Test
Quix3 - 50Q
Preguntas del test (50)
1Which one of the following actions is not normally part of the project
scope and planning phase of business continuity planning?- AA. Structured analysis of the organization
- BB. Review of the legal and regulatory landscape
- CC. Creation of a BCP team
- DD. Documentation of the plan
2Gary is implementing a new website architecture that uses multiple
small web servers behind a load balancer. What principle of
information security is Gary seeking to enforce?- AA. Denial
- BB. Confidentiality
- CC. Integrity
- DD. Availability
3Becka recently signed a contract with an alternate data processing
facility that will provide her company with space in the event of a
disaster. The facility includes HVAC, power, and communications
circuits but no hardware. What type of facility is Becka using?- AA. Cold site
- BB. Warm site
- CC. Hot site
- DD. Mobile site
4Ben is seeking a control objective framework that is widely accepted
around the world and focuses specifically on information security
controls. Which one of the following frameworks would best meet his
needs?- AA. ITIL
- BB. ISO 27002
- CC. CMM
- DD. PMBOK Guide
5Which one of the following agreements typically requires that a
vendor not disclose confidential information learned during the scope
of an engagement?- AA. NCA
- BB. SLA
- CC. NDA
- DD. RTO
6What issue is the validation portion of the NIST SP 800-88 sample
certificate of sanitization (shown here) intended to help prevent?
- AA. Destruction
- BB. Reuse
- CC. Data remanence
- DD. Attribution
7Why is declassification rarely chosen as an option for media reuse?
- AA. Purging is sufficient for sensitive data.
- BB. Sanitization is the preferred method of data removal.
- CC. It is more expensive than new media and may still fail.
- DD. Clearing is required first.
8Incineration, crushing, shredding, and disintegration all describe what
stage in the lifecycle of media?- AA. Sanitization
- BB. Degaussing
- CC. Purging
- DD. Destruction
9The European Union (EU) General Data Protection Regulation
(GDPR) does not include which of the following key elements?- AA. The need to collect information for specified, explicit, and
legitimate purposes - BB. The need to ensure that collection is limited to the information
necessary to achieve the stated purpose - CC. The need to protect data against accidental destruction
- DD. The need to encrypt information at rest
- AA. The need to collect information for specified, explicit, and
10Why might an organization use unique screen backgrounds or designs
on workstations that deal with data of different classification levels?- AA. To indicate the software version in use
- BB. To promote a corporate message
- CC. To promote availability
- DD. To indicate the classification level of the data or system
11Alice has read permissions on an object, and she would like Bob to
have those same rights. Which one of the rules in the Take-Grant
protection model would allow her to complete this operation?- AA. Create rule
- BB. Remove rule
- CC. Grant rule
- DD. Take rule
12As part of his incident response process, Charles securely wipes the
drive of a compromised machine and reinstalls the operating
system (OS) from original media. Once he is done, he patches the
machine fully and applies his organization’s security templates
before reconnecting the system to the network. Almost
immediately after the system is returned to service, he discovers
that it has reconnected to the same botnet it was part of before.
Where should Charles look for the malware that is causing this
behavior?- AA. The operating system partition
- BB. The system BIOS or firmware
- CC. The system memory
- DD. The installation media
13Which one of the following computing models allows the execution
of multiple concurrent tasks within a single process?- AA. Multitasking
- BB. Multiprocessing
- CC. Multiprogramming
- DD. Multithreading
14Alan intercepts an encrypted message and wants to determine
what type of algorithm was used to create the message. He first
performs a frequency analysis and notes that the frequency of
letters in the message closely matches the distribution of letters in
the English language. What type of cipher was most likely used to
create this message?- AA. Substitution cipher
- BB. AES
- CC. Transposition cipher
- DD. 3DES
15Lauren’s networking team has been asked to identify a technology that
will allow them to dynamically change the organization’s network by
treating the network like code. What type of architecture should she
recommend?- AA. A network that follows the 5-4-3 rule
- BB. A converged network
- CC. A software-defined network
- DD. A hypervisor-based network
16Cable modems, ISDN, and DSL are all examples of what type of
technology?- AA. Baseband
- BB. Broadband
- CC. Digital
- DD. Broadcast
17What type of firewall design is shown in the following image?
- AA. Single tier
- BB. Two tier
- CC. Three tier
- DD. Next generation
18During a review of her organization’s network, Angela discovered that
it was suffering from broadcast storms and that contractors, guests,
and organizational administrative staff were on the same network
segment. What design change should Angela recommend?- AA. Require encryption for all users.
- BB. Install a firewall at the network border.
- CC. Enable spanning tree loop detection.
- DD. Segment the network based on functional requirements.
19ICMP, RIP, and network address translation all occur at what layer of
the OSI model?- AA. Layer 1
- BB. Layer 2
- CC. Layer 3
- DD. Layer 4
20Kathleen works for a data center hosting facility that provides physical
data center space for individuals and organizations. Until recently,
each client was given a magnetic-strip-based keycard to access the
section of the facility where their servers are located, and they were
also given a key to access the cage or rack where their servers reside.
In the past month, a number of servers have been stolen, but the logs
for the passcards show only valid IDs. What is Kathleen’s best option
to make sure that the users of the passcards are who they are supposed
to be?- AA. Add a reader that requires a PIN for passcard users.
- BB. Add a camera system to the facility to observe who is accessing
servers. - CC. Add a biometric factor.
- DD. Replace the magnetic stripe keycards with smartcards.
21Which of the following is a ticket-based authentication protocol
designed to provide secure communication?- AA. RADIUS
- BB. OAuth
- CC. SAML
- DD. Kerberos
22What type of access control is composed of policies and procedures
that support regulations, requirements, and the organization’s own
policies?- AA. Corrective
- BB. Logical
- CC. Compensating
- DD. Administrative
23In a Kerberos environment, when a user needs to access a network
resource, what is sent to the TGS?- AA. A TGT
- BB. An AS
- CC. The SS
- DD. A session key
24Which objects and subjects have a label in a MAC model?
- AA. Objects and subjects that are classified as Confidential, Secret, or
Top Secret have a label. - BB. All objects have a label, and all subjects have a compartment.
- CC. All objects and subjects have a label.
- DD. All subjects have a label and all objects have a compartment.
- AA. Objects and subjects that are classified as Confidential, Secret, or
25Emily builds a script that sends data to a web application that she is
testing. Each time the script runs, it sends a series of transactions with
data that fits the expected requirements of the web application to
verify that it responds to typical customer behavior. What type of
transactions is she using, and what type of test is this?- AA. Synthetic, passive monitoring
- BB. Synthetic, use case testing
- CC. Actual, dynamic monitoring
- DD. Actual, fuzzing
26What passive monitoring technique records all user interaction with
an application or website to ensure quality and performance?- AA. Client/server testing
- BB. Real user monitoring
- CC. Synthetic user monitoring
- DD. Passive user recording
27Earlier this year, the information security team at Jim’s employer
identified a vulnerability in the web server that Jim is responsible for
maintaining. He immediately applied the patch and is sure that it
installed properly, but the vulnerability scanner has continued to
incorrectly flag the system as vulnerable due to the version number it
is finding even though Jim is sure the patch is installed. Which of the
following options is Jim’s best choice to deal with the issue?- AA. Uninstall and reinstall the patch.
- BB. Ask the information security team to flag the system as patched
and not vulnerable. - CC. Update the version information in the web server’s configuration.
- DD. Review the vulnerability report and use alternate remediation
options.
28Angela wants to test a web browser’s handling of unexpected data
using an automated tool. What tool should she choose?- AA. Nmap
- BB. zzuf
- CC. Nessus
- DD. Nikto
29STRIDE, which stands for Spoofing, Tampering, Repudiation,
Information Disclosure, Denial of Service, Elevation of Privilege, is
useful in what part of application threat modeling?- AA. Vulnerability assessment
- BB. Misuse case testing
- CC. Threat categorization
- DD. Penetration test planning
30Helen is implementing a new security mechanism for granting
employees administrative privileges in the accounting system. She
designs the process so that both the employee’s manager and the
accounting manager must approve the request before the access is
granted. What information security principle is Helen enforcing?- AA. Least privilege
- BB. Two-person control
- CC. Job rotation
- DD. Separation of duties
31Which one of the following is not a requirement for evidence to be
admissible in court?- AA. The evidence must be relevant.
- BB. The evidence must be material.
- CC. The evidence must be tangible.
- DD. The evidence must be competent.
32In which cloud computing model does a customer share computing
infrastructure with other customers of the cloud vendor where one
customer may not know the other’s identity?- AA. Public cloud
- BB. Private cloud
- CC. Community cloud
- DD. Shared cloud
33Which of the following organizations would be likely to have a
representative on a CSIRT?
I. Information security
II. Legal counsel
III. Senior management
IV. Engineering- AA. I, III, and IV
- BB. I, II, and III
- CC. I, II, and IV
- DD. All of the above
34Sam is responsible for backing up his company’s primary file server.
He configured a backup schedule that performs full backups every
Monday evening at 9 p.m. and differential backups on other days of
the week at that same time. Files change according to the information
shown in the following figure. How many files will be copied in
Wednesday’s backup?
- AA. 2
- BB. 3
- CC. 5
- DD. 6
35Victor recently took a new position at an online dating website and is
responsible for leading a team of developers. He realized quickly that
the developers are having issues with production code because they
are working on different projects that result in conflicting
modifications to the production code. What process should Victor
invest in improving?- AA. Request control
- BB. Release control
- CC. Change control
- DD. Configuration control
36What type of database security issue exists when a collection of facts
has a higher classification than the classification of any of those facts
standing alone?- AA. Inference
- BB. SQL injection
- CC. Multilevel security
- DD. Aggregation
37What are the two types of covert channels that are commonly
exploited by attackers seeking to surreptitiously exfiltrate
information?- AA. Timing and storage
- BB. Timing and firewall
- CC. Storage and memory
- DD. Firewall and storage
38Vivian would like to hire a software tester to come in and evaluate a
new web application from a user’s perspective. Which of the following
tests best simulates that perspective?- AA. Black box
- BB. Gray box
- CC. Blue box
- DD. White box
39Referring to the database transaction shown here, what would happen
if no account exists in the Accounts table with account number 1001?
- AA. The database would create a new account with this account
number and give it a $250 balance. - BB. The database would ignore that command and still reduce the
balance of the second account by $250. - CC. The database would roll back the transaction, ignoring the results
of both commands. - DD. The database would generate an error message.
- AA. The database would create a new account with this account
40Which one of the following security tools is not capable of generating
an active response to a security event?- AA. IPS
- BB. Firewall
- CC. IDS
- DD. Antivirus software
41In virtualization platforms, what name is given to the module that is
responsible for controlling access to physical resources by virtual
resources?- AA. Guest machine
- BB. SDN
- CC. Kernel
- DD. Hypervisor
42What term is used to describe the default set of privileges assigned to a
user when a new account is created?- AA. Aggregation
- BB. Transitivity
- CC. Baseline
- DD. Entitlement
43Which one of the following types of agreements is the most formal
document that contains expectations about availability and other
performance parameters between a service provider and a customer?- AA. Service-level agreement (SLA)
- BB. Operational-level agreement (OLA)
- CC. Memorandum of understanding (MOU)
- DD. Statement of work (SOW)
44Which one of the following frameworks focuses on IT service
management and includes topics such as change management,
configuration management, and service level agreements?- AA. ITIL
- BB. PMBOK
- CC. PCI DSS
- DD. TOGAF
45What type of malware is characterized by spreading from system to
system under its own power by exploiting vulnerabilities that do not
require user intervention?- AA. Trojan horse
- BB. Virus
- CC. Logic bomb
- DD. Worm
46Kim is troubleshooting an application firewall that serves as a
supplement to the organization’s network and host firewalls and
intrusion prevention system, providing added protection against webbased
attacks. The issue the organization is experiencing is that
the firewall technology suffers somewhat frequent restarts that render
it unavailable for 10 minutes at a time. What configuration might Kim
consider to maintain availability during that period at the lowest cost
to the company?- AA. High availability cluster
- BB. Failover device
- CC. Fail open
- DD. Redundant disks
47What type of security issue arises when an attacker can deduce a
more sensitive piece of information by analyzing several pieces of
information classified at a lower level?- AA. SQL injection
- BB. Multilevel security
- CC. Aggregation
- DD. Inference
48Greg is battling a malware outbreak in his organization. He used
specialized malware analysis tools to capture samples of the malware
from three different systems and noticed that the code is changing
slightly from infection to infection. Greg believes that this is the
reason that antivirus software is having a tough time defeating the
outbreak. What type of malware should Greg suspect is responsible
for this security incident?- AA. Stealth virus
- BB. Polymorphic virus
- CC. Multipartite virus
- DD. Encrypted virus
49Richard is experiencing issues with the quality of network service on
his organization’s network. The primary symptom is that packets are
consistently taking too long to travel from their source to their
destination. What term describes the issue Richard is facing?- AA. Jitter
- BB. Packet loss
- CC. Interference
- DD. Latency
50Why should passive scanning be conducted in addition to
implementing wireless security technologies like wireless intrusion
detection systems?- AA. It can help identify rogue devices.
- BB. It can test the security of the wireless network via scripted attacks.
- CC. Their short dwell time on each wireless channel can allow them to
capture more packets. - DD. They can help test wireless IDS or IPS systems.
Información
- Descripción
- Good Luck!
- Autor
- Requiemdust Sheena
- Idioma
- English
- Visitas
- 64
- Historial
- Creado el 9 may 2020 · actualizado el 11 may 2020
- Etiquetas
- Valoración
- 5,0 de 5 · 1 valoración Valora este test