ISC Certification CISSP CAT Exam Great Dumps

1. Checking routing information on e-mail to determine it is in a valid format and contains valid information is an example of which of the following anti-spam approaches?

2. Which of the following is MOST critical in a contract in a contract for data disposal on a hard drive with a third party?

3. What is the PRIMARY difference between security policies and security procedures?

4. Topic 8, . Software Development Security



A Java program is being developed to read a file from computer A and write it to computer B, using a third computer C. The program is not working as expected.

What is the MOST probable security feature of Java preventing the program from operating as intended?

5. Which of the following is a characteristic of the initialization vector when using Data Encryption Standard (DES)?

6. What does the term “100-year floodplain” mean to emergency preparedness officials?

7. What type of attack sends Internet Control Message Protocol (ICMP) echo requests to the target machine with a larger payload than the target can handle?

8. When a system changes significantly, who is PRIMARILY responsible for assessing the security impact?

9. Which of the following trust services principles refers to the accessibility of information used by the systems, products, or services offered to a third-party provider’s customers?

10. A security professional has been requested by the Board of Directors and Chief Information Security Officer (CISO) to perform an internal and external penetration test.

What is the BEST course of action?

11. Which of the following is the BEST example of weak management commitment to the protection of security assets and resources?

12. Which of the following types of technologies would be the MOST cost-effective method to provide a reactive control for protecting personnel in public areas?

13. How is Remote Authentication Dial-In User Service (RADIUS) authentication accomplished?

14. When would an organization review a Business Continuity Management (BCM) system?

15. A security professional determines that a number of outsourcing contracts inherited from a previous merger do not adhere to the current security requirements.

Which of the following BEST minimizes the risk of this happening again?

16. Which is the RECOMMENDED configuration mode for sensors for an intrusion prevention system (IPS) if the prevention capabilities will be used?

17. Refer to the information below to answer the question.

An organization experiencing a negative financial impact is forced to reduce budgets and the number of Information Technology (IT) operations staff performing basic logical access security administration functions. Security processes have been tightly integrated into normal IT operations and are not separate and distinct roles.

Which of the following will be the PRIMARY security concern as staff is released from the organization?

18. A database administrator is asked by a high-ranking member of management to perform specific changes to the accounting system database. The administrator is specifically instructed to not track or evidence the change in a ticket.

Which of the following is the BEST course of action?

19. All of the following items should be included in a Business Impact Analysis (BIA) questionnaire EXCEPT questions that

20. Which of the following is ensured when hashing files during chain of custody handling?

21. Who would be the BEST person to approve an organizations information security policy?

22. A project requires the use of en authentication mechanism where playback must be protected and plaintext secret must be used.

Which of the following should be used?

23. Which of the following BEST describes the responsibilities of data owner?

24. When designing a networked Information System (IS) where there will be several different types of individual access, what is the FIRST step that should be taken to ensure all access control requirements are addressed?

25. Although code using a specific program language may not be susceptible to a buffer overflow attack,

26. During an audit of system management, auditors find that the system administrator has not been trained.

What actions need to be taken at once to ensure the integrity of systems?

27. The security team has been tasked with performing an interface test against a frontend external facing application and needs to verify that all input fields protect against invalid input.

Which of the following BEST assists this process?

28. By carefully aligning the pins in the lock, which of the following defines the opening of a mechanical lock without the proper key?

29. Which of the following steps should be performed FIRST when purchasing Commercial Off-The-Shelf (COTS) software?

30. A company seizes a mobile device suspected of being used in committing fraud.

What would be the BEST method used by a forensic examiner to isolate the powered-on device from the network and preserve the evidence?

31. Which of the following is an appropriate source for test data?

32. Additional padding may be added to the Encapsulating security protocol (ESP) trailer to provide which of the following?

33. A company was ranked as high in the following National Institute of Standards and Technology (NIST) functions: Protect, Detect, Respond and Recover. However, a low maturity grade was attributed to the Identify function.

In which of the following the controls categories does this company need to improve when analyzing its processes individually?

34. What is the MOST effective method for gaining unauthorized access to a file protected with a long complex password?

35. An organization wants to enable uses to authenticate across multiple security domains. To accomplish this they have decided to use Federated Identity Management (F1M).

Which of the following is used behind the scenes in a FIM deployment?

36. What requirement MUST be met during internal security audits to ensure that all information provided is expressed as an objective assessment without risk of retaliation?

37. At a MINIMUM, a formal review of any Disaster Recovery Plan (DRP) should be conducted

38. A security architect plans to reference a Mandatory Access Control (MAC) model for implementation.

This indicates that which of the following properties are being prioritized?

39. Regarding asset security and appropriate retention, which of the following INITIAL top three areas are important to focus on?

40. Application of which of the following Institute of Electrical and Electronics Engineers (IEEE) standards will prevent an unauthorized wireless device from being attached to a network?

41. What would be the MOST cost effective solution for a Disaster Recovery (DR) site given that the organization’s systems cannot be unavailable for more than 24 hours?

42. Which would result in the GREATEST import following a breach to a cloud environment?

43. Which of the following is the MOST important consideration when developing a Disaster Recovery Plan (DRP)?

44. Which of the following initiates the system recovery phase of a disaster recovery plan?

45. Utilizing a public wireless Local Area network (WLAN) to connect to a private network should be done only in which of the following situations?

46. Which of the following BEST describes the purpose of the security functional requirements of Common Criteria?

47. Data remanence is the biggest threat in which of the following scenarios?

48. CORRECT TEXT

During a Disaster Recovery (DR) simulation, it is discovered that the shared recovery site lacks adequate data restoration capabilities to support the implementation of multiple plans simultaneously.

What would be impacted by this fact if left unchanged?

49. Extensible Authentication Protocol-Message Digest 5 (EAP-MD5) only provides which of the following?

50. An external attacker has compromised an organization's network security perimeter and installed a sniffer onto an inside computer.

Which of the following is the MOST effective layer of security the organization could have implemented to mitigate the attacker's ability to gain further information?

51. Which of the following disaster recovery test plans will be MOST effective while providing minimal risk?

52. DRAG DROP

A software security engineer is developing a black box-based test plan that will measure the system's reaction to incorrect or illegal inputs or unexpected operational errors and situations. Match the functional testing techniques on the left with the correct input parameters on the right.

53. Which of the following provides effective management assurance for a Wireless Local Area Network (WLAN)?

54. Which of the following is a security weakness in the evaluation of common criteria (CC) products?

55. Which of the following MOST applies to session initiation protocal (SIP) security?

56. DRAG DROP

Match the objectives to the assessment questions in the governance domain of Software Assurance Maturity Model (SAMM).

57. How is it possible to extract private keys securely stored on a cryptographic smartcard?

58. Which of the following is the BEST method to assess the effectiveness of an organization's vulnerability management program?

59. Which of the following mobile code security models relies only on trust?

60. What principle requires that changes to the plaintext affect many parts of the ciphertext?

61. A. The signer verifies that the software being loaded is the software originated by the signer.

B. The vendor certifies the software being loaded is free of malicious code and that it was originated by the signer.

C. The signer verifies that the software being loaded is free of malicious code.

D. Both vendor and the signer certify the software being loaded is free of malicious code and it was originated by the signer.

62. Copyright provides protection for which of the following?

63. Which of the following statements is TRUE regarding equivalence class testing?

64. The application of which of the following standards would BEST reduce the potential for data breaches?

65. Which security access policy contains fixed security attributes that are used by the system to determine a user’s access to a file or object?

66. Which of the following models uses unique groups contained in unique conflict classes?

67. Which of the following types of data would be MOST difficult to detect by a forensic examiner?

68. In a High Availability (HA) environment, what is the PRIMARY goal of working with a virtual router address as the gateway to a network?

69. Why must all users be positively identified prior to using multi-user computers?

70. What is the document that describes the measures that have been implemented or planned to correct any deficiencies noted during the assessment of the security controls?

71. Which of the following is the BIGGEST weakness when using native Lightweight Directory Access Protocol (LDAP) for authentication?

72. A large bank deploys hardware tokens to all customers that use their online banking system. The token generates and displays a six digit numeric password every 60 seconds. The customers must log into their bank accounts using this numeric password. This is an example of

73. Which of the following is the PRIMARY security consideration for how an organization should handle Information Technology (IT) assets?

74. Which of the following techniques is effective to detect taps in fiber optic cables?

75. When a flaw in Industrial control (ICS) software is discovered, what is the GREATEST impediment to deploying a patch?

76. Which layer of the Open systems Interconnection (OSI) model is being targeted in the event of a Synchronization (SYN) flood attack?

77. Which of the following is the BEST metric to obtain when gaining support for an Identify and Access Management (IAM) solution?

78. Which of the following explains why record destruction requirements are included in a data retention policy?

79. Which of the following MUST be scalable to address security concerns raised by the integration of third-party identity services?

80. What protocol is often used between gateway hosts on the Internet?

81. What is the most effective form of media sanitization to ensure residual data cannot be retrieved?

82. Which of the following types of security testing is the MOST effective in providing a better indication of the everyday security challenges of an organization when performing a security risk assessment?

83. The implementation of which features of an identity management system reduces costs and administration overhead while improving audit and accountability?

84. Which of the following access control models is MOST restrictive?

85. Which security modes is MOST commonly used in a commercial environment because it protects the integrity

of financial and accounting data?

86. HOTSPOT

In the network design below, where is the MOST secure Local Area Network (LAN) segment to deploy a Wireless Access Point (WAP) that provides contractors access to the Internet and authorized enterprise services?

87. Which of the following is the MOST important consideration when storing and processing Personally Identifiable Information (PII)?

88. What is the MOST common component of a vulnerability management framework?

89. By allowing storage communications to run on top of Transmission Control Protocol/Internet Protocol (TCP/IP) with a Storage Area Network (SAN), the

90. The goal of software assurance in application development is to

91. Which Radio Frequency Interference (RFI) phenomenon associated with bundled cable runs can create information leakage?

92. How should an organization determine the priority of its remediation efforts after a vulnerability assessment has been conducted?

93. Which one of the following data integrity models assumes a lattice of integrity levels?

94. The process of mutual authentication involves a computer system authenticating a user and authenticating the

95. Refer to the information below to answer the question.

A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive e-mail, search the web, and use instant messaging. The organization’s Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee's access.

Which of the following methods is the MOST effective way of removing the Peer-to-Peer (P2P) program from the computer?

96. Which of the following is a canon of the (ISC)2 Code of Ethics?

97. What is the difference between media marking and media labeling?

98. Which of the following is a Key Performance Indicator (KPI) for a security training and awareness program?

99. Why would a security architect specify that a default route pointing to a sinkhole be injected into internal networks?

100. Which of the following is PRIMARILY adopted for ensuring the integrity of information is preserved?

101. How can a forensic specialist exclude from examination a large percentage of operating system files residing on a copy of the target system?

102. Which Identity and Access Management (IAM) process can be used to maintain the principle of least

privilege?

103. Which of the following is used to ensure that data mining activities Will NOT reveal sensitive data?

104. Which of the following is the PRIMARY reason a sniffer operating on a network is collecting packets only from its own host?

105. When developing a business case for updating a security program, the security program owner MUST do which of the following?

106. Which of the following value comparisons MOST accurately reflects the agile development approach?

107. When developing solutions for mobile devices, in which phase of the Software Development Life Cycle (SDLC) should technical limitations related to devices be specified?

108. What does electronic vaulting accomplish?

109. Which of the following encryption types is used in Hash Message Authentication Code (HMAC) for key distribution?

110. When building a data classification scheme, which of the following is the PRIMARY concern?

111. Which of the following activities BEST identifies operational problems, security misconfigurations, and malicious attacks?

112. Refer to the information below to answer the question.

A security practitioner detects client-based attacks on the organization’s network. A plan will be necessary to address these concerns.

In addition to web browsers, what PRIMARY areas need to be addressed concerning mobile code used for malicious purposes?

113. A client has reviewed a vulnerability assessment report and has stated it is Inaccurate. The client states that the vulnerabilities listed are not valid because the host’s Operating System (OS) was not properly detected.

Where in the vulnerability assessment process did the erra MOST likely occur?

114. During a Disaster Recovery (DR) assessment, additional coverage for assurance is required.

What should en assessor do?

115. An organization is selecting a service provider to assist in the consolidation of multiple computing sites including development, implementation and ongoing support of various computer systems.

Which of the following MUST be verified by the Information Security Department?

116. Which of the following objects should be removed FIRST prior to uploading code to public code repositories?

117. With data labeling, which of the following MUST be the key decision maker?

118. A security professional is assessing the risk in an application and does not take into account any mitigating or compensating controls.

This type of risk rating is an example of which of the following?

119. When implementing a secure wireless network, which of the following supports authentication and authorization for individual client endpoints?

120. Which of the following does the Encapsulating Security Payload (ESP) provide?

121. Individual access to a network is BEST determined based on

122. During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant.

What is the best approach for the CISO?

123. Which attack defines a piece of code that is inserted into software to trigger a malicious function?

124. An application developer is deciding on the amount of idle session time that the application allows before a timeout. The BEST reason for determining the session timeout requirement is

125. Which of the following factors contributes to the weakness of Wired Equivalent Privacy (WEP) protocol?

126. Digital certificates used transport Layer security (TLS) support which of the following?

127. A vulnerability assessment report has been submitted to a client. The client indicates that one third of the hosts that were in scope are missing from the report.

In which phase of the assessment was this error MOST likely made?

128. An organization recently conducted a review of the security of its network applications. One of the vulnerabilities found was that the session key used in encrypting sensitive information to a third party server had been hard-coded in the client and server applications.

Which of the following would be MOST effective in mitigating this vulnerability?

129. Which of the following is generally indicative of a replay attack when dealing with biometric authentication?

130. Which of the following is the MOST significant benefit to implementing a third-party federated identity architecture?

131. After a thorough analysis, it was discovered that a perpetrator compromised a network by gaining access to the network through a Secure Socket Layer (SSL) Virtual Private Network (VPN) gateway. The perpetrator guessed a username and brute forced the password to gain access.

Which of the following BEST mitigates this issue?

132. What is a common mistake in records retention?

133. Which of the following management processes allots ONLY those services required for users to accomplish their tasks, change default user passwords, and set servers to retrieve antivirus updates?

134. A security practitioner is tasked with securing the organization’s Wireless Access Points (WAP).

Which of these is the MOST effective way of restricting this environment to authorized users?

135. A software scanner identifies a region within a binary image having high entropy.

What does this MOST likely indicate?

136. HOTSPOT

Which Web Services Security (WS-Security) specification maintains a single authenticated identity across multiple dissimilar environments? Click on the correct specification in the image below.

137. Which of the following defines the key exchange for Internet Protocol Security (IPSec)?

138. Which technique can be used to make an encryption scheme more resistant to a known plaintext attack?

139. Which of the following is the PRIMARY reason to perform regular vulnerability scanning of an organization network?

140. Alternate encoding such as hexadecimal representations is MOST often observed in which of the following forms of attack?

141. Which of the following types of business continuity tests includes assessment of resilience to internal and external risks without endangering live operations?

142. An organization implements a Remote Access Server (RAS). Once users correct to the server, digital certificates are used to authenticate their identity.

What type of Extensible Authentication Protocol (EAP) would the organization use dring this authentication?

143. Configuring a Wireless Access Point (WAP) with the same Service Set Identifier (SSID) as another WAP in order to have users unknowingly connect is referred to as which of the following?

144. The Hardware Abstraction Layer (HAL) is implemented in the

145. Which one of the following is a common risk with network configuration management?

146. Including a Trusted Platform Module (TPM) in the design of a computer system is an example of a technique to what?

147. Passive Infrared Sensors (PIR) used in a non-climate controlled environment should

148. What should be used immediately after a Business Continuity Plan (BCP) has been invoked?

149. An important principle of defense in depth is that achieving information security requires a balanced focus on which PRIMARY elements?

150. Refer to the information below to answer the question.

A large organization uses unique identifiers and requires them at the start of every system session. Application access is based on job classification. The organization is subject to periodic independent reviews of access controls and violations. The organization uses wired and wireless networks and remote access. The organization also uses secure connections to branch offices and secure backup and recovery strategies for selected information and processes.

In addition to authentication at the start of the user session, best practice would require re-authentication

151. An organization is designing a large enterprise-wide document repository system. They plan to have several different classification level areas with increasing levels of controls. The BEST way to ensure document confidentiality in the repository is to

152. Which Redundant Array c/ Independent Disks (RAID) Level does the following diagram represent?

153. The Rivest-Shamir-Adleman (RSA) algorithm is BEST suited for which of the following operations?

154. Which of the following is the MOST common method of memory protection?

155. Which factors MUST be considered when classifying information and supporting assets for risk management, legal discovery, and compliance?

156. Refer to the information below to answer the question.

In a Multilevel Security (MLS) system, the following sensitivity labels are used in increasing levels of sensitivity: restricted, confidential, secret, top secret. Table A lists the clearance levels for four users, while Table B lists the security classes of four different files.





In a Bell-LaPadula system, which user cannot write to File 3?

157. Which of the following sets of controls should allow an investigation if an attack is not blocked by preventive controls or detected by monitoring?

158. The key benefits of a signed and encrypted e-mail include

159. What protocol is often used between gateway hosts on the Internet’ To control the scope of a Business Continuity Management (BCM) system, a security practitioner should identify which of the following?

160. What is the best way for mutual authentication of devices belonging to the same organization?

161. Data leakage of sensitive information is MOST often concealed by which of the following?

162. Proven application security principles include which of the following?

163. Topic 2,. Asset Security



Which of the following BEST describes the responsibilities of a data owner?

164. In configuration management, what baseline configuration information MUST be maintained for each computer system?

165. What technique used for spoofing the origin of an email can successfully conceal the sender s Internet Protocol (IP) address?

166. Which of the following would BEST support effective testing of patch compatibility when patches are applied to an organization’s systems?

167. DRAG DROP

Match the types of e-authentication tokens to their description.

Drag each e-authentication token on the left to its corresponding description on the right.

168. Which of the following is a recommended alternative to an integrated email encryption system?

169. Which of the following statements is TRUE of black box testing?

170. Which one of the following activities would present a significant security risk to organizations when employing a Virtual Private Network (VPN) solution?

171. What can happen when an Intrusion Detection System (IDS) is installed inside a firewall-protected internal network?

172. How long should the records on a project be retained?

173. Which of the following features is MOST effective in mitigating against theft of data on a corporate mobile device Which has stolen?

174. Which of the following is MOST important when deploying digital certificates?

175. Host-Based Intrusion Protection (HIPS) systems are often deployed in monitoring or learning mode during their initial implementation.

What is the objective of starting in this mode?

176. According to the Capability Maturity Model Integration (CMMI), which of the following levels is identified by a managed process that is tailored from the organization's set of standard processes according to the organization's tailoring guidelines?

177. Access to which of the following is required to validate web session management?

178. Which one of the following is an advantage of an effective release control strategy form a configuration control standpoint?

179. What should be the FIRST action to protect the chain of evidence when a desktop computer is involved?

180. In the Open System Interconnection (OSI) model, which layer is responsible for the transmission of binary data over a communications network?

181. Topic 3, . Security Architecture and Engineering



Who in the organization is accountable for classification of data information assets?

182. What is the BEST approach for maintaining ethics when a security professional is unfamiliar with the culture of a country and is asked to perform a questionable task?

183. Which of the following is applicable to a publicly held company concerned about information handling and storage requirement specific to the financial reporting?

184. Which of the following is a method used to prevent Structured Query Language (SQL) injection attacks?

185. Which of the following is used to support the of defense in depth during development phase of a software product?

186. Which layer of the Open system Interconnect (OSI) model is responsible for secure data transfer between applications, flow control, and error detection and correction?

187. Which of the following is the BEST countermeasure to brute force login attacks?

188. Which of the following is the BEST mitigation from phishing attacks?

189. A security practitioner has been tasked with establishing organizational asset handling procedures.

What should be considered that would have the GRFATEST impact to the development of these procedures?

190. Which of the following phases involves researching a target's configuration from public sources when performing a penetration test?

191. Which of the following standards/guidelines requires an Information Security Management System (ISMS) to be defined?

192. A Security Operations Center (SOC) receives an incident response notification on a server with an active intruder who has planted a backdoor. Initial notifications are sent and communications are established.

What MUST be considered or evaluated before performing the next step?

193. Which of the following is an authentication protocol in which a new random number is generated uniquely for each login session?

194. Which of the following is the FIRST action that a system administrator should take when it is revealed during a penetration test that everyone in an organization has unauthorized access to a server holding sensitive data?

195. When determining who can accept the risk associated with a vulnerability, which of the following is MOST important?

196. An organization seeks to use a cloud Identity and Access Management (IAM) provider whose protocols and data formats are incompatible with existing systems.

Which of the following techniques addresses the compatibility issue?

197. Which of the BEST internationally recognized standard for evaluating security products and systems?

198. During the procurement of a new information system, it was determined that some of the security requirements were not addressed in the system specification.

Which of the following is the MOST likely reason for this?

199. Which of the following is a standard Access Control List (ACL) element that enables a router to filter Internet traffic?

200. Within the company, desktop clients receive Internet Protocol (IP) address over Dynamic Host Configuration Protocol (DHCP).

Which of the following represents a valid measure to help protect the network against unauthorized access?

201. Which of the following is a strategy of grouping requirements in developing a Security Test and Evaluation (ST&E)?

202. Which of the following BEST describes botnets?

203. Which of the following access management procedures would minimize the possibility of an organization's employees retaining access to secure werk areas after they change roles?

204. What is the BEST way to correlate large volumes of disparate data sources in a Security Operations Center (SOC) environment?

205. In the common criteria (CC) for information technology (IT) security evaluation, increasing Evaluation Assurance Levels (EAL) results in which of the following?

206. A security analyst for a large financial institution is reviewing network traffic related to an incident. The analyst determines the traffic is irrelevant to the investigation but in the process of the review, the analyst also finds that an applications data, which included full credit card cardholder data, is transferred in clear text between the server and user’s desktop. The analyst knows this violates the Payment Card Industry Data Security Standard (PCI-DSS).

Which of the following is the analyst’s next step?

207. Which one of the following documentation should be included in a Disaster Recovery (DR) package?

208. As a security manger which of the following is the MOST effective practice for providing value to an organization?

209. Which of the following is an essential element of a privileged identity lifecycle management?

210. At what level of the Open System Interconnection (OSI) model is data at rest on a Storage Area Network (SAN) located?

211. How does security in a distributed file system using mutual authentication differ from file security in a multi-user host?

212. Which of the following should be included in a hardware retention policy?

Which of the following should be included in a hardware retention policy?

213. What is the BEST way to establish identity over the internet?

214. Which of the following is the MOST effective method of mitigating data theft from an active user workstation?

215. Which of the following presents the PRIMARY concern to an organization when setting up a federated single sign-on (SSO) solution with another

216. Which of the following could cause a Denial of Service (DoS) against an authentication system?

217. Which of the following is the FIRST step in the incident response process?

218. How should the retention period for an organization's social media content be defined?

219. Which of the following job functions MUST be separated to maintain data and application integrity?

220. An input validation and exception handling vulnerability has been discovered on a critical web-based system.

Which of the following is MOST suited to quickly implement a control?

221. What does an organization FIRST review to assure compliance with privacy requirements?

222. Multi-threaded applications are more at risk than single-threaded applications to

223. Refer to the information below to answer the question.

During the investigation of a security incident, it is determined that an unauthorized individual accessed a system which hosts a database containing financial information.

If the intrusion causes the system processes to hang, which of the following has been affected?

224. Which of the following is the MOST effective attack against cryptographic hardware modules?

225. DRAG DROP

Match the level of evaluation to the correct common criteria (CC) assurance level.

Drag each level of evaluation on the left to is corresponding CC assurance level on the right

226. Which of the following is the PRIMARY reason for employing physical security personnel at entry points in facilities where card access is in operation?

227. A user has infected a computer with malware by connecting a Universal Serial Bus (USB) storage device.

Which of the following is MOST effective to mitigate future infections?

228. What should be the FIRST action for a security administrator who detects an intrusion on the network based on precursors and other indicators?

229. What Is the FIRST step for a digital investigator to perform when using best practices to collect digital evidence from a potential crime scene?

230. What is the MOST effective countermeasure to a malicious code attack against a mobile system?

231. Which of the following authorization standards is built to handle Application Programming Interface (API) access for Federated Identity Management (FIM)?

232. What is the MAIN reason for testing a Disaster Recovery Plan (DRP)?

233. Internet Protocol (IP) source address spoofing is used to defeat

234. Refer to the information below to answer the question.

A large organization uses unique identifiers and requires them at the start of every system session. Application access is based on job classification. The organization is subject to periodic independent reviews of access controls and violations. The organization uses wired and wireless networks and remote access. The organization also uses secure connections to branch offices and secure backup and recovery strategies for selected information and processes.

Following best practice, where should the permitted access for each department and job classification combination be specified?

235. Which of the following is critical if an empolyee is dismissed due to violation of an organization’s acceptable use policy (Aup)?

236. Which of the following BEST describes Recovery Time Objective (RTO)?

237. Which of the following adds end-to-end security inside a Layer 2 Tunneling Protocol (L2TP) Internet Protocol Security (IPSec) connection?

238. An employee receives a promotion that entities them to access higher-level functions on the company’s accounting system, as well as keeping their access to the previous system that is no longer needed or applicable.

What is the name of the process that tries to remove this excess privilege?

239. Which of the following methods protects Personally Identifiable Information (PII) by use of a full replacement of the data element?

240. When transmitting information over public networks, the decision to encrypt it should be based on

241. Which of the following is required to determine classification and ownership?

242. An organization has hired a security services firm to conduct a penetration test.

Which of the following will the organization provide to the tester?

243. Which of the following processes has the PRIMARY purpose of identifying outdated software versions, missing patches, and lapsed system updates?

244. What is the GREATEST challenge of an agent-based patch management solution?

245. An organization has decided to contract with a cloud-based service provider to leverage their identity as a service offering. They will use Open Authentication (OAuth) 2.0 to authenticate external users to the organization's services.

As part of the authentication process, which of the following must the end user provide?

246. In Identity Management (IdM), when is the verification stage performed?

247. Disaster Recovery Plan (DRP) training material should be

248. Of the following, which BEST provides non- repudiation with regards to access to a server room?

249. What is the PRIMARY objective for conducting an internal security audit?

250. A post-implementation review has identified that the Voice Over Internet Protocol (VoIP) system was designed to have gratuitous Address Resolution Protocol (ARP) disabled.

Why did the network architect likely design the VoIP system with gratuitous ARP disabled?

251. Which of the following will an organization's network vulnerability testing process BEST enhance?

252. As users switch roles within an organization, their accounts are given additional permissions to perform the duties of their new position. After a recent audit, it was discovered that many of these accounts maintained their old permissions as well. The obsolete permissions identified by the audit have been remediated and accounts have only the appropriate permissions to complete their jobs.

Which of the following is the BEST way to prevent access privilege creep?

253. Which of the following MUST be considered when developing business rules for a data loss prevention (DLP) solution?

254. How does identity as a service (IDaaS) provide an easy mechanism for integrating identity service into individual applications with minimal development effort?

255. Refer to the information below to answer the question.

An organization experiencing a negative financial impact is forced to reduce budgets and the number of Information Technology (IT) operations staff performing basic logical access security administration functions. Security processes have been tightly integrated into normal IT operations and are not separate and distinct roles.

Which of the following will indicate where the IT budget is BEST allocated during this time?

256. A system is developed so that its business users can perform business functions but not user administration functions. Application administrators can perform administration functions but not user business functions. These capabilities are BEST described as

257. The BEST example of the concept of "something that a user has" when providing an authorized user access to a computing system is

258. Which of the following BEST describes an access control method utilizing cryptographic keys derived from a smart card private key that is embedded within mobile devices?

259. A security professional recommends that a company integrate threat modeling into its Agile development processes.

Which of the following BEST describes the benefits of this approach?

260. In an organization where Network Access Control (NAC) has been deployed, a device trying to connect to the network is being placed into an isolated domain.

What could be done on this device in order to obtain proper connectivity?

261. In the Software Development Life Cycle (SDLC), maintaining accurate hardware and software inventories is a critical part of

262. DRAG DROP

Given the various means to protect physical and logical assets, match the access management area to the technology.

263. Which of the following is the MOST important security goal when performing application interface testing?

264. What is the BEST approach to addressing security issues in legacy web applications?

265. Which of the following MUST be part of a contract to support electronic discovery of data stored in a cloud environment?

266. The organization would like to deploy an authorization mechanism for an Information Technology (IT)

infrastructure project with high employee turnover.

Which access control mechanism would be preferred?

267. The BEST way to check for good security programming practices, as well as auditing for possible backdoors, is to conduct

268. Which of the following BEST represents the principle of open design?

269. Which of the following is a characteristic of a challenge/response authentication process?

270. Which of the following wraps the decryption key of a full disk encryption implementation and ties the hard disk drive to a particular device?

271. A vulnerability test on an Information System (IS) is conducted to

272. Which of the following is a characteristic of convert security testing?

273. When building a data center, site location and construction factors that increase the level of vulnerability to physical threats include

274. Refer to the information below to answer the question.

A large, multinational organization has decided to outsource a portion of their Information Technology (IT) organization to a third-party provider’s facility. This provider will be responsible for the design, development, testing, and support of several critical, customer-based applications used by the organization.

The third party needs to have

275. Which of the following is MOST appropriate for protecting confidentially of data stored on a hard drive?

276. An organization discovers that its secure file transfer protocol (SFTP) server has been accessed by an unauthorized person to download an unreleased game. A recent security audit found weaknesses in some of the organization’s general information technology (IT) controls, specifically pertaining to software change control and security patch management, but not in other control areas.

Which of the following is the MOST probable attack vector used in the security breach?

277. What is the MOST significant benefit of an application upgrade that replaces randomly generated session keys with certificate based encryption for communications with backend servers?

278. Which of the following actions MUST be performed when using secure multipurpose internet mail Extension (S/MIME) before sending an encrypted message to a recipient?

279. Which of the following assures that rules are followed in an identity management architecture?