Question 1

Which of the following defines the boundaries and scope of a risk assessment?

Accepted Answer

A)  The risk assessment schedule 
B)  The risk assessment framework 
C)  The risk assessment charter 
D)  The assessment context 
A)  The risk assessment schedule 
B)  The risk assessment framework 
C)  The risk assessment charter 
D)  The assessment context

Question 2

Which of the following tests is performed by an Information Systems (IS) auditor when a sample of programs is selected to determine if the source and object versions are the same?

Accepted Answer

A)  Substantive test of program library controls 
B)  A compliance test of the program compiler controls 
C)  A compliance test of program library controls 
D)  A substantive test of the program compiler controls 
A)  Substantive test of program library controls 
B)  A compliance test of the program compiler controls 
C)  A compliance test of program library controls 
D)  A substantive test of the program compiler controls

Question 3

Which of the following is a common technology for visual monitoring?

Accepted Answer

A)  Closed circuit television 
B)  Open circuit television 
C)  Blocked video 
D)  Local video 
A)  Closed circuit television 
B)  Open circuit television 
C)  Blocked video 
D)  Local video

Question 4

Assigning the role and responsibility of Information Assurance to a dedicated and independent security group is an example of:

Accepted Answer

A)  Detective Controls 
B)  Proactive Controls 
C)  Organizational Controls 
D)  Preemptive Controls 
A)  Detective Controls 
B)  Proactive Controls 
C)  Organizational Controls 
D)  Preemptive Controls

Question 5

What does mactime, an essential part of the coroner's toolkit do?

Accepted Answer

A)  It traverses the file system and produces a listing of all files based on the modification, access and change timestamps 
B)  It can recover deleted file space and search it for data. However, it does not allow the investigator to preview them 
C)  The tools scans for i-node information, which is used by other tools in the tool kit 
D)  It is too specific to the MAC OS and forms a core component of the toolkit 
A)  It traverses the file system and produces a listing of all files based on the modification, access and change timestamps 
B)  It can recover deleted file space and search it for data. However, it does not allow the investigator to preview them 
C)  The tools scans for i-node information, which is used by other tools in the tool kit 
D)  It is too specific to the MAC OS and forms a core component of the toolkit

Question 6

When a critical vulnerability has been discovered on production systems and needs to be fixed immediately, what is the BEST approach for a CISO to mitigate the vulnerability under tight budget constraints?

Accepted Answer

A)  Schedule an emergency meeting and request the finding to fix the issue 
B)  Take the system off line until budget is available 
C)  Transfer financial resources from other critical programs 
D)  Deploy countermeasures and compensation controls until the budget is available 
A)  Schedule an emergency meeting and request the finding to fix the issue 
B)  Take the system off line until budget is available 
C)  Transfer financial resources from other critical programs 
D)  Deploy countermeasures and compensation controls until the budget is available

Question 7

Scenario: The new CISO was informed of all the Information Security projects that the section has in progress. Two projects are over a year behind schedule and way over budget. Using the best business practices for project management, you determine that the project correctly aligns with the organization goals. What should be verified next?

Accepted Answer

A)  Scope 
B)  Constraints 
C)  Resources 
D)  Budget 
A)  Scope 
B)  Constraints 
C)  Resources 
D)  Budget

Question 8

What is the name of the Standard Linux Command that is also available as windows application that can be used to create bit-stream images?

Accepted Answer

A)  mcopy 
B)  image 
C)  MD5 
D)  dd 
A)  mcopy 
B)  image 
C)  MD5 
D)  dd

Question 9

When obtaining a warrant, it is important to:

Accepted Answer

A)  particularlydescribe the place to be searched and particularly describe the items to be seized 
B)  generallydescribe the place to be searched and particularly describe the items to be seized 
C)  generallydescribe the place to be searched and generally describe the items to be seized 
D)  particularlydescribe the place to be searched and generally describe the items to be seized 
A)  particularlydescribe the place to be searched and particularly describe the items to be seized 
B)  generallydescribe the place to be searched and particularly describe the items to be seized 
C)  generallydescribe the place to be searched and generally describe the items to be seized 
D)  particularlydescribe the place to be searched and generally describe the items to be seized

Question 10

If your organization operates under a model of "assumption of breach", you should:

Accepted Answer

A)  Establish active firewall monitoring protocols 
B)  Purchase insurance for your compliance liability 
C)  Focus your security efforts on high value assets 
D)  Protect all information resource assets equally 
A)  Establish active firewall monitoring protocols 
B)  Purchase insurance for your compliance liability 
C)  Focus your security efforts on high value assets 
D)  Protect all information resource assets equally

Question 11

A honey pot deployed with the IP 172.16.1.108 was compromised by an attacker. Given below is an excerpt from a Snort binary capture of the attack. Decipher the activity carried out by the attacker by studying the log. Please note that you are required to infer only what is explicit in the excerpt. (Note: The student is being tested on concepts learnt during passive OS fingerprinting, basic TCP/IP connection concepts and the ability to read packet signatures from a sniff dump.) 03/15-20:21:24.107053 211.185.125.124:3500 -> 172.16.1.108:111 TCP TTL:43 TOS:0x0 ID:29726 IpLen:20 DgmLen:52 DF ***A**** Seq: 0x9B6338C5 Ack: 0x5820ADD0 Win: 0x7D78 TcpLen: 32 TCP Options (3) => NOP NOP TS: 23678634 2878772 =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= 03/15-20:21:24.452051 211.185.125.124:789 -> 172.16.1.103:111 UDP TTL:43 TOS:0x0 ID:29733 IpLen:20 DgmLen:84 Len: 64 01 0A 8A 0A 00 00 00 00 00 00 00 02 00 01 86 A0 ................ 00 00 00 02 00 00 00 03 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 01 86 B8 00 00 00 01 ................ 00 00 00 11 00 00 00 00 ........ 03/15-20:21:24.730436 211.185.125.124:790 -> 172.16.1.103:32773 UDP TTL:43 TOS:0x0 ID:29781 IpLen:20 DgmLen:1104 Len: 1084 47 F7 9F 63 00 00 00 00 00 00 00 02 00 01 86 B8

Accepted Answer

A)  The attacker has conducted a network sweep on port 111 
B)  The attacker has scanned and exploited the system using Buffer Overflow 
C)  The attacker has used a Trojan on port 32773 
D)  The attacker has installed a backdoor 
A)  The attacker has conducted a network sweep on port 111 
B)  The attacker has scanned and exploited the system using Buffer Overflow 
C)  The attacker has used a Trojan on port 32773 
D)  The attacker has installed a backdoor

Question 12

What is the BEST reason for having a formal request for proposal process?

Accepted Answer

A)  Creates a timeline for purchasing and budgeting 
B)  Informs suppliers a company is going to make a purchase 
C)  Clearly identifies risks and benefits before funding is spent 
D)  Allows small companies to compete with larger companies 
A)  Creates a timeline for purchasing and budgeting 
B)  Informs suppliers a company is going to make a purchase 
C)  Clearly identifies risks and benefits before funding is spent 
D)  Allows small companies to compete with larger companies

Question 13

Which of the following statements about Encapsulating Security Payload (ESP) is true?

Accepted Answer

A)  It is an IPSec protocol 
B)  it is a text-based communication protocol 
C)  It uses UDP port 22 
D)  It uses TCP port 22 as the default port and operates at the application layer 
A)  It is an IPSec protocol 
B)  it is a text-based communication protocol 
C)  It uses UDP port 22 
D)  It uses TCP port 22 as the default port and operates at the application layer

Question 14

Which of the following is the BEST indicator of a successful project?

Accepted Answer

A)  it comes in at or below the expenditures planned for in the baseline budget 
B)  it meets most of the specifications as outlined in the approved project definition 
C)  it is completed on time or early as compared to the baseline project plan 
D)  the deliverables are accepted by the key stakeholders 
A)  it comes in at or below the expenditures planned for in the baseline budget 
B)  it meets most of the specifications as outlined in the approved project definition 
C)  it is completed on time or early as compared to the baseline project plan 
D)  the deliverables are accepted by the key stakeholders

Question 15

Your company uses Cisco routers exclusively throughout the network. After securing the routers to the best of your knowledge, an outside security firm is brought in to assess the network security. Although they found very few issues, they were able to enumerate the model, OS version, and capabilities for all your Cisco routers with very little effort. Which feature will you disable to eliminate the ability to enumerate this information on your Cisco routers?

Accepted Answer

A)  Border Gateway Protocol 
B)  Cisco Discovery Protocol 
C)  Broadcast System Protocol 
D)  Simple Network Management Protocol 
A)  Border Gateway Protocol 
B)  Cisco Discovery Protocol 
C)  Broadcast System Protocol 
D)  Simple Network Management Protocol

Question 16

You are just hired as the new CISO and are being briefed on all the Information Security projects that your section has on going. You discover that most projects are behind schedule and over budget. Using the best business practices for project management you determine that the project correctly aligns with the company goals and the scope of the project is correct. What is the NEXT step?

Accepted Answer

A)  Verify resources 
B)  Review time schedules 
C)  Verify budget 
D)  Verify constraints 
A)  Verify resources 
B)  Review time schedules 
C)  Verify budget 
D)  Verify constraints

Question 17

What type of attack requires the least amount of technical equipment and has the highest success rate?

Accepted Answer

A)  Social engineering 
B)  Shrink wrap attacks 
C)  Operating system attacks 
D)  War driving 
A)  Social engineering 
B)  Shrink wrap attacks 
C)  Operating system attacks 
D)  War driving

Question 18

When would it be more desirable to develop a set of decentralized security policies and procedures within an enterprise environment?

Accepted Answer

A)  When there is a variety of technologies deployed in the infrastructure. 
B)  When it results in an overall lower cost of operating the security program. 
C)  When there is a need to develop a more unified incident response capability. 
D)  When the enterprise is made up of many business units with diverse business activities, risks profiles and regulatory requirements. 
A)  When there is a variety of technologies deployed in the infrastructure. 
B)  When it results in an overall lower cost of operating the security program. 
C)  When there is a need to develop a more unified incident response capability. 
D)  When the enterprise is made up of many business units with diverse business activities, risks profiles and regulatory requirements.

Question 19

In order for a CISO to have true situational awareness there is a need to deploy technology that can give a real-time view of security events across the enterprise. Which tool selection represents the BEST choice to achieve situational awareness?

Accepted Answer

A)  Intrusion Detection System (IDS), firewall, switch, syslog 
B)  Security Incident Event Management (SIEM), IDS, router, syslog 
C)  VMware, router, switch, firewall, syslog, vulnerability management system (VMS) 
D)  SIEM, IDS, firewall, VMSSIEM, IDS, firewall, VMS 
A)  Intrusion Detection System (IDS), firewall, switch, syslog 
B)  Security Incident Event Management (SIEM), IDS, router, syslog 
C)  VMware, router, switch, firewall, syslog, vulnerability management system (VMS) 
D)  SIEM, IDS, firewall, VMSSIEM, IDS, firewall, VMS

Question 20

During the course of an investigation, you locate evidence that may prove the innocence of the suspect of the investigation. You must maintain an unbiased opinion and be objective in your entire fact finding process. Therefore, you report this evidence. This type of evidence is known as:

Accepted Answer

A)  Inculpatory evidence 
B)  Mandatory evidence 
C)  Exculpatory evidence 
D)  Terrible evidence 
A)  Inculpatory evidence 
B)  Mandatory evidence 
C)  Exculpatory evidence 
D)  Terrible evidence

Which of the following defines the boundaries and scope of a risk assessment?

Which of the following tests is performed by an Information Systems (IS) auditor when a sample of programs is selected to determine if the source and object versions are the same?

Which of the following is a common technology for visual monitoring?

Assigning the role and responsibility of Information Assurance to a dedicated and independent security group is an example of:

What does mactime, an essential part of the coroner's toolkit do?

When a critical vulnerability has been discovered on production systems and needs to be fixed immediately, what is the BEST approach for a CISO to mitigate the vulnerability under tight budget constraints?

What is the name of the Standard Linux Command that is also available as windows application that can be used to create bit-stream images?

When obtaining a warrant, it is important to:

If your organization operates under a model of "assumption of breach", you should:

What is the BEST reason for having a formal request for proposal process?

Which of the following statements about Encapsulating Security Payload (ESP) is true?

Which of the following is the BEST indicator of a successful project?

What type of attack requires the least amount of technical equipment and has the highest success rate?

When would it be more desirable to develop a set of decentralized security policies and procedures within an enterprise environment?

In order for a CISO to have true situational awareness there is a need to deploy technology that can give a real-time view of security events across the enterprise. Which tool selection represents the BEST choice to achieve situational awareness?

During the course of an investigation, you locate evidence that may prove the innocence of the suspect of the investigation. You must maintain an unbiased opinion and be objective in your entire fact finding process. Therefore, you report this evidence. This type of evidence is known as:

EC-Council Certified Incident Handler

EC-Council Information Security Manager (E|ISM)

EC-Council Certified CISO

ECCouncil Computer Hacking Forensic Investigator

EC-Council Certified Security Analyst

Filters

Exam 2: Certified Network Defender

Which of the following defines the boundaries and scope of a risk assessment?

Which of the following tests is performed by an Information Systems (IS) auditor when a sample of programs is selected to determine if the source and object versions are the same?

Which of the following is a common technology for visual monitoring?

Assigning the role and responsibility of Information Assurance to a dedicated and independent security group is an example of:

What does mactime, an essential part of the coroner's toolkit do?

When a critical vulnerability has been discovered on production systems and needs to be fixed immediately, what is the BEST approach for a CISO to mitigate the vulnerability under tight budget constraints?

What is the name of the Standard Linux Command that is also available as windows application that can be used to create bit-stream images?

When obtaining a warrant, it is important to:

If your organization operates under a model of "assumption of breach", you should:

What is the BEST reason for having a formal request for proposal process?

Which of the following statements about Encapsulating Security Payload (ESP) is true?

Which of the following is the BEST indicator of a successful project?

What type of attack requires the least amount of technical equipment and has the highest success rate?

When would it be more desirable to develop a set of decentralized security policies and procedures within an enterprise environment?

In order for a CISO to have true situational awareness there is a need to deploy technology that can give a real-time view of security events across the enterprise. Which tool selection represents the BEST choice to achieve situational awareness?

During the course of an investigation, you locate evidence that may prove the innocence of the suspect of the investigation. You must maintain an unbiased opinion and be objective in your entire fact finding process. Therefore, you report this evidence. This type of evidence is known as:

EC-Council Certified Incident Handler

EC-Council Information Security Manager (E|ISM)

EC-Council Certified CISO

ECCouncil Computer Hacking Forensic Investigator

EC-Council Certified Security Analyst

Filters