Question 1

A vulnerability in which of the following components would be MOST difficult to detect?

Accepted Answer

A)  Kernel 
B)  Shared libraries 
C)  Hardware 
D)  System application 
A)  Kernel 
B)  Shared libraries 
C)  Hardware 
D)  System application C

Question 2

Which item below is a federated identity standard?

Accepted Answer

A)  802.11i 
B)  Kerberos 
C)  Lightweight Directory Access Protocol (LDAP) 
D)  Security Assertion Markup Language (SAML) 
A)  802.11i 
B)  Kerberos 
C)  Lightweight Directory Access Protocol (LDAP) 
D)  Security Assertion Markup Language (SAML) D

Question 3

Configuring a Wireless Access Point (WAP) with the same Service Set Identifier (SSID) as another WAP in order to have users unknowingly connect is referred to as which of the following?

Accepted Answer

A)  Jamming 
B)  Man-in-the-Middle (MITM) 
C)  War driving 
D)  Internet Protocol (IP) spoofing 
A)  Jamming 
B)  Man-in-the-Middle (MITM) 
C)  War driving 
D)  Internet Protocol (IP) spoofing B

Question 4

A Virtual Machine (VM) environment has five guest Operating Systems (OS) and provides strong isolation. What MUST an administrator review to audit a user's access to data files?

Accepted Answer

A)  Host VM monitor audit logs 
B)  Guest OS access controls 
C)  Host VM access controls 
D)  Guest OS audit logs 
A)  Host VM monitor audit logs 
B)  Guest OS access controls 
C)  Host VM access controls 
D)  Guest OS audit logs

Question 5

When conveying the results of a security assessment, which of the following is the PRIMARY audience?

Accepted Answer

A)  Information System Security Officer (ISSO) 
B)  Authorizing Official (AO) 
C)  Information System Security Manager (ISSM) 
D)  Security Control Assessor (SC
A)  
A)  Information System Security Officer (ISSO) 
B)  Authorizing Official (AO) 
C)  Information System Security Manager (ISSM) 
D)  Security Control Assessor (SC
A)

Question 6

Sensitive customer data is going to be added to a database. What is the MOST effective implementation for ensuring data privacy?

Accepted Answer

A)  Mandatory Access Control (MA
C)  procedures 
B)  Discretionary Access Control (DA
C)  procedures 
C)  Segregation of duties 
D)  Data link encryption 
A)  Mandatory Access Control (MA
C)  procedures 
B)  Discretionary Access Control (DA
C)  procedures 
C)  Segregation of duties 
D)  Data link encryption

Question 7

Which of the following initiates the systems recovery phase of a Disaster Recovery Plan (DRP)?

Accepted Answer

A)  Evacuating the disaster site 
B)  Activating the organization's hot site 
C)  Issuing a formal disaster declaration 
D)  Assessing the extent of damage following the disaster 
A)  Evacuating the disaster site 
B)  Activating the organization's hot site 
C)  Issuing a formal disaster declaration 
D)  Assessing the extent of damage following the disaster

Question 8

Which of the following could cause a Denial of Service (DoS) against an authentication system?

Accepted Answer

A)  Encryption of audit logs 
B)  No archiving of audit logs 
C)  Hashing of audit logs 
D)  Remote access audit logs 
A)  Encryption of audit logs 
B)  No archiving of audit logs 
C)  Hashing of audit logs 
D)  Remote access audit logs

Question 9

An international medical organization with headquarters in the United States (US) and branches in France wants to test a drug in both countries. What is the organization allowed to do with the test subject's data?

Accepted Answer

A)  Aggregate it into one database in the US 
B)  Process it in the US, but store the information in France 
C)  Share it with a third party 
D)  Anonymize it and process it in the US 
A)  Aggregate it into one database in the US 
B)  Process it in the US, but store the information in France 
C)  Share it with a third party 
D)  Anonymize it and process it in the US

Question 10

An organization is found lacking the ability to properly establish performance indicators for its Web hosting solution during an audit. What would be the MOST probable cause?

Accepted Answer

A)  Absence of a Business Intelligence (BI) solution 
B)  Inadequate cost modeling 
C)  Improper deployment of the Service-Oriented Architecture (SO
A)  
D)  Insufficient Service Level Agreement (SL
A)  
A)  Absence of a Business Intelligence (BI) solution 
B)  Inadequate cost modeling 
C)  Improper deployment of the Service-Oriented Architecture (SO
A)  
D)  Insufficient Service Level Agreement (SL
A)

Question 11

Which of the following would an attacker BEST be able to accomplish through the use of Remote Access Tools (RAT)?

Accepted Answer

A)  Reduce the probability of identification 
B)  Detect further compromise of the target 
C)  Destabilize the operation of the host 
D)  Maintain and expand control 
A)  Reduce the probability of identification 
B)  Detect further compromise of the target 
C)  Destabilize the operation of the host 
D)  Maintain and expand control

Question 12

What is the MAIN goal of information security awareness and training?

Accepted Answer

A)  To inform users of the latest malware threats 
B)  To inform users of information assurance responsibilities 
C)  To comply with the organization information security policy 
D)  To prepare students for certification 
A)  To inform users of the latest malware threats 
B)  To inform users of information assurance responsibilities 
C)  To comply with the organization information security policy 
D)  To prepare students for certification

Question 13

Which of the following is the PRIMARY risk with using open source software in a commercial software construction?

Accepted Answer

A)  Lack of software documentation 
B)  License agreements requiring release of modified code 
C)  Expiration of the license agreement 
D)  Costs associated with support of the software 
A)  Lack of software documentation 
B)  License agreements requiring release of modified code 
C)  Expiration of the license agreement 
D)  Costs associated with support of the software

Question 14

Which of the following is MOST appropriate for protecting confidentially of data stored on a hard drive?

Accepted Answer

A)  Triple Data Encryption Standard (3DES) 
B)  Advanced Encryption Standard (AES) 
C)  Message Digest 5 (MD5) 
D)  Secure Hash Algorithm 2(SHA-2) 
A)  Triple Data Encryption Standard (3DES) 
B)  Advanced Encryption Standard (AES) 
C)  Message Digest 5 (MD5) 
D)  Secure Hash Algorithm 2(SHA-2)

Question 15

The restoration priorities of a Disaster Recovery Plan (DRP) are based on which of the following documents?

Accepted Answer

A)  Service Level Agreement (SL
A)  
B)  Business Continuity Plan (BCP) 
C)  Business Impact Analysis (BI
A)  
D)  Crisis management plan 
A)  Service Level Agreement (SL
A)  
B)  Business Continuity Plan (BCP) 
C)  Business Impact Analysis (BI
A)  
D)  Crisis management plan

Question 16

Which of the following is the key requirement for test results when implementing forensic procedures?

Accepted Answer

A)  The test results must be cost-effective. 
B)  The test result must be authorized. 
C)  The test results must be quantifiable. 
D)  The test results must be reproducible. 
A)  The test results must be cost-effective. 
B)  The test result must be authorized. 
C)  The test results must be quantifiable. 
D)  The test results must be reproducible.

Question 17

Who would be the BEST person to approve an organizations information security policy?

Accepted Answer

A)  Chief Information Officer (CIO) 
B)  Chief Information Security Officer (CISO) 
C)  Chief internal auditor 
D)  Chief Executive Officer (CEO) 
A)  Chief Information Officer (CIO) 
B)  Chief Information Security Officer (CISO) 
C)  Chief internal auditor 
D)  Chief Executive Officer (CEO)

Question 18

Which of the following will help prevent improper session handling?

Accepted Answer

A)  Ensure JavaScript and plugin support is disabled 
B)  Ensure that certificates are valid and fail closed 
C)  Ensure that tokens are sufficiently long, complex, and pseudo-random 
D)  Ensure that all UIWebView calls do not execute without proper input validation 
A)  Ensure JavaScript and plugin support is disabled 
B)  Ensure that certificates are valid and fail closed 
C)  Ensure that tokens are sufficiently long, complex, and pseudo-random 
D)  Ensure that all UIWebView calls do not execute without proper input validation

Question 19

Which of the following access control models is MOST restrictive?

Accepted Answer

A)  Discretionary Access Control (DA
C)  
B)  Mandatory Access Control (MA
C)  
C)  Role Based Access Control (RBA
C)  
D)  Rule based access control 
A)  Discretionary Access Control (DA
C)  
B)  Mandatory Access Control (MA
C)  
C)  Role Based Access Control (RBA
C)  
D)  Rule based access control

Question 20

What is the FIRST step required in establishing a records retention program?

Accepted Answer

A)  Classify records based on sensitivity 
B)  Identify and inventory all records storage locations 
C)  Identify and inventory all records 
D)  Draft a records retention policy 
A)  Classify records based on sensitivity 
B)  Identify and inventory all records storage locations 
C)  Identify and inventory all records 
D)  Draft a records retention policy

A vulnerability in which of the following components would be MOST difficult to detect?

Which item below is a federated identity standard?

Configuring a Wireless Access Point (WAP) with the same Service Set Identifier (SSID) as another WAP in order to have users unknowingly connect is referred to as which of the following?

A Virtual Machine (VM) environment has five guest Operating Systems (OS) and provides strong isolation. What MUST an administrator review to audit a user's access to data files?

When conveying the results of a security assessment, which of the following is the PRIMARY audience?

Sensitive customer data is going to be added to a database. What is the MOST effective implementation for ensuring data privacy?

Which of the following initiates the systems recovery phase of a Disaster Recovery Plan (DRP)?

Which of the following could cause a Denial of Service (DoS) against an authentication system?

An international medical organization with headquarters in the United States (US) and branches in France wants to test a drug in both countries. What is the organization allowed to do with the test subject's data?

An organization is found lacking the ability to properly establish performance indicators for its Web hosting solution during an audit. What would be the MOST probable cause?

Which of the following would an attacker BEST be able to accomplish through the use of Remote Access Tools (RAT)?

What is the MAIN goal of information security awareness and training?

Which of the following is the PRIMARY risk with using open source software in a commercial software construction?

Which of the following is MOST appropriate for protecting confidentially of data stored on a hard drive?

The restoration priorities of a Disaster Recovery Plan (DRP) are based on which of the following documents?

Which of the following is the key requirement for test results when implementing forensic procedures?

Who would be the BEST person to approve an organizations information security policy?

Which of the following will help prevent improper session handling?

Which of the following access control models is MOST restrictive?

What is the FIRST step required in establishing a records retention program?

Certified Authorization Professional

Certified Cloud Security Professional (CCSP)

Filters

Exam 3: Certified Information Systems Security Professional

A vulnerability in which of the following components would be MOST difficult to detect?

Which item below is a federated identity standard?

Configuring a Wireless Access Point (WAP) with the same Service Set Identifier (SSID) as another WAP in order to have users unknowingly connect is referred to as which of the following?

A Virtual Machine (VM) environment has five guest Operating Systems (OS) and provides strong isolation. What MUST an administrator review to audit a user's access to data files?

When conveying the results of a security assessment, which of the following is the PRIMARY audience?

Sensitive customer data is going to be added to a database. What is the MOST effective implementation for ensuring data privacy?

Which of the following initiates the systems recovery phase of a Disaster Recovery Plan (DRP)?

Which of the following could cause a Denial of Service (DoS) against an authentication system?

An international medical organization with headquarters in the United States (US) and branches in France wants to test a drug in both countries. What is the organization allowed to do with the test subject's data?

An organization is found lacking the ability to properly establish performance indicators for its Web hosting solution during an audit. What would be the MOST probable cause?

Which of the following would an attacker BEST be able to accomplish through the use of Remote Access Tools (RAT)?

What is the MAIN goal of information security awareness and training?

Which of the following is the PRIMARY risk with using open source software in a commercial software construction?

Which of the following is MOST appropriate for protecting confidentially of data stored on a hard drive?

The restoration priorities of a Disaster Recovery Plan (DRP) are based on which of the following documents?

Which of the following is the key requirement for test results when implementing forensic procedures?

Who would be the BEST person to approve an organizations information security policy?

Which of the following will help prevent improper session handling?

Which of the following access control models is MOST restrictive?

What is the FIRST step required in establishing a records retention program?

Certified Authorization Professional

Certified Cloud Security Professional (CCSP)

Filters