Question 1

Scenario: Your corporate systems have been under constant probing and attack from foreign IP addresses for more than a week. Your security team and security infrastructure have performed well under the stress. You are confident that your defenses have held up under the test, but rumors are spreading that sensitive customer data has been stolen and is now being sold on the Internet by criminal elements. During your investigation of the rumored compromise, you discover that data has been breached and that the repository of stolen data is on a server located in a foreign country. Your team now has full access to the data on the foreign server. What action should you take FIRST?

Accepted Answer

A)  Consult with other executives to develop an action plan 
B)  Contract with a credit reporting company for paid monitoring services for affected customers 
C)  Contact your local law enforcement agency 
D)  Destroy the repository of stolen data

Question 2

When you develop your audit remediation plan what is the MOST important criteria?

Accepted Answer

A)  To validate the remediation process with the auditor. 
B)  To validate that the cost of the remediation is less than risk of the finding. 
C)  To remediate half of the findings before the next audit. 
D)  To remediate all of the findings before the next audit.

Question 3

One of your executives needs to send an important and confidential email. You want to ensure that the message cannot be read by anyone but the recipient. Which of the following keys should be used to encrypt the message?

Accepted Answer

A)  Certificate authority key 
B)  the recipient's private key 
C)  The recipient's public key 
D)  Your public key

Question 4

An access point (AP) is discovered using Wireless Equivalent Protocol (WEP). The cipher text sent by the AP is encrypted with the same key and cipher used by its stations. What authentication method is being used?

Accepted Answer

A)  Open 
B)  Asynchronous 
C)  None 
D)  Shared key

Question 5

What is the difference between encryption and tokenization?

Accepted Answer

A)  Tokenization combined with hashing is always better than encryption 
B)  Encryption can be mathematically reversed to provide the original information 
C)  The token contains the all original information 
D)  Tokenization can be mathematically reversed to provide the original information

Question 6

Which of the following best describes the sensors designed to project and detect a light beam across an area?

Accepted Answer

A)  Smoke 
B)  Thermal 
C)  Air-aspirating 
D)  Photo electric

Question 7

Scenario: An organization has recently appointed a CISO. This is a new role in the organization and it signals the increasing need to address security consistently at the enterprise level. This new CISO, while confident with skills and experience, is constantly on the defensive and is unable to advance the IT security centric agenda. The CISO has been able to implement a number of technical controls and is able to influence the Information Technology teams but has not been able to influence the rest of the organization. From an organizational perspective, which of the following is the LIKELY reason for this?

Accepted Answer

A)  The CISO reports to the IT organization 
B)  The CISO has not implemented a policy management framework 
C)  The CISO does not report directly to the CEO of the organization 
D)  The CISO has not implemented a security awareness program

Question 8

In MOST organizations which group periodically reviews network intrusion detection system logs for all systems as part of their daily tasks?

Accepted Answer

A)  Internal Audit 
B)  Information Security 
C)  Compliance 
D)  Database Administration

Question 9

A suspect is accused of violating the acceptable use of computing resources, as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed visit these sites. However, the suspect has cleared the search history and emptied the cookie cache. Moreover, he has removed any images he might have downloaded. What can the investigator do to prove the violation?

Accepted Answer

A)  Image the disk and try to recover deleted files 
B)  Seek the help of co-workers who are eye-witnesses 
C)  Check the Windows registry for connection data (you may or may not recover) 
D)  Approach the websites for evidence

Question 10

When an investigator contacts by telephone the domain administrator or controller listed by a Who is lookup to request all e-mails sent and received for a user account be preserved, what U.S.C. statute authorizes this phone call and obligates the ISP to preserve e-mail records?

Accepted Answer

A)  Title 18, Section 1030 
B)  Title 18, Section 2703(d) 
C)  Title 18, Section Chapter 90 
D)  Title 18, Section 2703(f)

Question 11

Acme Inc. has engaged a third party vendor to provide 99.999% up-time for their online web presence and had them contractually agree to this service level agreement. What type of risk tolerance is Acme exhibiting?

Accepted Answer

A)  medium-high risk-tolerance 
B)  low risk-tolerance 
C)  high risk-tolerance 
D)  moderate risk-tolerance

Question 12

Which of the following terms is used to describe countermeasures implemented to minimize risks to physical property, information, and computing systems?

Accepted Answer

A)  Security frameworks 
B)  Security policies 
C)  Security awareness 
D)  Security controls

Question 13

As a new CISO at a large healthcare company you are told that everyone has to badge in to get in the building. Below your office window you notice a door that is normally propped open during the day for groups of people to take breaks outside. Upon looking closer you see there is no badge reader. What should you do?

Accepted Answer

A)  Post a guard at the door to maintain physical security 
B)  Close and chain the door shut and send a company-wide memo banning the practice 
C)  Have a risk assessment performed 
D)  Nothing, this falls outside your area of influence

Question 14

When managing an Information Security Program, which of the following is of MOST importance in order to influence the culture of an organization?

Accepted Answer

A)  Compliance with local privacy regulations 
B)  An independent Governance, Risk and Compliance organization 
C)  Support Legal and HR teams 
D)  Alignment of security goals with business goals

Question 15

Which of the following should be determined while defining risk management strategies?

Accepted Answer

A)  Organizational objectives and risk tolerance 
B)  Enterprise disaster recovery plans 
C)  Risk assessment criteria 
D)  IT architecture complexity

Question 16

The PRIMARY objective for information security program development should be:

Accepted Answer

A)  Reducing the impact of the risk to the business. 
B)  Establishing incident response programs. 
C)  Establishing strategic alignment with business continuity requirements. 
D)  Identifying and implementing the best security solutions.

Question 17

Which of the following is considered a project versus a managed process?

Accepted Answer

A)  ongoing risk assessment of routine operations 
B)  continuous vulnerability assessment and vulnerability repair 
C)  monitoring external and internal environment during incident response 
D)  installation of a new firewall system

Question 18

What binary coding is used most often for e-mail purposes?

Accepted Answer

A)  MIME 
B)  Uuencode 
C)  IMAP 
D)  SMTP

Question 19

A method to transfer risk is to______________.

Accepted Answer

A)  Implement redundancy 
B)  Move operations to another region 
C)  Align to business operations 
D)  Purchase breach insurance

Question 20

Which of the following organizations is typically in charge of validating the implementation and effectiveness of security controls?

Accepted Answer

A)  Security Operations 
B)  Internal/External Audit 
C)  Risk Management 
D)  Security Administrators

Exam 2: Certified Network Defender