What is the formula used to determine risk?

HAL Systems recently decided to stop offering public NTP services
because of a fear that its NTP servers would be used in amplification
DDoS attacks. What type of risk management strategy did HAL
pursue with respect to its NTP services?

Susan is working with the management team in her company to
classify data in an attempt to apply extra security controls that will
limit the likelihood of a data breach. What principle of information
security is Susan trying to enforce?

Which one of the following components should be included in an
organization’s emergency response guidelines?

Who is the ideal person to approve an organization’s business
continuity plan?

Which of the following is not one of the European Union’s General
Data Protection Regulation (GDPR) principles?

Ben’s company, which is based in the European Union, hires a thirdparty
organization that processes data for it. Who has responsibility to
protect the privacy of the data and ensure that it isn’t used for
anything other than its intended purpose?

When a computer is removed from service and disposed of, the
process that ensures that all storage media has been removed or
destroyed is known as what?

Linux systems that use bcrypt are using a tool based on what DES
alternative encryption scheme?

Susan works in an organization that labels all removable media with
the classification level of the data it contains, including public data.
Why would Susan’s employer label all media instead of labeling only
the media that contains data that could cause harm if it was exposed?

Data stored in RAM is best characterized as what type of data?

Gordon is concerned about the possibility that hackers may be able
to use the Van Eck radiation phenomenon to remotely read the
contents of computer monitors in his facility. What technology
would protect against this type of attack?

Sherry conducted an inventory of the cryptographic technologies in
use within her organization and found the following algorithms
and protocols in use. Which one of these technologies should she
replace because it is no longer considered secure?

What action can you take to prevent accidental data disclosure due
to wear leveling on an SSD device before reusing the drive?

Tom is a cryptanalyst and is working on breaking a cryptographic
algorithm’s secret key. He has a copy of an intercepted message
that is encrypted, and he also has a copy of the decrypted version of
that message. He wants to use both the encrypted message and its
decrypted plaintext to retrieve the secret key for use in decrypting
other messages. What type of attack is Tom engaging in?

A hacker recently violated the integrity of data in James’s company
by modifying a file using a precise timing attack. The attacker
waited until James verified the integrity of a file’s contents using a
hash value and then modified the file between the time that James
verified the integrity and read the contents of the file. What type of
attack took place?

What standard governs the creation and validation of digital
certificates for use in a public key infrastructure?

What is the minimum fence height that makes a fence difficult to
climb easily, deterring most intruders?

Johnson Widgets strictly limits access to total sales volume
information, classifying it as a competitive secret. However,
shipping clerks have unrestricted access to order records to
facilitate transaction completion. A shipping clerk recently pulled
all of the individual sales records for a quarter and totaled them up
to determine the total sales volume. What type of attack occurred?

What physical security control broadcasts false emanations
constantly to mask the presence of true electromagnetic
emanations from computing equipment?

In a software as a service cloud computing environment, who is
normally responsible for ensuring that appropriate firewall
controls are in place to protect the application?

Data streams occur at what three layers of the OSI model?

Chris needs to design a firewall architecture that can support a DMZ, a
database, and a private internal network in a secure manner that
separates each function. What type of design should he use, and how
many firewalls does he need?

A new customer at a bank that uses fingerprint scanners to
authenticate its users is surprised when he scans his fingerprint and is
logged in to another customer’s account. What type of biometric factor
error occurred?

What type of access control is typically used by firewalls?

When you input a user ID and password, you are performing what
important identity and access management activity?

During a port scan using nmap, Joseph discovers that a system shows
two ports open that cause him immediate worry:
21/open
23/open
What services are likely running on those ports?

Saria’s team is working to persuade their management that their
network has extensive vulnerabilities that attackers could exploit. If
she wants to conduct a realistic attack as part of a penetration test,
what type of penetration test should she conduct?

What method is commonly used to assess how well software testing
covered the potential uses of an application?

Testing that is focused on functions that a system should not allow are
an example of what type of testing?

What type of monitoring uses simulated traffic to a website to monitor
performance?

Which of the following vulnerabilities is unlikely to be found by a web
vulnerability scanner?

Jim uses a tool that scans a system for available services and then
connects to them to collect banner information to determine what
version of the service is running. It then provides a report detailing
what it gathers, basing results on service fingerprinting, banner
information, and similar details it gathers combined with CVE
information. What type of tool is Jim using?

Mark is considering replacing his organization’s customer relationship
management (CRM) solution with a new product that is available in
the cloud. This new solution is completely managed by the vendor,
and Mark’s company will not have to write any code or manage any
physical resources. What type of cloud solution is Mark considering?

Which one of the following information sources is useful to security
administrators seeking a list of information security vulnerabilities in
applications, devices, and operating systems?

Which of the following would normally be considered an example of a
disaster when performing disaster recovery planning?
I. Hacking incident
II. Flood
III. Fire
IV. Terrorism

Glenda would like to conduct a disaster recovery test and is seeking a
test that will allow a review of the plan with no disruption to normal
information system activities and as minimal a commitment of time as
possible. What type of test should she choose?

Which one of the following is not an example of a backup tape rotation
scheme?

Victor created a database table that contains information on his
organization’s employees. The table contains the employee’s user ID,
three different telephone number fields (home, work, and mobile),
the employee’s office location, and the employee’s job title. There are
16 records in the table. What is the degree of this table?

Carrie is analyzing the application logs for her web-based application
and comes across the following string:
../../../../../../../../../etc/passwd
What type of attack was likely attempted against Carrie’s application?

When should a design review take place when following an SDLC
approach to software development?

Tracy is preparing to apply a patch to her organization’s enterprise
resource planning system. She is concerned that the patch may
introduce flaws that did not exist in prior versions, so she plans to
conduct a test that will compare previous responses to input with
those produced by the newly patched application. What type of
testing is Tracy planning?

What term is used to describe the level of confidence that software is
free from vulnerabilities, either intentionally designed into the
software or accidentally inserted at any time during its life cycle, and
that the software functions in the intended manner?