Question 1

Which step of the Risk Management Framework (RMF) identifies the initial set of baseline security controls?

Accepted Answer

A)  Selection 
B)  Monitoring 
C)  Implementation 
D)  Assessment 
A)  Selection 
B)  Monitoring 
C)  Implementation 
D)  Assessment

Question 2

Which of the following is the MOST effective countermeasure against Man-in-the-Middle (MITM) attacks while using online banking?

Accepted Answer

A)  Transport Layer Security (TLS) 
B)  Secure Sockets Layer (SSL) 
C)  Pretty Good Privacy (PGP) 
D)  Secure Shell (SSH) 
A)  Transport Layer Security (TLS) 
B)  Secure Sockets Layer (SSL) 
C)  Pretty Good Privacy (PGP) 
D)  Secure Shell (SSH)

Question 3

The use of private and public encryption keys is fundamental in the implementation of which of the following?

Accepted Answer

A)  Diffie-Hellman algorithm 
B)  Secure Sockets Layer (SSL) 
C)  Advanced Encryption Standard (AES) 
D)  Message Digest 5 (MD5) 
A)  Diffie-Hellman algorithm 
B)  Secure Sockets Layer (SSL) 
C)  Advanced Encryption Standard (AES) 
D)  Message Digest 5 (MD5)

Question 4

What is the PRIMARY role of a scrum master in agile development?

Accepted Answer

A)  To choose the primary development language 
B)  To choose the integrated development environment 
C)  To match the software requirements to the delivery plan 
D)  To project manage the software delivery 
A)  To choose the primary development language 
B)  To choose the integrated development environment 
C)  To match the software requirements to the delivery plan 
D)  To project manage the software delivery

Question 5

When building a data classification scheme, which of the following is the PRIMARY concern?

Accepted Answer

A)  Purpose 
B)  Cost effectiveness 
C)  Availability 
D)  Authenticity 
A)  Purpose 
B)  Cost effectiveness 
C)  Availability 
D)  Authenticity

Question 6

When writing security assessment procedures, what is the MAIN purpose of the test outputs and reports?

Accepted Answer

A)  To force the software to fail and document the process 
B)  To find areas of compromise in confidentiality and integrity 
C)  To allow for objective pass or fail decisions 
D)  To identify malware or hidden code within the test results 
A)  To force the software to fail and document the process 
B)  To find areas of compromise in confidentiality and integrity 
C)  To allow for objective pass or fail decisions 
D)  To identify malware or hidden code within the test results

Question 7

Which of the following is the BEST method to reduce the effectiveness of phishing attacks?

Accepted Answer

A)  User awareness 
B)  Two-factor authentication 
C)  Anti-phishing software 
D)  Periodic vulnerability scan 
A)  User awareness 
B)  Two-factor authentication 
C)  Anti-phishing software 
D)  Periodic vulnerability scan

Question 8

An organization has a short-term agreement with a public Cloud Service Provider (CSP). Which of the following BEST protects sensitive data once the agreement expires and the assets are reused?

Accepted Answer

A)  Recommend that the business data owners use continuous monitoring and analysis of applications to prevent data loss 
B)  Recommend that the business data owners use internal encryption keys for data-at-rest and data-in-transit to the storage environment 
C)  Use a contractual agreement to ensure the CSP wipes and data from the storage environment 
D)  Use a National Institute of Standards and Technology (NIST) recommendation for wiping data on the storage environment 
A)  Recommend that the business data owners use continuous monitoring and analysis of applications to prevent data loss 
B)  Recommend that the business data owners use internal encryption keys for data-at-rest and data-in-transit to the storage environment 
C)  Use a contractual agreement to ensure the CSP wipes and data from the storage environment 
D)  Use a National Institute of Standards and Technology (NIST) recommendation for wiping data on the storage environment

Question 9

What is the HIGHEST priority in agile development?

Accepted Answer

A)  Selecting appropriate coding language 
B)  Managing costs of product delivery 
C)  Early and continuous delivery of software 
D)  Maximizing the amount of code delivered 
A)  Selecting appropriate coding language 
B)  Managing costs of product delivery 
C)  Early and continuous delivery of software 
D)  Maximizing the amount of code delivered

Question 10

The security accreditation task of the System Development Life Cycle (SDLC) process is completed at the end of which phase?

Accepted Answer

A)  System acquisition and development 
B)  System operations and maintenance 
C)  System initiation 
D)  System implementation 
A)  System acquisition and development 
B)  System operations and maintenance 
C)  System initiation 
D)  System implementation

Question 11

The MAIN task of promoting security for Personal Computers (PC) is:

Accepted Answer

A)  understanding the technical controls and ensuring they are correctly installed 
B)  understanding the required systems and patching processes for different Operating Systems (OS) 
C)  making sure that users are using only valid, authorized software, so that the chance of virus infection is reduced 
D)  making users understand the risks to the machines and data, so they will take appropriate steps to protect them 
A)  understanding the technical controls and ensuring they are correctly installed 
B)  understanding the required systems and patching processes for different Operating Systems (OS) 
C)  making sure that users are using only valid, authorized software, so that the chance of virus infection is reduced 
D)  making users understand the risks to the machines and data, so they will take appropriate steps to protect them

Question 12

What is the MAIN objective of risk analysis in Disaster Recovery (DR) planning?

Accepted Answer

A)  Establish Maximum Tolerable Downtime (MT
D)  Information Systems (IS) 
B)  Define the variable cost for extended downtime scenarios 
C)  Identify potential threats to business availability 
D)  Establish personnel requirements for various downtime scenarios 
A)  Establish Maximum Tolerable Downtime (MT
D)  Information Systems (IS) 
B)  Define the variable cost for extended downtime scenarios 
C)  Identify potential threats to business availability 
D)  Establish personnel requirements for various downtime scenarios

Question 13

Which of the following BEST describes the standard used to exchange authorization information between different identity management systems?

Accepted Answer

A)  Security Assertion Markup Language (SAML) 
B)  Service Oriented Architecture (SO
A)  
C)  Extensible Markup Language (XML) 
D)  Wireless Authentication Protocol (WAP) 
A)  Security Assertion Markup Language (SAML) 
B)  Service Oriented Architecture (SO
A)  
C)  Extensible Markup Language (XML) 
D)  Wireless Authentication Protocol (WAP)

Question 14

Security categorization of a new system takes place during which phase of the Systems Development Life Cycle (SDLC)?

Accepted Answer

A)  System implementation 
B)  System initiation 
C)  System operations and maintenance 
D)  System acquisition and development 
A)  System implementation 
B)  System initiation 
C)  System operations and maintenance 
D)  System acquisition and development

Question 15

Which of the following is critical if an employee is dismissed due to violation of an organization's Acceptable Use Policy (AUP)?

Accepted Answer

A)  Privilege suspension 
B)  Appropriate documentation 
C)  Internet access logs 
D)  Proxy records 
A)  Privilege suspension 
B)  Appropriate documentation 
C)  Internet access logs 
D)  Proxy records

Question 16

What is the BEST method if an investigator wishes to analyze a hard drive which may be used as evidence?

Accepted Answer

A)  Leave the hard drive in place and use only verified and authenticated Operating Systems (OS) utilities to analyze the contents 
B)  Log into the system and immediately make a copy of all relevant files to a Write Once, Read Many (WORM) device 
C)  Remove the hard drive from the system and make a copy of the hard drive's contents using imaging hardware 
D)  Use a separate bootable device to make a copy of the hard drive before booting the system and analyzing the hard drive 
A)  Leave the hard drive in place and use only verified and authenticated Operating Systems (OS) utilities to analyze the contents 
B)  Log into the system and immediately make a copy of all relevant files to a Write Once, Read Many (WORM) device 
C)  Remove the hard drive from the system and make a copy of the hard drive's contents using imaging hardware 
D)  Use a separate bootable device to make a copy of the hard drive before booting the system and analyzing the hard drive

Question 17

What is a common mistake in records retention?

Accepted Answer

A)  Adopting a retention policy with the longest requirement period 
B)  Having the Human Resource (HR) department create a retention policy 
C)  Adopting a retention policy based on applicable organization requirements 
D)  Having the organization legal department create a retention policy 
A)  Adopting a retention policy with the longest requirement period 
B)  Having the Human Resource (HR) department create a retention policy 
C)  Adopting a retention policy based on applicable organization requirements 
D)  Having the organization legal department create a retention policy

Question 18

Why should Open Web Application Security Project (OWASP) Application Security Verification Standards (ASVS) Level 1 be considered a MINIMUM level of protection for any web application?

Accepted Answer

A)  Most regulatory bodies consider ASVS Level 1 as a baseline set of controls for applications 
B)  Securing applications at ASVS Level 1 provides adequate protection for sensitive data 
C)  ASVS Level 1 ensures that applications are invulnerable to OWASP top 10 threats 
D)  Opportunistic attackers will look for any easily exploitable vulnerable applications 
A)  Most regulatory bodies consider ASVS Level 1 as a baseline set of controls for applications 
B)  Securing applications at ASVS Level 1 provides adequate protection for sensitive data 
C)  ASVS Level 1 ensures that applications are invulnerable to OWASP top 10 threats 
D)  Opportunistic attackers will look for any easily exploitable vulnerable applications

Question 19

In a change-controlled environment, which of the following is MOST likely to lead to unauthorized changes to production programs?

Accepted Answer

A)  Developers checking out source code without approval 
B)  Developers using rapid application development (RA
D)  methodologies without approval 
C)  Promoting programs to production without approval 
D)  Modifying source code without approval 
A)  Developers checking out source code without approval 
B)  Developers using rapid application development (RA
D)  methodologies without approval 
C)  Promoting programs to production without approval 
D)  Modifying source code without approval

Question 20

What is the MAIN reason for having a developer sign a Non-Disclosure Agreement (NDA)?

Accepted Answer

A)  Signing the NDA always gives consent to the developer to access tools and privileged company information to do their work. 
B)  Signing the NDA allows the developer to use their developed coding methods. 
C)  Signing the NDA protects confidential, technical, or Intellectual Property (IP) from disclosure to others. 
D)  Signing the NDA is legally binding for up to one year of employment. 
A)  Signing the NDA always gives consent to the developer to access tools and privileged company information to do their work. 
B)  Signing the NDA allows the developer to use their developed coding methods. 
C)  Signing the NDA protects confidential, technical, or Intellectual Property (IP) from disclosure to others. 
D)  Signing the NDA is legally binding for up to one year of employment.

Which step of the Risk Management Framework (RMF) identifies the initial set of baseline security controls?

Which of the following is the MOST effective countermeasure against Man-in-the-Middle (MITM) attacks while using online banking?

The use of private and public encryption keys is fundamental in the implementation of which of the following?

What is the PRIMARY role of a scrum master in agile development?

When building a data classification scheme, which of the following is the PRIMARY concern?

When writing security assessment procedures, what is the MAIN purpose of the test outputs and reports?

Which of the following is the BEST method to reduce the effectiveness of phishing attacks?

An organization has a short-term agreement with a public Cloud Service Provider (CSP). Which of the following BEST protects sensitive data once the agreement expires and the assets are reused?

What is the HIGHEST priority in agile development?

The security accreditation task of the System Development Life Cycle (SDLC) process is completed at the end of which phase?

The MAIN task of promoting security for Personal Computers (PC) is:

What is the MAIN objective of risk analysis in Disaster Recovery (DR) planning?

Which of the following BEST describes the standard used to exchange authorization information between different identity management systems?

Security categorization of a new system takes place during which phase of the Systems Development Life Cycle (SDLC)?

Which of the following is critical if an employee is dismissed due to violation of an organization's Acceptable Use Policy (AUP)?

What is the BEST method if an investigator wishes to analyze a hard drive which may be used as evidence?

What is a common mistake in records retention?

Why should Open Web Application Security Project (OWASP) Application Security Verification Standards (ASVS) Level 1 be considered a MINIMUM level of protection for any web application?

In a change-controlled environment, which of the following is MOST likely to lead to unauthorized changes to production programs?

What is the MAIN reason for having a developer sign a Non-Disclosure Agreement (NDA)?

Certified Authorization Professional

Certified Cloud Security Professional (CCSP)

Filters

Exam 3: Certified Information Systems Security Professional

Which step of the Risk Management Framework (RMF) identifies the initial set of baseline security controls?

Which of the following is the MOST effective countermeasure against Man-in-the-Middle (MITM) attacks while using online banking?

The use of private and public encryption keys is fundamental in the implementation of which of the following?

What is the PRIMARY role of a scrum master in agile development?

When building a data classification scheme, which of the following is the PRIMARY concern?

When writing security assessment procedures, what is the MAIN purpose of the test outputs and reports?

Which of the following is the BEST method to reduce the effectiveness of phishing attacks?

An organization has a short-term agreement with a public Cloud Service Provider (CSP). Which of the following BEST protects sensitive data once the agreement expires and the assets are reused?

What is the HIGHEST priority in agile development?

The security accreditation task of the System Development Life Cycle (SDLC) process is completed at the end of which phase?

The MAIN task of promoting security for Personal Computers (PC) is:

What is the MAIN objective of risk analysis in Disaster Recovery (DR) planning?

Which of the following BEST describes the standard used to exchange authorization information between different identity management systems?

Security categorization of a new system takes place during which phase of the Systems Development Life Cycle (SDLC)?

Which of the following is critical if an employee is dismissed due to violation of an organization's Acceptable Use Policy (AUP)?

What is the BEST method if an investigator wishes to analyze a hard drive which may be used as evidence?

What is a common mistake in records retention?

Why should Open Web Application Security Project (OWASP) Application Security Verification Standards (ASVS) Level 1 be considered a MINIMUM level of protection for any web application?

In a change-controlled environment, which of the following is MOST likely to lead to unauthorized changes to production programs?

What is the MAIN reason for having a developer sign a Non-Disclosure Agreement (NDA)?

Certified Authorization Professional

Certified Cloud Security Professional (CCSP)

Filters