Question 1

Which one of the following BEST describes which member of the management team is accountable for the day-to-day operation of the information security program?

Accepted Answer

A)  Security managers 
B)  Security analysts 
C)  Security technicians 
D)  Security administrators

Question 2

A CISO has recently joined an organization with a poorly implemented security program. The desire is to base the security program on a risk management approach. Which of the following is a foundational requirement in order to initiate this type of program?

Accepted Answer

A)  A complete inventory of Information technology assets including infrastructure, networks, applications and data 
B)  A security organization that is adequately staffed to apply required mitigation strategies and regulatory compliance solutions 
C)  A clear set of security policies and procedures that are more concept-based than controls-based than controls-based 
D)  A clearly identified executive sponsor who will champion the effort to ensure organizational buy-in

Question 3

Scenario: Most industries require compliance with multiple government regulations and/or industry standards to meet data protection and privacy mandates. What is one proven method to account for common elements found within separate regulations and/or standards?

Accepted Answer

A)  Design your program to meet the strictest government standards 
B)  Develop a crosswalk 
C)  Hire a GRC expert 
D)  Use the Find function of your word processor

Question 4

Creating good security metrics is essential for a CISO. What would be the BEST sources for creating security metrics for baseline defenses coverage?

Accepted Answer

A)  Servers, routers, switches, modem 
B)  Firewall, anti-virus console, IDS, syslog 
C)  Firewall, exchange, web server, intrusion detection system (IDS) 
D)  IDS, syslog, router, switches

Question 5

After undergoing an external IT audit, George realizes his network is vulnerable to DDoS attacks. What countermeasures could he take to prevent DDoS attacks?

Accepted Answer

A)  Enable direct broadcasts 
B)  Disable direct broadcasts 
C)  Disable BGP 
D)  Enable BGP

Question 6

Item 2If you come across a sheepdip machine at your client site, what would you infer?

Accepted Answer

A)  A sheepdip coordinates several honeypots 
B)  A sheepdip computer is another name for a honeypot 
C)  A sheepdip computer is used only for virus-checking. 
D)  A sheepdip computer defers a denial of service attack

Question 7

Jason has set up a honeypot environment by creating a DMZ that has no physical or logical access to his production network. In this honeypot, he has placed a server running Windows Active Directory. He has also placed a Web server in the DMZ that services a number of web pages that offer visitors a chance to download sensitive information by clicking on a button. A week later, Jason finds in his network logs how an intruder accessed the honeypot and downloaded sensitive information. Jason uses the logs to try and prosecute the intruder for stealing sensitive corporate information. Why will this not be viable?

Accepted Answer

A)  Entrapment 
B)  Enticement 
C)  Intruding into a honeypot is not illegal 
D)  Intruding into a DMZ is not illegal

Question 8

You are carrying out the last round of testing for your new website before it goes live. The website has many dynamic pages and connects to a SQL backend that accesses your product inventory in a database. You come across a web security site that recommends inputting the following code into a search field on web pages to check for vulnerabilities: When you type this and click on search, you receive a pop-up window that says: "This is a test." What is the result of this test?

Accepted Answer

A)  Your website is vulnerable to CSS 
B)  Your website is not vulnerable 
C)  Your website is vulnerable to SQL injection 
D)  Your website is vulnerable to web bugs

Question 9

If an attacker's computer sends an IPID of 31400 to a zombie computer on an open port in IDLE scanning, what will be the response?

Accepted Answer

A)  The zombie will not send a response 
B)  31402 
C)  31399 
D)  31401

Question 10

You have completed a forensic investigation case. You would like to destroy the data contained in various disks at the forensics lab due to sensitivity of the case. How would you permanently erase the data on the hard disk?

Accepted Answer

A)  Throw the hard disk into the fire 
B)  Run the powerful magnets over the hard disk 
C)  Format the hard disk multiple times using a low level disk utility 
D)  Overwrite the contents of the hard disk with Junk data

Question 11

Which of the following has the GREATEST impact on the implementation of an information security governance model?

Accepted Answer

A)  Complexity of organizational structure 
B)  Distance between physical locations 
C)  Organizational budget 
D)  Number of employees

Question 12

Which of the following international standards can be BEST used to define a Risk Management process in an organization?

Accepted Answer

A)  International Organization for Standardizations - 27005 (ISO-27005) 
B)  National Institute for Standards and Technology 800-50 (NIST 800-50) 
C)  Payment Card Industry Data Security Standards (PCI-DSS) 
D)  International Organization for Standardizations - 27004 (ISO-27004)

Question 13

You work as a penetration tester for Hammond Security Consultants. You are currently working on a contract for the state government of California. Your next step is to initiate a DoS attack on their network. Why would you want to initiate a DoS attack on a system you are testing?

Accepted Answer

A)  Show outdated equipment so it can be replaced 
B)  List weak points on their network 
C)  Use attack as a launching point to penetrate deeper into the network 
D)  Demonstrate that no system can be protected against DoS attacks

Question 14

Which of the following is a fundamental component of an audit record?

Accepted Answer

A)  Originating IP-Address 
B)  Date and time of the event 
C)  Failure of the event 
D)  Authentication type

Question 15

Scenario: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified. After determining the audit findings are accurate, which of the following is the MOST logical next activity?

Accepted Answer

A)  Validate gaps with the Information Technology team 
B)  Begin initial gap remediation analyses 
C)  Review the security organization's charter 
D)  Create a briefing of the findings for executive management

Question 16

You have compromised a lower-level administrator account on an Active Directory network of a small company in Dallas, Texas. You discover Domain Controllers through enumeration. You connect to one of the Domain Controllers on port 389 using ldp.exe. What are you trying to accomplish here?

Accepted Answer

A)  Poison the DNS records with false records 
B)  Enumerate MX and A records from DNS 
C)  Establish a remote connection to the Domain Controller 
D)  Enumerate domain user accounts and built-in groups

Question 17

Scenario: An organization has recently appointed a CISO. This is a new role in the organization and it signals the increasing need to address security consistently at the enterprise level. This new CISO, while confident with skills and experience, is constantly on the defensive and is unable to advance the IT security centric agenda. From an Information Security Leadership perspective, which of the following is a MAJOR concern about the CISO's approach to security?

Accepted Answer

A)  Compliance centric agenda 
B)  IT security centric agenda 
C)  Lack of risk management process 
D)  Lack of sponsorship from executive management

Question 18

You are working for a local police department that services a population of 1,000,000 people and you have been given the task of building a computer forensics lab. How many law-enforcement computer investigators should you request to staff the lab?

Accepted Answer

A)  8 
B)  1 
C)  4 
D)  2

Question 19

Quantitative Risk Assessments have the following advantages over qualitative risk assessments:

Accepted Answer

A)  They are subjective and can be completed more quickly 
B)  They are objective and express risk / cost in approximates 
C)  They are subjective and can express risk / cost real numbers 
D)  They are objective and can express risk / cost in real numbers

Question 20

Which of the following information would MOST likely be reported at the board-level within an organization?

Accepted Answer

A)  System scanning trends and results as they pertain to insider and external threat sources 
B)  The capabilities of a security program in terms of staffing support 
C)  Significant risks and security incidents that have been discovered since the last assembly of the membership 
D)  The numbers and types of cyberattacks experienced by the organization since the last assembly of the membership

Exam 2: Certified Network Defender