Question 1

As the CISO, you need to create an IT security strategy. Which of the following is the MOST important thing to review before you start writing the plan?

Accepted Answer

A)  The existing IT environment 
B)  Other corporate technology trends 
C)  The company business plan 
D)  The present IT budget

Question 2

In terms of supporting a forensic investigation, it is now imperative that managers, firstresponders, etc., accomplish the following actions to the computer under investigation:

Accepted Answer

A)  Immediately place hard drive and other components in an anti-static bag 
B)  Secure the area and attempt to maintain power until investigators arrive 
C)  Secure the area and shut down the computer until investigators arrive 
D)  Secure the area

Question 3

How many sectors will a 125 KB file use in a FAT32 file system?

Accepted Answer

A)  32 
B)  16 
C)  256 
D)  25

Question 4

In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most file slack to analyze?

Accepted Answer

A)  one who has NTFS 4 or 5 partitions 
B)  one who uses dynamic swap file capability 
C)  one who uses hard disk writes on IRQ 13 and 21 
D)  one who has lots of allocation units per block or cluster

Question 5

One way to identify the presence of hidden partitions on a suspect's hard drive is to:

Accepted Answer

A)  Add up the total size of all known partitions and compare it to the total size of the hard drive 
B)  Examine the FAT and identify hidden partitions by noting an H in the partition Type field 
C)  Examine the LILO and note an H in the partition Type field 
D)  It is not possible to have hidden partitions on a hard drive

Question 6

When creating contractual agreements and procurement processes why should security requirements be included?

Accepted Answer

A)  To make sure the security process aligns with the vendor's security process 
B)  To make sure they are added on after the process is completed 
C)  To make sure the costs of security is included and understood 
D)  To make sure the patching process is included with the costs

Question 7

When choosing a risk mitigation method what is the MOST important factor?

Accepted Answer

A)  Approval from the board of directors 
B)  Metrics of mitigation method success 
C)  Cost of the mitigation is less than a risk 
D)  Mitigation method complies with PCI regulations

Question 8

Scenario: A CISO has several two-factor authentication systems under review and selects the one that is most sufficient and least costly. The implementation project planning is completed and the teams are ready to implement the solution. The CISO then discovers that the product it is not as scalable as originally thought and will not fit the organization's needs. The CISO is unsure of the information provided and orders a vendor proof of concept to validate the system's scalability. This demonstrates which of the following?

Accepted Answer

A)  A methodology-based approach to ensure authentication mechanism functions 
B)  An approach providing minimum time impact to the implementation schedules 
C)  An approach that allows for minimum budget impact if the solution is unsuitable 
D)  A risk-based approach to determine if the solution is suitable for investment

Question 9

An example of professional unethical behavior is:

Accepted Answer

A)  Sharing copyrighted material with other members of a professional organization where all members have legitimate access to the material 
B)  Copying documents from an employer's server which you assert that you have an intellectual property claim to possess, but the company disputes 
C)  Storing client lists and other sensitive corporate internal documents on a removable thumb drive 
D)  Gaining access to an affiliated employee's work email account as part of an officially sanctioned internal investigation

Question 10

A new CISO just started with a company and on the CISO's desk is the last complete Information Security Management audit report. The audit report is over two years old. After reading it, what should be your first priority?

Accepted Answer

A)  Review the recommendations and follow up to see if audit implemented the changes 
B)  Meet with audit team to determine a timeline for corrections 
C)  Have internal audit conduct another audit to see what has changed. 
D)  Contract with an external audit company to conduct an unbiased audit

Question 11

Which of the following file system is used by Mac OS X?

Accepted Answer

A)  EFS 
B)  HFS+ 
C)  EXT2 
D)  NFS

Question 12

Which of the following is used to establish and maintain a framework to provide assurance that information security strategies are aligned with organizational objectives?

Accepted Answer

A)  Governance 
B)  Compliance 
C)  Awareness 
D)  Management

Question 13

Which business stakeholder is accountable for the integrity of a new information system?

Accepted Answer

A)  Compliance Officer 
B)  CISO 
C)  Project manager 
D)  Board of directors

Question 14

When updating the security strategic planning document what two items must be included?

Accepted Answer

A)  Alignment with the business goals and the vision of the CIO 
B)  The risk tolerance of the company and the company mission statement 
C)  The alignment with the business goals and the risk tolerance 
D)  The executive summary and vision of the board of directors

Question 15

Scenario: An organization has recently appointed a CISO. This is a new role in the organization and it signals the increasing need to address security consistently at the enterprise level. This new CISO, while confident with skills and experience, is constantly on the defensive and is unable to advance the IT security centric agenda. Which of the following is the reason the CISO has not been able to advance the security agenda in this organization?

Accepted Answer

A)  Lack of business continuity process 
B)  Lack of identification of technology stake holders 
C)  Lack of a security awareness program 
D)  Lack of influence with leaders outside IT

Question 16

Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN. Recently, members of your organization have been targeted through a number of sophisticated phishing attempts, resulting in compromised credentials. What action can you take to prevent external misuse of compromised credentials while still allowing employees to manage their bank information?

Accepted Answer

A)  Turn off VPN access for users originating from outside the country 
B)  Remove VPN access for all employees except for senior management 
C)  Enable monitoring on the VPN for suspicious activity 
D)  Block access to the Employee-Self Service application via VPN

Question 17

Area density refers to:

Accepted Answer

A)  the amount of data per disk 
B)  the amount of data per partition 
C)  the amount of data per square inch 
D)  the amount of data per platter

Question 18

Which of the following is a benefit of a risk-based approach to audit planning?

Accepted Answer

A)  Resources are allocated to the areas of the highest concern 
B)  Scheduling may be performed months in advance 
C)  Budgets are more likely to be met by the IT audit staff 
D)  Staff will be exposed to a variety of technologies

Question 19

As a CISO you need to understand the steps that are used to perform an attack against a network. Put each step into the correct order. 1.Covering tracks 2.Scanning and enumeration 3.Maintaining Access 4.Reconnaissance 5.Gaining Access

Accepted Answer

A)  4, 3, 5, 2, 1 
B)  4, 2, 5, 3, 1 
C)  2, 5, 3, 1, 4 
D)  4, 5, 2, 3, 1

Question 20

You setup SNMP in multiple offices of your company. Your SNMP software manager is not receiving data from other offices like it is for your main office. You suspect that firewall changes are to blame. What ports should you open for SNMP to work through Firewalls? (Choose two.)

Accepted Answer

A)  162 
B)  161 
C)  163 
D)  160

Exam 2: Certified Network Defender