Question 1

Which of the following is a remote access protocol that uses a static authentication?

Accepted Answer

A)  Point-to-Point Tunneling Protocol (PPTP) 
B)  Routing Information Protocol (RIP) 
C)  Password Authentication Protocol (PAP) 
D)  Challenge Handshake Authentication Protocol (CHAP) 
A)  Point-to-Point Tunneling Protocol (PPTP) 
B)  Routing Information Protocol (RIP) 
C)  Password Authentication Protocol (PAP) 
D)  Challenge Handshake Authentication Protocol (CHAP)

Question 2

A vulnerability assessment report has been submitted to a client. The client indicates that one third of the hosts that were in scope are missing from the report. In which phase of the assessment was this error MOST likely made?

Accepted Answer

A)  Enumeration 
B)  Reporting 
C)  Detection 
D)  Discovery 
A)  Enumeration 
B)  Reporting 
C)  Detection 
D)  Discovery

Question 3

Which of the following value comparisons MOST accurately reflects the agile development approach?

Accepted Answer

A)  Processes and tools over individuals and interactions 
B)  Contract negotiation over customer collaboration 
C)  Following a plan over responding to change 
D)  Working software over comprehensive documentation 
A)  Processes and tools over individuals and interactions 
B)  Contract negotiation over customer collaboration 
C)  Following a plan over responding to change 
D)  Working software over comprehensive documentation

Question 4

When using Generic Routing Encapsulation (GRE) tunneling over Internet Protocol version 4 (IPv4), where is the GRE header inserted?

Accepted Answer

A)  Into the options field 
B)  Between the delivery header and payload 
C)  Between the source and destination addresses 
D)  Into the destination address 
A)  Into the options field 
B)  Between the delivery header and payload 
C)  Between the source and destination addresses 
D)  Into the destination address

Question 5

Which of the following is a process in the access provisioning lifecycle that will MOST likely identify access aggregation issues?

Accepted Answer

A)  Test 
B)  Assessment 
C)  Review 
D)  Peer review 
A)  Test 
B)  Assessment 
C)  Review 
D)  Peer review

Question 6

What Service Organization Controls (SOC) report can be freely distributed and used by customers to gain confidence in a service organization's systems?

Accepted Answer

A)  SOC 1 Type 1 
B)  SOC 1 Type 2 
C)  SOC 2 
D)  SOC 3 
A)  SOC 1 Type 1 
B)  SOC 1 Type 2 
C)  SOC 2 
D)  SOC 3

Question 7

Which of the following techniques is effective to detect taps in fiber optic cables?

Accepted Answer

A)  Taking baseline signal level of the cable 
B)  Measuring signal through external oscillator solution devices 
C)  Outlining electromagnetic field strength 
D)  Performing network vulnerability scanning 
A)  Taking baseline signal level of the cable 
B)  Measuring signal through external oscillator solution devices 
C)  Outlining electromagnetic field strength 
D)  Performing network vulnerability scanning

Question 8

A security professional should consider the protection of which of the following elements FIRST when developing a defense-in-depth strategy for a mobile workforce?

Accepted Answer

A)  Network perimeters 
B)  Demilitarized Zones (DMZ) 
C)  Databases and back-end servers 
D)  End-user devices 
A)  Network perimeters 
B)  Demilitarized Zones (DMZ) 
C)  Databases and back-end servers 
D)  End-user devices

Question 9

Which of the following management process allows ONLY those services required for users to accomplish their tasks, change default user passwords, and set servers to retrieve antivirus updates?

Accepted Answer

A)  Configuration 
B)  Identity 
C)  Compliance 
D)  Patch 
A)  Configuration 
B)  Identity 
C)  Compliance 
D)  Patch

Question 10

A manufacturing organization wants to establish a Federated Identity Management (FIM) system with its 20 different supplier companies. Which of the following is the BEST solution for the manufacturing organization?

Accepted Answer

A)  Trusted third-party certification 
B)  Lightweight Directory Access Protocol (LDAP) 
C)  Security Assertion Markup language (SAML) 
D)  Cross-certification 
A)  Trusted third-party certification 
B)  Lightweight Directory Access Protocol (LDAP) 
C)  Security Assertion Markup language (SAML) 
D)  Cross-certification

Question 11

Which type of test would an organization perform in order to locate and target exploitable defects?

Accepted Answer

A)  Penetration 
B)  System 
C)  Performance 
D)  Vulnerability 
A)  Penetration 
B)  System 
C)  Performance 
D)  Vulnerability

Question 12

When dealing with compliance with the Payment Card Industry-Data Security Standard (PCI-DSS), an organization that shares card holder information with a service provider MUST do which of the following?

Accepted Answer

A)  Perform a service provider PCI-DSS assessment on a yearly basis 
B)  Validate the service provider's PCI-DSS compliance status on a regular basis 
C)  Validate that the service providers security policies are in alignment with those of the organization 
D)  Ensure that the service provider updates and tests its Disaster Recovery Plan (DRP) on a yearly basis 
A)  Perform a service provider PCI-DSS assessment on a yearly basis 
B)  Validate the service provider's PCI-DSS compliance status on a regular basis 
C)  Validate that the service providers security policies are in alignment with those of the organization 
D)  Ensure that the service provider updates and tests its Disaster Recovery Plan (DRP) on a yearly basis

Question 13

The adoption of an enterprise-wide Business Continuity (BC) program requires which of the following?

Accepted Answer

A)  Good communication throughout the organization 
B)  A completed Business Impact Analysis (BI
A)  
C)  Formation of Disaster Recovery (DR) project team 
D)  Well-documented information asset classification 
A)  Good communication throughout the organization 
B)  A completed Business Impact Analysis (BI
A)  
C)  Formation of Disaster Recovery (DR) project team 
D)  Well-documented information asset classification

Question 14

Which of the following is the MOST effective preventative method to identify security flaws in software?

Accepted Answer

A)  Monitor performance in production environments 
B)  Perform a structured code review 
C)  Perform application penetration testing 
D)  Use automated security vulnerability testing tools 
A)  Monitor performance in production environments 
B)  Perform a structured code review 
C)  Perform application penetration testing 
D)  Use automated security vulnerability testing tools

Question 15

Which of the following MOST applies to Session Initiation Protocol (SIP) security?

Accepted Answer

A)  It reuses security mechanisms derived from existing protocols 
B)  It supports end-to-end security natively 
C)  It leverages Hypertext Transfer Protocol (HTTP) over Transport Layer Security (TLS) 
D)  It requires a Public Key Infrastructure (PKI) 
A)  It reuses security mechanisms derived from existing protocols 
B)  It supports end-to-end security natively 
C)  It leverages Hypertext Transfer Protocol (HTTP) over Transport Layer Security (TLS) 
D)  It requires a Public Key Infrastructure (PKI)

Question 16

Which of the following is a common feature of an Identity as a Service (IDaaS) solution?

Accepted Answer

A)  Single Sign-On (SSO) authentication support 
B)  Privileged user authentication support 
C)  Password reset service support 
D)  Terminal Access Controller Access Control System (TACACS) authentication support 
A)  Single Sign-On (SSO) authentication support 
B)  Privileged user authentication support 
C)  Password reset service support 
D)  Terminal Access Controller Access Control System (TACACS) authentication support

Question 17

What is the FIRST step in establishing an information security program?

Accepted Answer

A)  Identify critical security infrastructure 
B)  Establish baseline security controls 
C)  Establish an information security policy 
D)  Identify factors affecting information security 
A)  Identify critical security infrastructure 
B)  Establish baseline security controls 
C)  Establish an information security policy 
D)  Identify factors affecting information security

Question 18

At what level of the Open System Interconnection (OSI) model is data at rest on a Storage Area Network (SAN) located?

Accepted Answer

A)  Link layer 
B)  Physical layer 
C)  Session layer 
D)  Application layer 
A)  Link layer 
B)  Physical layer 
C)  Session layer 
D)  Application layer

Question 19

Which of the following is the MOST common method of memory protection?

Accepted Answer

A)  Compartmentalization 
B)  Segmentation 
C)  Error correction 
D)  Virtual Local Area Network (VLAN) tagging 
A)  Compartmentalization 
B)  Segmentation 
C)  Error correction 
D)  Virtual Local Area Network (VLAN) tagging

Question 20

Which of the following processes has the PRIMARY purpose of identifying outdated software versions, missing patches, and lapsed system updates?

Accepted Answer

A)  Penetration testing 
B)  Vulnerability management 
C)  Software Development Life Cycle (SDL
C)  
D)  Life cycle management 
A)  Penetration testing 
B)  Vulnerability management 
C)  Software Development Life Cycle (SDL
C)  
D)  Life cycle management

Which of the following is a remote access protocol that uses a static authentication?

A vulnerability assessment report has been submitted to a client. The client indicates that one third of the hosts that were in scope are missing from the report. In which phase of the assessment was this error MOST likely made?

Which of the following value comparisons MOST accurately reflects the agile development approach?

When using Generic Routing Encapsulation (GRE) tunneling over Internet Protocol version 4 (IPv4), where is the GRE header inserted?

Which of the following is a process in the access provisioning lifecycle that will MOST likely identify access aggregation issues?

What Service Organization Controls (SOC) report can be freely distributed and used by customers to gain confidence in a service organization's systems?

Which of the following techniques is effective to detect taps in fiber optic cables?

A security professional should consider the protection of which of the following elements FIRST when developing a defense-in-depth strategy for a mobile workforce?

Which of the following management process allows ONLY those services required for users to accomplish their tasks, change default user passwords, and set servers to retrieve antivirus updates?

A manufacturing organization wants to establish a Federated Identity Management (FIM) system with its 20 different supplier companies. Which of the following is the BEST solution for the manufacturing organization?

Which type of test would an organization perform in order to locate and target exploitable defects?

When dealing with compliance with the Payment Card Industry-Data Security Standard (PCI-DSS), an organization that shares card holder information with a service provider MUST do which of the following?

The adoption of an enterprise-wide Business Continuity (BC) program requires which of the following?

Which of the following is the MOST effective preventative method to identify security flaws in software?

Which of the following MOST applies to Session Initiation Protocol (SIP) security?

Which of the following is a common feature of an Identity as a Service (IDaaS) solution?

What is the FIRST step in establishing an information security program?

At what level of the Open System Interconnection (OSI) model is data at rest on a Storage Area Network (SAN) located?

Which of the following is the MOST common method of memory protection?

Which of the following processes has the PRIMARY purpose of identifying outdated software versions, missing patches, and lapsed system updates?

Certified Authorization Professional

Certified Cloud Security Professional (CCSP)

Filters

Exam 3: Certified Information Systems Security Professional

Which of the following is a remote access protocol that uses a static authentication?

A vulnerability assessment report has been submitted to a client. The client indicates that one third of the hosts that were in scope are missing from the report. In which phase of the assessment was this error MOST likely made?

Which of the following value comparisons MOST accurately reflects the agile development approach?

When using Generic Routing Encapsulation (GRE) tunneling over Internet Protocol version 4 (IPv4), where is the GRE header inserted?

Which of the following is a process in the access provisioning lifecycle that will MOST likely identify access aggregation issues?

What Service Organization Controls (SOC) report can be freely distributed and used by customers to gain confidence in a service organization's systems?

Which of the following techniques is effective to detect taps in fiber optic cables?

A security professional should consider the protection of which of the following elements FIRST when developing a defense-in-depth strategy for a mobile workforce?

Which of the following management process allows ONLY those services required for users to accomplish their tasks, change default user passwords, and set servers to retrieve antivirus updates?

A manufacturing organization wants to establish a Federated Identity Management (FIM) system with its 20 different supplier companies. Which of the following is the BEST solution for the manufacturing organization?

Which type of test would an organization perform in order to locate and target exploitable defects?

When dealing with compliance with the Payment Card Industry-Data Security Standard (PCI-DSS), an organization that shares card holder information with a service provider MUST do which of the following?

The adoption of an enterprise-wide Business Continuity (BC) program requires which of the following?

Which of the following is the MOST effective preventative method to identify security flaws in software?

Which of the following MOST applies to Session Initiation Protocol (SIP) security?

Which of the following is a common feature of an Identity as a Service (IDaaS) solution?

What is the FIRST step in establishing an information security program?

At what level of the Open System Interconnection (OSI) model is data at rest on a Storage Area Network (SAN) located?

Which of the following is the MOST common method of memory protection?

Which of the following processes has the PRIMARY purpose of identifying outdated software versions, missing patches, and lapsed system updates?

Certified Authorization Professional

Certified Cloud Security Professional (CCSP)

Filters