Exam 3: Certified Information Systems Security Professional

Which of the following practices provides the development team with a definition of security and identification of threats in designing software?

Which of the following is the BEST way to reduce the impact of an externally sourced flood attack?

Which of the following methods of suppressing a fire is environmentally friendly and the MOST appropriate for a data center?

Which of the following would MINIMIZE the ability of an attacker to exploit a buffer overflow?

Which of the following techniques BEST prevents buffer overflows?

Which of the following operates at the Network Layer of the Open System Interconnection (OSI) model?

What is the BEST way to encrypt web application communications?

A chemical plan wants to upgrade the Industrial Control System (ICS) to transmit data using Ethernet instead of RS422. The project manager wants to simplify administration and maintenance by utilizing the office network infrastructure and staff to implement this upgrade. Which of the following is the GREATEST impact on security for the network?

Which concept might require users to use a second access token or to re-enter passwords to gain elevated access rights in the identity and access provisioning life cycle?

Although code using a specific program language may not be susceptible to a buffer overflow attack,

A company has decided that they need to begin maintaining assets deployed in the enterprise. What approach should be followed to determine and maintain ownership information to bring the company into compliance?

Which of the following BEST describes an access control method utilizing cryptographic keys derived from a smart card private key that is embedded within mobile devices?

Which of the following would an internal technical security audit BEST validate?

Which of the following is the MOST important activity an organization performs to ensure that security is part of the overall organization culture?

What is the GREATEST challenge of an agent-based patch management solution?

What is the FIRST action a security professional needs to take while assessing an organization's asset security in order to properly classify and protect access to data?

When assessing an organization's security policy according to standards established by the International Organization for Standardization (ISO) 27001 and 27002, when can management responsibilities be defined?

Which of the following is considered best practice for preventing e-mail spoofing?

When implementing a data classification program, why is it important to avoid too much granularity?

A company was ranked as high in the following National Institute of Standards and Technology (NIST) functions: Protect, Detect, Respond and Recover. However, a low maturity grade was attributed to the Identify function. In which of the following the controls categories does this company need to improve when analyzing its processes individually?