Question 1

Which of the following is the FIRST thing to consider when reviewing Information Technology (IT) internal controls?

Accepted Answer

A)  The risk culture of the organization 
B)  The impact of the control 
C)  The nature of the risk 
D)  The cost of the control 
A)  The risk culture of the organization 
B)  The impact of the control 
C)  The nature of the risk 
D)  The cost of the control

Question 2

What is the BEST approach to addressing security issues in legacy web applications?

Accepted Answer

A)  Debug the security issues 
B)  Migrate to newer, supported applications where possible 
C)  Conduct a security assessment 
D)  Protect the legacy application with a web application firewall 
A)  Debug the security issues 
B)  Migrate to newer, supported applications where possible 
C)  Conduct a security assessment 
D)  Protect the legacy application with a web application firewall

Question 3

Which of the following adds end-to-end security inside a Layer 2 Tunneling Protocol (L2TP) Internet Protocol Security (IPSec) connection?

Accepted Answer

A)  Temporal Key Integrity Protocol (TKIP) 
B)  Secure Hash Algorithm (SH
A)  
C)  Secure Shell (SSH) 
D)  Transport Layer Security (TLS) 
A)  Temporal Key Integrity Protocol (TKIP) 
B)  Secure Hash Algorithm (SH
A)  
C)  Secure Shell (SSH) 
D)  Transport Layer Security (TLS)

Question 4

An organization regularly conducts its own penetration tests. Which of the following scenarios MUST be covered for the test to be effective?

Accepted Answer

A)  Third-party vendor with access to the system 
B)  System administrator access compromised 
C)  Internal attacker with access to the system 
D)  Internal user accidentally accessing data 
A)  Third-party vendor with access to the system 
B)  System administrator access compromised 
C)  Internal attacker with access to the system 
D)  Internal user accidentally accessing data

Question 5

What is a characteristic of Secure Sockets Layer (SSL) and Transport Layer Security (TLS)?

Accepted Answer

A)  SSL and TLS provide a generic channel security mechanism on top of Transmission Control Protocol (TCP). 
B)  SSL and TLS provide nonrepudiation by default. 
C)  SSL and TLS do not provide security for most routed protocols. 
D)  SSL and TLS provide header encapsulation over HyperText Transfer Protocol (HTTP). 
A)  SSL and TLS provide a generic channel security mechanism on top of Transmission Control Protocol (TCP). 
B)  SSL and TLS provide nonrepudiation by default. 
C)  SSL and TLS do not provide security for most routed protocols. 
D)  SSL and TLS provide header encapsulation over HyperText Transfer Protocol (HTTP).

Question 6

Which of the following MUST be considered when developing business rules for a data loss prevention (DLP) solution?

Accepted Answer

A)  Data availability 
B)  Data sensitivity 
C)  Data ownership 
D)  Data integrity 
A)  Data availability 
B)  Data sensitivity 
C)  Data ownership 
D)  Data integrity

Question 7

Reciprocal backup site agreements are considered to be

Accepted Answer

A)  a better alternative than the use of warm sites. 
B)  difficult to test for complex systems. 
C)  easy to implement for similar types of organizations. 
D)  easy to test and implement for complex systems. 
A)  a better alternative than the use of warm sites. 
B)  difficult to test for complex systems. 
C)  easy to implement for similar types of organizations. 
D)  easy to test and implement for complex systems.

Question 8

Which of the following is a Key Performance Indicator (KPI) for a security training and awareness program?

Accepted Answer

A)  The number of security audits performed 
B)  The number of attendees at security training events 
C)  The number of security training materials created 
D)  The number of security controls implemented 
A)  The number of security audits performed 
B)  The number of attendees at security training events 
C)  The number of security training materials created 
D)  The number of security controls implemented

Question 9

Which of the following is a canon of the (ISC)2 Code of Ethics?

Accepted Answer

A)  Integrity first, association before self, and excellence in all we do 
B)  Perform all professional activities and duties in accordance with all applicable laws and the highest ethical standards 
C)  Provide diligent and competent service to principals 
D)  Cooperate with others in the interchange of knowledge and ideas for mutual security 
A)  Integrity first, association before self, and excellence in all we do 
B)  Perform all professional activities and duties in accordance with all applicable laws and the highest ethical standards 
C)  Provide diligent and competent service to principals 
D)  Cooperate with others in the interchange of knowledge and ideas for mutual security

Question 10

In a High Availability (HA) environment, what is the PRIMARY goal of working with a virtual router address as the gateway to a network?

Accepted Answer

A)  The second of two routers can periodically check in to make sure that the first router is operational. 
B)  The second of two routers can better absorb a Denial of Service (DoS) attack knowing the first router is present. 
C)  The first of two routers fails and is reinstalled, while the second handles the traffic flawlessly. 
D)  The first of two routers can better handle specific traffic, while the second handles the rest of the traffic seamlessly. 
A)  The second of two routers can periodically check in to make sure that the first router is operational. 
B)  The second of two routers can better absorb a Denial of Service (DoS) attack knowing the first router is present. 
C)  The first of two routers fails and is reinstalled, while the second handles the traffic flawlessly. 
D)  The first of two routers can better handle specific traffic, while the second handles the rest of the traffic seamlessly.

Question 11

In a data classification scheme, the data is owned by the

Accepted Answer

A)  system security managers 
B)  business managers 
C)  Information Technology (IT) managers 
D)  end users 
A)  system security managers 
B)  business managers 
C)  Information Technology (IT) managers 
D)  end users

Question 12

An Intrusion Detection System (IDS) is based on the general hypothesis that a security violation is associated with a pattern of system usage, which can be

Accepted Answer

A)  differentiated from a normal usage pattern 
B)  used to detect known violations 
C)  used to detect a masquerader 
D)  differentiated to detect all security violations 
A)  differentiated from a normal usage pattern 
B)  used to detect known violations 
C)  used to detect a masquerader 
D)  differentiated to detect all security violations

Question 13

Which media sanitization methods should be used for data with a high security categorization?

Accepted Answer

A)  Clear or destroy 
B)  Clear or purge 
C)  Destroy or delete 
D)  Purge or destroy 
A)  Clear or destroy 
B)  Clear or purge 
C)  Destroy or delete 
D)  Purge or destroy

Question 14

Data remanence is the biggest threat in which of the following scenarios?

Accepted Answer

A)  A physical disk drive has been overwritten and reused within a datacenter 
B)  A physical disk drive has been degaussed, verified, and released to a third party for destruction 
C)  A flash drive has been overwritten, verified, and reused within a datacenter 
D)  A flash drive has been overwritten and released to a third party for destruction 
A)  A physical disk drive has been overwritten and reused within a datacenter 
B)  A physical disk drive has been degaussed, verified, and released to a third party for destruction 
C)  A flash drive has been overwritten, verified, and reused within a datacenter 
D)  A flash drive has been overwritten and released to a third party for destruction

Question 15

At a MINIMUM , audits of permissions to individual or group accounts should be scheduled

Accepted Answer

A)  annually 
B)  to correspond with staff promotions 
C)  to correspond with terminations 
D)  continually 
A)  annually 
B)  to correspond with staff promotions 
C)  to correspond with terminations 
D)  continually

Question 16

An organization lacks a data retention policy. Of the following, who is the BEST person to consult for such requirement?

Accepted Answer

A)  Application Manager 
B)  Database Administrator 
C)  Privacy Officer 
D)  Finance Manager 
A)  Application Manager 
B)  Database Administrator 
C)  Privacy Officer 
D)  Finance Manager

Which of the following is the FIRST thing to consider when reviewing Information Technology (IT) internal controls?

What is the BEST approach to addressing security issues in legacy web applications?

Which of the following adds end-to-end security inside a Layer 2 Tunneling Protocol (L2TP) Internet Protocol Security (IPSec) connection?

An organization regularly conducts its own penetration tests. Which of the following scenarios MUST be covered for the test to be effective?

What is a characteristic of Secure Sockets Layer (SSL) and Transport Layer Security (TLS)?

Which of the following MUST be considered when developing business rules for a data loss prevention (DLP) solution?

Reciprocal backup site agreements are considered to be

Which of the following is a Key Performance Indicator (KPI) for a security training and awareness program?

Which of the following is a canon of the (ISC)2 Code of Ethics?

In a High Availability (HA) environment, what is the PRIMARY goal of working with a virtual router address as the gateway to a network?

In a data classification scheme, the data is owned by the

An Intrusion Detection System (IDS) is based on the general hypothesis that a security violation is associated with a pattern of system usage, which can be

Which media sanitization methods should be used for data with a high security categorization?

Data remanence is the biggest threat in which of the following scenarios?

At a MINIMUM , audits of permissions to individual or group accounts should be scheduled

An organization lacks a data retention policy. Of the following, who is the BEST person to consult for such requirement?

Certified Authorization Professional

Certified Cloud Security Professional (CCSP)

Filters

Exam 3: Certified Information Systems Security Professional

Which of the following is the FIRST thing to consider when reviewing Information Technology (IT) internal controls?

What is the BEST approach to addressing security issues in legacy web applications?

Which of the following adds end-to-end security inside a Layer 2 Tunneling Protocol (L2TP) Internet Protocol Security (IPSec) connection?

An organization regularly conducts its own penetration tests. Which of the following scenarios MUST be covered for the test to be effective?

What is a characteristic of Secure Sockets Layer (SSL) and Transport Layer Security (TLS)?

Which of the following MUST be considered when developing business rules for a data loss prevention (DLP) solution?

Reciprocal backup site agreements are considered to be

Which of the following is a Key Performance Indicator (KPI) for a security training and awareness program?

Which of the following is a canon of the (ISC)2 Code of Ethics?

In a High Availability (HA) environment, what is the PRIMARY goal of working with a virtual router address as the gateway to a network?

In a data classification scheme, the data is owned by the

An Intrusion Detection System (IDS) is based on the general hypothesis that a security violation is associated with a pattern of system usage, which can be

Which media sanitization methods should be used for data with a high security categorization?

Data remanence is the biggest threat in which of the following scenarios?

At a MINIMUM , audits of permissions to individual or group accounts should be scheduled

An organization lacks a data retention policy. Of the following, who is the BEST person to consult for such requirement?

Certified Authorization Professional

Certified Cloud Security Professional (CCSP)

Filters