Question 1

Which of the following mechanisms will BEST prevent a Cross-Site Request Forgery (CSRF) attack?

Accepted Answer

A)  parameterized database queries 
B)  whitelist input values 
C)  synchronized session tokens 
D)  use strong ciphers 
A)  parameterized database queries 
B)  whitelist input values 
C)  synchronized session tokens 
D)  use strong ciphers

Question 2

Transport Layer Security (TLS) provides which of the following capabilities for a remote access server?

Accepted Answer

A)  Transport layer handshake compression 
B)  Application layer negotiation 
C)  Peer identity authentication 
D)  Digital certificate revocation 
A)  Transport layer handshake compression 
B)  Application layer negotiation 
C)  Peer identity authentication 
D)  Digital certificate revocation

Question 3

Which of the following media sanitization techniques is MOST likely to be effective for an organization using public cloud services?

Accepted Answer

A)  Low-level formatting 
B)  Secure-grade overwrite erasure 
C)  Cryptographic erasure 
D)  Drive degaussing 
A)  Low-level formatting 
B)  Secure-grade overwrite erasure 
C)  Cryptographic erasure 
D)  Drive degaussing

Question 4

Which of the following protocols will allow the encrypted transfer of content on the Internet?

Accepted Answer

A)  Server Message Block (SM
B)  
B)  Secure copy 
C)  Hypertext Transfer Protocol (HTTP) 
D)  Remote copy 
A)  Server Message Block (SM
B)  
B)  Secure copy 
C)  Hypertext Transfer Protocol (HTTP) 
D)  Remote copy

Question 5

Which of the following is a standard Access Control List (ACL) element that enables a router to filter Internet traffic?

Accepted Answer

A)  Media Access Control (MA
C)  address 
B)  Internet Protocol (IP) address 
C)  Security roles 
D)  Device needs 
A)  Media Access Control (MA
C)  address 
B)  Internet Protocol (IP) address 
C)  Security roles 
D)  Device needs

Question 6

A security practitioner is tasked with securing the organization's Wireless Access Points (WAP). Which of these is the MOST effective way of restricting this environment to authorized users?

Accepted Answer

A)  Enable Wi-Fi Protected Access 2 (WPA2) encryption on the wireless access point 
B)  Disable the broadcast of the Service Set Identifier (SSI
D)  name 
C)  Change the name of the Service Set Identifier (SSI
D)  to a random value not associated with the organization 
D)  Create Access Control Lists (ACL) based on Media Access Control (MA
C)  addresses 
A)  Enable Wi-Fi Protected Access 2 (WPA2) encryption on the wireless access point 
B)  Disable the broadcast of the Service Set Identifier (SSI
D)  name 
C)  Change the name of the Service Set Identifier (SSI
D)  to a random value not associated with the organization 
D)  Create Access Control Lists (ACL) based on Media Access Control (MA
C)  addresses

Question 7

Which of the following is the BEST technique to facilitate secure software development?

Accepted Answer

A)  Adhere to secure coding practices for the software application under development 
B)  Conduct penetrating testing for the software application under development 
C)  Develop a threat modeling review for the software application under development 
D)  Perform a code review process for the software application under development 
A)  Adhere to secure coding practices for the software application under development 
B)  Conduct penetrating testing for the software application under development 
C)  Develop a threat modeling review for the software application under development 
D)  Perform a code review process for the software application under development

Question 8

What is the PRIMARY purpose for an organization to conduct a security audit?

Accepted Answer

A)  To ensure the organization is adhering to a well-defined standard 
B)  To ensure the organization is applying security controls to mitigate identified risks 
C)  To ensure the organization is configuring information systems efficiently 
D)  To ensure the organization is documenting findings 
A)  To ensure the organization is adhering to a well-defined standard 
B)  To ensure the organization is applying security controls to mitigate identified risks 
C)  To ensure the organization is configuring information systems efficiently 
D)  To ensure the organization is documenting findings

Question 9

In a Transmission Control Protocol/Internet Protocol (TCP/IP) stack, which layer is responsible for negotiating and establishing a connection with another node?

Accepted Answer

A)  Transport layer 
B)  Application layer 
C)  Network layer 
D)  Session layer 
A)  Transport layer 
B)  Application layer 
C)  Network layer 
D)  Session layer

Question 10

Which of the following is the MOST appropriate action when reusing media that contains sensitive data?

Accepted Answer

A)  Erase 
B)  Sanitize 
C)  Encrypt 
D)  Degauss 
A)  Erase 
B)  Sanitize 
C)  Encrypt 
D)  Degauss

Question 11

What is the BEST way to correlate large volumes of disparate data sources in a Security Operations Center (SOC) environment?

Accepted Answer

A)  Implement Intrusion Detection System (IDS) 
B)  Implement a Security Information and Event Management (SIEM) system 
C)  Hire a team of analysts to consolidate data and generate reports 
D)  Outsource the management of the SOC 
A)  Implement Intrusion Detection System (IDS) 
B)  Implement a Security Information and Event Management (SIEM) system 
C)  Hire a team of analysts to consolidate data and generate reports 
D)  Outsource the management of the SOC

Question 12

Who has the PRIMARY responsibility to ensure that security objectives are aligned with organization goals?

Accepted Answer

A)  Senior management 
B)  Information security department 
C)  Audit committee 
D)  All users 
A)  Senior management 
B)  Information security department 
C)  Audit committee 
D)  All users

Question 13

Which of the following BEST describes Recovery Time Objective (RTO)?

Accepted Answer

A)  Time of application resumption after disaster 
B)  Time of application verification after disaster. 
C)  Time of data validation after disaster. 
D)  Time of data restoration from backup after disaster. 
A)  Time of application resumption after disaster 
B)  Time of application verification after disaster. 
C)  Time of data validation after disaster. 
D)  Time of data restoration from backup after disaster.

Question 14

During a fingerprint verification process, which of the following is used to verify identity and authentication?

Accepted Answer

A)  A pressure value is compared with a stored template 
B)  Sets of digits are matched with stored values 
C)  A hash table is matched to a database of stored value 
D)  A template of minutiae is compared with a stored template 
A)  A pressure value is compared with a stored template 
B)  Sets of digits are matched with stored values 
C)  A hash table is matched to a database of stored value 
D)  A template of minutiae is compared with a stored template

Question 15

Who in the organization is accountable for classification of data information assets?

Accepted Answer

A)  Data owner 
B)  Data architect 
C)  Chief Information Security Officer (CISO) 
D)  Chief Information Officer (CIO) 
A)  Data owner 
B)  Data architect 
C)  Chief Information Security Officer (CISO) 
D)  Chief Information Officer (CIO)

Question 16

Proven application security principles include which of the following?

Accepted Answer

A)  Minimizing attack surface area 
B)  Hardening the network perimeter 
C)  Accepting infrastructure security controls 
D)  Developing independent modules 
A)  Minimizing attack surface area 
B)  Hardening the network perimeter 
C)  Accepting infrastructure security controls 
D)  Developing independent modules

Question 17

Which of the following is the MOST effective practice in managing user accounts when an employee is terminated?

Accepted Answer

A)  Implement processes for automated removal of access for terminated employees. 
B)  Delete employee network and system IDs upon termination. 
C)  Manually remove terminated employee user-access to all systems and applications. 
D)  Disable terminated employee network ID to remove all access. 
A)  Implement processes for automated removal of access for terminated employees. 
B)  Delete employee network and system IDs upon termination. 
C)  Manually remove terminated employee user-access to all systems and applications. 
D)  Disable terminated employee network ID to remove all access.

Question 18

An Internet software application requires authentication before a user is permitted to utilize the resource. Which testing scenario BEST validates the functionality of the application?

Accepted Answer

A)  Reasonable data testing 
B)  Input validation testing 
C)  Web session testing 
D)  Allowed data bounds and limits testing 
A)  Reasonable data testing 
B)  Input validation testing 
C)  Web session testing 
D)  Allowed data bounds and limits testing

Question 19

A security engineer is tasked with implementing a new identity solution. The client doesn't want to install or maintain the infrastructure. Which of the following would qualify as the BEST solution?

Accepted Answer

A)  Microsoft Identity Manager (MIM) 
B)  Azure Active Directory (A
D)  
C)  Active Directory Federation Services (ADFS) 
D)  Active Directory (A
D)  
A)  Microsoft Identity Manager (MIM) 
B)  Azure Active Directory (A
D)  
C)  Active Directory Federation Services (ADFS) 
D)  Active Directory (A
D)

Question 20

What is the expected outcome of security awareness in support of a security awareness program?

Accepted Answer

A)  Awareness activities should be used to focus on security concerns and respond to those concerns accordingly 
B)  Awareness is not an activity or part of the training but rather a state of persistence to support the program 
C)  Awareness is training. The purpose of awareness presentations is to broaden attention of security. 
D)  Awareness is not training. The purpose of awareness presentation is simply to focus attention on security. 
A)  Awareness activities should be used to focus on security concerns and respond to those concerns accordingly 
B)  Awareness is not an activity or part of the training but rather a state of persistence to support the program 
C)  Awareness is training. The purpose of awareness presentations is to broaden attention of security. 
D)  Awareness is not training. The purpose of awareness presentation is simply to focus attention on security.

Which of the following mechanisms will BEST prevent a Cross-Site Request Forgery (CSRF) attack?

Transport Layer Security (TLS) provides which of the following capabilities for a remote access server?

Which of the following media sanitization techniques is MOST likely to be effective for an organization using public cloud services?

Which of the following protocols will allow the encrypted transfer of content on the Internet?

Which of the following is a standard Access Control List (ACL) element that enables a router to filter Internet traffic?

A security practitioner is tasked with securing the organization's Wireless Access Points (WAP). Which of these is the MOST effective way of restricting this environment to authorized users?

Which of the following is the BEST technique to facilitate secure software development?

What is the PRIMARY purpose for an organization to conduct a security audit?

In a Transmission Control Protocol/Internet Protocol (TCP/IP) stack, which layer is responsible for negotiating and establishing a connection with another node?

Which of the following is the MOST appropriate action when reusing media that contains sensitive data?

What is the BEST way to correlate large volumes of disparate data sources in a Security Operations Center (SOC) environment?

Who has the PRIMARY responsibility to ensure that security objectives are aligned with organization goals?

Which of the following BEST describes Recovery Time Objective (RTO)?

During a fingerprint verification process, which of the following is used to verify identity and authentication?

Who in the organization is accountable for classification of data information assets?

Proven application security principles include which of the following?

Which of the following is the MOST effective practice in managing user accounts when an employee is terminated?

An Internet software application requires authentication before a user is permitted to utilize the resource. Which testing scenario BEST validates the functionality of the application?

A security engineer is tasked with implementing a new identity solution. The client doesn't want to install or maintain the infrastructure. Which of the following would qualify as the BEST solution?

What is the expected outcome of security awareness in support of a security awareness program?

Certified Authorization Professional

Certified Cloud Security Professional (CCSP)

Filters

Exam 3: Certified Information Systems Security Professional

Which of the following mechanisms will BEST prevent a Cross-Site Request Forgery (CSRF) attack?

Transport Layer Security (TLS) provides which of the following capabilities for a remote access server?

Which of the following media sanitization techniques is MOST likely to be effective for an organization using public cloud services?

Which of the following protocols will allow the encrypted transfer of content on the Internet?

Which of the following is a standard Access Control List (ACL) element that enables a router to filter Internet traffic?

A security practitioner is tasked with securing the organization's Wireless Access Points (WAP). Which of these is the MOST effective way of restricting this environment to authorized users?

Which of the following is the BEST technique to facilitate secure software development?

What is the PRIMARY purpose for an organization to conduct a security audit?

In a Transmission Control Protocol/Internet Protocol (TCP/IP) stack, which layer is responsible for negotiating and establishing a connection with another node?

Which of the following is the MOST appropriate action when reusing media that contains sensitive data?

What is the BEST way to correlate large volumes of disparate data sources in a Security Operations Center (SOC) environment?

Who has the PRIMARY responsibility to ensure that security objectives are aligned with organization goals?

Which of the following BEST describes Recovery Time Objective (RTO)?

During a fingerprint verification process, which of the following is used to verify identity and authentication?

Who in the organization is accountable for classification of data information assets?

Proven application security principles include which of the following?

Which of the following is the MOST effective practice in managing user accounts when an employee is terminated?

An Internet software application requires authentication before a user is permitted to utilize the resource. Which testing scenario BEST validates the functionality of the application?

A security engineer is tasked with implementing a new identity solution. The client doesn't want to install or maintain the infrastructure. Which of the following would qualify as the BEST solution?

What is the expected outcome of security awareness in support of a security awareness program?

Certified Authorization Professional

Certified Cloud Security Professional (CCSP)

Filters