Quiz
Quix4 - D1 - 50Q
Crie uma conta grátis para terminar este quiz
Salve seu progresso e veja sua nota final.
Já tem uma conta? Inicie sessão
Perguntas do quiz (50)
1Which one of the following is not an example of a technical control?
- AA. Router ACL
- BB. Firewall rule
- CC. Encryption
- DD. Data classification
2Which one of the following stakeholders is not typically included on a
business continuity planning team?- AA. Core business function leaders
- BB. Information technology staff
- CC. CEO
- DD. Support departments
3Ben is designing a messaging system for a bank and would like to
include a feature that allows the recipient of a message to prove to a
third party that the message did indeed come from the purported
originator. What goal is Ben trying to achieve?- AA. Authentication
- BB. Authorization
- CC. Integrity
- DD. Nonrepudiation
4What principle of information security states that an organization
should implement overlapping security controls whenever possible?- AA. Least privilege
- BB. Separation of duties
- CC. Defense in depth
- DD. Security through obscurity
5Which one of the following is not a goal of a formal change
management program?- AA. Implement change in an orderly fashion.
- BB. Test changes prior to implementation.
- CC. Provide rollback plans for changes.
- DD. Inform stakeholders of changes after they occur.
6Ben is responsible for the security of payment card information stored
in a database. Policy directs that he remove the information from the
database, but he cannot do this for operational reasons. He obtained
an exception to policy and is seeking an appropriate compensating
control to mitigate the risk. What would be his best option?- AA. Purchasing insurance
- BB. Encrypting the database contents
- CC. Removing the data
- DD. Objecting to the exception
7The Domer Industries risk assessment team recently conducted a
qualitative risk assessment and developed a matrix similar to the one
shown here. Which quadrant contains the risks that require the most
immediate attention?
- AA. I
- BB. II
- CC. III
- DD. IV
8Tom is planning to terminate an employee this afternoon for fraud
and expects that the meeting will be somewhat hostile. He is
coordinating the meeting with Human Resources and wants to
protect the company against damage. Which one of the following
steps is most important to coordinate in time with the termination
meeting?- AA. Informing other employees of the termination
- BB. Retrieving the employee’s photo ID
- CC. Calculating the final paycheck
- DD. Revoking electronic access rights
9Rolando is a risk manager with a large-scale enterprise. The firm
recently evaluated the risk of California mudslides on its operations in
the region and determined that the cost of responding outweighed the
benefits of any controls it could implement. The company chose to
take no action at this time. What risk management strategy did
Rolando’s organization pursue?- AA. Risk avoidance
- BB. Risk mitigation
- CC. Risk transference
- DD. Risk acceptance
10You discover that a user on your network has been using the
Wireshark tool, as shown here. Further investigation revealed that he
was using it for illicit purposes. What pillar of information security
has most likely been violated?
- AA. Integrity
- BB. Denial
- CC. Availability
- DD. Confidentiality
11Alan is performing threat modeling and decides that it would be
useful to decompose the system into the key elements shown here.
What tool is he using?
- AA. Vulnerability assessment
- BB. Fuzzing
- CC. Reduction analysis
- DD. Data modeling
12Which one of the following tools is most often used for identification
purposes and is not suitable for use as an authenticator?- AA. Password
- BB. Retinal scan
- CC. Username
- DD. Token
13Which type of business impact assessment tool is most appropriate
when attempting to evaluate the impact of a failure on customer
confidence?- AA. Quantitative
- BB. Qualitative
- CC. Annualized loss expectancy
- DD. Reduction
14Which one of the following is the first step in developing an
organization’s vital records program?- AA. Identifying vital records
- BB. Locating vital records
- CC. Archiving vital records
- DD. Preserving vital records
15Which one of the following security programs is designed to provide
employees with the knowledge they need to perform their specific
work tasks?- AA. Awareness
- BB. Training
- CC. Education
- DD. Indoctrination
16Which one of the following security programs is designed to establish
a minimum standard common denominator of security
understanding?- AA. Training
- BB. Education
- CC. Indoctrination
- DD. Awareness
17Ryan is a security risk analyst for an insurance company. He is
currently examining a scenario in which a malicious hacker might use
a SQL injection attack to deface a web server due to a missing patch in
the company’s web application. In this scenario, what is the threat?- AA. Unpatched web application
- BB. Web defacement
- CC. Malicious hacker
- DD. Operating system
18Henry is the risk manager for Atwood Landing, a resort
community in the midwestern United States. The resort’s main
data center is located in northern Indiana in an area that is prone
to tornados. Henry recently undertook a replacement cost analysis
and determined that rebuilding and reconfiguring the data center
would cost $10 million.
Henry consulted with tornado experts, data center specialists, and
structural engineers. Together, they determined that a typical
tornado would cause approximately $5 million of damage to the
facility. The meteorologists determined that Atwood’s facility lies
in an area where they are likely to experience a tornado once every
200 years.
Based upon the information in this scenario, what is the exposure
factor for the effect of a tornado on Atwood Landing’s data center?- AA. 10%
- BB. 25%
- CC. 50%
- DD. 75%
19Henry is the risk manager for Atwood Landing, a resort
community in the midwestern United States. The resort’s main
data center is located in northern Indiana in an area that is prone
to tornados. Henry recently undertook a replacement cost analysis
and determined that rebuilding and reconfiguring the data center
would cost $10 million.
Henry consulted with tornado experts, data center specialists, and
structural engineers. Together, they determined that a typical
tornado would cause approximately $5 million of damage to the
facility. The meteorologists determined that Atwood’s facility lies
in an area where they are likely to experience a tornado once every
200 years.
Based upon the information in this scenario, what is the annualized
rate of occurrence for a tornado at Atwood Landing’s data center?- AA. 0.0025
- BB. 0.005
- CC. 0.01
- DD. 0.015
20Henry is the risk manager for Atwood Landing, a resort
community in the midwestern United States. The resort’s main
data center is located in northern Indiana in an area that is prone
to tornados. Henry recently undertook a replacement cost analysis
and determined that rebuilding and reconfiguring the data center
would cost $10 million.
Henry consulted with tornado experts, data center specialists, and
structural engineers. Together, they determined that a typical
tornado would cause approximately $5 million of damage to the
facility. The meteorologists determined that Atwood’s facility lies
in an area where they are likely to experience a tornado once every
200 years.
Based upon the information in this scenario, what is the annualized
loss expectancy for a tornado at Atwood Landing’s data center?- AA. $25,000
- BB. $50,000
- CC. $250,000
- DD. $500,000
21John is analyzing an attack against his company in which the attacker
found comments embedded in HTML code that provided the clues
needed to exploit a software vulnerability. Using the STRIDE model,
what type of attack did he uncover?- AA. Spoofing
- BB. Repudiation
- CC. Information disclosure
- DD. Elevation of privilege
22Which one of the following is an administrative control that can
protect the confidentiality of information?- AA. Encryption
- BB. Nondisclosure agreement
- CC. Firewall
- DD. Fault tolerance
23Chris is worried that the laptops that his organization has recently
acquired were modified by a third party to include keyloggers before
they were delivered. Where should he focus his efforts to prevent
this?- AA. His supply chain
- BB. His vendor contracts
- CC. His post-purchase build process
- DD. The original equipment manufacturer (OEM)
24STRIDE, PASTA, and VAST are all examples of what type of tool?
- AA. Risk assessment methodologies
- BB. Control matrices
- CC. Threat modeling methodologies
- DD. Awareness campaign tools
25In her role as a developer for an online bank, Lisa is required to
submit her code for testing and review. After it passes through this
process and it is approved, another employee moves the code to the
production environment. What security management does this
process describe?- AA. Regression testing
- BB. Code review
- CC. Change management
- DD. Fuzz testing
26After completing the first year of his security awareness program,
Charles reviews the data about how many staff completed training
compared to how many were assigned the training to determine
whether he hit the 95 percent completion rate he was aiming for.
What is this type of measure called?- AA. A KPI
- BB. A metric
- CC. An awareness control
- DD. A return on investment rate
27Which of the following is not typically included in a prehire screening
process?- AA. A drug test
- BB. A background check
- CC. Social media review
- DD. Fitness evaluation
28The (ISC)2 code of ethics applies to all CISSP holders. Which of the
following is not one of the four mandatory canons of the code?- AA. Protect society, the common good, the necessary public trust and
confidence, and the infrastructure - BB. Disclose breaches of privacy, trust, and ethics
- CC. Provide diligent and competent service to the principles
- DD. Advance and protect the profession
- AA. Protect society, the common good, the necessary public trust and
29Greg’s company recently experienced a significant data breach
involving the personal data of many of their customers. Which breach
laws should they review to ensure that they are taking appropriate
action?- AA. The breach laws in the state where they are headquartered
- BB. The breach laws of states they do business in
- CC. Only federal breach laws
- DD. Breach laws only cover government agencies, not private
businesses
30Lawrence has been asked to perform vulnerability scans and a risk
assessment of systems. Which organizational process are these more
likely to be associated with?- AA. A merger
- BB. A divestiture
- CC. A layoff
- DD. A financial audit
31Which of the following is not typically part of a termination process?
- AA. An exit interview
- BB. Recovery of property
- CC. Account termination
- DD. Signing an NCA
32Laura has been asked to perform an SCA. What type of organization is
she most likely in?- AA. Higher education
- BB. Banking
- CC. Government
- DD. Healthcare
33After conducting a qualitative risk assessment of her organization,
Sally recommends purchasing cybersecurity breach insurance. What
type of risk response behavior is she recommending?- AA. Accept
- BB. Transfer
- CC. Reduce
- DD. Reject
34What is the final step of a quantitative risk analysis?
- AA. Determine asset value.
- BB. Assess the annualized rate of occurrence.
- CC. Derive the annualized loss expectancy.
- DD. Conduct a cost/benefit analysis.
35Under the Digital Millennium Copyright Act (DMCA), what type of
offenses do not require prompt action by an internet service provider
after it receives a notification of infringement claim from a copyright
holder?- AA. Storage of information by a customer on a provider’s server
- BB. Caching of information by the provider
- CC. Transmission of information over the provider’s network by a
customer - DD. Caching of information in a provider search engine
36FlyAway Travel has offices in both the European Union (EU) and the
United States and transfers personal information between those
offices regularly. They have recently received a request from an EU
customer requesting that their account be terminated. Under the
General Data Protection Regulation (GDPR), which requirement for
processing personal information states that individuals may request
that their data no longer be disseminated or processed?- AA. The right to access
- BB. Privacy by design
- CC. The right to be forgotten
- DD. The right of data portability
37Which one of the following is not one of the three common threat
modeling techniques?- AA. Focused on assets
- BB. Focused on attackers
- CC. Focused on software
- DD. Focused on social engineering
38In 1991, the Federal Sentencing Guidelines formalized a rule that
requires senior executives to take personal responsibility for
information security matters. What is the name of this rule?- AA. Due diligence rule
- BB. Personal liability rule
- CC. Prudent man rule
- DD. Due process rule
39Which one of the following provides an authentication mechanism
that would be appropriate for pairing with a password to achieve
multifactor authentication?- AA. Username
- BB. Personal identification number (PIN)
- CC. Security question
- DD. Fingerprint scan
40Chris is advising travelers from his organization who will be visiting
many different countries overseas. He is concerned about compliance
with export control laws. Which of the following technologies is most
likely to trigger these regulations?- AA. Memory chips
- BB. Office productivity applications
- CC. Hard drives
- DD. Encryption software
41Bobbi is investigating a security incident and discovers that an
attacker began with a normal user account but managed to exploit a
system vulnerability to provide that account with administrative
rights. What type of attack took place under the STRIDE threat
model?- AA. Spoofing
- BB. Repudiation
- CC. Tampering
- DD. Elevation of privilege
42You are completing your business continuity planning effort and have
decided that you wish to accept one of the risks. What should you do
next?- AA. Implement new security controls to reduce the risk level.
- BB. Design a disaster recovery plan.
- CC. Repeat the business impact assessment.
- DD. Document your decision-making process.
43Which one of the following control categories does not accurately
describe a fence around a facility- AA. Physical
- BB. Detective
- CC. Deterrent
- DD. Preventive
44Tony is developing a business continuity plan and is having difficulty
prioritizing resources because of the difficulty of combining
information about tangible and intangible assets. What would be the
most effective risk assessment approach for him to use?- AA. Quantitative risk assessment
- BB. Qualitative risk assessment
- CC. Neither quantitative nor qualitative risk assessment
- DD. Combination of quantitative and qualitative risk assessment
45What law provides intellectual property protection to the holders of
trade secrets?- AA. Copyright Law
- BB. Lanham Act
- CC. Glass-Steagall Act
- DD. Economic Espionage Act
46Which one of the following principles imposes a standard of care
upon an individual that is broad and equivalent to what one would
expect from a reasonable person under the circumstances?- AA. Due diligence
- BB. Separation of duties
- CC. Due care
- DD. Least privilege
47Darcy is designing a fault tolerant system and wants to implement
RAID level 5 for her system. What is the minimum number of
physical hard disks she can use to build this system?- AA. One
- BB. Two
- CC. Three
- DD. Five
48Which one of the following is an example of an administrative
control?- AA. Intrusion detection system
- BB. Security awareness training
- CC. Firewalls
- DD. Security guards
49Keenan Systems recently developed a new manufacturing process for
microprocessors. The company wants to license the technology to
other companies for use but wishes to prevent unauthorized use of
the technology. What type of intellectual property protection is best
suited for this situation?- AA. Patent
- BB. Trade secret
- CC. Copyright
- DD. Trademark
50Which one of the following actions might be taken as part of a
business continuity plan?- AA. Restoring from backup tapes
- BB. Implementing RAID
- CC. Relocating to a cold site
- DD. Restarting business operations
Informações
- Descrição
- Good Luck!
- Autor
- Requiemdust Sheena
- Idioma
- English
- Visualizações
- 838
- Etiquetas
- Avaliação
- 3,0 de 5 · 1 avaliação Avalie este quiz