Exam 3: Certified Information Systems Security Professional

A group of organizations follows the same access standards and practices. One manages the verification and due diligence processes for the others. For a user to access a resource from one of the organizations, a check is made to see if that user has been certified. Which Federated Identity Management (FIM) process is this an example of?

Which of the following are the FIRST two steps to securing employees from threats involving workplace violence and acts of terrorism?

A company whose Information Technology (IT) services are being delivered from a Tier 4 data center, is preparing a companywide Business Continuity Planning (BCP). Which of the following failures should the IT manager be concerned with?

When designing a vulnerability test, which one of the following is likely to give the BEST indication of what components currently operate on the network?

Which of the following is the PRIMARY reason to perform regular vulnerability scanning of an organization network?

An organization's information security strategic plan MUST be reviewed

Which of the following will accomplish Multi-Factor Authentication (MFA)?

Which of the following actions MUST be performed when using Secure/Multipurpose Internet Mail Extensions (S/MIME) before sending an encrypted message to a recipient?

Which of the following is the PRIMARY benefit of a formalized information classification program?

Which of the following is the BEST definition of Cross-Site Request Forgery (CSRF)?

When developing solutions for mobile devices, in which phase of the Software Development Life Cycle (SDLC) should technical limitations related to devices be specified?

All of the following items should be included in a Business Impact Analysis (BIA) questionnaire EXCEPT questions that

A security practitioner has just been assigned to address an ongoing Denial of Service (DoS) attack against the company's network, which includes an e-commerce web site. The strategy has to include defenses for any size of attack without rendering the company network unusable. Which of the following should be a PRIMARY concern when addressing this issue?

Which of the following is the BEST reason for writing an information security policy?

Which of the following global privacy legislation principles ensures that data handling policies and the name of the data controller are easily accessible to the public?

Which of the following BEST describes a chosen plaintext attack?

How is it possible to extract private keys securely stored on a cryptographic smartcard?

Within the company, desktop clients receive Internet Protocol (IP) address over Dynamic Host Configuration Protocol (DHCP). Which of the following represents a valid measure to help protect the network against unauthorized access?

A proxy firewall operates at what layer of the Open System Interconnection (OSI) model?

Which testing method requires very limited or no information about the network infrastructure?