Quiz
Ji Ba Bom - 100Q
Crie uma conta grátis para terminar este quiz
Salve seu progresso e veja sua nota final.
Já tem uma conta? Inicie sessão
Perguntas do quiz (100)
1Joan is seeking to protect a piece of computer software that she
developed under intellectual property law. Which one of the following
avenues of protection would not apply to a piece of software?- AA. Trademark
- BB. Copyright
- CC. Patent
- DD. Trade secret
2Juniper Content is a web content development company with 40
employees located in two offices: one in New York and a smaller
office in the San Francisco Bay Area. Each office has a local area
network protected by a perimeter firewall. The local area network
(LAN) contains modern switch equipment connected to both
wired and wireless networks.
Each office has its own file server, and the information technology
(IT) team runs software every hour to synchronize files between
the two servers, distributing content between the offices. These
servers are primarily used to store images and other files related
to web content developed by the company. The team also uses a
SaaS-based email and document collaboration solution for much
of their work.
You are the newly appointed IT manager for Juniper Content, and
you are working to augment existing security controls to improve
the organization’s security.
Users in the two offices would like to access each other’s file servers
over the internet. What control would provide confidentiality for
those communications?- AA. Digital signatures
- BB. Virtual private network
- CC. Virtual LAN
- DD. Digital content management
3Juniper Content is a web content development company with 40
employees located in two offices: one in New York and a smaller
office in the San Francisco Bay Area. Each office has a local area
network protected by a perimeter firewall. The local area network
(LAN) contains modern switch equipment connected to both
wired and wireless networks.
Each office has its own file server, and the information technology
(IT) team runs software every hour to synchronize files between
the two servers, distributing content between the offices. These
servers are primarily used to store images and other files related
to web content developed by the company. The team also uses a
SaaS-based email and document collaboration solution for much
of their work.
You are the newly appointed IT manager for Juniper Content, and
you are working to augment existing security controls to improve
the organization’s security.
You are also concerned about the availability of data stored on each
office’s server. You would like to add technology that would enable
continued access to files located on the server even if a hard drive in a
server fails. What integrity control allows you to add robustness
without adding additional servers?- AA. Server clustering
- BB. Load balancing
- CC. RAID
- DD. Scheduled backups
4Juniper Content is a web content development company with 40
employees located in two offices: one in New York and a smaller
office in the San Francisco Bay Area. Each office has a local area
network protected by a perimeter firewall. The local area network
(LAN) contains modern switch equipment connected to both
wired and wireless networks.
Each office has its own file server, and the information technology
(IT) team runs software every hour to synchronize files between
the two servers, distributing content between the offices. These
servers are primarily used to store images and other files related
to web content developed by the company. The team also uses a
SaaS-based email and document collaboration solution for much
of their work.
You are the newly appointed IT manager for Juniper Content, and
you are working to augment existing security controls to improve
the organization’s security.
Finally, there are historical records stored on the server that are
extremely important to the business and should never be modified.
You would like to add an integrity control that allows you to verify on
a periodic basis that the files were not modified. What control can you
add?- AA. Hashing
- BB. ACLs
- CC. Read-only attributes
- DD. Firewalls
5Which one of the following is not normally included in business
continuity plan documentation?- AA. Statement of accounts
- BB. Statement of importance
- CC. Statement of priorities
- DD. Statement of organizational responsibility
6An accounting employee at Doolittle Industries was recently arrested
for participation in an embezzlement scheme. The employee
transferred money to a personal account and then shifted funds
around between other accounts every day to disguise the fraud for
months. Which one of the following controls might have best allowed
the earlier detection of this fraud?- AA. Separation of duties
- BB. Least privilege
- CC. Defense in depth
- DD. Mandatory vacation
7Which one of the following is not normally considered a business
continuity task?- AA. Business impact assessment
- BB. Emergency response guidelines
- CC. Electronic vaulting
- DD. Vital records program
8Which information security goal is impacted when an organization
experiences a DoS or DDoS attack?- AA. Confidentiality
- BB. Integrity
- CC. Availability
- DD. Denial
9Yolanda is writing a document that will provide configuration
information regarding the minimum level of security that every
system in the organization must meet. What type of document is she
preparing?- AA. Policy
- BB. Baseline
- CC. Guideline
- DD. Procedure
10Who should receive initial business continuity plan training in an
organization?- AA. Senior executives
- BB. Those with specific business continuity roles
- CC. Everyone in the organization
- DD. First responders
11James is conducting a risk assessment for his organization and is
attempting to assign an asset value to the servers in his data center.
The organization’s primary concern is ensuring that it has sufficient
funds available to rebuild the data center in the event it is damaged or
destroyed. Which one of the following asset valuation methods would
be most appropriate in this situation?- AA. Purchase cost
- BB. Depreciated cost
- CC. Replacement cost
- DD. Opportunity cost
12Frank discovers a keylogger hidden on the laptop of his company’s
chief executive officer. What information security principle is the
keylogger most likely designed to disrupt?- AA. Confidentiality
- BB. Integrity
- CC. Availability
- DD. Denial
13Which attack helped drive vendors to move away from SSL toward
TLS-only by default?- AA. POODLE
- BB. Stuxnet
- CC. BEAST
- DD. CRIME
14What security measure can provide an additional security control in
the event that backup tapes are stolen or lost?- AA. Keep multiple copies of the tapes.
- BB. Replace tape media with hard drives.
- CC. Use appropriate security labels.
- DD. Use AES-256 encryption.
15Joe works at a major pharmaceutical research and development
company and has been tasked with writing his organization’s data
retention policy. As part of its legal requirements, the organization
must comply with the U.S. Food and Drug Administration’s Code of
Federal Regulations Title 21. To do so, it is required to retain records
with electronic signatures. Why would a signature be part of a
retention requirement?- AA. It ensures that someone has reviewed the data.
- BB. It provides confidentiality.
- CC. It ensures that the data has not been changed.
- DD. It validates who approved the data.
16What protocol is preferred over Telnet for remote server
administration via the command line?- AA. SCP
- BB. SFTP
- CC. WDS
- DD. SSH
17What method uses a strong magnetic field to erase media?
- AA. Magwipe
- BB. Degaussing
- CC. Sanitization
- DD. Purging
18Steve is concerned about the fact that employees leaving his
organization were often privy to proprietary information. Which one
of the following controls is most effective against this threat?- AA. Sanitization
- BB. NDAs
- CC. Clearing
- DD. Encryption
19Alex works for a government agency that is required to meet U.S.
federal government requirements for data security. To meet these
requirements, Alex has been tasked with making sure data is
identifiable by its classification level. What should Alex do to the data?- AA. Classify the data.
- BB. Encrypt the data.
- CC. Label the data.
- DD. Apply DRM to the data.
20Ben is following the National Institute of Standards and Technology
(NIST) Special Publication 800-88 guidelines for sanitization and
disposition as shown here. He is handling information that his
organization classified as sensitive, which is a moderate security
categorization in the NIST model. If the media is going to be sold as
surplus, what process does Ben need to follow?
- AA. Destroy, validate, document
- BB. Clear, purge, document
- CC. Purge, document, validate
- DD. Purge, validate, document
21What methods are often used to protect data in transit?
- AA. Telnet, ISDN, UDP
- BB. BitLocker, FileVault
- CC. AES, Serpent, IDEA
- DD. TLS, VPN, IPSec
22Which one of the following data roles bears ultimate organizational
responsibility for data?- AA. System owners
- BB. Business owners
- CC. Data owners
- DD. Mission owners
23Chris has recently been hired into a new organization. The
organization that Chris belongs to uses the following classification
process:
1. Criteria are set for classifying data.
2. Data owners are established for each type of data.
3. Data is classified.
4. Required controls are selected for each classification.
5. Baseline security standards are selected for the organization.
6. Controls are scoped and tailored.
7. Controls are applied and enforced.
8. Access is granted and managed.
If Chris is one of the data owners for the organization, what steps in
this process is he most likely responsible for?- AA. He is responsible for steps 3, 4, and 5.
- BB. He is responsible for steps 1, 2, and 3.
- CC. He is responsible for steps 5, 6, and 7.
- DD. All of the steps are his direct responsibility.
24Chris has recently been hired into a new organization. The
organization that Chris belongs to uses the following classification
process:
1. Criteria are set for classifying data.
2. Data owners are established for each type of data.
3. Data is classified.
4. Required controls are selected for each classification.
5. Baseline security standards are selected for the organization.
6. Controls are scoped and tailored.
7. Controls are applied and enforced.
8. Access is granted and managed.
Chris manages a team of system administrators. What data role are
they fulfilling if they conduct steps 6, 7, and 8 of the classification
process?- AA. They are system owners and administrators.
- BB. They are administrators and custodians.
- CC. They are data owners and administrators.
- DD. They are custodians and users.
25Chris has recently been hired into a new organization. The
organization that Chris belongs to uses the following classification
process:
1. Criteria are set for classifying data.
2. Data owners are established for each type of data.
3. Data is classified.
4. Required controls are selected for each classification.
5. Baseline security standards are selected for the organization.
6. Controls are scoped and tailored.
7. Controls are applied and enforced.
8. Access is granted and managed.
If Chris’s company operates in the European Union and has been
contracted to handle the data for a third party, what role is his
company operating in when it uses this process to classify and handle
data?- AA. Business owners
- BB. Mission owners
- CC. Data processors
- DD. Data administrators
26Kyle is being granted access to a military computer system that
uses System High mode. What is not true about Kyle’s security
clearance requirements?- AA. Kyle must have a clearance for the highest level of classification
processed by the system, regardless of his access. - BB. Kyle must have access approval for all information processed by
the system. - CC. Kyle must have a valid need to know for all information
processed by the system. - DD. Kyle must have a valid security clearance.
- AA. Kyle must have a clearance for the highest level of classification
27Gary intercepts a communication between two individuals and
suspects that they are exchanging secret messages. The content of
the communication appears to be the image shown here. What type
of technique may the individuals use to hide messages inside this
image?
- AA. Visual cryptography
- BB. Steganography
- CC. Cryptographic hashing
- DD. Transport layer security
28Which one of the following terms accurately describes the Caesar
cipher?- AA. Transposition cipher
- BB. Block cipher
- CC. Shift cipher
- DD. Strong cipher
29In the ring protection model shown here, what ring contains the
operating system’s kernel?
- AA. Ring 0
- BB. Ring 1
- CC. Ring 2
- DD. Ring 3
30In an infrastructure as a service (IaaS) environment where a
vendor supplies a customer with access to storage services, who is
normally responsible for removing sensitive data from drives that
are taken out of service?- AA. Customer’s security team
- BB. Customer’s storage team
- CC. Customer’s vendor management team
- DD. Vendor
31Which one of the following is an example of a code, not a cipher?
- AA. Data Encryption Standard
- BB. “One if by land; two if by sea”
- CC. Shifting letters by three
- DD. Word scramble
32Which one of the following systems assurance processes provides
an independent third-party evaluation of a system’s controls that
may be trusted by many different organizations?- AA. Certification
- BB. Definition
- CC. Verification
- DD. Accreditation
33Process _____________ ensures that any behavior will affect
only the memory and resources associated with a process.- AA. Restriction
- BB. Isolation
- CC. Limitation
- DD. Parameters
34Harold is assessing the susceptibility of his environment to
hardware failures and would like to identify the expected lifetime
of a piece of hardware. What measure should he use for this?- AA. MTTR
- BB. MTTF
- CC. RTO
- DD. MTO
35What type of fire extinguisher is useful only against common
combustibles?- AA. Class A
- BB. Class B
- CC. Class C
- DD. Class D
36Gary is concerned about applying consistent security settings to the
many mobile devices used throughout his organization. What
technology would best assist with this challenge?- AA. MDM
- BB. IPS
- CC. IDS
- DD. SIEM
37Alice sent a message to Bob. Bob would like to demonstrate to
Charlie that the message he received definitely came from Alice.
What goal of cryptography is Bob attempting to achieve?- AA. Authentication
- BB. Confidentiality
- CC. Nonrepudiation
- DD. Integrity
38What does a bluesnarfing attack target?
- AA. Data on IBM systems
- BB. An outbound phone call via Bluetooth
- CC. 802.11b networks
- DD. Data from a Bluetooth-enabled device
39Which of the following options includes standards or protocols that
exist in layer 6 of the OSI model?- AA. NFS, SQL, and RPC
- BB. TCP, UDP, and TLS
- CC. JPEG, ASCII, and MIDI
- DD. HTTP, FTP, and SMTP
40What network topology is shown here?
- AA. A ring
- BB. A bus
- CC. A star
- DD. A mesh
41There are four common VPN protocols. Which group listed contains
all of the common VPN protocols?- AA. PPTP, LTP, L2TP, IPsec
- BB. PPP, L2TP, IPsec, VNC
- CC. PPTP, L2F, L2TP, IPsec
- DD. PPTP, L2TP, IPsec, SPAP
42What network technology is best described as a token-passing network
that uses a pair of rings with traffic flowing in opposite directions?- AA. A ring topology
- BB. Token Ring
- CC. FDDI
- DD. SONET
43Which OSI layer includes electrical specifications, protocols, and
interface standards?- AA. The Transport layer
- BB. The Device layer
- CC. The Physical layer
- DD. The Data Link layer
44Ben is designing a Wi-Fi network and has been asked to choose the
most secure option for the network. Which wireless security standard
should he choose?- AA. WPA2
- BB. WPA
- CC. WEP
- DD. AES
45If your organization needs to allow attachments in email to support
critical business processes, what are the two best options for helping
to avoid security problems caused by attachments?- AA. Train your users and use antimalware tools.
- BB. Encrypt your email and use antimalware tools.
- CC. Train your users and require S/MIME for all email.
- DD. Use S/MIME by default and remove all ZIP (.zip) file attachments.
46Segmentation, sequencing, and error checking all occur at what layer
of the OSI model that is associated with SSL, TLS, and UDP?- AA. The Transport layer
- BB. The Network layer
- CC. The Session layer
- DD. The Presentation layer
47The Windows ipconfig command displays the following information:
BC-5F-F4-7B-4B-7D
What term describes this, and what information can usually be
gathered from it?- AA. The IP address, the network location of the system
- BB. The MAC address, the network interface card’s manufacturer
- CC. The MAC address, the media type in use
- DD. The IPv6 client ID, the network interface card’s manufacturer
48Chris has been asked to choose between implementing PEAP and
LEAP for wireless authentication. What should he choose, and why?- AA. LEAP, because it fixes problems with TKIP, resulting in stronger
security - BB. PEAP, because it implements CCMP for security
- CC. LEAP, because it implements EAP-TLS for end-to-end session
encryption - DD. PEAP, because it can provide a TLS tunnel that encapsulates EAP
methods, protecting the entire session
- AA. LEAP, because it fixes problems with TKIP, resulting in stronger
49Ben is troubleshooting a network and discovers that the NAT router he
is connected to has the 192.168.x.x subnet as its internal network and
that its external IP is 192.168.1.40. What problem is he encountering?- AA. 192.168.x.x is a nonroutable network and will not be carried to the
Internet. - BB. 192.168.1.40 is not a valid address because it is reserved by RFC
1918. - CC. Double NATing is not possible using the same IP range.
- DD. The upstream system is unable to de-encapsulate his packets and
he needs to use PAT instead.
- AA. 192.168.x.x is a nonroutable network and will not be carried to the
50Susan has been asked to recommend whether her organization should
use a MAC scheme or a DAC scheme. If flexibility and scalability are
important requirements for implementing access controls, which
scheme should she recommend and why?- AA. MAC, because it provides greater scalability and flexibility because
you can simply add more labels as needed - BB. DAC, because allowing individual administrators to make choices
about the objects they control provides scalability and flexibility - CC. MAC, because compartmentalization is well suited to flexibility and
adding compartments will allow it to scale well - DD. DAC, because a central decision process allows quick responses
and will provide scalability by reducing the number of decisions
required and flexibility by moving those decisions to a central
authority
- AA. MAC, because it provides greater scalability and flexibility because
51Which of the following tools is not typically used to verify that a
provisioning process was followed in a way that ensures that the
organization’s security policy is being followed?- AA. Log review
- BB. Manual review of permissions
- CC. Signature-based detection
- DD. Review the audit trail
52Lauren needs to send information about services she is provisioning to
a third-party organization. What standards-based markup language
should she choose to build the interface?- AA. SAML
- BB. SOAP
- CC. SPML
- DD. XACML
53During a penetration test, Chris recovers a file containing hashed
passwords for the system he is attempting to access. What type of
attack is most likely to succeed against the hashed passwords?- AA. A brute-force attack
- BB. A pass-the-hash attack
- CC. A rainbow table attack
- DD. A salt recovery attack
54Google’s identity integration with a variety of organizations and
applications across domains is an example of which of the following?- AA. PKI
- BB. Federation
- CC. Single sign-on
- DD. Provisioning
55Lauren starts at her new job and finds that she has access to a variety
of systems that she does not need to accomplish her job. What
problem has she encountered?- AA. Privilege creep
- BB. Rights collision
- CC. Least privilege
- DD. Excessive privileges
56When Chris verifies an individual’s identity and adds a unique
identifier like a user ID to an identity system, what process has
occurred?- AA. Identity proofing
- BB. Registration
- CC. Directory management
- DD. Session management
57Jim configures his LDAP client to connect to an LDAP directory
server. According to the configuration guide, his client should connect
to the server on port 636. What does this indicate to Jim about the
configuration of the LDAP server?- AA. It requires connections over SSL/TLS.
- BB. It supports only unencrypted connections.
- CC. It provides global catalog services.
- DD. It does not provide global catalog services.
58The X.500 standards cover what type of important identity systems?
- AA. Kerberos
- BB. Provisioning services
- CC. Biometric authentication systems
- DD. Directory services
59Microsoft’s Active Directory Domain Services is based on which of the
following technologies?- AA. RADIUS
- BB. LDAP
- CC. SSO
- DD. PKI
60Lauren is responsible for building a banking website. She needs proof
of the identity of the users who register for the site. How should she
validate user identities?- AA. Require users to create unique questions that only they will know.
- BB. Require new users to bring their driver’s license or passport in
person to the bank. - CC. Use information that both the bank and the user have such as
questions pulled from their credit report. - DD. Call the user on their registered phone number to verify that they
are who they claim to be.
61By default, in what format does OpenLDAP store the value of the
userPassword attribute?- AA. In the clear
- BB. Salted and hashed
- CC. MD5 hashed
- DD. Encrypted using AES256 encryption
62During a wireless network penetration test, Susan runs aircrack-ng
against the network using a password file. What might cause her to fail
in her password-cracking efforts?- AA. Use of WPA2 encryption
- BB. Running WPA2 in Enterprise mode
- CC. Use of WEP encryption
- DD. Running WPA2 in PSK mode
63A zero-day vulnerability is announced for the popular Apache web
server in the middle of a workday. In Jacob’s role as an information
security analyst, he needs to quickly scan his network to determine
what servers are vulnerable to the issue. What is Jacob’s best route to
quickly identify vulnerable systems?- AA. Immediately run Nessus against all of the servers to identify which
systems are vulnerable. - BB. Review the CVE database to find the vulnerability information and
patch information. - CC. Create a custom IDS or IPS signature.
- DD. Identify affected versions and check systems for that version
number using an automated scanner.
- AA. Immediately run Nessus against all of the servers to identify which
64What type of testing is used to ensure that separately developed
software modules properly exchange data?- AA. Fuzzing
- BB. Dynamic testing
- CC. Interface testing
- DD. API checksums
65Which of the following is not a potential problem with active wireless
scanning?- AA. Accidently scanning apparent rogue devices that actually belong to
guests - BB. Causing alarms on the organization’s wireless IPS
- CC. Scanning devices that belong to nearby organizations
- DD. Misidentifying rogue devices
- AA. Accidently scanning apparent rogue devices that actually belong to
66Ben uses a fuzzing tool that tests an application by developing data
models and creating fuzzed data based on information about how the
application uses data. What type of fuzzing is Ben doing?- AA. Mutation
- BB. Parametric
- CC. Generational
- DD. Derivative
67Saria wants to log and review traffic information between parts of her
network. What type of network logging should she enable on her
routers to allow her to perform this analysis?- AA. Audit logging
- BB. Flow logging
- CC. Trace logging
- DD. Route logging
68Jim has been contracted to conduct a gray box penetration test, and
his clients have provided him with the following information about
their networks so that he can scan them:
Data center: 10.10.10.0/24
Sales: 10.10.11.0/24
Billing: 10.10.12.0/24
Wireless: 192.168.0.0/16
What problem will Jim encounter if he is contracted to conduct a scan
from offsite?- AA. The IP ranges are too large to scan efficiently.
- BB. The IP addresses provided cannot be scanned.
- CC. The IP ranges overlap and will cause scanning issues.
- DD. The IP addresses provided are RFC 1918 addresses.
69Karen’s organization has been performing system backups for years
but has not used the backups frequently. During a recent system
outage, when administrators tried to restore from backups, they found
that the backups had errors and could not be restored. Which of the
following options should Karen avoid when selecting ways to ensure
that her organization’s backups will work next time?- AA. Log review
- BB. MTD verification
- CC. Hashing
- DD. Periodic testing
70The company that Jennifer works for has implemented a central
logging infrastructure, as shown in the following image. Use this
diagram and your knowledge of logging systems to answer the
following questions.
Jennifer needs to ensure that all Windows systems provide identical
logging information to the SIEM. How can she best ensure that all
Windows desktops have the same log settings?
- AA. Perform periodic configuration audits.
- BB. Use Group Policy.
- CC. Use Local Policy.
- DD. Deploy a Windows syslog client.
71The company that Jennifer works for has implemented a central
logging infrastructure, as shown in the following image. Use this
diagram and your knowledge of logging systems to answer the
following questions.
During normal operations, Jennifer’s team uses the SIEM appliance to
monitor for exceptions received via syslog. What system shown does
not natively have support for syslog events?- AA. Enterprise wireless access points
- BB. Windows desktop systems
- CC. Linux web servers
- DD. Enterprise firewall devices
72The company that Jennifer works for has implemented a central
logging infrastructure, as shown in the following image. Use this
diagram and your knowledge of logging systems to answer the
following questions.
What technology should an organization use for each of the devices
shown in the diagram to ensure that logs can be time sequenced across
the entire infrastructure?- AA. Syslog
- BB. NTP
- CC. Logsync
- DD. SNAP
73During a penetration test, Danielle needs to identify systems, but she
hasn’t gained sufficient access on the system she is using to generate
raw packets. What type of scan should she run to verify the most open
services?- AA. A TCP connect scan
- BB. A TCP SYN scan
- CC. A UDP scan
- DD. An ICMP scan
74Gary was recently hired as the first chief information security
officer (CISO) for a local government agency. The agency recently
suffered a security breach and is attempting to build a new
information security program. Gary would like to apply some best
practices for security operations as he is designing this program.
As Gary decides what access permissions he should grant to each user,
what principle should guide his decisions about default permissions?- AA. Separation of duties
- BB. Least privilege
- CC. Aggregation
- DD. Separation of privileges
75Gary was recently hired as the first chief information security
officer (CISO) for a local government agency. The agency recently
suffered a security breach and is attempting to build a new
information security program. Gary would like to apply some best
practices for security operations as he is designing this program.
As Gary designs the program, he uses the matrix shown here. What
principle of information security does this matrix most directly help
enforce?
- AA. Segregation of duties
- BB. Aggregation
- CC. Two-person control
- DD. Defense in depth
76Gary was recently hired as the first chief information security
officer (CISO) for a local government agency. The agency recently
suffered a security breach and is attempting to build a new
information security program. Gary would like to apply some best
practices for security operations as he is designing this program.
Gary is preparing to create an account for a new user and assign
privileges to the HR database. What two elements of information must
Gary verify before granting this access?- AA. Credentials and need to know
- BB. Clearance and need to know
- CC. Password and clearance
- DD. Password and biometric scan
77Gary was recently hired as the first chief information security
officer (CISO) for a local government agency. The agency recently
suffered a security breach and is attempting to build a new
information security program. Gary would like to apply some best
practices for security operations as he is designing this program.
Gary is preparing to develop controls around access to root encryption
keys and would like to apply a principle of security designed
specifically for very sensitive operations. Which principle should he
apply?- AA. Least privilege
- BB. Defense in depth
- CC. Security through obscurity
- DD. Two-person control
78When should an organization conduct a review of the privileged access
that a user has to sensitive systems?- AA. On a periodic basis
- BB. When a user leaves the organization
- CC. When a user changes roles
- DD. All of the above
79Which one of the following terms is often used to describe a collection
of unrelated patches released in a large collection?- AA. Hotfix
- BB. Update
- CC. Security fix
- DD. Service pack
80Which one of the following tasks is performed by a forensic disk
controller?- AA. Masking error conditions reported by the storage device
- BB. Transmitting write commands to the storage device
- CC. Intercepting and modifying or discarding commands sent to the
storage device - DD. Preventing data from being returned by a read operation sent to
the device
81Lydia is processing access control requests for her organization. She
comes across a request where the user does have the required security
clearance, but there is no business justification for the access. Lydia
denies this request. What security principle is she following?- AA. Need to know
- BB. Least privilege
- CC. Separation of duties
- DD. Two-person control
82Which one of the following mechanisms is not commonly seen as a
deterrent to fraud?- AA. Job rotation
- BB. Mandatory vacations
- CC. Incident response
- DD. Two-person control
83Brian recently joined an organization that runs the majority of its
services on a virtualization platform located in its own data center but
also leverages an IaaS provider for hosting its web services and a SaaS
email system. What term best describes the type of cloud environment
this organization uses?- AA. Public cloud
- BB. Dedicated cloud
- CC. Private cloud
- DD. Hybrid cloud
84Tom is responding to a recent security incident and is seeking
information on the approval process for a recent modification to a
system’s security settings. Where would he most likely find this
information?- AA. Change log
- BB. System log
- CC. Security log
- DD. Application log
85Which one of the following is considered primary storage?
- AA. Memory
- BB. Hard disk
- CC. Flash drive
- DD. DVD
86Which one of the following testing methodologies typically works
without access to source code?- AA. Dynamic testing
- BB. Static testing
- CC. White box testing
- DD. Code review
87The web application that Lucca built has a flaw that causes users who
are logged in to be able to take actions they should not be able to in
their role. What type of security vulnerability should this be classified
as?- AA. Data validation
- BB. Session management
- CC. Authorization
- DD. Error handling
88Bobby is investigating how an authorized database user is gaining
access to information outside his normal clearance level. Bobby
believes that the user is making use of a type of function that
summarizes data. What term describes this type of function?- AA. Inference
- BB. Polymorphic
- CC. Aggregate
- DD. Modular
89Which one of the following controls would best protect an application
against buffer overflow attacks?- AA. Encryption
- BB. Input validation
- CC. Firewall
- DD. Intrusion prevention system
90Berta is analyzing the logs of the Windows Firewall on one of her
servers and comes across the entries shown in this figure. What type
of attack do these entries indicate?
- AA. SQL injection
- BB. Port scan
- CC. Teardrop
- DD. Land
91Robert is a consultant who helps organizations create and develop
mature software development practices. He prefers to use the
Software Capability Maturity Model (SW-CMM) to evaluate the
current and future status of organizations using both independent
review and self-assessments. He is currently working with two
different clients.
Acme Widgets is not very well organized with their software
development practices. They have a dedicated team of developers
who do “whatever it takes” to get software out the door, but they
do not have any formal processes.
Beta Particles is a company with years of experience developing
software using formal, documented software development
processes. They use a standard model for software development
but do not have quantitative management of those processes.
What phase of the SW-CMM should Robert report as the current
status of Acme Widgets?- AA. Defined
- BB. Repeatable
- CC. Initial
- DD. Managed
92Robert is a consultant who helps organizations create and develop
mature software development practices. He prefers to use the
Software Capability Maturity Model (SW-CMM) to evaluate the
current and future status of organizations using both independent
review and self-assessments. He is currently working with two
different clients.
Acme Widgets is not very well organized with their software
development practices. They have a dedicated team of developers
who do “whatever it takes” to get software out the door, but they
do not have any formal processes.
Beta Particles is a company with years of experience developing
software using formal, documented software development
processes. They use a standard model for software development
but do not have quantitative management of those processes.
Robert is working with Acme Widgets on a strategy to advance their
software development practices. What SW-CMM stage should be
their next target milestone?- AA. Defined
- BB. Repeatable
- CC. Initial
- DD. Managed
93Robert is a consultant who helps organizations create and develop
mature software development practices. He prefers to use the
Software Capability Maturity Model (SW-CMM) to evaluate the
current and future status of organizations using both independent
review and self-assessments. He is currently working with two
different clients.
Acme Widgets is not very well organized with their software
development practices. They have a dedicated team of developers
who do “whatever it takes” to get software out the door, but they
do not have any formal processes.
Beta Particles is a company with years of experience developing
software using formal, documented software development
processes. They use a standard model for software development
but do not have quantitative management of those processes.
What phase of the SW-CMM should Robert report as the current
status of Beta Particles?- AA. Defined
- BB. Repeatable
- CC. Optimizing
- DD. Managed
94Robert is a consultant who helps organizations create and develop
mature software development practices. He prefers to use the
Software Capability Maturity Model (SW-CMM) to evaluate the
current and future status of organizations using both independent
review and self-assessments. He is currently working with two
different clients.
Acme Widgets is not very well organized with their software
development practices. They have a dedicated team of developers
who do “whatever it takes” to get software out the door, but they
do not have any formal processes.
Beta Particles is a company with years of experience developing
software using formal, documented software development
processes. They use a standard model for software development
but do not have quantitative management of those processes.
Robert is also working with Beta Particles on a strategy to advance
their software development practices. What SW-CMM stage should
be their next target milestone?- AA. Defined
- BB. Repeatable
- CC. Optimizing
- DD. Managed
95Which one of the following database keys is used to enforce
referential integrity relationships between tables?- AA. Primary key
- BB. Candidate key
- CC. Foreign key
- DD. Master key
96Which one of the following files is most likely to contain a macro
virus?- AA. projections.doc
- BB. command.com
- CC. command.exe
- DD. loopmaster.exe
97What is the default subnet mask for a Class B network?
- AA. 255.0.0.0
- BB. 255.255.0.0
- CC. 255.254.0.0
- DD. 255.255.255.0
98Jim’s organization uses a traditional PBX for voice communication.
What is the most common security issue that its internal
communications are likely to face, and what should he recommend to
prevent it?- AA. Eavesdropping, encryption
- BB. Man-in-the-middle attacks, end-to-end encryption
- CC. Eavesdropping, physical security
- DD. Wardialing, deploy an IPS
99What common security issue is often overlooked with cordless
phones?- AA. Their signal is rarely encrypted and thus can be easily monitored.
- BB. They use unlicensed frequencies
- CC. They can allow attackers access to wireless networks.
- DD. They are rarely patched and are vulnerable to malware.
100Lauren’s organization has deployed VoIP phones on the same switches
that the desktop PCs are on. What security issue could this create, and
what solution would help?- AA. VLAN hopping; use physically separate switches.
- BB. VLAN hopping; use encryption.
- CC. Caller ID spoofing; MAC filtering.
- DD. Denial of service attacks; use a firewall between networks.
Informações
- Descrição
- Good Luck!
- Autor
- Requiemdust Sheena
- Idioma
- English
- Visualizações
- 23
- Etiquetas
- Avaliação
- Ainda sem avaliações Avalie este quiz