Question 1

You work as a project manager for TYU project. You are planning for risk mitigation. You need to quickly identify high-level risks that will need a more in-depth analysis. Which of the following activities will help you in this?

Accepted Answer

A)  Risk mitigation 
B)  Estimate activity duration 
C)  Quantitative analysis 
D)  Qualitative analysis

Question 2

A method to transfer risk is to______________.

Accepted Answer

A)  Implement redundancy 
B)  Move operations to another region 
C)  Alignment with business operations 
D)  Purchase breach insurance

Question 3

The ultimate goal of an IT security projects is:

Accepted Answer

A)  Support business requirements 
B)  Implement information security policies 
C)  Increase stock value 
D)  Complete security

Question 4

Which of the following are the MOST important factors for proactively determining system vulnerabilities?

Accepted Answer

A)  Subscribe to vendor mailing lists and distribute notifications of system requirements 
B)  Configure firewall, perimeter router and Intrusion Prevention System (IPS) 
C)  Conduct security testing, vulnerability scanning, and penetration testing 
D)  Deploy Intrusion Detection System (IDS) and install anti-virus on systems

Question 5

A customer of a bank has placed a dispute on a payment for a credit card account. The banking system uses digital signatures to safeguard the integrity of their transactions. The bank claims that the system shows proof that the customer in fact made the payment. What is this system capability commonly known as?

Accepted Answer

A)  conflict resolution 
B)  strong authentication 
C)  non-repudiation 
D)  digital rights management

Question 6

A CISO sees abnormally high volumes of exceptions to security requirements and constant pressure from business units to change security processes. Which of the following represents the MOST LIKELY cause of this situation?

Accepted Answer

A)  Poor audit support for the security program 
B)  Poor alignment of the security program to business needs 
C)  This is normal since business units typically resist security requirements 
D)  A lack of executive presence within the security program

Question 7

IT control objectives are useful to IT auditors as they provide the basis for understanding the:

Accepted Answer

A)  The audit control checklist 
B)  Technique for securing information 
C)  Desired results or purpose of implementing specific control procedures. 
D)  Security policy

Question 8

A recommended method to document the respective roles of groups and individuals for a given process is to:

Accepted Answer

A)  Develop a detailed internal organization chart 
B)  Develop an isolinear response matrix with cost benefit analysis projections 
C)  Develop a Responsible, Accountable, Consulted, Informed (RACI) chart 
D)  Develop a telephone call tree for emergency response

Question 9

Which of the following represents the best method of ensuring business unit alignment with security program requirements?

Accepted Answer

A)  Create collaborative risk management approaches within the organization 
B)  Perform increased audits of security processes and procedures 
C)  Provide clear communication of security requirements throughout the organization 
D)  Demonstrate executive support with written mandates for security policy adherence

Question 10

You are working as an independent computer forensics investigator and receive a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a simple backup copy of the hard drive in the PC and put it on this drive and requests that you examine that drive for evidence of the suspected images. You inform him that a simple backup copy will not provide deleted files or recover file fragments. What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceedings?

Accepted Answer

A)  Bit-stream Copy 
B)  Robust Copy 
C)  Full backup Copy 
D)  Incremental Backup Copy

Question 11

Which of the following best describes revenue?

Accepted Answer

A)  Non-operating financial liabilities minus expenses 
B)  The true profit-making potential of an organization 
C)  The sum value of all assets and cash flow into the business 
D)  The economic benefit derived by operating a business

Question 12

Which of the following refers to the quantity or quality of project deliverables expanding from the original project plan?

Accepted Answer

A)  Scope creep 
B)  Deadline extension 
C)  Deliverable expansion 
D)  Scope modification

Question 13

The new CISO was informed of all the Information Security projects that the organization has in progress. Two projects are over a year behind schedule and over budget. Using best business practices for project management you determine that the project correctly aligns with the company goals. Which of the following needs to be performed NEXT?

Accepted Answer

A)  Verify technical resources 
B)  Verify capacity constraints 
C)  Verify the scope of the project 
D)  Verify the regulatory requirements

Question 14

A CISO implements smart cards for credential management, and as a result has reduced costs associated with help desk operations supporting password resets. This demonstrates which of the following principles?

Accepted Answer

A)  Increased security program presence 
B)  Regulatory compliance effectiveness 
C)  Security organizational policy enforcement 
D)  Proper organizational policy enforcement

Question 15

You are the network administrator for a small bank in Dallas, Texas. To ensure network security, you enact a security policy that requires all users to have 14 character passwords. After giving your users 2 weeks notice, you change the Group Policy to force 14 character passwords. A week later you dump the SAM database from the standalone server and run a password-cracking tool against it. Over 99% of the passwords are broken within an hour. Why were these passwords cracked so Quickly?

Accepted Answer

A)  Passwords of 14 characters or less are broken up into two 7-character hashes 
B)  A password Group Policy change takes at least 3 weeks to completely replicate throughout a network 
C)  Networks using Active Directory never use SAM databases so the SAM database pulled was empty 
D)  The passwords that were cracked are local accounts on the Domain Controller

Question 16

A security manager regularly checks work areas after business hours for security violations; such as unsecured files or unattended computers with active sessions. This activity BEST demonstrates what part of a security program?

Accepted Answer

A)  Compliance management 
B)  Audit validation 
C)  Physical control testing 
D)  Security awareness training

Question 17

You are working as an investigator for a corporation and you have just received instructions from your manager to assist in the collection of 15 hard drives that are part of an ongoing investigation. Your job is to complete the required evidence custody forms to properly document each piece of evidence as it is collected by other members of your team. Your manager instructs you to complete one multi-evidence form for the entire case and a single-evidence form for each hard drive. How will these forms be stored to help preserve the chain of custody of the case?

Accepted Answer

A)  All forms should be placed in an approved secure container because they are now primary evidence in the case. 
B)  The multi-evidence form should be placed in the report file and the single-evidence forms should be kept with each hard drive in an approved secure container. 
C)  The multi-evidence form should be placed in an approved secure container with the hard drives and the single-evidence forms should be placed in the report file. 
D)  All forms should be placed in the report file because they are now primary evidence in the case.

Question 18

You are contracted to work as a computer forensics investigator for a regional bank that has four 30 TB storage area networks that store customer data. What method would be most efficient for you to acquire digital evidence from this network?

Accepted Answer

A)  create a compressed copy of the file with DoubleSpace 
B)  create a sparse data copy of a folder or file 
C)  make a bit-stream disk-to-image file 
D)  make a bit-stream disk-to-disk file

Question 19

What does the acronym POST mean as it relates to a PC?

Accepted Answer

A)  Primary Operations Short Test 
B)  PowerOn Self Test 
C)  Pre Operational Situation Test 
D)  Primary Operating System Test

Question 20

If you see the files Zer0.tar.gz and copy.tar.gz on a Linux system while doing an investigation, what can you conclude?

Accepted Answer

A)  The system files have been copied by a remote attacker 
B)  The system administrator has created an incremental backup 
C)  The system has been compromised using a t0rnrootkit 
D)  Nothing in particular as these can be operational files

Exam 2: Certified Network Defender