Question 1

As the CISO, you have been tasked with the execution of the company's key management program. You MUST ensure the integrity of encryption keys at the point of generation. Which principal of encryption key control will ensure no single individual can constitute or re-constitute a key?

Accepted Answer

A)  Dual Control 
B)  Separation of Duties 
C)  Split Knowledge 
D)  Least Privilege

Question 2

What two methods are used to assess risk impact?

Accepted Answer

A)  Quantitative and qualitative 
B)  Qualitative and percent of loss realized 
C)  Subjective and Objective 
D)  Cost and annual rate of expectance

Question 3

Which of the following provides an audit framework?

Accepted Answer

A)  Control Objectives for IT (COBIT) 
B)  International Organization Standard (ISO) 27002 
C)  Payment Card Industry -Data Security Standard (PCI-DSS) 
D)  National Institute of Standards and technology (NIST) SP 800-30

Question 4

Scenario: As you begin to develop the program for your organization, you assess the corporate culture and determine that there is a pervasive opinion that the security program only slows things down and limits the performance of the "real workers." What must you do first in order to shift the prevailing opinion and reshape corporate culture to understand the value of information security to the organization?

Accepted Answer

A)  Cite corporate policy and insist on compliance with audit findings 
B)  Draw from your experience and recount stories of how other companies have been compromised 
C)  Understand the business and focus your efforts on enabling operations securely 
D)  Cite compliance with laws, statutes, and regulations - explaining the financial implications for the company for non-compliance

Question 5

The process for identifying, collecting, and producing digital information in support of legal proceedings is called _____________________________.

Accepted Answer

A)  chain of custody 
B)  electronic review 
C)  evidence tampering 
D)  electronic discovery

Question 6

What is the MAIN reason for conflicts between Information Technology and Information Security programs?

Accepted Answer

A)  The effective implementation of security controls can be viewed as an inhibitor to rapid Information technology implementations. 
B)  Technology Governance is focused on process risks whereas Security Governance is focused on business risk. 
C)  Technology governance defines technology policies and standards while security governance does not. 
D)  Security governance defines technology best practices and Information Technology governance does not.

Question 7

Which regulation or policy governs protection of personally identifiable user data gathered during a cyber investigation?

Accepted Answer

A)  ITIL 
B)  Privacy Act 
C)  Sarbanes Oxley 
D)  PCI-DSS

Question 8

Printing under a Windows Computer normally requires which one of the following files types to be created?

Accepted Answer

A)  EME 
B)  MEM 
C)  EMF 
D)  CME

Question 9

A security manager has created a risk program. Which of the following is a critical part of ensuring the program is successful?

Accepted Answer

A)  Ensuring developers include risk control comments in code 
B)  Creating risk assessment templates based on specific threats 
C)  Providing a risk program governance structure 
D)  Allowing for the acceptance of risk for regulatory compliance requirements

Question 10

What is the following command trying to accomplish?

Accepted Answer

A)  Verify that UDP port 445 is open for the 192.168.0.0 network 
B)  Verify that TCP port 445 is open for the 192.168.0.0 network 
C)  Verify that NETBIOS is running for the 192.168.0.0 network 
D)  Verify that UDP port 445 is closed for the 192.168.0.0 network

Question 11

An information security department is required to remediate system vulnerabilities when they are discovered. Please select the three primary remediation methods that can be used on an affected system.

Accepted Answer

A)  Install software patch, configuration adjustment, Software Removal 
B)  Install software patch, operate system, Maintain system 
C)  Discover software, Remove affected software, Apply software patch 
D)  Software removal, install software patch, maintain system

Question 12

If the result of an NPV is positive, then the project should be selected. The net present value shows the present value of the project, based on the decisions taken for its selection. What is the net present value equal to?

Accepted Answer

A)  Net profit - per capita income 
B)  Total investment - Discounted cash 
C)  Average profit - Annual investment 
D)  Initial investment - Future value

Question 13

Scenario: You are the CISO and are required to brief the C-level executive team on your information security audit for the year. During your review of the audit findings you discover that many of the controls that were put in place the previous year to correct some of the findings are not performing as needed. You have thirty days until the briefing. To formulate a remediation plan for the non-performing controls what other document do you need to review before adjusting the controls?

Accepted Answer

A)  Business Continuity plan 
B)  Security roadmap 
C)  Business Impact Analysis 
D)  Annual report to shareholders

Question 14

Which of the following represents the BEST method of ensuring security program alignment to business needs?

Accepted Answer

A)  Ensure the organization has strong executive-level security representation through clear sponsorship or the creation of a CISO role 
B)  Create a comprehensive security awareness program and provide success metrics to business units 
C)  Create security consortiums, such as strategic security planning groups, that include business unit participation 
D)  Ensure security implementations include business unit testing and functional validation prior to production rollout

Question 15

A missing/ineffective security control is identified. Which of the following should be the NEXT step?

Accepted Answer

A)  Perform an audit to measure the control formally 
B)  Escalate the issue to the IT organization 
C)  Perform a risk assessment to measure risk 
D)  Establish Key Risk Indicators

Question 16

Which of the following are the MOST important factors for proactively determining system vulnerabilities?

Accepted Answer

A)  Subscribe to vendor mailing list to get notification of system vulnerabilities 
B)  Configure firewall, perimeter router and Intrusion Prevention System (IPS) 
C)  Conduct security testing, vulnerability scanning, and penetration testing 
D)  Deploy Intrusion Detection System (IDS) and install anti-virus on systems

Question 17

Annual Loss Expectancy is derived from the function of which two factors?

Accepted Answer

A)  Annual rate of Occurrence and Single Loss Expectancy 
B)  Annual rate of Occurrence and Asset Value 
C)  Safeguard value and Annual Rate of Occurrence 
D)  Single Loss Expectancy and Exposure factor

Question 18

Your company has a "no right to privacy" notice on all logon screens for your information systems and users sign an Acceptable Use Policy informing them of this condition. A peer group member and friend comes to you and requests access to one of her employee's email account. What should you do?

Accepted Answer

A)  Deny the request citing national privacy laws 
B)  None 
C)  Grant her access, the employee has been adequately warned through the AUP. 
D)  Assist her with the request, but only after her supervisor signs off on the action. 
E)  Reset the employee's password and give it to the supervisor.

Question 19

The CIO of an organization has decided to assign the responsibility of internal IT audit to the IT team. This is consider a bad practice MAINLY because_______________.

Accepted Answer

A)  The IT team is not familiar in IT audit practices 
B)  This represents a bad implementation of the Least Privilege principle 
C)  The IT team is not certified to perform audits 
D)  This represents a conflict of interest

Question 20

The establishment of a formal risk management framework and system authorization program is essential. The LAST step of the system authorization process is:

Accepted Answer

A)  Getting authority to operate the system from executive management 
B)  Contacting the Internet Service Provider for an IP scope 
C)  Changing the default passwords 
D)  Conducting a final scan of the live system and mitigating all high and medium level vulnerabilities

Exam 2: Certified Network Defender