Question 1

Which part of the Windows Registry contains the user's password file?

Accepted Answer

A)  HKEY_LOCAL_MACHINE 
B)  HKEY_CURRENT_CONFIGURATION 
C)  HKEY_USER 
D)  HKEY_CURRENT_USER 
A)  HKEY_LOCAL_MACHINE 
B)  HKEY_CURRENT_CONFIGURATION 
C)  HKEY_USER 
D)  HKEY_CURRENT_USER

Question 2

Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs. You have identified potential solutions for all of your risks that do not have security controls. What is the NEXT step?

Accepted Answer

A)  Create a risk metrics for all unmitigated risks 
B)  Get approval from the board of directors 
C)  Verify that the cost of mitigation is less than the risk 
D)  Screen potential vendor solutions 
A)  Create a risk metrics for all unmitigated risks 
B)  Get approval from the board of directors 
C)  Verify that the cost of mitigation is less than the risk 
D)  Screen potential vendor solutions

Question 3

What is kept in the following directory? HKLM\SECURITY\Policy\Secrets

Accepted Answer

A)  Cached password hashes for the past 20 users 
B)  Service account passwords in plain text 
C)  IAS account names and passwords 
D)  Local store PKI Kerberos certificates 
A)  Cached password hashes for the past 20 users 
B)  Service account passwords in plain text 
C)  IAS account names and passwords 
D)  Local store PKI Kerberos certificates

Question 4

In Microsoft file structures, sectors are grouped together to form:

Accepted Answer

A)  Clusters 
B)  Drives 
C)  Bitstreams 
D)  Partitions 
A)  Clusters 
B)  Drives 
C)  Bitstreams 
D)  Partitions

Question 5

A CISO wants to change the defense strategy to ward off attackers. To accomplish this the CISO is looking to a strategy where attackers are lured into a zone of a safe network where attackers can be monitored, controlled, quarantined, or eradicated.

Accepted Answer

A)  Moderate investment 
B)  Passive monitoring 
C)  Integrated security controls 
D)  Dynamic deception 
A)  Moderate investment 
B)  Passive monitoring 
C)  Integrated security controls 
D)  Dynamic deception

Question 6

E-mail logs contain which of the following information to help you in your investigation? (Choose four.)

Accepted Answer

A)  user account that was used to send the account 
B)  attachments sent with the e-mail message 
C)  unique message identifier 
D)  contents of the e-mail message 
E)  date and time the message was sent 
A)  user account that was used to send the account 
B)  attachments sent with the e-mail message 
C)  unique message identifier 
D)  contents of the e-mail message 
E)  date and time the message was sent

Question 7

Michael starts a new job and discovers that he has unnecessary access to a variety of systems. Which of the following best describes the problem he has encountered?

Accepted Answer

A)  Rights collision 
B)  Excessive privileges 
C)  Privilege creep 
D)  Least privileges 
A)  Rights collision 
B)  Excessive privileges 
C)  Privilege creep 
D)  Least privileges

Question 8

Which of the following best represents a calculation for Annual Loss Expectancy (ALE)?

Accepted Answer

A)  Value of the asset multiplied by the loss expectancy 
B)  Replacement cost multiplied by the single loss expectancy 
C)  Single loss expectancy multiplied by the annual rate of occurrence 
D)  Total loss expectancy multiplied by the total loss frequency 
A)  Value of the asset multiplied by the loss expectancy 
B)  Replacement cost multiplied by the single loss expectancy 
C)  Single loss expectancy multiplied by the annual rate of occurrence 
D)  Total loss expectancy multiplied by the total loss frequency

Question 9

A Chief Information Security Officer received a list of high, medium, and low impact audit findings. Which of the following represents the BEST course of action?

Accepted Answer

A)  If the findings do not impact regulatory compliance, remediate only the high and medium risk findings. 
B)  If the findings do not impact regulatory compliance, review current security controls. 
C)  If the findings impact regulatory compliance, try to apply remediation that will address the most findings for the least cost. 
D)  if the findings impact regulatory compliance, remediate the high findings as quickly as possible. 
A)  If the findings do not impact regulatory compliance, remediate only the high and medium risk findings. 
B)  If the findings do not impact regulatory compliance, review current security controls. 
C)  If the findings impact regulatory compliance, try to apply remediation that will address the most findings for the least cost. 
D)  if the findings impact regulatory compliance, remediate the high findings as quickly as possible.

Question 10

As a CHFI professional, which of the following is the most important to your professional reputation?

Accepted Answer

A)  Your Certifications 
B)  The correct, successful management of each and every case 
C)  The free that you charge 
D)  The friendship of local law enforcement officers 
A)  Your Certifications 
B)  The correct, successful management of each and every case 
C)  The free that you charge 
D)  The friendship of local law enforcement officers

Question 11

Which of the following is a strong post designed to stop a car?

Accepted Answer

A)  Fence 
B)  Bollard 
C)  Reinforced rebar 
D)  Gate 
A)  Fence 
B)  Bollard 
C)  Reinforced rebar 
D)  Gate

Question 12

If a competitor wants to cause damage to your organization, steal critical secrets, or put you out of business, they just have to find a job opening, prepare someone to pass the interview, have that person hired, and they will be in the organization. How would you prevent such type of attacks?

Accepted Answer

A)  Conduct thorough background checks before you engage them 
B)  Hire the people through third-party job agencies who will vet them for you 
C)  Investigate their social networking profiles 
D)  It is impossible to block these attacks 
A)  Conduct thorough background checks before you engage them 
B)  Hire the people through third-party job agencies who will vet them for you 
C)  Investigate their social networking profiles 
D)  It is impossible to block these attacks

Question 13

An "idle" system is also referred to as what?

Accepted Answer

A)  PC not connected to the Internet 
B)  Zombie 
C)  PC not being used 
D)  Bot 
A)  PC not connected to the Internet 
B)  Zombie 
C)  PC not being used 
D)  Bot

Question 14

Scenario: Your company has many encrypted telecommunications links for their world-wide operations. Physically distributing symmetric keys to all locations has proven to be administratively burdensome, but symmetric keys are preferred to other alternatives. How can you reduce the administrative burden of distributing symmetric keys for your employer?

Accepted Answer

A)  Use certificate authority to distribute private keys 
B)  Symmetrically encrypt the key and then use asymmetric encryption to unencrypt it 
C)  Use a self-generated key on both ends to eliminate the need for distribution 
D)  Use asymmetric encryption for the automated distribution of symmetric key 
A)  Use certificate authority to distribute private keys 
B)  Symmetrically encrypt the key and then use asymmetric encryption to unencrypt it 
C)  Use a self-generated key on both ends to eliminate the need for distribution 
D)  Use asymmetric encryption for the automated distribution of symmetric key

Question 15

Which of the following methodologies references the recommended industry standard that Information security project managers should follow?

Accepted Answer

A)  The Security Systems Development Life Cycle 
B)  Project Management System Methodology 
C)  Project Management Body of Knowledge 
D)  The Security Project and Management Methodology 
A)  The Security Systems Development Life Cycle 
B)  Project Management System Methodology 
C)  Project Management Body of Knowledge 
D)  The Security Project and Management Methodology

Question 16

An international organization is planning a project to implement encryption technologies to protect company confidential information. This organization has data centers on three continents. Which of the following would be considered a MAJOR constraint for the project?

Accepted Answer

A)  Compliance to local hiring laws 
B)  Encryption import/export regulations 
C)  Local customer privacy laws 
D)  Time zone differences 
A)  Compliance to local hiring laws 
B)  Encryption import/export regulations 
C)  Local customer privacy laws 
D)  Time zone differences

Question 17

During the course of a corporate investigation, you find that an Employee is committing a crime. Can the Employer file a criminal complaint with Police?

Accepted Answer

A)  Yes, and all evidence can be turned over to the police 
B)  Yes, but only if you turn the evidence over to a federal law enforcement agency 
C)  No, because the investigation was conducted without following standard police procedures 
D)  No, because the investigation was conducted without warrant 
A)  Yes, and all evidence can be turned over to the police 
B)  Yes, but only if you turn the evidence over to a federal law enforcement agency 
C)  No, because the investigation was conducted without following standard police procedures 
D)  No, because the investigation was conducted without warrant

Question 18

From an information security perspective, information that no longer supports the main purpose of the business should be:

Accepted Answer

A)  protected under the information classification policy 
B)  analyzed under the data ownership policy 
C)  assessed by a business impact analysis. 
D)  analyzed under the retention policy. 
A)  protected under the information classification policy 
B)  analyzed under the data ownership policy 
C)  assessed by a business impact analysis. 
D)  analyzed under the retention policy.

Question 19

What happens when a file is deleted by a Microsoft operating system using the FAT file system?

Accepted Answer

A)  only the reference to the file is removed from the FAT 
B)  the file is erased and cannot be recovered 
C)  a copy of the file is stored and the original file is erased 
D)  the file is erased but can be recovered 
A)  only the reference to the file is removed from the FAT 
B)  the file is erased and cannot be recovered 
C)  a copy of the file is stored and the original file is erased 
D)  the file is erased but can be recovered

Question 20

When you carve an image, recovering the image depends on which of the following skills?

Accepted Answer

A)  Recognizing the pattern of the header content 
B)  Recovering the image from a tape backup 
C)  Recognizing the pattern of a corrupt file 
D)  Recovering the image from the tape backup 
A)  Recognizing the pattern of the header content 
B)  Recovering the image from a tape backup 
C)  Recognizing the pattern of a corrupt file 
D)  Recovering the image from the tape backup

Which part of the Windows Registry contains the user's password file?

What is kept in the following directory? HKLM\SECURITY\Policy\Secrets

In Microsoft file structures, sectors are grouped together to form:

A CISO wants to change the defense strategy to ward off attackers. To accomplish this the CISO is looking to a strategy where attackers are lured into a zone of a safe network where attackers can be monitored, controlled, quarantined, or eradicated.

E-mail logs contain which of the following information to help you in your investigation? (Choose four.)

Michael starts a new job and discovers that he has unnecessary access to a variety of systems. Which of the following best describes the problem he has encountered?

Which of the following best represents a calculation for Annual Loss Expectancy (ALE)?

A Chief Information Security Officer received a list of high, medium, and low impact audit findings. Which of the following represents the BEST course of action?

As a CHFI professional, which of the following is the most important to your professional reputation?

Which of the following is a strong post designed to stop a car?

If a competitor wants to cause damage to your organization, steal critical secrets, or put you out of business, they just have to find a job opening, prepare someone to pass the interview, have that person hired, and they will be in the organization. How would you prevent such type of attacks?

An "idle" system is also referred to as what?

Which of the following methodologies references the recommended industry standard that Information security project managers should follow?

An international organization is planning a project to implement encryption technologies to protect company confidential information. This organization has data centers on three continents. Which of the following would be considered a MAJOR constraint for the project?

During the course of a corporate investigation, you find that an Employee is committing a crime. Can the Employer file a criminal complaint with Police?

From an information security perspective, information that no longer supports the main purpose of the business should be:

What happens when a file is deleted by a Microsoft operating system using the FAT file system?

When you carve an image, recovering the image depends on which of the following skills?

EC-Council Certified Incident Handler

EC-Council Information Security Manager (E|ISM)

EC-Council Certified CISO

ECCouncil Computer Hacking Forensic Investigator

EC-Council Certified Security Analyst

Filters

Exam 2: Certified Network Defender

Which part of the Windows Registry contains the user's password file?

What is kept in the following directory? HKLM\SECURITY\Policy\Secrets

In Microsoft file structures, sectors are grouped together to form:

A CISO wants to change the defense strategy to ward off attackers. To accomplish this the CISO is looking to a strategy where attackers are lured into a zone of a safe network where attackers can be monitored, controlled, quarantined, or eradicated.

E-mail logs contain which of the following information to help you in your investigation? (Choose four.)

Michael starts a new job and discovers that he has unnecessary access to a variety of systems. Which of the following best describes the problem he has encountered?

Which of the following best represents a calculation for Annual Loss Expectancy (ALE)?

A Chief Information Security Officer received a list of high, medium, and low impact audit findings. Which of the following represents the BEST course of action?

As a CHFI professional, which of the following is the most important to your professional reputation?

Which of the following is a strong post designed to stop a car?

If a competitor wants to cause damage to your organization, steal critical secrets, or put you out of business, they just have to find a job opening, prepare someone to pass the interview, have that person hired, and they will be in the organization. How would you prevent such type of attacks?

An "idle" system is also referred to as what?

Which of the following methodologies references the recommended industry standard that Information security project managers should follow?

An international organization is planning a project to implement encryption technologies to protect company confidential information. This organization has data centers on three continents. Which of the following would be considered a MAJOR constraint for the project?

During the course of a corporate investigation, you find that an Employee is committing a crime. Can the Employer file a criminal complaint with Police?

From an information security perspective, information that no longer supports the main purpose of the business should be:

What happens when a file is deleted by a Microsoft operating system using the FAT file system?

When you carve an image, recovering the image depends on which of the following skills?

EC-Council Certified Incident Handler

EC-Council Information Security Manager (E|ISM)

EC-Council Certified CISO

ECCouncil Computer Hacking Forensic Investigator

EC-Council Certified Security Analyst

Filters