Question 1

What determines the level of security of a combination lock?

Accepted Answer

A)  Complexity of combination required to open the lock 
B)  Amount of time it takes to brute force the combination 
C)  The number of barrels associated with the internal mechanism 
D)  The hardness score of the metal lock material 
A)  Complexity of combination required to open the lock 
B)  Amount of time it takes to brute force the combination 
C)  The number of barrels associated with the internal mechanism 
D)  The hardness score of the metal lock material

Question 2

Which of the following is a weakness of Wired Equivalent Privacy (WEP)?

Accepted Answer

A)  Length of Initialization Vector (IV) 
B)  Protection against message replay 
C)  Detection of message tampering 
D)  Built-in provision to rotate keys 
A)  Length of Initialization Vector (IV) 
B)  Protection against message replay 
C)  Detection of message tampering 
D)  Built-in provision to rotate keys

Question 3

Which of the following is a direct monetary cost of a security incident?

Accepted Answer

A)  Morale 
B)  Reputation 
C)  Equipment 
D)  Information 
A)  Morale 
B)  Reputation 
C)  Equipment 
D)  Information

Question 4

Which of the following countermeasures is the MOST effective in defending against a social engineering attack?

Accepted Answer

A)  Mandating security policy acceptance 
B)  Changing individual behavior 
C)  Evaluating security awareness training 
D)  Filtering malicious e-mail content 
A)  Mandating security policy acceptance 
B)  Changing individual behavior 
C)  Evaluating security awareness training 
D)  Filtering malicious e-mail content

Question 5

How does a Host Based Intrusion Detection System (HIDS) identify a potential attack?

Accepted Answer

A)  Examines log messages or other indications on the system. 
B)  Monitors alarms sent to the system administrator 
C)  Matches traffic patterns to virus signature files 
D)  Examines the Access Control List (ACL) 
A)  Examines log messages or other indications on the system. 
B)  Monitors alarms sent to the system administrator 
C)  Matches traffic patterns to virus signature files 
D)  Examines the Access Control List (ACL)

Question 6

After following the processes defined within the change management plan, a super user has upgraded a device within an Information system. What step would be taken to ensure that the upgrade did NOT affect the network security posture?

Accepted Answer

A)  Conduct an Assessment and Authorization (A&
A)  
B)  Conduct a security impact analysis 
C)  Review the results of the most recent vulnerability scan 
D)  Conduct a gap analysis with the baseline configuration 
A)  Conduct an Assessment and Authorization (A&
A)  
B)  Conduct a security impact analysis 
C)  Review the results of the most recent vulnerability scan 
D)  Conduct a gap analysis with the baseline configuration

Question 7

Which of the following explains why classifying data is an important step in performing a risk assessment?

Accepted Answer

A)  To provide a framework for developing good security metrics 
B)  To justify the selection of costly security controls 
C)  To classify the security controls sensitivity that helps scope the risk assessment 
D)  To help determine the appropriate level of data security controls 
A)  To provide a framework for developing good security metrics 
B)  To justify the selection of costly security controls 
C)  To classify the security controls sensitivity that helps scope the risk assessment 
D)  To help determine the appropriate level of data security controls

Question 8

What does the Maximum Tolerable Downtime (MTD) determine?

Accepted Answer

A)  The estimated period of time a business critical database can remain down before customers are affected. 
B)  The fixed length of time a company can endure a disaster without any Disaster Recovery (DR) planning 
C)  The estimated period of time a business can remain interrupted beyond which it risks never recovering 
D)  The fixed length of time in a DR process before redundant systems are engaged 
A)  The estimated period of time a business critical database can remain down before customers are affected. 
B)  The fixed length of time a company can endure a disaster without any Disaster Recovery (DR) planning 
C)  The estimated period of time a business can remain interrupted beyond which it risks never recovering 
D)  The fixed length of time in a DR process before redundant systems are engaged

Question 9

Which of the following is the primary advantage of segmenting Virtual Machines (VM) using physical networks?

Accepted Answer

A)  Simplicity of network configuration and network monitoring 
B)  Removes the need for decentralized management solutions 
C)  Removes the need for dedicated virtual security controls 
D)  Simplicity of network configuration and network redundancy 
A)  Simplicity of network configuration and network monitoring 
B)  Removes the need for decentralized management solutions 
C)  Removes the need for dedicated virtual security controls 
D)  Simplicity of network configuration and network redundancy

Question 10

What type of attack sends Internet Control Message Protocol (ICMP) echo requests to the target machine with a larger payload than the target can handle?

Accepted Answer

A)  Man-in-the-Middle (MITM) 
B)  Denial of Service (DoS) 
C)  Domain Name Server (DNS) poisoning 
D)  Buffer overflow 
A)  Man-in-the-Middle (MITM) 
B)  Denial of Service (DoS) 
C)  Domain Name Server (DNS) poisoning 
D)  Buffer overflow

Question 11

Which of the following methods protects Personally Identifiable Information (PII) by use of a full replacement of the data element?

Accepted Answer

A)  Data tokenization 
B)  Volume encryption 
C)  Transparent Data Encryption (TD
E)  
D)  Column level database encryption 
A)  Data tokenization 
B)  Volume encryption 
C)  Transparent Data Encryption (TD
E)  
D)  Column level database encryption

Question 12

Who is responsible for the protection of information when it is shared with or provided to other organizations?

Accepted Answer

A)  Systems owner 
B)  Authorizing Official (AO) 
C)  Information owner 
D)  Security officer 
A)  Systems owner 
B)  Authorizing Official (AO) 
C)  Information owner 
D)  Security officer

Question 13

When in the Software Development Life Cycle (SDLC) MUST software security functional requirements be defined?

Accepted Answer

A)  After the system preliminary design has been developed and the data security categorization has been performed 
B)  After the vulnerability analysis has been performed and before the system detailed design begins 
C)  After the system preliminary design has been developed and before the data security categorization begins 
D)  After the business functional analysis and the data security categorization have been performed 
A)  After the system preliminary design has been developed and the data security categorization has been performed 
B)  After the vulnerability analysis has been performed and before the system detailed design begins 
C)  After the system preliminary design has been developed and before the data security categorization begins 
D)  After the business functional analysis and the data security categorization have been performed

Question 14

The Secure Shell (SSH) version 2 protocol supports

Accepted Answer

A)  availability, accountability, compression, and integrity 
B)  authentication, availability, confidentiality, and integrity 
C)  accountability, compression, confidentiality, and integrity 
D)  authentication, compression, confidentiality, and integrity 
A)  availability, accountability, compression, and integrity 
B)  authentication, availability, confidentiality, and integrity 
C)  accountability, compression, confidentiality, and integrity 
D)  authentication, compression, confidentiality, and integrity

Question 15

Which of the following is held accountable for the risk to organizational systems and data that result from outsourcing Information Technology (IT) systems and services?

Accepted Answer

A)  The acquiring organization 
B)  The service provider 
C)  The risk executive (function) 
D)  The IT manager 
A)  The acquiring organization 
B)  The service provider 
C)  The risk executive (function) 
D)  The IT manager

Question 16

Which of the following is the MOST important reason for timely installation of software patches?

Accepted Answer

A)  Patches are only available for a specific time 
B)  Attackers reverse engineer the exploit from the patch 
C)  Patches may not be compatible with proprietary software 
D)  Attackers may be conducting network analysis 
A)  Patches are only available for a specific time 
B)  Attackers reverse engineer the exploit from the patch 
C)  Patches may not be compatible with proprietary software 
D)  Attackers may be conducting network analysis

Question 17

What is the MOST common component of a vulnerability management framework?

Accepted Answer

A)  Risk analysis 
B)  Patch management 
C)  Threat analysis 
D)  Backup management 
A)  Risk analysis 
B)  Patch management 
C)  Threat analysis 
D)  Backup management

Question 18

During which of the following processes is least privilege implemented for a user account?

Accepted Answer

A)  Provision 
B)  Approve 
C)  Request 
D)  Review 
A)  Provision 
B)  Approve 
C)  Request 
D)  Review

Question 19

From a cryptographic perspective, the service of non-repudiation includes which of the following features?

Accepted Answer

A)  Validity of digital certificates 
B)  Validity of the authorization rules 
C)  Proof of authenticity of the message 
D)  Proof of integrity of the message 
A)  Validity of digital certificates 
B)  Validity of the authorization rules 
C)  Proof of authenticity of the message 
D)  Proof of integrity of the message

Question 20

Which of the following types of technologies would be the MOST cost-effective method to provide a reactive control for protecting personnel in public areas?

Accepted Answer

A)  Install mantraps at the building entrances 
B)  Enclose the personnel entry area with polycarbonate plastic 
C)  Supply a duress alarm for personnel exposed to the public 
D)  Hire a guard to protect the public area 
A)  Install mantraps at the building entrances 
B)  Enclose the personnel entry area with polycarbonate plastic 
C)  Supply a duress alarm for personnel exposed to the public 
D)  Hire a guard to protect the public area

What determines the level of security of a combination lock?

Which of the following is a weakness of Wired Equivalent Privacy (WEP)?

Which of the following is a direct monetary cost of a security incident?

Which of the following countermeasures is the MOST effective in defending against a social engineering attack?

How does a Host Based Intrusion Detection System (HIDS) identify a potential attack?

After following the processes defined within the change management plan, a super user has upgraded a device within an Information system. What step would be taken to ensure that the upgrade did NOT affect the network security posture?

Which of the following explains why classifying data is an important step in performing a risk assessment?

What does the Maximum Tolerable Downtime (MTD) determine?

Which of the following is the primary advantage of segmenting Virtual Machines (VM) using physical networks?

What type of attack sends Internet Control Message Protocol (ICMP) echo requests to the target machine with a larger payload than the target can handle?

Which of the following methods protects Personally Identifiable Information (PII) by use of a full replacement of the data element?

Who is responsible for the protection of information when it is shared with or provided to other organizations?

When in the Software Development Life Cycle (SDLC) MUST software security functional requirements be defined?

The Secure Shell (SSH) version 2 protocol supports

Which of the following is held accountable for the risk to organizational systems and data that result from outsourcing Information Technology (IT) systems and services?

Which of the following is the MOST important reason for timely installation of software patches?

What is the MOST common component of a vulnerability management framework?

During which of the following processes is least privilege implemented for a user account?

From a cryptographic perspective, the service of non-repudiation includes which of the following features?

Which of the following types of technologies would be the MOST cost-effective method to provide a reactive control for protecting personnel in public areas?

Certified Authorization Professional

Certified Cloud Security Professional (CCSP)

Filters

Exam 3: Certified Information Systems Security Professional

What determines the level of security of a combination lock?

Which of the following is a weakness of Wired Equivalent Privacy (WEP)?

Which of the following is a direct monetary cost of a security incident?

Which of the following countermeasures is the MOST effective in defending against a social engineering attack?

How does a Host Based Intrusion Detection System (HIDS) identify a potential attack?

After following the processes defined within the change management plan, a super user has upgraded a device within an Information system. What step would be taken to ensure that the upgrade did NOT affect the network security posture?

Which of the following explains why classifying data is an important step in performing a risk assessment?

What does the Maximum Tolerable Downtime (MTD) determine?

Which of the following is the primary advantage of segmenting Virtual Machines (VM) using physical networks?

What type of attack sends Internet Control Message Protocol (ICMP) echo requests to the target machine with a larger payload than the target can handle?

Which of the following methods protects Personally Identifiable Information (PII) by use of a full replacement of the data element?

Who is responsible for the protection of information when it is shared with or provided to other organizations?

When in the Software Development Life Cycle (SDLC) MUST software security functional requirements be defined?

The Secure Shell (SSH) version 2 protocol supports

Which of the following is held accountable for the risk to organizational systems and data that result from outsourcing Information Technology (IT) systems and services?

Which of the following is the MOST important reason for timely installation of software patches?

What is the MOST common component of a vulnerability management framework?

During which of the following processes is least privilege implemented for a user account?

From a cryptographic perspective, the service of non-repudiation includes which of the following features?

Which of the following types of technologies would be the MOST cost-effective method to provide a reactive control for protecting personnel in public areas?

Certified Authorization Professional

Certified Cloud Security Professional (CCSP)

Filters