Activedumpsnet Logo
A manufacturing organization wants to establish a Federated Identity Management (FIM) system with its 20 different supplier companies. Which of the following is the BEST solution for the manufacturing organization?
What is the BEST approach for controlling access to highly sensitive information when employees have the same level of security clearance?
Which of the following BEST describes an access control method utilizing cryptographic keys derived from a smart card private key that is embedded within mobile devices?
Users require access rights that allow them to view the average salary of groups of employees. Which control would prevent the users from obtaining an individual employee’s salary?
Are companies legally required to report all data breaches?
What is the MOST efficient way to secure a production program and its data?
Which of the following is the BIGGEST weakness when using native Lightweight Directory Access Protocol (LDAP) for authentication?
Which of the following is the MOST effective method of mitigating data theft from an active user workstation?
What is the PRIMARY difference between security policies and security procedures?
To protect auditable information, which of the following MUST be configured to only allow read access?
Which of the following is the BEST method to assess the effectiveness of an organization's vulnerability management program?
While inventorying storage equipment, it is found that there are unlabeled, disconnected, and powered off devices. Which of the following is the correct procedure for handling such equipment?
A health care provider is considering Internet access for their employees and patients. Which of the following is the organization's MOST secure solution for protection of data?
Order the below steps to create an effective vulnerability management process.
Which of the following methods can be used to achieve confidentiality and integrity for data in transit?
Which of the following operates at the Network Layer of the Open System Interconnection (OSI) model?
What is the purpose of an Internet Protocol (IP) spoofing attack?
In a Transmission Control Protocol/Internet Protocol (TCP/IP) stack, which layer is responsible for negotiating and establishing a connection with another node?
Which of the following is the BEST network defense against unknown types of attacks or stealth attacks in progress?
At what level of the Open System Interconnection (OSI) model is data at rest on a Storage Area Network (SAN) located?
Which of the following factors contributes to the weakness of Wired Equivalent Privacy (WEP) protocol?
An input validation and exception handling vulnerability has been discovered on a critical web-based system. Which of the following is MOST suited to quickly implement a control?
Which of the following is used by the Point-to-Point Protocol (PPP) to determine packet formats?
An external attacker has compromised an organization’s network security perimeter and installed a sniffer onto an inside computer. Which of the following is the MOST effective layer of security the organization could have implemented to mitigate the attacker’s ability to gain further information?
What is the second phase of Public Key Infrastructure (PKI) key/certificate life-cycle management?
The use of private and public encryption keys is fundamental in the implementation of which of the following?
Which of the following mobile code security models relies only on trust?
Which technique can be used to make an encryption scheme more resistant to a known plaintext attack?
Who in the organization is accountable for classification of data information assets?
Which security service is served by the process of encryption plaintext with the sender’s private key and decrypting cipher text with the sender’s public key?
What is the PRIMARY advantage of using automated application security testing tools?
Refer to the information below to answer the question.
In a Multilevel Security (MLS) system, the following sensitivity labels are used in increasing levels of sensitivity: restricted, confidential, secret, top secret. Table A lists the clearance levels for four users, while Table B lists the security classes of four different files.
Which of the following is true according to the star property (*property)?
What is the BEST first step for determining if the appropriate security controls are in place for protecting data at rest?
The use of proximity card to gain access to a building is an example of what type of security control?
The amount of data that will be collected during an audit is PRIMARILY determined by the.
Which of the following MOST influences the design of the organization's electronic monitoring policies?
Which of the following is the BEST countermeasure to brute force login attacks?
Refer to the information below to answer the question.
Desktop computers in an organization were sanitized for re-use in an equivalent security environment. The data was destroyed in accordance with organizational policy and all marking and other external indications of the sensitivity of the data that was formerly stored on the magnetic drives were removed.
After magnetic drives were degaussed twice according to the product manufacturer's directions, what is the MOST LIKELY security issue with degaussing?
Which of the following is critical for establishing an initial baseline for software components in the operation and maintenance of applications?
Which of the following provides effective management assurance for a Wireless Local Area Network (WLAN)?
During the procurement of a new information system, it was determined that some of the security requirements were not addressed in the system specification. Which of the following is the MOST likely reason for this?
Which of the following is the PRIMARY benefit of a formalized information classification program?
From a security perspective, which of the following is a best practice to configure a Domain Name Service (DNS) system?
With data labeling, which of the following MUST be the key decision maker?
Which item below is a federated identity standard?
Match the name of access control model with its associated restriction.
Drag each access control model to its appropriate restriction access on the right.
What is an advantage of Elliptic Curve Cryptography (ECC)?
Which of the following would BEST describe the role directly responsible for data within an organization?
Knowing the language in which an encrypted message was originally produced might help a cryptanalyst to perform a
Which of the following adds end-to-end security inside a Layer 2 Tunneling Protocol (L2TP) Internet Protocol Security (IPSec) connection?
The application of a security patch to a product previously validate at Common Criteria (CC) Evaluation Assurance Level (EAL) 4 would
When evaluating third-party applications, which of the following is the GREATEST responsibility of Information Security?
Which of the following is the BEST method to reduce the effectiveness of phishing attacks?
Between which pair of Open System Interconnection (OSI) Reference Model layers are routers used as a communications device?
Which of the following is the PRIMARY reason to perform regular vulnerability scanning of an organization network?
In which identity management process is the subject’s identity established?
During which of the following processes is least privilege implemented for a user account?
Which of the following media sanitization techniques is MOST likely to be effective for an organization using public cloud services?
Which of the following is BEST suited for exchanging authentication and authorization messages in a multi-party decentralized environment?
Which of the following information MUST be provided for user account provisioning?
Which of the following is MOST appropriate for protecting confidentially of data stored on a hard drive?
Which of the following are important criteria when designing procedures and acceptance criteria for acquired software?
Which of the following is MOST effective in detecting information hiding in Transmission Control Protocol/internet Protocol (TCP/IP) traffic?
A post-implementation review has identified that the Voice Over Internet Protocol (VoIP) system was designed
to have gratuitous Address Resolution Protocol (ARP) disabled.
Why did the network architect likely design the VoIP system with gratuitous ARP disabled?
Which of the following is a characteristic of an internal audit?
In a change-controlled environment, which of the following is MOST likely to lead to unauthorized changes to
production programs?
The core component of Role Based Access Control (RBAC) must be constructed of defined data elements.
Which elements are required?
In a High Availability (HA) environment, what is the PRIMARY goal of working with a virtual router address as the gateway to a network?
Which of the following steps should be performed FIRST when purchasing Commercial Off-The-Shelf (COTS) software?
Which security modes is MOST commonly used in a commercial environment because it protects the integrity
of financial and accounting data?
Which of the following is the MOST effective practice in managing user accounts when an employee is terminated?
A security professional determines that a number of outsourcing contracts inherited from a previous merger do not adhere to the current security requirements. Which of the following BEST minimizes the risk of this
happening again?
Which of the following is the BEST metric to obtain when gaining support for an Identify and Access
Management (IAM) solution?
Which of the following entails identification of data and links to business processes, applications, and data
stores as well as assignment of ownership responsibilities?
Which factors MUST be considered when classifying information and supporting assets for risk management, legal discovery, and compliance?
Which of the following is an initial consideration when developing an information security management system?
When implementing a data classification program, why is it important to avoid too much granularity?
An organization has doubled in size due to a rapid market share increase. The size of the Information Technology (IT) staff has maintained pace with this growth. The organization hires several contractors whose onsite time is limited. The IT department has pushed its limits building servers and rolling out workstations and has a backlog of account management requests.
Which contract is BEST in offloading the task from the IT staff?
In a data classification scheme, the data is owned by the
Which of the following BEST describes the responsibilities of a data owner?
Which one of the following affects the classification of data?
Which of the following is MOST important when assigning ownership of an asset to a department?
Which of the following is an effective control in preventing electronic cloning of Radio Frequency Identification (RFID) based access cards?
The configuration management and control task of the certification and accreditation process is incorporated in which phase of the System Development Life Cycle (SDLC)?
Which of the following is the BEST method to prevent malware from being introduced into a production environment?
When in the Software Development Life Cycle (SDLC) MUST software security functional requirements be defined?
What is the BEST approach to addressing security issues in legacy web applications?
Which of the following is a web application control that should be put into place to prevent exploitation of Operating System (OS) bugs?
Which of the following is the PRIMARY risk with using open source software in a commercial software construction?
A Java program is being developed to read a file from computer A and write it to computer B, using a third computer C. The program is not working as expected. What is the MOST probable security feature of Java preventing the program from operating as intended?
Which of the following will have the MOST influence on the definition and creation of data classification and data ownership policies?
Which of the following statements is TRUE regarding equivalence class testing?
Which of the following BEST describes how access to a system is granted to federated user accounts?
Which of the following is the MOST significant benefit to implementing a third-party federated identity architecture?
An organization wants to enable uses to authenticate across multiple security domains. To accomplish this they have decided to use Federated Identity Management (F1M). Which of the following is used behind the scenes in a FIM deployment?
What is maintained by using write blocking devices whan forensic evidence is examined?
Which attack defines a piece of code that is inserted into software to trigger a malicious function?
Which of the following techniques BEST prevents buffer overflows?
Physical assets defined in an organization’s Business Impact Analysis (BIA) could include which of the following?
What is the PRIMARY purpose for an organization to conduct a security audit?
A corporate security policy specifies that all devices on the network must have updated operating system patches and anti-malware software. Which technology should be used to enforce this policy?
Which of the following is the PRIMARY risk associated with Extensible Markup Language (XML) applications?
Utilizing a public wireless Local Area network (WLAN) to connect to a private network should be done only in which of the following situations?
Which of the following is the PRIMARY security consideration for how an organization should handle Information Technology (IT) assets?
Why would a security architect specify that a default route pointing to a sinkhole be
injected into internal networks?
Which of the following attacks, if successful, could give an intruder complete control of a software-defined networking (SDN) architecture?
A software engineer uses automated tools to review application code and search for application flaws, back doors, or other malicious code. Which of the following is the
FIRST Software Development Life Cycle (SDLC) phase where this takes place?
During a penetration test, what are the three PRIMARY objectives of the planning phase?
The personal laptop of an organization executive is stolen from the office, complete with personnel and project records. Which of the following should be done FIRST to mitigate future occurrences?
Which algorithm gets its security from the difficulty of calculating discrete logarithms in a finite field and is used to distribute keys, but cannot be used to encrypt or decrypt messages?
Which of the following is the MOST effective preventative method to identify security flaws in software?
Which audit type is MOST appropriate for evaluating the effectiveness of a security program?
A corporation does not have a formal data destruction policy. During which phase of a criminal legal proceeding will this have the MOST impact?
A malicious user gains access to unprotected directories on a web server. Which of the following is MOST likely the cause for this information disclosure?
Which of the following is a risk matrix?
When are security requirements the LEAST expensive to implement?
A firm within the defense industry has been directed to comply with contractual requirements for encryption of a government client’s Controlled Unclassified Information (CUI). What encryption strategy represents how to protect data at rest in the MOST efficient and cost-effective manner?
Physical Access Control Systems (PACS) allow authorized security personnel to manage and monitor access control for subjects through which function?
A security practitioner needs to implementation solution to verify endpoint security protections and operating system (0S) versions. Which of the following is the BEST solution to implement?
A systems engineer is designing a wide area network (WAN) environment for a new organization. The WAN will connect sites holding information at various levels of sensitivity, from publicly available to highly confidential. The organization requires a high degree of interconnectedness to support existing business processes. What is the
BEST design approach to securing this environment?
Which of the following could cause a Denial of Service (DoS) against an authentication system?
Which of the following is of GREATEST assistance to auditors when reviewing system configurations?
Which of the following is a PRIMARY benefit of using a formalized security testing report format and structure?
A Virtual Machine (VM) environment has five guest Operating Systems (OS) and provides strong isolation. What MUST an administrator review to audit a user’s access to data files?
In which of the following programs is it MOST important to include the collection of security process data?
All of the following items should be included in a Business Impact Analysis (BIA) questionnaire EXCEPT questions that
An important principle of defense in depth is that achieving information security requires a balanced focus on which PRIMARY elements?
What is the MOST important consideration from a data security perspective when an organization plans to relocate?
When assessing an organization’s security policy according to standards established by the International Organization for Standardization (ISO) 27001 and 27002, when can management responsibilities be defined?
A company whose Information Technology (IT) services are being delivered from a Tier 4 data center, is preparing a companywide Business Continuity Planning (BCP). Which of the following failures should the IT manager be concerned with?
Which of the following actions will reduce risk to a laptop before traveling to a high risk area?
Intellectual property rights are PRIMARY concerned with which of the following?
Which of the following represents the GREATEST risk to data confidentiality?
Which of the following types of technologies would be the MOST cost-effective method to provide a reactive control for protecting personnel in public areas?
An organization is found lacking the ability to properly establish performance indicators for its Web hosting solution during an audit. What would be the MOST probable cause?
The PRIMARY purpose of a security awareness program is to
Which of the following is an appropriate source for test data?
Which of the following is a security feature of Global Systems for Mobile Communications (GSM)?
Internet Protocol (IP) source address spoofing is used to defeat
What security management control is MOST often broken by collusion?
Which of the following is the FIRST step of a penetration test plan?
Multi-threaded applications are more at risk than single-threaded applications to
Who must approve modifications to an organization's production infrastructure configuration?
When transmitting information over public networks, the decision to encrypt it should be based on
When building a data center, site location and construction factors that increase the level of vulnerability to physical threats include
What is the ultimate objective of information classification?
When implementing controls in a heterogeneous end-point network for an organization, it is critical that
What is the MOST important purpose of testing the Disaster Recovery Plan (DRP)?
Which of the following is an essential element of a privileged identity lifecycle management?
An Intrusion Detection System (IDS) is generating alarms that a user account has over 100 failed login attempts per minute. A sniffer is placed on the network, and a variety of passwords for that user are noted. Which of the following is MOST likely occurring?
