Quiz
Quix17 - 125Q
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (125)
1Jesse is looking at the /etc/passwd file on a system configured to use
shadowed passwords. What should she expect to see in the password
field of this file?- AA. Plaintext passwords
- BB. Encrypted passwords
- CC. Hashed passwords
- DD. x
2SYN floods rely on implementations of what protocol to cause denial
of service conditions?- AA. IGMP
- BB. UDP
- CC. TCP
- DD. ICMP
3What principle states that an individual should make every effort to
complete his or her responsibilities in an accurate and timely manner?- AA. Least privilege
- BB. Separation of duties
- CC. Due care
- DD. Due diligence
4Cable modems, ISDN, and DSL are all examples of what type of
technology?- AA. Baseband
- BB. Broadband
- CC. Digital
- DD. Broadcast
5What penetration testing technique can best help assess training and
awareness issues?- AA. Port scanning
- BB. Discovery
- CC. Social engineering
- DD. Vulnerability scanning
6Bill implemented RAID level 5 on a server that he operates using a
total of three disks. How many disks may fail without the loss of data?- AA. 0
- BB. 1
- CC. 2
- DD. 3
7Data is sent as bits at what layer of the OSI model?
- AA. Transport
- BB. Network
- CC. Data Link
- DD. Physical
8Bert is considering the use of an infrastructure as a service cloud
computing partner to provide virtual servers. Which one of the
following would be a vendor responsibility in this scenario?- AA. Maintaining the hypervisor
- BB. Managing operating system security settings
- CC. Maintaining the host firewall
- DD. Configuring server access control
9When Ben records data and then replays it against his test website to
verify how it performs based on a real production workload, what type
of performance monitoring is he undertaking?- AA. Passive
- BB. Proactive
- CC. Reactive
- DD. Replay
10What technology ensures that an operating system allocates separate
memory spaces used by each application on a system?- AA. Abstraction
- BB. Layering
- CC. Data hiding
- DD. Process isolation
11Alan is considering the use of new identification cards in his
organization that will be used for physical access control. He comes
across a sample card and is unsure of the technology. He breaks it
open and sees the following internal construction. What type of card is
this?
- AA. Smart card
- BB. Proximity card
- CC. Magnetic stripe
- DD. Phase-two card
12Mark is planning a disaster recovery test for his organization. He
would like to perform a live test of the disaster recovery facility but
does not want to disrupt operations at the primary facility. What type
of test should Mark choose?- AA. Full interruption test
- BB. Checklist review
- CC. Parallel test
- DD. Tabletop exercise
13Which one of the following is not a principle of the Agile approach to
software development?- AA. The best architecture, requirements, and designs emerge from self-organizing teams.
- BB. Deliver working software infrequently, with an emphasis on creating accurate code over longer timelines.
- CC. Welcome changing requirements, even late in the development process.
- DD. Simplicity is essential.
14During a security audit, Susan discovers that the organization is using
hand geometry scanners as the access control mechanism for their
secure data center. What recommendation should Susan make about
the use of hand geometry scanners?- AA. They have a high FRR and should be replaced.
- BB. A second factor should be added because they are not a good way to reliably distinguish individuals.
- CC. The hand geometry scanners provide appropriate security for the data center and should be considered for other high-security areas.
- DD. They may create accessibility concerns, and an alternate biometric system should be considered.
15Colleen is conducting a business impact assessment for her
organization. What metric provides important information about the
amount of time that the organization may be without a service before
causing irreparable harm?- AA. MTD
- BB. ALE
- CC. RPO
- DD. RTO
16An attack that changes a symlink on a Linux system between the time
that an account’s rights to the file are verified and the file is accessed is
an example of what type of attack?- AA. Unlinking
- BB. Tick/tock
- CC. setuid
- DD. TOCTOU
17An authentication factor that is “something you have,” and that
typically includes a microprocessor and one or more certificates, is
what type of authenticator?- AA. A smart card
- BB. A token
- CC. A Type I validator
- DD. A Type III authenticator
18What term best describes an attack that relies on stolen or falsified
authentication credentials to bypass an authentication mechanism?- AA. Spoofing
- BB. Replay
- CC. Masquerading
- DD. Modification
19Lisa wants to integrate with a cloud identity provider that uses OAuth
2.0, and she wants to select an appropriate authentication framework.
Which of the following best suits her needs?- AA. OpenID Connect
- BB. SAML
- CC. RADIUS
- DD. Kerberos
20Owen recently designed a security access control structure that
prevents a single user from simultaneously holding the role required
to create a new vendor and the role required to issue a check. What
principle is Owen enforcing?- AA. Two-person control
- BB. Least privilege
- CC. Separation of duties
- DD. Job rotation
21Denise is preparing for a trial relating to a contract dispute between
her company and a software vendor. The vendor is claiming that
Denise made a verbal agreement that amended their written contract.
What rule of evidence should Denise raise in her defense?- AA. Real evidence rule
- BB. Best evidence rule
- CC. Parol evidence rule
- DD. Testimonial evidence rule
22While Lauren is monitoring traffic on two ends of a network
connection, she sees traffic that is inbound to a public IP address show
up inside the production network bound for an internal host that uses
an RFC 1918 reserved address. What technology should she expect is
in use at the network border?- AA. NAT
- BB. VLANs
- CC. S/NAT
- DD. BGP
23Which of the following statements about SSAE-18 is not true?
- AA. It mandates a specific control set.
- BB. It is an attestation standard.
- CC. It is used for external audits.
- DD. It uses a framework, including SOC 1, SOC 2, and SOC 3 reports.
24What does a constrained user interface do?
- AA. It prevents unauthorized users from logging in.
- BB. It limits the data visible in an interface based on the content.
- CC. It limits the access a user is provided based on what activity they are performing.
- DD. It limits what users can do or see based on privileges.
25Greg is building a disaster recovery plan for his organization and
would like to determine the amount of time that it should take to
restore a particular IT service after an outage. What variable is Greg
calculating?- AA. MTD
- BB. RTO
- CC. RPO
- DD. SLA
26What business process typically requires sign-off from a manager
before modifications are made to a system?- AA. SDN
- BB. Release management
- CC. Change management
- DD. Versioning
27What type of fire extinguisher is useful against liquid-based fires?
- AA. Class A
- BB. Class B
- CC. Class C
- DD. Class D
28The company Chris works for has notifications posted at each door
reminding employees to be careful to not allow people to enter when
they do. Which type of controls best describes this?- AA. Detective
- BB. Physical
- CC. Preventive
- DD. Directive
29Which one of the following principles is not included in the seven EUU.
S. Privacy Shield provisions?- AA. Access
- BB. Security
- CC. Recourse
- DD. Nonrepudiation
30What group is eligible to receive safe harbor protection under the
terms of the Digital Millennium Copyright Act (DMCA)?- AA. Music producers
- BB. Book publishers
- CC. Internet service providers
- DD. Banks
31Alex is the system owner for the HR system at a major university.
According to NIST SP 800-18, what action should he take when a
significant change occurs in the system?- AA. He should develop a data confidentiality plan.
- BB. He should update the system security plan.
- CC. He should classify the data the system contains.
- DD. He should select custodians to handle day-to-day operational tasks.
32Alex has been with the university he works at for over 10 years.
During that time, he has been a system administrator and a
database administrator, and he has worked in the university’s help
desk. He is now a manager for the team that runs the university’s
web applications. Using the provisioning diagram shown here,
answer the following questions.
If Alex hires a new employee and the employee’s account is
provisioned after HR manually inputs information into the
provisioning system based on data Alex provides via a series of forms,
what type of provisioning has occurred?
- AA. Discretionary account provisioning
- BB. Workflow-based account provisioning
- CC. Automated account provisioning
- DD. Self-service account provisioning
33Alex has been with the university he works at for over 10 years.
During that time, he has been a system administrator and a
database administrator, and he has worked in the university’s help
desk. He is now a manager for the team that runs the university’s
web applications. Using the provisioning diagram shown here,
answer the following questions.
Alex has access to B, C, and D. What concern should he raise to the
university’s identity management team?- AA. The provisioning process did not give him the rights he needs.
- BB. He has excessive privileges.
- CC. Privilege creep may be taking place.
- DD. Logging is not properly enabled.
34Alex has been with the university he works at for over 10 years.
During that time, he has been a system administrator and a
database administrator, and he has worked in the university’s help
desk. He is now a manager for the team that runs the university’s
web applications. Using the provisioning diagram shown here,
answer the following questions.
When Alex changes roles, what should occur?- AA. He should be de-provisioned and a new account should be created.
- BB. He should have his new rights added to his existing account.
- CC. He should be provisioned for only the rights that match his role.
- DD. He should have his rights set to match those of the person he is replacing.
35Robert is reviewing a system that has been assigned the EAL2
evaluation assurance level under the Common Criteria. What is the
highest level of assurance that he may have about the system?- AA. It has been functionally tested.
- BB. It has been structurally tested.
- CC. It has been formally verified, designed, and tested.
- DD. It has been semiformally designed and tested.
36Adam is processing an access request for an end user. What two items
should he verify before granting the access?- AA. Separation and need to know
- BB. Clearance and endorsement
- CC. Clearance and need to know
- DD. Second factor and clearance
37During what phase of the electronic discovery reference model does an
organization ensure that potentially discoverable information is
protected against alteration or deletion?- AA. Identification
- BB. Preservation
- CC. Collection
- DD. Processing
38Nessus, OpenVAS, and SAINT are all examples of what type of tool?
- AA. Port scanners
- BB. Patch management suites
- CC. Port mappers
- DD. Vulnerability scanners
39Harry would like to access a document owned by Sally stored on a file
server. Applying the subject/object model to this scenario, who or
what is the object of the resource request?- AA. Harry
- BB. Sally
- CC. File server
- DD. Document
40What is the process that occurs when the Session layer removes the
header from data sent by the Transport layer?- AA. Encapsulation
- BB. Packet unwrapping
- CC. De-encapsulation
- DD. Payloading
41Which of the following tools is best suited to testing known exploits
against a system?- AA. Nikto
- BB. Ettercap
- CC. Metasploit
- DD. THC Hydra
42What markup language uses the concepts of a Requesting Authority, a
Provisioning Service Point, and a Provisioning Service Target to
handle its core functionality?- AA. SAML
- BB. SAMPL
- CC. SPML
- DD. XACML
43What type of risk assessment uses tools such as the one shown here?
- AA. Quantitative
- BB. Loss expectancy
- CC. Financial
- DD. Qualitative
44MAC models use three types of environments. Which of the following
is not a mandatory access control design?- AA. Hierarchical
- BB. Bracketed
- CC. Compartmentalized
- DD. Hybrid
45What level of RAID is also called disk striping with parity?
- AA. RAID 0
- BB. RAID 1
- CC. RAID 5
- DD. RAID 10
46Sally is wiring a gigabit Ethernet network. What cabling choices
should she make to ensure she can use her network at the full 1000
Mbps she wants to provide to her users?- AA. Cat 5 and Cat 6
- BB. Cat 5e and Cat 6
- CC. Cat 4e and Cat 5e
- DD. Cat 6 and Cat 7
47Which one of the following is typically considered a business
continuity task?- AA. Business impact assessment
- BB. Alternate facility selection
- CC. Activation of cold sites
- DD. Restoration of data from backup
48Robert is the network administrator for a small business and recently
installed a new firewall. After seeing signs of unusually heavy network
traffic, he checked his intrusion detection system, which reported that
a smurf attack was under way. What firewall configuration change can
Robert make to most effectively prevent this attack?- AA. Block the source IP address of the attack.
- BB. Block inbound UDP traffic.
- CC. Block the destination IP address of the attack.
- DD. Block inbound ICMP traffic.
49Which one of the following types of firewalls does not have the ability
to track connection status between different packets?- AA. Stateful inspection
- BB. Application proxy
- CC. Packet filter
- DD. Next generation
50Which of the following is used only to encrypt data in transit over a
network and cannot be used to encrypt data at rest?- AA. TKIP
- BB. AES
- CC. 3DES
- DD. RSA
51What type of fuzzing is known as intelligent fuzzing?
- AA. Zzuf
- BB. Mutation
- CC. Generational
- DD. Code based
52Matthew is experiencing issues with the quality of network service on
his organization’s network. The primary symptom is that packets are
occasionally taking too long to travel from their source to their
destination. The length of this delay changes for individual packets.
What term describes the issue Matthew is facing?- AA. Latency
- BB. Jitter
- CC. Packet loss
- DD. Interference
53Which of the following multifactor authentication technologies
provides both low management overhead and flexibility?- AA. Biometrics
- BB. Software tokens
- CC. Synchronous hardware tokens
- DD. Asynchronous hardware tokens
54What type of testing would validate support for all the web browsers
that are supported by a web application?- AA. Regression testing
- BB. Interface testing
- CC. Fuzzing
- DD. White box testing
55Kathleen is implementing an access control system for her
organization and builds the following array:
Reviewers: update files, delete files
Submitters: upload files
Editors: upload files, update files
Archivists: delete files
What type of access control system has Kathleen implemented?- AA. Role-based access control
- BB. Task-based access control
- CC. Rule-based access control
- DD. Discretionary access control
56Alan is installing a fire suppression system that will kick in after a fire
breaks out and protect the equipment in the data center from
extensive damage. What metric is Alan attempting to lower?- AA. Likelihood
- BB. RTO
- CC. RPO
- DD. Impact
57Alan’s Wrenches recently developed a new manufacturing process for
its product. They plan to use this technology internally and not share it
with others. They would like it to remain protected for as long as
possible. What type of intellectual property protection is best suited
for this situation?- AA. Patent
- BB. Copyright
- CC. Trademark
- DD. Trade secret
58Ben wants to interface with the National Vulnerability Database using
a standardized protocol. What option should he use to ensure that the
tools he builds work with the data contained in the NVD?- AA. XACML
- BB. SCML
- CC. VSML
- DD. SCAP
59Which of the following is not one of the three components of the
DevOps model?- AA. Software development
- BB. Change management
- CC. Quality assurance
- DD. Operations
60In the figure shown here, Harry’s request to read the data file is
blocked. Harry has a Secret security clearance, and the data file has a
Top Secret classification. What principle of the Bell-LaPadula model
blocked this request?
- AA. Simple Security Property
- BB. Simple Integrity Property
- CC. *-Security Property
- DD. Discretionary Security Property
61Norm is starting a new software project with a vendor that uses an
SDLC approach to development. When he arrives on the job, he
receives a document that has the sections shown here. What type of
planning document is this?
- AA. Functional requirements
- BB. Work breakdown structure
- CC. Test analysis report
- DD. Project plan
62Kolin is searching for a network security solution that will allow him to
help reduce zero-day attacks while using identities to enforce a
security policy on systems before they connect to the network. What
type of solution should Kolin implement?- AA. A firewall
- BB. A NAC system
- CC. An intrusion detection system
- DD. Port security
63Gwen comes across an application that is running under a service
account on a web server. The service account has full administrative
rights to the server. What principle of information security does this
violate?- AA. Need to know
- BB. Separation of duties
- CC. Least privilege
- DD. Job rotation
64Which of the following is not a type of structural coverage in a code
review process?- AA. Statement
- BB. Trace
- CC. Loop
- DD. Data flow
65Which of the following tools is best suited to the information gathering
phase of a penetration test?- AA. Whois
- BB. zzuf
- CC. Nessus
- DD. Metasploit
66During a web application vulnerability scanning test, Steve runs
Nikto against a web server he believes may be vulnerable to
attacks. Using the Nikto output shown here, answer the following
questions.
Why does Nikto flag the /test directory?
- AA. The /test directory allows administrative access to PHP.
- BB. It is used to store sensitive data.
- CC. Test directories often contain scripts that can be misused.
- DD. It indicates a potential compromise.
67During a web application vulnerability scanning test, Steve runs
Nikto against a web server he believes may be vulnerable to
attacks. Using the Nikto output shown here, answer the following
questions.
Why does Nikto identify directory indexing as an issue?- AA. It lists files in a directory.
- BB. It may allow for XDRF.
- CC. Directory indexing can result in a denial of service attack.
- DD. Directory indexing is off by default, potentially indicating
compromise.
68During a web application vulnerability scanning test, Steve runs
Nikto against a web server he believes may be vulnerable to
attacks. Using the Nikto output shown here, answer the following
questions.
Nikto lists OSVDB-877, noting that the system may be vulnerable to
XST. What would this type of attack allow an attacker to do?- AA. Use cross-site targeting.
- BB. Steal a user’s cookies.
- CC. Counter SQL tracing.
- DD. Modify a user’s TRACE information.
69Which one of the following memory types is considered volatile
memory?- AA. Flash
- BB. EEPROM
- CC. EPROM
- DD. RAM
70Ursula believes that many individuals in her organization are storing
sensitive information on their laptops in a manner that is unsafe and
potentially violates the organization’s security policy. What control
can she use to identify the presence of these files?- AA. Network DLP
- BB. Network IPS
- CC. Endpoint DLP
- DD. Endpoint IPS
71In what cloud computing model does the customer build a cloud
computing environment in his or her own data center or build an
environment in another data center that is for the customer’s exclusive
use?- AA. Public cloud
- BB. Private cloud
- CC. Hybrid cloud
- DD. Shared cloud
72Which one of the following technologies is designed to prevent a web
server going offline from becoming a single point of failure in a web
application architecture?- AA. Load balancing
- BB. Dual-power supplies
- CC. IPS
- DD. RAID
73Alice wants to send Bob a message with the confidence that Bob will
know the message was not altered while in transit. What goal of
cryptography is Alice trying to achieve?- AA. Confidentiality
- BB. Nonrepudiation
- CC. Authentication
- DD. Integrity
74What network topology is shown here?
- AA. A ring
- BB. A bus
- CC. A star
- DD. A mesh
75Monica is developing a software application that calculates an
individual’s body mass index for use in medical planning. She would
like to include a control on the field where the physician enters an
individual’s weight to ensure that the weight falls within an expected
range. What type of control should Monica use?- AA. Fail open
- BB. Fail secure
- CC. Limit check
- DD. Buffer bounds
76Your lab manager is preparing to buy all the equipment that has been budgeted for next year. While reviewing the
specifications for several pieces of equipment, he notices that each device has a Mean Time To Repair (MTTR) rating. He
asks you what this means. Which of the following is the best response?- A○ A. The MTTR is used to determine the expected time before the repair can be completed. Higher numbers are better.
- B○ B. The MTTR is used to determine the expected time before the repair can be completed. Lower numbers are better.
- C○ C. The MTTR is used to determine the expected time between failures. Higher numbers are better.
- D○ D. The MTTR is used to determine the expected time between failures. Lower numbers are better.
77Which of the following would you be least likely to find in a data center?
- A○ A. Dry pipe fire control
- B○ B. Smoke detectors
- C○ C. Drop ceilings
- D○ D. Surge protection
78You are asked to serve as a consultant on the design of a new facility. Which of the following is the best location for the
server room?- A○ A. Near the outside of the building
- B○ B. Near the center of the building
- C○ C. In an area that has plenty of traffic so that equipment can be observed by other employees and guests
- D○ D. In an area that offers easy access
79Which of the following is not one of the three types of access controls?
- A○ A. Administrative
- B○ B. Personnel
- C○ C. Technical
- D○ D. Physical
80Your company has just opened a call center in India to handle nighttime operations, and you are asked to review the site’s
security controls. Specifically, you are asked which of the following is the strongest form of authentication. What will your
answer be?- A○ A. Something you know
- B○ B. Something you are
- C○ C. Passwords
- D○ D. Tokens
81Your organization has become worried about recent attempts to gain unauthorized access to the R&D facility. Therefore,
you are asked to implement a system that will require individuals to present a password and enter a PIN at the security gate
before gaining access. What is this type of system called?- A○ A. Authorization
- B○ B. Two-factor authentication
- C○ C. Authentication
- D○ D. Three-factor authentication
82Which of the following ciphers is/are symmetric?
- A○ A. DES
- B○ B. DES and Skytale
- C○ C. DES, Skytale, and Caesar’s cipher
- D○ D. DES, Skytale, Caesar’s cipher, and RSA
83An employee is leaving your company. You debrief the individual and escort him to the door. After reviewing the materials in
his office, you realize he left with the VPN router that had been configured for him to use when he worked from home. This
router had a certificate issued to that employee, and it is not deemed worth the effort to retrieve it. What action should be
taken in regards to the certificate?- A○ A. Suspend it.
- B○ B. Destroy it.
- C○ C. Revoke it.
- D○ D. Transfer it.
84Which algorithm provides for key distribution but does not provide encryption or nonrepudiation?
- A○ A. Diffie-Hellman
- B○ B. ElGamal
- C○ C. RSA
- D○ D. Elliptic Curve Cryptosystem (ECC)
85TCSEC provides levels of security that are classified in a hierarchical manner. Each level has a corresponding set of security
requirements that must be met. Which of the following does Level A correspond to?- A○ A. Mandatory protection
- B○ B. Required protection
- C○ C. Verified protection
- D○ D. Validated protection
86TCSEC offers numbered divisions of security that can occur in each category. With this in mind, which of the following
represents the highest level of security?- A○ A. B2
- B○ B. D2
- C○ C. B1
- D○ D. D1
87Jim has been asked to assist with a security evaluation. He has heard other members of the teams speak of TCB. What does
TCB stand for?- A○ A. Taking care of business
- B○ B. Total computer base
- C○ C. Trusted computer base
- D○ D. Total communication bandwidth
88Which of the following is considered a connection-oriented protocol?
- A○ A. UDP
- B○ B. TCP
- C○ C. ICMP
- D○ D. ARP
89Which connectionless protocol is used for its low overhead and speed?
- A○ A. UDP
- B○ B. TCP
- C○ C. ICMP
- D○ D. ARP
90Information security is not built on which of the following?
- A○ A. Confidentiality
- B○ B. Availability
- C○ C. Accessibility
- D○ D. Integrity
91Place the following four elements of the Business Continuity Plan in the proper order.
- A○ A. Scope and plan initiation, plan approval and implementation, business impact assessment, business continuity plan development
- BB. Scope and plan initiation, business impact assessment, business continuity plan development, plan approval and
implementation - C○ C. Business impact assessment, scope and plan initiation, business continuity plan development, plan approval and implementation
- D○ D. Plan approval and implementation, business impact assessment, scope and plan initiation, business continuity plan development
92Risk assessment is a critical component of the BCP process. As such, which risk-assessment method is scenario-driven and
does not assign numeric values to specific assets?- A○ A. Qualitative Risk Assessment
- B○ B. Statistical Weighted Risk Assessment
- C○ C. Quantitative Risk Assessment
- D○ D. Asset-Based Risk Assessment
93Which of the following best describes the concept and purpose of BCP?
- A○ A. BCPs are used to reduce outage times.
- B○ B. BCPs and procedures are put in place for the response to an emergency.
- C○ C. BCPs guarantee the reliability of standby systems.
- D○ D. BCPs are created to prevent interruptions to normal business activity.
94What is not one of the three things that are needed to commit a computer crime?
- A○ A. Means
- B○ B. Skill
- C○ C. Motive
- D○ D. Opportunity
95The IAB (Internet Architecture Board) considers which of the following acts unethical?
- A○ A. Disrupting the intended use of the Internet
- B○ B. Rerouting Internet traffic
- C○ C. Writing articles about security exploits
- D○ D. Developing security patches
96What category of attack is characterized by the removal of small amounts of money over long periods of time?
- A○ A. Slicing attack
- B○ B. Skimming attack
- C○ C. Bologna attack
- D○ D. Salami attack
97Which of the following is not a valid database management system model?
- A○ A. The hierarchical database management system
- B○ B. The structured database management system
- C○ C. The network database management system
- D○ D. The relational database management system
98During which stage of the software development life cycle should security be implemented?
- A○ A. Development
- B○ B. Project initiation
- C○ C. Deployment
- D○ D. Installation
99In which software development life cycle phase do the programmers and developers become deeply involved and do the
majority of the work?- A○ A. System Design Specifications
- B○ B. Software Development
- C○ C. Operation and Maintenance
- D○ D. Functional Design Analysis and Planning
100You have just won a contract for a small software development firm, which has asked you to perform a risk analysis. The
firm provided you information on previous incidents and has a list of the known environmental threats of the geographic area.
The firm’s president believes that risk is something that can be eliminated. As a CISSP, how should you respond to this
statement?- A○ A. Although it can be prohibitively expensive, risk can be eliminated.
- B○ B. Risk can be reduced but cannot be eliminated.
- C○ C. A qualitative risk analysis can eliminate risk.
- D○ D. A quantitative risk assessment can eliminate risk.
101Which term describes the method of identifying vulnerabilities and threats and assessing the possible damage to determine
where to implement security safeguards?- A○ A. Information management
- B○ B. Risk analysis
- C○ C. Countermeasure selection
- D○ D. Classification controls
102Proper security management dictates separation of duties for all the following reasons except which one?
- A○ A. It reduces the possibility of fraud.
- B○ B. It reduces dependency on individual workers.
- C○ C. It reduces the need for personnel.
- D○ D. It provides integrity.
103Attackers are always looking for ways to identify systems. One such method is to send a TCP SYN to a targeted port.
What would an attacker expect to receive in response to indicate an open port?- A○ A. SYN
- B○ B. SYN ACK
- C○ C. ACK
- D○ D. ACK FIN
104Which of the following is an example of a directive control?
- A○ A. Policies
- B○ B. Data validation
- C○ C. Job rotation
- D○ D. Fault-tolerant systems
105Brad uses Telnet to connect to several open ports on a victim computer and capture the banner information. What is the
purpose of his activity?- A○ A. Scanning
- B○ B. Fingerprinting
- C○ C. Attempting a DoS
- D○ D. Privilege escalation
106A closed-circuit TV (CCTV) system has been installed to monitor a bank’s ATM. The lighting has been adjusted to prevent
dark areas, and the depth of field and degree of focus are appropriate for proper monitoring. However, the guard has asked
if it would be possible to provide greater width to the area being monitored to permit a subject to be captured for a longer
stretch of time. Which adjustment is needed?- A○ A. Decrease the focal length
- B○ B. Increase the focal length
- C○ C. Decrease the iris
- D○ D. Increase the iris
107When you’re choosing the physical location for a new facility, which of the following should you not avoid?
- A○ A. Airport flight paths
- B○ B. Chemical refineries
- C○ C. Railway freight lines
- D○ D. Hospitals
108Which of the following is not one of the three primary types of authentication?
- A○ A. Something you remember
- B○ B. Something you know
- C○ C. Something you are
- D○ D. Something you have
109While working as a contractor for Widget, Inc., you are asked what the weakest form of authentication is. What will you
say?- A○ A. Passwords
- B○ B. Retina scans
- C○ C. Facial recognition
- D○ D. Tokens
110A coworker reports that she has lost her public key ring. What does this mean?
- A○ A. This is a security violation. You need to revoke her digital certificate.
- B○ B. She can regenerate it.
- C○ C. She will be unable to decrypt her stored files.
- D○ D. The PKI is gone.
111What is the risk to an organization when a cryptosystem fails to use the full keyspace available?
- A○ A. Keys are too short.
- B○ B. Keys cause a collision.
- C○ C. Keys are clustered.
- D○ D. Keys repeat.
112Which of the following is not one of the valid states in which a CPU can operate?
- A○ A. Processor
- B○ B. Supervisor
- C○ C. Problem
- D○ D. Wait
113Which organization began developing the Common Criteria standard in 1990?
- A○ A. IEEE
- B○ B. ISC2
- C○ C. ISO
- D○ D. NIST
114Which data communications solution transmits timing information to the receiver by using a “preamble” of alternating 1s and
0s?- A○ A. Modem communication
- B○ B. Ethernet communication
- C○ C. Instant messaging
- D○ D. Serial communication
115LAN data transmissions can take on several different forms. Which of the following can be both a source and a destination
address?- A○ A. Unicast
- B○ B. Multicast
- C○ C. Broadcast
- D○ D. Anycast
116What are the three goals of a business impact analysis?
- A○ A. Downtime estimation, resource requirements, defining the continuity strategy
- B○ B. Defining the continuity strategy, criticality prioritization, resource requirements
- C○ C. Criticality prioritization, downtime estimation, documenting the continuity strategy
- D○ D. Criticality prioritization, downtime estimation, resource requirements
117Which of the following is the number-one priority for all Business Continuity Plans (BCPs) and Disaster Recovery Plans
(DRPs)?- A○ A. The reduction of potential critical outages
- B○ B. The minimization of potential outages
- C○ C. The elimination of potential outages
- D○ D. The protection and welfare of employees
118You are assigned to a team that is investigating a computer crime. You are asked to make sure that the original data remains
unchanged. Which of the following programs can be used to create a cryptographic checksum to verify the data’s integrity?- A○ A. PKZip
- B○ B. MD5sum
- C○ C. DES
- D○ D. PGP
119Paul is concerned about the proper disposal of old hard drives that contain propriety information. Which of the following
techniques ensures that the data cannot be recovered?- A○ A. Formatting
- B○ B. FDISK
- C○ C. Drive wiping
- D○ D. Data parsing
120In the software development life cycle, what is used to maintain changes to development or production?
- A○ A. Certification
- B○ B. Audit control team
- C○ C. Manufacturing review board
- D○ D. Change control
121What is the most-used type of database management system?
- A○ A. The hierarchical database management system
- B○ B. The structured database management system
- C○ C. The network database management system
- D○ D. The relational database management system
122As a potential CISSP, you need to know common RFCs and NIST standards. One such RFC is 2196. This IETF
document provides basic guidance on security in a networked environment. What is the title of this document?- A○ A. “Ethics and the Internet”
- B○ B. “Site Security Handbook”
- C○ C. “Cracking and Hacking TCP/IP”
- D○ D. “Security Policies and Procedures”
123Mr. Hunting, your former college math teacher, hears that you are studying for your CISSP exam and asks if you know the
formula for total risk. What is the correct response?- A○ A. Annual Loss Expectancy * Vulnerability = Total Risk
- B○ B. Threat * Vulnerability * Asset Value = Total Risk
- C○ C. Residual Risk / Asset Value * Vulnerability = Total Risk
- D○ D. Asset Value / Residual Risk = Total Risk
124An access-control matrix can be used to associate permissions of a subject to an object. Permissions can be tied to a lattice
of control. If the lattice of control for Cindy and Bob is read and read/write, which of the following is true?
- A○ A. Bob will be able to read File X.
- B○ B. Bob has full control of File X.
- C○ C. Bob cannot access File X.
- D○ D. Alice has full access on File Y.
125The attacker waits until his victim establishes a connection to the organization’s FTP server. Then, he executes a program
that allows him to take over the established session. What type of attack has taken place?- A○ A. Password attack
- B○ B. Spoofing
- C○ C. Session hijack
- D○ D. ARP redirection
Information
- Description
- Good Luck!
- Author
- Requiemdust Sheena
- Language
- English
- Views
- 113
- Tags
- Rating
- 3.0 out of 5 · 1 rating Rate this quiz