Question 1

The application of a security patch to a product previously validate at Common Criteria (CC) Evaluation Assurance Level (EAL) 4 would

Accepted Answer

A)  require an update of the Protection Profile (PP). 
B)  require recertification. 
C)  retain its current EAL rating. 
D)  reduce the product to EAL 3. 
A)  require an update of the Protection Profile (PP). 
B)  require recertification. 
C)  retain its current EAL rating. 
D)  reduce the product to EAL 3.

Question 2

What is the PRIMARY reason for implementing change management?

Accepted Answer

A)  Certify and approve releases to the environment 
B)  Provide version rollbacks for system changes 
C)  Ensure that all applications are approved 
D)  Ensure accountability for changes to the environment 
A)  Certify and approve releases to the environment 
B)  Provide version rollbacks for system changes 
C)  Ensure that all applications are approved 
D)  Ensure accountability for changes to the environment

Question 3

What should be the FIRST action for a security administrator who detects an intrusion on the network based on precursors and other indicators?

Accepted Answer

A)  Isolate and contain the intrusion. 
B)  Notify system and application owners. 
C)  Apply patches to the Operating Systems (OS). 
D)  Document and verify the intrusion. 
A)  Isolate and contain the intrusion. 
B)  Notify system and application owners. 
C)  Apply patches to the Operating Systems (OS). 
D)  Document and verify the intrusion.

Question 4

In order to support the least privilege security principle when a resource is transferring within the organization from a production support system administration role to a developer role, what changes should be made to that resource's access to the production Operating System (OS) directory structure?

Accepted Answer

A)  From Read Only privileges to No Access privileges 
B)  From Author privileges to Administrative privileges 
C)  From Administrative privileges to No Access privileges 
D)  From No Access privileges to Author privileges 
A)  From Read Only privileges to No Access privileges 
B)  From Author privileges to Administrative privileges 
C)  From Administrative privileges to No Access privileges 
D)  From No Access privileges to Author privileges

Question 5

During examination of Internet history records, the following string occurs within a Unique Resource Locator (URL): http://www.companysite.com/products/products.asp?productid=123 or 1=1 What type of attack does this indicate?

Accepted Answer

A)  Directory traversal 
B)  Structured Query Language (SQL) injection 
C)  Cross-Site Scripting (XSS) 
D)  Shellcode injection 
A)  Directory traversal 
B)  Structured Query Language (SQL) injection 
C)  Cross-Site Scripting (XSS) 
D)  Shellcode injection

Question 6

Assessing a third party's risk by counting bugs in the code may not be the best measure of an attack surface within the supply chain. Which of the following is LEAST associated with the attack surface?

Accepted Answer

A)  Input protocols 
B)  Target processes 
C)  Error messages 
D)  Access rights 
A)  Input protocols 
B)  Target processes 
C)  Error messages 
D)  Access rights

Question 7

Which of the following is the BEST approach for a forensic examiner to obtain the greatest amount of relevant information from malicious software?

Accepted Answer

A)  Analyze the behavior of the program 
B)  Analyze the logs generated by the software 
C)  Review the code to identify its origin 
D)  Examine the file properties and permissions 
A)  Analyze the behavior of the program 
B)  Analyze the logs generated by the software 
C)  Review the code to identify its origin 
D)  Examine the file properties and permissions

Question 8

What is an advantage of Elliptic Curve Cryptography (ECC)?

Accepted Answer

A)  Cryptographic approach that does not require a fixed-length key 
B)  Military-strength security that does not depend upon secrecy of the algorithm 
C)  Opportunity to use shorter keys for the same level of security 
D)  Ability to use much longer keys for greater security 
A)  Cryptographic approach that does not require a fixed-length key 
B)  Military-strength security that does not depend upon secrecy of the algorithm 
C)  Opportunity to use shorter keys for the same level of security 
D)  Ability to use much longer keys for greater security

Question 9

In a dispersed network that lacks central control, which of the following is the PRIMARY course of action to mitigate exposure?

Accepted Answer

A)  Implement security policies and standards, data backups, and audit controls 
B)  Implement management policies, audit control, and data backups 
C)  Implement security policies and standards, access controls, and access limitations 
D)  Implement remote access policies, shared workstations, and log management 
A)  Implement security policies and standards, data backups, and audit controls 
B)  Implement management policies, audit control, and data backups 
C)  Implement security policies and standards, access controls, and access limitations 
D)  Implement remote access policies, shared workstations, and log management

Question 10

Which of the following is a credible source to validate that security testing of Commercial Off-The-Shelf (COTS) software has been performed with international standards?

Accepted Answer

A)  Common Criteria (C
C)  
B)  Evaluation Assurance Level (EAL) 
C)  National Information Assurance Partnership (NIAP) 
D)  International Standards Organization (ISO) 
A)  Common Criteria (C
C)  
B)  Evaluation Assurance Level (EAL) 
C)  National Information Assurance Partnership (NIAP) 
D)  International Standards Organization (ISO)

Question 11

Which of the following needs to be included in order for High Availability (HA) to continue operations during planned system outages?

Accepted Answer

A)  Redundant hardware, disk spanning, and patching 
B)  Load balancing, power reserves, and disk spanning 
C)  Backups, clustering, and power reserves 
D)  Clustering, load balancing, and fault-tolerant options 
A)  Redundant hardware, disk spanning, and patching 
B)  Load balancing, power reserves, and disk spanning 
C)  Backups, clustering, and power reserves 
D)  Clustering, load balancing, and fault-tolerant options

Question 12

Which of the following Service Organization Control (SOC) report types should an organization request if they require a period of time report covering security and availability for a particular system?

Accepted Answer

A)  SOC 1 Type 1 
B)  SOC 1 Type 2 
C)  SOC 2 Type 1 
D)  SOC 2 Type 2 
A)  SOC 1 Type 1 
B)  SOC 1 Type 2 
C)  SOC 2 Type 1 
D)  SOC 2 Type 2

Question 13

Which of the following is included in the Global System for Mobile Communications (GSM) security framework?

Accepted Answer

A)  Public-Key Infrastructure (PKI) 
B)  Symmetric key cryptography 
C)  Digital signatures 
D)  Biometric authentication 
A)  Public-Key Infrastructure (PKI) 
B)  Symmetric key cryptography 
C)  Digital signatures 
D)  Biometric authentication

Question 14

Which of the following is a characteristic of an internal audit?

Accepted Answer

A)  An internal audit is typically shorter in duration than an external audit. 
B)  The internal audit schedule is published to the organization well in advance. 
C)  The internal auditor reports to the Information Technology (IT) department 
D)  Management is responsible for reading and acting upon the internal audit results 
A)  An internal audit is typically shorter in duration than an external audit. 
B)  The internal audit schedule is published to the organization well in advance. 
C)  The internal auditor reports to the Information Technology (IT) department 
D)  Management is responsible for reading and acting upon the internal audit results

Question 15

When should the software Quality Assurance (QA) team feel confident that testing is complete?

Accepted Answer

A)  When release criteria are met 
B)  When the time allocated for testing the software is met 
C)  When senior management approves the test results 
D)  When the software has zero security vulnerabilities 
A)  When release criteria are met 
B)  When the time allocated for testing the software is met 
C)  When senior management approves the test results 
D)  When the software has zero security vulnerabilities

Question 16

Once the types of information have been identified, who should an information security practitioner work with to ensure that the information is properly categorized?

Accepted Answer

A)  Information Owner (IO) 
B)  System Administrator 
C)  Business Continuity (B
C)  Manager 
D)  Chief Information Officer (CIO) 
A)  Information Owner (IO) 
B)  System Administrator 
C)  Business Continuity (B
C)  Manager 
D)  Chief Information Officer (CIO)

Question 17

Which of the following is a MAJOR concern when there is a need to preserve or retain information for future retrieval?

Accepted Answer

A)  Laws and regulations may change in the interim, making it unnecessary to retain the information 
B)  The expense of retaining the information could become untenable for the organization 
C)  The organization may lose track of the information and not dispose of it securely 
D)  The technology needed to retrieve the information may not be available in the future 
A)  Laws and regulations may change in the interim, making it unnecessary to retain the information 
B)  The expense of retaining the information could become untenable for the organization 
C)  The organization may lose track of the information and not dispose of it securely 
D)  The technology needed to retrieve the information may not be available in the future

Question 18

The PRIMARY outcome of a certification process is that it provides documented

Accepted Answer

A)  interconnected systems and their implemented security controls. 
B)  standards for security assessment, testing, and process evaluation. 
C)  system weakness for remediation. 
D)  security analyses needed to make a risk-based decision. 
A)  interconnected systems and their implemented security controls. 
B)  standards for security assessment, testing, and process evaluation. 
C)  system weakness for remediation. 
D)  security analyses needed to make a risk-based decision.

Question 19

When would an organization review a Business Continuity Management (BCM) system?

Accepted Answer

A)  When major changes occur on systems 
B)  When personnel changes occur 
C)  Before and after Disaster Recovery (DR) tests 
D)  At planned intervals 
A)  When major changes occur on systems 
B)  When personnel changes occur 
C)  Before and after Disaster Recovery (DR) tests 
D)  At planned intervals

Question 20

Which of the following is BEST suited for exchanging authentication and authorization messages in a multi-party decentralized environment?

Accepted Answer

A)  Lightweight Directory Access Protocol (LDAP) 
B)  Security Assertion Markup Language (SAML) 
C)  Internet Mail Access Protocol 
D)  Transport Layer Security (TLS) 
A)  Lightweight Directory Access Protocol (LDAP) 
B)  Security Assertion Markup Language (SAML) 
C)  Internet Mail Access Protocol 
D)  Transport Layer Security (TLS)

The application of a security patch to a product previously validate at Common Criteria (CC) Evaluation Assurance Level (EAL) 4 would

What is the PRIMARY reason for implementing change management?

What should be the FIRST action for a security administrator who detects an intrusion on the network based on precursors and other indicators?

During examination of Internet history records, the following string occurs within a Unique Resource Locator (URL): http://www.companysite.com/products/products.asp?productid=123 or 1=1 What type of attack does this indicate?

Assessing a third party's risk by counting bugs in the code may not be the best measure of an attack surface within the supply chain. Which of the following is LEAST associated with the attack surface?

Which of the following is the BEST approach for a forensic examiner to obtain the greatest amount of relevant information from malicious software?

What is an advantage of Elliptic Curve Cryptography (ECC)?

In a dispersed network that lacks central control, which of the following is the PRIMARY course of action to mitigate exposure?

Which of the following is a credible source to validate that security testing of Commercial Off-The-Shelf (COTS) software has been performed with international standards?

Which of the following needs to be included in order for High Availability (HA) to continue operations during planned system outages?

Which of the following Service Organization Control (SOC) report types should an organization request if they require a period of time report covering security and availability for a particular system?

Which of the following is included in the Global System for Mobile Communications (GSM) security framework?

Which of the following is a characteristic of an internal audit?

When should the software Quality Assurance (QA) team feel confident that testing is complete?

Once the types of information have been identified, who should an information security practitioner work with to ensure that the information is properly categorized?

Which of the following is a MAJOR concern when there is a need to preserve or retain information for future retrieval?

The PRIMARY outcome of a certification process is that it provides documented

When would an organization review a Business Continuity Management (BCM) system?

Which of the following is BEST suited for exchanging authentication and authorization messages in a multi-party decentralized environment?

Certified Authorization Professional

Certified Cloud Security Professional (CCSP)

Filters

Exam 3: Certified Information Systems Security Professional

The application of a security patch to a product previously validate at Common Criteria (CC) Evaluation Assurance Level (EAL) 4 would

What is the PRIMARY reason for implementing change management?

What should be the FIRST action for a security administrator who detects an intrusion on the network based on precursors and other indicators?

During examination of Internet history records, the following string occurs within a Unique Resource Locator (URL): http://www.companysite.com/products/products.asp?productid=123 or 1=1 What type of attack does this indicate?

Assessing a third party's risk by counting bugs in the code may not be the best measure of an attack surface within the supply chain. Which of the following is LEAST associated with the attack surface?

Which of the following is the BEST approach for a forensic examiner to obtain the greatest amount of relevant information from malicious software?

What is an advantage of Elliptic Curve Cryptography (ECC)?

In a dispersed network that lacks central control, which of the following is the PRIMARY course of action to mitigate exposure?

Which of the following is a credible source to validate that security testing of Commercial Off-The-Shelf (COTS) software has been performed with international standards?

Which of the following needs to be included in order for High Availability (HA) to continue operations during planned system outages?

Which of the following Service Organization Control (SOC) report types should an organization request if they require a period of time report covering security and availability for a particular system?

Which of the following is included in the Global System for Mobile Communications (GSM) security framework?

Which of the following is a characteristic of an internal audit?

When should the software Quality Assurance (QA) team feel confident that testing is complete?

Once the types of information have been identified, who should an information security practitioner work with to ensure that the information is properly categorized?

Which of the following is a MAJOR concern when there is a need to preserve or retain information for future retrieval?

The PRIMARY outcome of a certification process is that it provides documented

When would an organization review a Business Continuity Management (BCM) system?

Which of the following is BEST suited for exchanging authentication and authorization messages in a multi-party decentralized environment?

Certified Authorization Professional

Certified Cloud Security Professional (CCSP)

Filters