Question 1

What is the second step in the identity and access provisioning lifecycle?

Accepted Answer

A)  Provisioning 
B)  Review 
C)  Approval 
D)  Revocation 
A)  Provisioning 
B)  Review 
C)  Approval 
D)  Revocation

Question 2

Users require access rights that allow them to view the average salary of groups of employees. Which control would prevent the users from obtaining an individual employee's salary?

Accepted Answer

A)  Limit access to predefined queries 
B)  Segregate the database into a small number of partitions each with a separate security level 
C)  Implement Role Based Access Control (RBA
C)  
D)  Reduce the number of people who have access to the system for statistical purposes 
A)  Limit access to predefined queries 
B)  Segregate the database into a small number of partitions each with a separate security level 
C)  Implement Role Based Access Control (RBA
C)  
D)  Reduce the number of people who have access to the system for statistical purposes

Question 3

Individual access to a network is BEST determined based on:

Accepted Answer

A)  risk matrix 
B)  value of the data 
C)  business need 
D)  data classification 
A)  risk matrix 
B)  value of the data 
C)  business need 
D)  data classification

Question 4

How is Remote Authentication Dial-In User Service (RADIUS) authentication accomplished?

Accepted Answer

A)  It uses clear text and firewall rules 
B)  It relies on Virtual Private Networks (VPN) 
C)  It uses clear text and shared secret keys 
D)  It relies on asymmetric encryption keys 
A)  It uses clear text and firewall rules 
B)  It relies on Virtual Private Networks (VPN) 
C)  It uses clear text and shared secret keys 
D)  It relies on asymmetric encryption keys

Question 5

Which of the following could be considered the MOST significant security challenge when adopting DevOps practices compared to a more traditional control framework?

Accepted Answer

A)  Achieving Service Level Agreements (SL
A)  on how quickly patches will be released when a security flaw is found. 
B)  Maintaining segregation of duties. 
C)  Standardized configurations for logging, alerting, and security metrics. 
D)  Availability of security teams at the end of design process to perform last-minute manual audits and reviews. 
A)  Achieving Service Level Agreements (SL
A)  on how quickly patches will be released when a security flaw is found. 
B)  Maintaining segregation of duties. 
C)  Standardized configurations for logging, alerting, and security metrics. 
D)  Availability of security teams at the end of design process to perform last-minute manual audits and reviews.

Question 6

Which of the following actions should be taken by a security professional when a mission critical computer network attack is suspected?

Accepted Answer

A)  Isolate the network, log an independent report, fix the problem, and redeploy the computer 
B)  Isolate the network, install patches, and report the occurrence 
C)  Prioritize, report and investigate the occurrence 
D)  Turn the router off, perform forensic analysis, apply the appropriate fix, and log incidents 
A)  Isolate the network, log an independent report, fix the problem, and redeploy the computer 
B)  Isolate the network, install patches, and report the occurrence 
C)  Prioritize, report and investigate the occurrence 
D)  Turn the router off, perform forensic analysis, apply the appropriate fix, and log incidents

Question 7

Which of the following is PRIMARILY adopted for ensuring the integrity of information is preserved?

Accepted Answer

A)  Data at rest protection 
B)  Transport Layer Security (TLS) 
C)  Role Based Access Control (RBA
C)  
D)  One-way encryption 
A)  Data at rest protection 
B)  Transport Layer Security (TLS) 
C)  Role Based Access Control (RBA
C)  
D)  One-way encryption

Question 8

Which of the following statements is TRUE regarding state-based analysis as a functional software testing technique?

Accepted Answer

A)  It is characterized by the stateless behavior of a process implemented in a function 
B)  Test inputs are obtained from the derived boundaries of the given functional specifications 
C)  An entire partition can be covered by considering only one representative value from that partition 
D)  It is useful for testing communications protocols and graphical user interfaces 
A)  It is characterized by the stateless behavior of a process implemented in a function 
B)  Test inputs are obtained from the derived boundaries of the given functional specifications 
C)  An entire partition can be covered by considering only one representative value from that partition 
D)  It is useful for testing communications protocols and graphical user interfaces

Question 9

Which of the following information MUST be provided for user account provisioning?

Accepted Answer

A)  Full name 
B)  Unique identifier 
C)  Security question 
D)  Date of birth 
A)  Full name 
B)  Unique identifier 
C)  Security question 
D)  Date of birth

Question 10

What is the second phase of Public Key Infrastructure (PKI) key/certificate life-cycle management?

Accepted Answer

A)  Implementation Phase 
B)  Initialization Phase 
C)  Cancellation Phase 
D)  Issued Phase 
A)  Implementation Phase 
B)  Initialization Phase 
C)  Cancellation Phase 
D)  Issued Phase

Question 11

Which of the following sets of controls should allow an investigation if an attack is not blocked by preventive controls or detected by monitoring?

Accepted Answer

A)  Logging and audit trail controls to enable forensic analysis 
B)  Security incident response lessons learned procedures 
C)  Security event alert triage done by analysts using a Security Information and Event Management (SIEM) system 
D)  Transactional controls focused on fraud prevention 
A)  Logging and audit trail controls to enable forensic analysis 
B)  Security incident response lessons learned procedures 
C)  Security event alert triage done by analysts using a Security Information and Event Management (SIEM) system 
D)  Transactional controls focused on fraud prevention

Question 12

The MAIN use of Layer 2 Tunneling Protocol (L2TP) is to tunnel data

Accepted Answer

A)  through a firewall at the Session layer 
B)  through a firewall at the Transport layer 
C)  in the Point-to-Point Protocol (PPP) 
D)  in the Payload Compression Protocol (PCP) 
A)  through a firewall at the Session layer 
B)  through a firewall at the Transport layer 
C)  in the Point-to-Point Protocol (PPP) 
D)  in the Payload Compression Protocol (PCP)

Question 13

Which of the following is the MOST important goal of information asset valuation?

Accepted Answer

A)  Developing a consistent and uniform method of controlling access on information assets 
B)  Developing appropriate access control policies and guidelines 
C)  Assigning a financial value to an organization's information assets 
D)  Determining the appropriate level of protection 
A)  Developing a consistent and uniform method of controlling access on information assets 
B)  Developing appropriate access control policies and guidelines 
C)  Assigning a financial value to an organization's information assets 
D)  Determining the appropriate level of protection

Question 14

In Disaster Recovery (DR) and Business Continuity (DC) training, which BEST describes a functional drill?

Accepted Answer

A)  a functional evacuation of personnel 
B)  a specific test by response teams of individual emergency response functions 
C)  an activation of the backup site 
D)  a full-scale simulation of an emergency and the subsequent response functions. 
A)  a functional evacuation of personnel 
B)  a specific test by response teams of individual emergency response functions 
C)  an activation of the backup site 
D)  a full-scale simulation of an emergency and the subsequent response functions.

Question 15

As part of the security assessment plan, the security professional has been asked to use a negative testing strategy on a new website. Which of the following actions would be performed?

Accepted Answer

A)  Use a web scanner to scan for vulnerabilities within the website. 
B)  Perform a code review to ensure that the database references are properly addressed. 
C)  Establish a secure connection to the web server to validate that only the approved ports are open. 
D)  Enter only numbers in the web form and verify that the website prompts the user to enter a valid input. 
A)  Use a web scanner to scan for vulnerabilities within the website. 
B)  Perform a code review to ensure that the database references are properly addressed. 
C)  Establish a secure connection to the web server to validate that only the approved ports are open. 
D)  Enter only numbers in the web form and verify that the website prompts the user to enter a valid input.

Question 16

Which of the following is a security weakness in the evaluation of Common Criteria (CC) products?

Accepted Answer

A)  The manufacturer can state what configuration of the product is to be evaluated 
B)  The product can be evaluated by labs in other countries 
C)  The Target of Evaluation's (TO
E)  testing environment is identical to the operating environment 
D)  The evaluations are expensive and time-consuming to perform 
A)  The manufacturer can state what configuration of the product is to be evaluated 
B)  The product can be evaluated by labs in other countries 
C)  The Target of Evaluation's (TO
E)  testing environment is identical to the operating environment 
D)  The evaluations are expensive and time-consuming to perform

Question 17

Which of the BEST internationally recognized standard for evaluating security products and systems?

Accepted Answer

A)  Payment Card Industry Data Security Standards (PCI-DSS) 
B)  Common Criteria (C
C)  
C)  Health Insurance Portability and Accountability Act (HIPA
A)  
D)  Sarbanes-Oxley (SOX) 
A)  Payment Card Industry Data Security Standards (PCI-DSS) 
B)  Common Criteria (C
C)  
C)  Health Insurance Portability and Accountability Act (HIPA
A)  
D)  Sarbanes-Oxley (SOX)

Question 18

Which of the following is the BEST metric to obtain when gaining support for an Identify and Access Management (IAM) solution?

Accepted Answer

A)  Application connection successes resulting in data leakage 
B)  Administrative costs for restoring systems after connection failure 
C)  Employee system timeouts from implementing wrong limits 
D)  Help desk costs required to support password reset requests 
A)  Application connection successes resulting in data leakage 
B)  Administrative costs for restoring systems after connection failure 
C)  Employee system timeouts from implementing wrong limits 
D)  Help desk costs required to support password reset requests

Question 19

Which of the following trust services principles refers to the accessibility of information used by the systems, products, or services offered to a third-party provider's customers?

Accepted Answer

A)  Security 
B)  Privacy 
C)  Access 
D)  Availability 
A)  Security 
B)  Privacy 
C)  Access 
D)  Availability

Question 20

Which of the following authorization standards is built to handle Application Programming Interface (API) access for Federated Identity Management (FIM)?

Accepted Answer

A)  Remote Authentication Dial-In User Service (RADIUS) 
B)  Terminal Access Controller Access Control System Plus (TACACS+) 
C)  Open Authorization (OAuth) 
D)  Security Assertion Markup Language (SAML) 
A)  Remote Authentication Dial-In User Service (RADIUS) 
B)  Terminal Access Controller Access Control System Plus (TACACS+) 
C)  Open Authorization (OAuth) 
D)  Security Assertion Markup Language (SAML)

What is the second step in the identity and access provisioning lifecycle?

Users require access rights that allow them to view the average salary of groups of employees. Which control would prevent the users from obtaining an individual employee's salary?

Individual access to a network is BEST determined based on:

How is Remote Authentication Dial-In User Service (RADIUS) authentication accomplished?

Which of the following could be considered the MOST significant security challenge when adopting DevOps practices compared to a more traditional control framework?

Which of the following actions should be taken by a security professional when a mission critical computer network attack is suspected?

Which of the following is PRIMARILY adopted for ensuring the integrity of information is preserved?

Which of the following statements is TRUE regarding state-based analysis as a functional software testing technique?

Which of the following information MUST be provided for user account provisioning?

What is the second phase of Public Key Infrastructure (PKI) key/certificate life-cycle management?

Which of the following sets of controls should allow an investigation if an attack is not blocked by preventive controls or detected by monitoring?

The MAIN use of Layer 2 Tunneling Protocol (L2TP) is to tunnel data

Which of the following is the MOST important goal of information asset valuation?

In Disaster Recovery (DR) and Business Continuity (DC) training, which BEST describes a functional drill?

As part of the security assessment plan, the security professional has been asked to use a negative testing strategy on a new website. Which of the following actions would be performed?

Which of the following is a security weakness in the evaluation of Common Criteria (CC) products?

Which of the BEST internationally recognized standard for evaluating security products and systems?

Which of the following is the BEST metric to obtain when gaining support for an Identify and Access Management (IAM) solution?

Which of the following trust services principles refers to the accessibility of information used by the systems, products, or services offered to a third-party provider's customers?

Which of the following authorization standards is built to handle Application Programming Interface (API) access for Federated Identity Management (FIM)?

Certified Authorization Professional

Certified Cloud Security Professional (CCSP)

Filters

Exam 3: Certified Information Systems Security Professional

What is the second step in the identity and access provisioning lifecycle?

Users require access rights that allow them to view the average salary of groups of employees. Which control would prevent the users from obtaining an individual employee's salary?

Individual access to a network is BEST determined based on:

How is Remote Authentication Dial-In User Service (RADIUS) authentication accomplished?

Which of the following could be considered the MOST significant security challenge when adopting DevOps practices compared to a more traditional control framework?

Which of the following actions should be taken by a security professional when a mission critical computer network attack is suspected?

Which of the following is PRIMARILY adopted for ensuring the integrity of information is preserved?

Which of the following statements is TRUE regarding state-based analysis as a functional software testing technique?

Which of the following information MUST be provided for user account provisioning?

What is the second phase of Public Key Infrastructure (PKI) key/certificate life-cycle management?

Which of the following sets of controls should allow an investigation if an attack is not blocked by preventive controls or detected by monitoring?

The MAIN use of Layer 2 Tunneling Protocol (L2TP) is to tunnel data

Which of the following is the MOST important goal of information asset valuation?

In Disaster Recovery (DR) and Business Continuity (DC) training, which BEST describes a functional drill?

As part of the security assessment plan, the security professional has been asked to use a negative testing strategy on a new website. Which of the following actions would be performed?

Which of the following is a security weakness in the evaluation of Common Criteria (CC) products?

Which of the BEST internationally recognized standard for evaluating security products and systems?

Which of the following is the BEST metric to obtain when gaining support for an Identify and Access Management (IAM) solution?

Which of the following trust services principles refers to the accessibility of information used by the systems, products, or services offered to a third-party provider's customers?

Which of the following authorization standards is built to handle Application Programming Interface (API) access for Federated Identity Management (FIM)?

Certified Authorization Professional

Certified Cloud Security Professional (CCSP)

Filters