handling manager detects a virus attack in the network of your company. You develop a signature based on the characteristics of the detected virus. Which of the following phases in the incident handling process will utilize the signature to resolve this incident?

The amount of risk an organization is willing to accept in pursuit of its mission is known as______________.

The Information Security Management program MUST protect:

The MD5 program is used to:

Quantitative Risk Assessments have the following advantages over qualitative risk assessments:

On Linux/Unix based Web servers, what privilege should the daemon service be run under?

What should an organization do to ensure that they have a sound Business Continuity (BC) Plan?

When conducting computer forensic analysis, you must guard against ______________ So that you remain focused on the primary job and insure that the level of work does not increase beyond what was originally expected.

Software firewalls work at which layer of the OSI model?

In General, __________________ Involves the investigation of data that can be retrieved from the hard disk or other disks of a computer by applying scientific methods to retrieve the data.

Which of the following best describes the purpose of the International Organization for Standardization (ISO) 27002 standard?

Why should you note all cable connections for a computer you want to seize as evidence?

What is the BEST way to achieve on-going compliance monitoring in an organization?

EC-Council Certified Incident Handler

EC-Council Information Security Manager (E|ISM)

EC-Council Certified CISO

ECCouncil Computer Hacking Forensic Investigator

EC-Council Certified Security Analyst

Filters

Exam 2: Certified Network Defender

Risk is defined as:

You have used a newly released forensic investigation tool, which doesn't meet the Daubert Test, during a case. The case has ended-up in court. What argument could the defense make to weaken your case?

The MOST common method to get an unbiased measurement of the effectiveness of an Information Security Management System (ISMS) is to_________________________.

Your incident handling manager detects a virus attack in the network of your company. You develop a signature based on the characteristics of the detected virus. Which of the following phases in the incident handling process will utilize the signature to resolve this incident?

The amount of risk an organization is willing to accept in pursuit of its mission is known as______________.

The Information Security Management program MUST protect:

The MD5 program is used to:

Quantitative Risk Assessments have the following advantages over qualitative risk assessments:

On Linux/Unix based Web servers, what privilege should the daemon service be run under?

What should an organization do to ensure that they have a sound Business Continuity (BC) Plan?

When conducting computer forensic analysis, you must guard against ______________ So that you remain focused on the primary job and insure that the level of work does not increase beyond what was originally expected.

Software firewalls work at which layer of the OSI model?

In General, __________________ Involves the investigation of data that can be retrieved from the hard disk or other disks of a computer by applying scientific methods to retrieve the data.

Which of the following best describes the purpose of the International Organization for Standardization (ISO) 27002 standard?

Why should you note all cable connections for a computer you want to seize as evidence?

What is the BEST way to achieve on-going compliance monitoring in an organization?

EC-Council Certified Incident Handler

EC-Council Information Security Manager (E|ISM)

EC-Council Certified CISO

ECCouncil Computer Hacking Forensic Investigator

EC-Council Certified Security Analyst

Filters