Question 1

Which of the following is considered the PRIMARY security issue associated with encrypted e-mail messages?

Accepted Answer

A)  Key distribution 
B)  Storing attachments in centralized repositories 
C)  Scanning for viruses and other malware 
D)  Greater costs associated for backups and restores

Question 2

Which Identity and Access Management (IAM) process can be used to maintain the principle of least privilege?

Accepted Answer

A)  identity provisioning 
B)  access recovery 
C)  multi-factor authentication (MF
A)  
D)  user access review

Question 3

An organization publishes and periodically updates its employee policies in a file on their intranet. Which of the following is a PRIMARY security concern?

Accepted Answer

A)  Ownership 
B)  Confidentiality 
C)  Availability 
D)  Integrity

Question 4

As part of an application penetration testing process, session hijacking can BEST be achieved by which of the following?

Accepted Answer

A)  Known-plaintext attack 
B)  Denial of Service (DoS) 
C)  Cookie manipulation 
D)  Structured Query Language (SQL) injection

Question 5

Which of the following offers the BEST security functionality for transmitting authentication tokens?

Accepted Answer

A)  JavaScript Object Notation (JSON) 
B)  Terminal Access Controller Access Control System (TACACS) 
C)  Security Assertion Markup Language (SAML) 
D)  Remote Authentication Dial-In User Service (RADIUS)

Question 6

Recovery strategies of a Disaster Recovery planning (DRIP) MUST be aligned with which of the following?

Accepted Answer

A)  Hardware and software compatibility issues 
B)  Applications' critically and downtime tolerance 
C)  Budget constraints and requirements 
D)  Cost/benefit analysis and business objectives

Question 7

Change management policies and procedures belong to which of the following types of controls?

Accepted Answer

A)  Directive 
B)  Detective 
C)  Corrective 
D)  Preventative

Question 8

During a Disaster Recovery (DR) simulation, it is discovered that the shared recovery site lacks adequate data restoration capabilities to support the implementation of multiple plans simultaneously. What would be impacted by this fact if left unchanged?

Accepted Answer

A)  Recovery Point Objective (RPO) 
B)  Recovery Time Objective (RTO) 
C)  Business Impact Analysis (BI
A)  
D)  Return on Investment (ROI)

Question 9

A Java program is being developed to read a file from computer A and write it to computer B, using a third computer C. The program is not working as expected. What is the MOST probable security feature of Java preventing the program from operating as intended?

Accepted Answer

A)  Least privilege 
B)  Privilege escalation 
C)  Defense in depth 
D)  Privilege bracketing

Question 10

Who is accountable for the information within an Information System (IS)?

Accepted Answer

A)  Security manager 
B)  System owner 
C)  Data owner 
D)  Data processor

Question 11

What is the PRIMARY goal of fault tolerance?

Accepted Answer

A)  Elimination of single point of failure 
B)  Isolation using a sandbox 
C)  Single point of repair 
D)  Containment to prevent propagation

Question 12

An audit of an application reveals that the current configuration does not match the configuration of the originally implemented application. Which of the following is the FIRST action to be taken?

Accepted Answer

A)  Recommend an update to the change control process 
B)  Verify the approval of the configuration change 
C)  Roll back the application to the original configuration 
D)  Document the changes to the configuration

Question 13

Which of the following is the BEST reason for the use of security metrics?

Accepted Answer

A)  They ensure that the organization meets its security objectives. 
B)  They provide an appropriate framework for Information Technology (IT) governance. 
C)  They speed up the process of quantitative risk assessment. 
D)  They quantify the effectiveness of security processes.

Question 14

A financial company has decided to move its main business application to the Cloud. The legal department objects, arguing that the move of the platform should comply with several regulatory obligations such as the General Data Protection (GDPR) and ensure data confidentiality. The Chief Information Security Officer (CISO) says that the cloud provider has met all regulations requirements and even provides its own encryption solution with internally-managed encryption keys to address data confidentiality. Did the CISO address all the legal requirements in this situation?

Accepted Answer

A)  No, because the encryption solution is internal to the cloud provider. 
B)  Yes, because the cloud provider meets all regulations requirements. 
C)  Yes, because the cloud provider is GDPR compliant. 
D)  No, because the cloud provider is not certified to host government data.

Question 15

What access control scheme uses fine-grained rules to specify the conditions under which access to each data item or applications is granted?

Accepted Answer

A)  Mandatory Access Control (MA
C)  
B)  Discretionary Access Control (DA
C)  
C)  Role Based Access Control (RBA
C)  
D)  Attribute Based Access Control (ABA
C)

Question 16

Which of the following would BEST support effective testing of patch compatibility when patches are applied to an organization's systems?

Accepted Answer

A)  Standardized configurations for devices 
B)  Standardized patch testing equipment 
C)  Automated system patching 
D)  Management support for patching

Question 17

Which of the following is of GREATEST assistance to auditors when reviewing system configurations?

Accepted Answer

A)  Change management processes 
B)  User administration procedures 
C)  Operating System (OS) baselines 
D)  System backup documentation

Question 18

A security professional should ensure that clients support which secondary algorithm for digital signatures when a Secure Multipurpose Internet Mail Extension (S/MIME) is used?

Accepted Answer

A)  Triple Data Encryption Standard (3DES) 
B)  Advanced Encryption Standard (AES) 
C)  Digital Signature Algorithm (DS
A)  
D)  Rivest-Shamir-Adleman (RS
A)

Question 19

In which identity management process is the subject's identity established?

Accepted Answer

A)  Trust 
B)  Provisioning 
C)  Authorization 
D)  Enrollment

Question 20

Which of the following threats exists with an implementation of digital signatures?

Accepted Answer

A)  Spoofing 
B)  Substitution 
C)  Eavesdropping 
D)  Content tampering

Exam 3: Certified Information Systems Security Professional