Fichas
Sin título
Fichas del conjunto (10)
- 1Which of the following encryption methodologies should be implemented in an environment where all users need access to bulk storage, but not all users have authorized access to each individual database entry? A. Row-level encryption B. Block-level encryption C. File-level encryption D. Table-level encryption E. Full disk encryptionA
- 2A security bulletin describes a vulnerability in a common blogging platform due to XML HTTP Request (XHR) processing of state information. Which of the following technologies would this be a part of? A. JavaScript B. CSS C. AJAX D. XML DOMB
- 3An organization is developing a new web application that can provide the ability for customers to retrieve fast quotes on products and services. After going live with the web application, the organization is seeing system outages and delays in presenting quotes to customers. Further investigation reveals the logs are seeing SQL queries with $username = '1' or '1' = '1' that give results. Which of the following could prevent this query from being successful? A. Ad hoc queries B. ACLs C. Stored procedures D. Web content filtering E. DLP solutionC
- 4An information systems manager has been asked to manage the consolidation of two merging companies' IT infrastructures. As part of the project the manager will need to evaluate the impact of regulatory requirements relating to storage of data in datacenters.Which of the following is a regulatory consideration the manager should evaluate? A. Encryption of data in transit B. Compatibility of datacenter providers C. Outsourcing of security operations and auditing D. Geographical location of datacentersD
- 5An online gaming company receives two DoS attacks per year. Losses are estimated to be $200,000 per incident. Executives have decided to invest $75,000 annually in performance and security services, which reduced the annual loss by 30 percent. Which of the following is the return on investment? A. $45,000 B. $75,000 C. $120,000 D. $280,000 E. $355,000A
- 6A company is evaluating an investment of $1.5 million in IT infrastructure upgrades. The upgrades will take three years to be fully implemented but will be 80% implemented within 60 days. The remaining upgrades will be completed on an evenly distributed schedule. The board of directors is only willing to make the infrastructure investment if the cost of the upgrades can be recouped within 12 months. It is estimated that for every 10% of the infrastructure that is upgraded, an additional $200,000 in profit will be realized. Which of the following describes the length of time it will take for the investment to be fully paid for? A. Less than two months B. Between two and three months C. Between nine and 12 months D. After 12 monthsA
- 7A security architect has the following requirements for a system: 1. Must be developed with an object-oriented programming language 2. Must encrypt data at rest 3. Must comply with corporate PII policies 4. Must support multi-factor authentication 5. Should be built on a trusted OS Which of the following contractual documents is the correct place to list these requirements when initially surveying the vendor space? A. RFC B. RFT C. RFQ D. RFPB
- 8A company is deploying smartphones for the mobile workforce. The devices will be used for personal and business use, but are owned by the organization. Sales personnel will save new customer data via a custom application developed by the company. This information will integrate with the phones' contact information application storage and populate new records into it. The custom application's data is encrypted at rest and the connection to the back office is considered secure. The Chief Information Security Officer (CISO) has concerns that the customer contact information might accidentally leak due to the devices' limited security capabilities and controls planned. What is the MOST effective security control to implement to lower the risk? A. Implement a mobile data loss agent on the devices to prevent any user manipulation with the contact information B. Restrict screen capture features on the device when using the custom application and the contact information C. Restrict contact information storage dataflow so that it is only shared with the custom application D. Require complex pC
- 9A vulnerability scanner report shows that a client-server host monitoring solution operating in the credit card corporate environment is managing SSL sessions with a weak algorithm which does not meet corporate policy. Which of the following are true statements? (Select TWO). A. The X509 V3 certificate was issued by a non trusted public CA. B. The client-server handshake could not negotiate strong ciphers C. The client-server handshake is configured with a wrong priority. D. The client-server handshake is based on TLS authentication. E. The X509 V3 certificate is expired. F. The client-server implements client-server mutual authentication with different certificates.BC
- 10—
Información
- Descripción
- Fichas sobre Sin título, creado por Gary Clinton el 07/09/2017.
- Creado por
- Gary Clinton
- Visitas
- 1
- Valoración