Question 1

Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN. Once supervisors and data owners have approved requests, information system administrators will implement:

Accepted Answer

A)  Management control(s) 
B)  Technical control(s) 
C)  Operational control(s) 
D)  Policy controls(s)

Question 2

When dealing with Security Incident Response procedures, which of the following steps come FIRST when reacting to an incident?

Accepted Answer

A)  Eradication 
B)  Escalation 
C)  Containment 
D)  Recovery

Question 3

Larry is an IT consultant who works for corporations and government agencies. Larry plans on shutting down the city's network using BGP devices and zombies? What type of Penetration Testing is Larry planning to carry out?

Accepted Answer

A)  Router Penetration Testing 
B)  DoS Penetration Testing 
C)  Firewall Penetration Testing 
D)  Internal Penetration Testing

Question 4

A digital signature addresses which of the following concerns?

Accepted Answer

A)  Message alteration 
B)  Message copying 
C)  Message theft 
D)  Unauthorized reading

Question 5

Your penetration testing team installs an in-line hardware key logger onto one of your network machines. Which of the following is of major concern to the security organization?

Accepted Answer

A)  In-line hardware keyloggers are undetectable by software 
B)  In-line hardware keyloggers are relatively inexpensive 
C)  In-line hardware keyloggers don't require physical access 
D)  In-line hardware keyloggers don't comply to industry regulations

Question 6

Which of the following functions implements and oversees the use of controls to reduce risk when creating an information security program?

Accepted Answer

A)  Risk Assessment 
B)  Risk Management 
C)  Incident Response 
D)  Network Security administration

Question 7

It takes _____________ mismanaged case/s to ruin your professional reputation as a computer forensics examiner?

Accepted Answer

A)  by law, three 
B)  quite a few 
C)  only one 
D)  at least two

Question 8

In the context of file deletion process, which of the following statement holds true?

Accepted Answer

A)  When files are deleted, the data is overwritten and the cluster marked as available 
B)  The longer a disk is in use, the less likely it is that deleted files will be overwritten 
C)  While booting, the machine may create temporary files that can delete evidence 
D)  Secure delete programs work by completely overwriting the file in one go

Question 9

Developing effective security controls is a balance between:

Accepted Answer

A)  Technology and Vendor Management 
B)  Operations and Regulations 
C)  Risk Management and Operations 
D)  Corporate Culture and Job Expectations

Question 10

Scenario: Your program is developed around minimizing risk to information by focusing on people, technology, and operations. An effective way to evaluate the effectiveness of an information security awareness program for end users, especially senior executives, is to conduct periodic:

Accepted Answer

A)  Baseline of computer systems 
B)  Password changes 
C)  Controlled spear phishing campaigns 
D)  Scanning for viruses

Question 11

Which of the following is the MOST important reason to measure the effectiveness of an Information Security Management System (ISMS)?

Accepted Answer

A)  Better understand the threats and vulnerabilities affecting the environment 
B)  Better understand strengths and weakness of the program 
C)  Meet regulatory compliance requirements 
D)  Meet legal requirements

Question 12

File Integrity Monitoring (FIM) is considered a________________________.

Accepted Answer

A)  Network based security preventative control 
B)  Software segmentation control 
C)  User segmentation control 
D)  Security detective control

Question 13

The process for management approval of the security certification process which states the risks and mitigation of such risks of a given IT system is called___________________.

Accepted Answer

A)  Security certification 
B)  Security system analysis 
C)  Alignment with business practices 
D)  Security accreditation

Question 14

The following excerpt is taken from a honeypot log. The log captures activities across three days. There are several intrusion attempts; however, a few are successful. (Note: The objective of this question is to test whether the student can read basic information from log entries and interpret the nature of attack.) Apr 24 14:46:46 [4663]: spp_portscan: portscan detected from 194.222.156.169 Apr 24 14:46:46 [4663]: IDS27/FIN Scan: 194.222.156.169:56693 -> 172.16.1.107:482 Apr 24 18:01:05 [4663]: IDS/DNS-version-query: 212.244.97.121:3485 -> 172.16.1.107:53 Apr 24 19:04:01 [4663]: IDS213/ftp-passwd-retrieval: 194.222.156.169:1425 -> 172.16.1.107:21 Apr 25 08:02:41 [5875]: spp_portscan: PORTSCAN DETECTED from 24.9.255.53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4499 -> 172.16.1.107:53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4630 -> 172.16.1.101:53 Apr 25 02:38:17 [5875]: IDS/RPC-rpcinfo-query: 212.251.1.94:642 -> 172.16.1.107:111 Apr 25 19:37:32 [5875]: IDS230/web-cgi-space-wildcard: 198.173.35.164:4221 -> 172.16.1.107:80 Apr 26 05:45:12 [6283]: IDS212/dns-zone-transfer: 38.31.107.87:2291 -> 172.16.1.101:53 Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53 Apr 26 06:44:25 victim7 PAM_pwdb[12509]: (login) session opened for user simple by (uid=0) Apr 26 06:44:36 victim7 PAM_pwdb[12521]: (su) session opened for user simon by simple(uid=506) Apr 26 06:45:34 [6283]: IDS175/socks-probe: 24.112.167.35:20 -> 172.16.1.107:1080 Apr 26 06:52:10 [6283]: IDS127/telnet-login-incorrect: 172.16.1.107:23 -> 213.28.22.189:4558 From the options given below choose the one which best interprets the following entry:

Accepted Answer

A)  An IDS evasion technique 
B)  A buffer overflow attempt 
C)  A DNS zone transfer 
D)  Data being retrieved from 63.226.81.13

Question 15

Jim performed a vulnerability analysis on his network and found no potential problems. He runs another utility that executes exploits against his system to verify the results of the vulnerability test. The second utility executes five known exploits against his network in which the vulnerability analysis said were not exploitable. What kind of results did Jim receive from his vulnerability analysis?

Accepted Answer

A)  False negatives 
B)  False positives 
C)  True negatives 
D)  True positives

Question 16

Which of the following best describes a portfolio?

Accepted Answer

A)  The portfolio is used to manage and track individual projects 
B)  The portfolio is used to manage incidents and events 
C)  A portfolio typically consists of several programs 
D)  A portfolio delivers one specific service or program to the business

Question 17

During the course of a risk analysis your IT auditor identified threats and potential impacts. Next, your IT auditor should:

Accepted Answer

A)  Identify and assess the risk assessment process used by management. 
B)  Identify and evaluate existing controls. 
C)  Identify information assets and the underlying systems. 
D)  Disclose the threats and impacts to management.

Question 18

Your IT auditor is reviewing significant events from the previous year and has identified some procedural oversights. Which of the following would be the MOST concerning?

Accepted Answer

A)  Failure to notify police of an attempted intrusion 
B)  Lack of reporting of a successful denial of service attack on the network. 
C)  Lack of periodic examination of access rights 
D)  Lack of notification to the public of disclosure of confidential information

Question 19

You have implemented the new controls. What is the next step?

Accepted Answer

A)  Perform a risk assessment 
B)  Monitor the effectiveness of the controls 
C)  Document the process for the stakeholders 
D)  Update the audit findings report

Question 20

Using the Transport Layer Security (TLS) protocol enables a client in a network to be:

Accepted Answer

A)  Provided with a digital signature 
B)  Assured of the server's identity 
C)  Identified by a network 
D)  Registered by the server

Exam 2: Certified Network Defender