The configuration management and control task of the certification and accreditation process is incorporated in which phase of the System Development Life Cycle (SDLC)?
Which of the following is a web application control that should be put into place to prevent exploitation of Operating System (OS) bugs?
When in the Software Development Life Cycle (SDLC) MUST software security functional requirements be defined?
A Java program is being developed to read a file from computer A and write it to computer B, using a third computer C. The program is not working as expected. What is the MOST probable security feature of Java preventing the program from operating as intended?
What is the BEST approach to addressing security issues in legacy web applications?
Which of the following is the PRIMARY risk with using open source software in a commercial software construction?
Which of the following is the BEST method to prevent malware from being introduced into a production environment?
The use of strong authentication, the encryption of Personally Identifiable Information (PII) on database servers, application security reviews, and the encryption of data transmitted across networks provide
Multi-threaded applications are more at risk than single-threaded applications to
Which of the following MUST be part of a contract to support electronic discovery of data stored in a cloud environment?
Which of the following is a security limitation of File Transfer Protocol (FTP)?
Intellectual property rights are PRIMARY concerned with which of the following?
A company whose Information Technology (IT) services are being delivered from a Tier 4 data center, is preparing a companywide Business Continuity Planning (BCP). Which of the following failures should the IT manager be concerned with?
An important principle of defense in depth is that achieving information security requires a balanced focus on which PRIMARY elements?
Which of the following actions will reduce risk to a laptop before traveling to a high risk area?
Which of the following represents the GREATEST risk to data confidentiality?
Which of the following types of technologies would be the MOST cost-effective method to provide a reactive control for protecting personnel in public areas?
What is the MOST important consideration from a data security perspective when an organization plans to relocate?
When assessing an organization’s security policy according to standards established by the International Organization for Standardization (ISO) 27001 and 27002, when can management responsibilities be defined?
All of the following items should be included in a Business Impact Analysis (BIA) questionnaire EXCEPT questions that
A Virtual Machine (VM) environment has five guest Operating Systems (OS) and provides strong isolation. What MUST an administrator review to audit a user’s access to data files?
Which of the following could cause a Denial of Service (DoS) against an authentication system?
An external attacker has compromised an organization’s network security perimeter and installed a sniffer onto an inside computer. Which of the following is the MOST effective layer of security the organization could have implemented to mitigate the attacker’s ability to gain further information?
Which of the following operates at the Network Layer of the Open System Interconnection (OSI) model?
An input validation and exception handling vulnerability has been discovered on a critical web-based system. Which of the following is MOST suited to quickly implement a control?
Which of the following is used by the Point-to-Point Protocol (PPP) to determine packet formats?
What is the purpose of an Internet Protocol (IP) spoofing attack?
Which of the following is the BEST network defense against unknown types of attacks or stealth attacks in progress?
In a Transmission Control Protocol/Internet Protocol (TCP/IP) stack, which layer is responsible for negotiating and establishing a connection with another node?
Which of the following factors contributes to the weakness of Wired Equivalent Privacy (WEP) protocol?
At what level of the Open System Interconnection (OSI) model is data at rest on a Storage Area Network (SAN) located?
Which security service is served by the process of encryption plaintext with the sender’s private key and decrypting cipher text with the sender’s public key?
Which technique can be used to make an encryption scheme more resistant to a known plaintext attack?
Which of the following is a BEST practice when traveling internationally with laptops containing Personally Identifiable Information (PII)?
Without proper signal protection, embedded systems may be prone to which type of attack?
What is the MOST critical factor to achieve the goals of a security program?
Refer to the information below to answer the question.
A large organization uses unique identifiers and requires them at the start of every system session. Application access is based on job classification. The organization is subject to periodic independent reviews of access controls and violations. The organization uses wired and wireless networks and remote access. The organization also uses secure connections to branch offices and secure backup and recovery strategies for selected information and processes.
Following best practice, where should the permitted access for each department and job classification combination be specified?
The use of proximity card to gain access to a building is an example of what type of security control?
Refer to the information below to answer the question.
An organization experiencing a negative financial impact is forced to reduce budgets and the number of Information Technology (IT) operations staff performing basic logical access security administration functions. Security processes have been tightly integrated into normal IT operations and are not separate and distinct roles.
Which of the following will MOST likely allow the organization to keep risk at an acceptable level?
Refer to the information below to answer the question.
A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive e-mail, search the web, and use instant messaging. The organization’s Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee's access.
Which of the following solutions would have MOST likely detected the use of peer-to-peer programs when the computer was connected to the office network?
Refer to the information below to answer the question.
A large, multinational organization has decided to outsource a portion of their Information Technology (IT) organization to a third-party provider’s facility. This provider will be responsible for the design, development, testing, and support of several critical, customer-based applications used by the organization.
The organization should ensure that the third party's physical security controls are in place so that they
When is security personnel involvement in the Systems Development Life Cycle (SDLC) process MOST beneficial?
Refer to the information below to answer the question.
In a Multilevel Security (MLS) system, the following sensitivity labels are used in increasing levels of sensitivity: restricted, confidential, secret, top secret. Table A lists the clearance levels for four users, while Table B lists the security classes of four different files.
In a Bell-LaPadula system, which user cannot write to File 3?
What is the BEST first step for determining if the appropriate security controls are in place for protecting data at rest?
Which of the following is the PRIMARY consideration when determining the frequency an automated control should be assessed or monitored?
What type of access control determines the authorization to resource based on pre-defined job titles within an organization?
Digital non-repudiation requires which of the following?
What is the BEST way to correlate large volumes of disparate data sources in a
Security Operations Center (SOC) environment?
Match the level of evaluation to the correct common criteria (CC) assurance level.
Drag each level of evaluation on the left to is corresponding CC assurance level on the right
Which of the following types of data would be MOST difficult to detect by a forensic examiner?
Which of the following is MOST important when determining appropriate countermeasures for an identified risk?
In Identity Management (IdM), when is the verification stage performed?
Limiting the processor, memory, and Input/output (I/O) capabilities of mobile code is known as
Which of the following is the MOST secure password technique?
A security professional is assessing the risk in an application and does not take into account any mitigating or compensating controls. This type of risk rating is an example of which of the following?
What is the BEST approach for controlling access to highly sensitive information when employees have the same level of security clearance?
A manufacturing organization wants to establish a Federated Identity Management (FIM) system with its 20 different supplier companies. Which of the following is the BEST solution for the manufacturing organization?
Users require access rights that allow them to view the average salary of groups of employees. Which control would prevent the users from obtaining an individual employee’s salary?
Which of the following BEST describes an access control method utilizing cryptographic keys derived from a smart card private key that is embedded within mobile devices?
An organization has doubled in size due to a rapid market share increase. The size of the Information Technology (IT) staff has maintained pace with this growth. The organization hires several contractors whose onsite time is limited. The IT department has pushed its limits building servers and rolling out workstations and has a backlog of account management requests.
Which contract is BEST in offloading the task from the IT staff?
Which of the following is an initial consideration when developing an information security management system?
Which one of the following affects the classification of data?
In a data classification scheme, the data is owned by the
Which of the following is an effective control in preventing electronic cloning of Radio Frequency Identification (RFID) based access cards?
Which of the following BEST describes the responsibilities of a data owner?
When implementing a data classification program, why is it important to avoid too much granularity?
When developing a business case for updating a security program, the security program owner MUST do
which of the following?
Which of the following is MOST effective in detecting information hiding in Transmission Control Protocol/internet Protocol (TCP/IP) traffic?
What is the MAIN purpose of a change management policy?
Mandatory Access Controls (MAC) are based on:
Which of the following is a characteristic of an internal audit?
A post-implementation review has identified that the Voice Over Internet Protocol (VoIP) system was designed
to have gratuitous Address Resolution Protocol (ARP) disabled.
Why did the network architect likely design the VoIP system with gratuitous ARP disabled?
The security accreditation task of the System Development Life Cycle (SDLC) process is completed at the end of which phase?
As part of an application penetration testing process, session hijacking can BEST be achieved by which of the following?
Which of the following is the GREATEST benefit of implementing a Role Based Access Control (RBAC)
system?
What is the PRIMARY goal of fault tolerance?
Which of the following is considered a secure coding practice?
What is the MOST important step during forensic analysis when trying to learn the purpose of an unknown application?
When is a Business Continuity Plan (BCP) considered to be valid?
What should be the FIRST action to protect the chain of evidence when a desktop computer is involved?
Which of the following types of business continuity tests includes assessment of resilience to internal and external risks without endangering live operations?
A continuous information security monitoring program can BEST reduce risk through which of the following?
Recovery strategies of a Disaster Recovery planning (DRIP) MUST be aligned with which of the following?
A Business Continuity Plan/Disaster Recovery Plan (BCP/DRP) will provide which of the following?
Which of the following is the FIRST step in the incident response process?
An organization is found lacking the ability to properly establish performance indicators for its Web hosting solution during an audit. What would be the MOST probable cause?
What would be the MOST cost effective solution for a Disaster Recovery (DR) site given that the organization’s systems cannot be unavailable for more than 24 hours?
Which of the following is a PRIMARY advantage of using a third-party identity service?
What security risk does the role-based access approach mitigate MOST effectively?
Which of the following types of security testing is the MOST effective in providing a better indication of the everyday security challenges of an organization when performing a security risk assessment?
Which of the following is the MOST important element of change management documentation?
Which methodology is recommended for penetration testing to be effective in the development phase of the life-cycle process?
Which of the following BEST avoids data remanence disclosure for cloud hosted resources?
In which order, from MOST to LEAST impacted, does user awareness training reduce the occurrence of the events below?
Which Web Services Security (WS-Security) specification negotiates how security tokens will be issued, renewed and validated? Click on the correct specification in the image below.
Which Web Services Security (WS-Security) specification handles the management of security tokens and the underlying policies for granting access? Click on the correct specification in the image below.
Which of the following analyses is performed to protect information assets?
Disaster Recovery Plan (DRP) training material should be
What is an important characteristic of Role Based Access Control (RBAC)?
During the Security Assessment and Authorization process, what is the PRIMARY purpose for conducting a hardware and software inventory?
When writing security assessment procedures, what is the MAIN purpose of the test outputs and reports?
In configuration management, what baseline configuration information MUST be maintained for each computer system?
Which technology is a prerequisite for populating the cloud-based directory in a federated identity solution?
Which of the following are effective countermeasures against passive network-layer attacks?
Which Radio Frequency Interference (RFI) phenomenon associated with bundled cable runs can create information leakage?
Which of the following is BEST suited for exchanging authentication and authorization messages in a multi-party decentralized environment?
Which of the following is the PRIMARY reason to perform regular vulnerability scanning of an organization network?
From a cryptographic perspective, the service of non-repudiation includes which of the following features?
Which of the following countermeasures is the MOST effective in defending against a social engineering attack?
The goal of a Business Impact Analysis (BIA) is to determine which of the following?
