Quiz
Quix12 - 50Q
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (50)
1NIST SP800-53 discusses a set of security controls as what type of
security tool?- AA. A configuration list
- BB. A threat management strategy
- CC. A baseline
- DD. The CIS standard
2Ed has been tasked with identifying a service that will provide a lowlatency,
high-performance, and high-availability way to host content
for his employer. What type of solution should he seek out to ensure
that his employer’s customers around the world can access their
content quickly, easily, and reliably?- AA. A hot site
- BB. A CDN
- CC. Redundant servers
- DD. A P2P CDN
3Which one of the following is not a function of a forensic disk
controller?- AA. Preventing the modification of data on a storage device
- BB. Returning data requested from the device
- CC. Reporting errors sent by the device to the forensic host
- DD. Blocking read commands sent to the device
4Mike is building a fault-tolerant server and wishes to implement RAID
1. How many physical disks are required to build this solution?- AA. 1
- BB. 2
- CC. 3
- DD. 5
5Which Kerberos service generates a new ticket and session keys and
sends them to the client?- AA. KDC
- BB. TGT
- CC. AS
- DD. TGS
6Communication systems that rely on start and stop flags or bits to
manage data transmission are known as what type of communication?- AA. Analog
- BB. Digital
- CC. Synchronous
- DD. Asynchronous
7What type of motion detector uses high microwave frequency signal
transmissions to identify potential intruders?- AA. Infrared
- BB. Heat-based
- CC. Wave pattern
- DD. Capacitance
8Susan sets up a firewall that keeps track of the status of the
communication between two systems and allows a remote system to
respond to a local system after the local system starts communication.
What type of firewall is Susan using?- AA. A static packet filtering firewall
- BB. An application-level gateway firewall
- CC. A stateful packet inspection firewall
- DD. A circuit-level gateway firewall
9Ben owns a coffeehouse and wants to provide wireless Internet
service for his customers. Ben’s network is simple and uses a single
consumer-grade wireless router and a cable modem connected via
a commercial cable data contract.
How can Ben provide access control for his customers without having
to provision user IDs before they connect while also gathering useful
contact information for his business purposes?- AA. WPA2 PSK
- BB. A captive portal
- CC. Require customers to use a publicly posted password like
“BensCoffee.” - DD. Port security
10Ben owns a coffeehouse and wants to provide wireless Internet
service for his customers. Ben’s network is simple and uses a single
consumer-grade wireless router and a cable modem connected via
a commercial cable data contract.
Ben intends to run an open (unencrypted) wireless network. How
should he connect his business devices?- AA. Run WPA2 on the same SSID.
- BB. Set up a separate SSID using WPA2.
- CC. Run the open network in Enterprise mode.
- DD. Set up a separate wireless network using WEP.
11Ben owns a coffeehouse and wants to provide wireless Internet
service for his customers. Ben’s network is simple and uses a single
consumer-grade wireless router and a cable modem connected via
a commercial cable data contract.
After implementing the solution from the first question, Ben receives a
complaint about users in his cafe hijacking other customers’ web
traffic, including using their usernames and passwords. How is this
possible?- AA. The password is shared by all users, making traffic vulnerable.
- BB. A malicious user has installed a Trojan on the router.
- CC. A user has ARP spoofed the router, making all traffic broadcast to
all users. - DD. Open networks are unencrypted, making traffic easily sniffable.
12Which one of the following is not a mode of operation for the Data
Encryption Standard?- AA. CBC
- BB. CFB
- CC. OFB
- DD. AES
13Tom is tuning his security monitoring tools in an attempt to reduce
the number of alerts received by administrators without missing
important security events. He decides to configure the system to only
report failed login attempts if there are five failed attempts to access
the same account within a one-hour period of time. What term best
describes the technique that Tom is using?- AA. Thresholding
- BB. Sampling
- CC. Account lockout
- DD. Clipping
14Sally has been tasked with deploying an authentication, authorization,
and accounting server for wireless network services in her
organization and needs to avoid using proprietary technology. What
technology should she select?- AA. OAuth
- BB. RADIUS
- CC. XTACACS
- DD. TACACS+
15An accounting clerk for Christopher’s Cheesecakes does not have
access to the salary information for individual employees but wanted
to know the salary of a new hire. He pulled total payroll expenses for
the pay period before the new person was hired and then pulled the
same expenses for the following pay period. He computed the
difference between those two amounts to determine the individual’s
salary. What type of attack occurred?- AA. Aggregation
- BB. Data diddling
- CC. Inference
- DD. Social engineering
16Alice would like to have read permissions on an object and knows that
Bob already has those rights and would like to give them to herself.
Which one of the rules in the Take-Grant protection model would
allow her to complete this operation if the relationship exists between
Alice and Bob?- AA. Take rule
- BB. Grant rule
- CC. Create rule
- DD. Remote rule
17During a log review, Danielle discovers a series of logs that show login
failures:
Jan 31 11:39:12 ip-10-0-0-2 sshd[29092]: Invalid user admin from
remotehost passwd=aaaaaaaa
Jan 31 11:39:20 ip-10-0-0-2 sshd[29098]: Invalid user admin from
remotehost passwd=aaaaaaab
Jan 31 11:39:23 ip-10-0-0-2 sshd[29100]: Invalid user admin from
remotehost passwd=aaaaaaac
Jan 31 11:39:31 ip-10-0-0-2 sshd[29106]: Invalid user admin from
remotehost passwd=aaaaaaad
Jan 31 20:40:53 ip-10-0-0-254 sshd[30520]: Invalid user admin
from remotehost passwd=aaaaaaae
What type of attack has Danielle discovered?- AA. A pass-the-hash attack
- BB. A brute-force attack
- CC. A man-in-the-middle attack
- DD. A dictionary attack
18What property of a relational database ensures that two executing
transactions do not affect each other by storing interim results in the
database?- AA. Atomicity
- BB. Isolation
- CC. Consistency
- DD. Durability
19Kim is the system administrator for a small business network that is
experiencing security problems. She is in the office in the evening
working on the problem, and nobody else is there. As she is watching,
she can see that systems on the other side of the office that were
previously behaving normally are now exhibiting signs of infection.
What type of malware is Kim likely dealing with?- AA. Virus
- BB. Worm
- CC. Trojan horse
- DD. Logic bomb
20Which of the following is an industry standard for data security?
- AA. FERPA
- BB. HIPAA
- CC. SOX
- DD. PCI DSS
21Which of the following sequences properly describes the TCP threeway
handshake?- AA. SYN, ACK, SYN/ACK
- BB. PSH, RST, ACK
- CC. SYN, SYN/ACK, ACK
- DD. SYN, RST, FIN
22Which one of the following technologies is not normally a capability of
mobile device management (MDM) solutions?- AA. Remotely wiping the contents of a mobile device
- BB. Assuming control of a nonregistered BYOD mobile device
- CC. Enforcing the use of device encryption
- DD. Managing device backups
23Jim is implementing an IDaaS solution for his organization. What type
of technology is he putting in place?- AA. Identity as a service
- BB. Employee ID as a service
- CC. Intrusion detection as a service
- DD. OAuth
24Gina recently took the CISSP certification exam and then wrote a blog
post that included the text of many of the exam questions that she
experienced. What aspect of the (ISC)2 code of ethics is most directly
violated in this situation?- AA. Advance and protect the profession.
- BB. Act honorably, honestly, justly, responsibly, and legally.
- CC. Protect society, the common good, necessary public trust and
confidence, and the infrastructure. - DD. Provide diligent and competent service to principals.
25Gordon is conducting a risk assessment for his organization and
determined the amount of damage that flooding is expected to cause
to his facilities each year. What metric has Gordon identified?- AA. ALE
- BB. ARO
- CC. SLE
- DD. EF
26Greg would like to implement application control technology in his
organization. He would like to limit users to installing only approved
software on their systems. What type of application control would be
appropriate in this situation?- AA. Blacklisting
- BB. Graylisting
- CC. Whitelisting
- DD. Bluelisting
27Frank is the security administrator for a web server that provides news
and information to people located around the world. His server
received an unusually high volume of traffic that it could not handle
and was forced to reject requests. Frank traced the source of the traffic
back to a botnet. What type of attack took place?- AA. Denial of service
- BB. Reconaissance
- CC. Compromise
- DD. Malicious insider
28In the database table shown here, which column would be the best
candidate for a primary key?
- AA. Company ID
- BB. Company Name
- CC. ZIP Code
- DD. Sales Rep
29Jesse is looking at the /etc/passwd file on a system configured to use
shadowed passwords. What should she expect to see in the password
field of this file?- AA. Plaintext passwords
- BB. Encrypted passwords
- CC. Hashed passwords
- DD. x
30Bob is configuring egress filtering on his network, examining traffic
destined for the Internet. His organization uses the public address
range 12.8.195.0/24. Packets with which one of the following
destination addresses should Bob permit to leave the network?- AA. 12.8.195.15
- BB. 10.8.15.9
- CC. 192.168.109.55
- DD. 129.53.44.124
31How many possible keys exist in a cryptographic algorithm that uses
6-bit encryption keys?- AA. 12
- BB. 16
- CC. 32
- DD. 64
32What problem drives the recommendation to physically destroy SSD
drives to prevent data leaks when they are retired?- AA. Degaussing only partially wipes the data on SSDs.
- BB. SSDs don’t have data remanence.
- CC. SSDs are unable to perform a zero fill.
- DD. The built-in erase commands are not completely effective on some
SSDs.
33GAD Systems is concerned about the risk of hackers stealing sensitive
information stored on a file server. They choose to pursue a risk
mitigation strategy. Which one of the following actions would support
that strategy?- AA. Encrypting the files
- BB. Deleting the files
- CC. Purchasing cyber-liability insurance
- DD. Taking no action
34How should samples be generated when assessing account
management practices?- AA. They should be generated by administrators.
- BB. The last 180 days of accounts should be validated.
- CC. Sampling should be conducted randomly.
- DD. Sampling is not effective, and all accounts should be audited.
35The EU-U.S. Privacy Shield Framework relies on seven principles.
Which of the following correctly lists all seven?- AA. Awareness, selection, control, security, data integrity, access,
recourse and enforcement - BB. Notice, choice, accountability for onward transfer, security, data
integrity and purpose limitation, access, recourse and enforcement - CC. Privacy, security, control, notification, data integrity and purpose,
access, enforcement - DD. Submission, editing, updates, confidential, integrity, security,
access
- AA. Awareness, selection, control, security, data integrity, access,
36SYN floods rely on implementations of what protocol to cause denial
of service conditions?- AA. IGMP
- BB. UDP
- CC. TCP
- DD. ICMP
37What type of log is shown in the figure?
- AA. Firewall log
- BB. Change log
- CC. Application log
- DD. System log
38What principle states that an individual should make every effort to
complete his or her responsibilities in an accurate and timely manner?- AA. Least privilege
- BB. Separation of duties
- CC. Due care
- DD. Due diligence
39When an attacker calls an organization’s help desk and persuades
them to reset a password for them due to the help desk employee’s
trust and willingness to help, what type of attack succeeded?- AA. A human Trojan
- BB. Social engineering
- CC. Phishing
- DD. Whaling
40When a user attempts to log into their online account, Google sends a
text message with a code to their cell phone. What type of verification
is this?- AA. Knowledge-based authentication
- BB. Dynamic knowledge–based authentication
- CC. Out-of-band identity proofing
- DD. Risk-based identity proofing
41What mathematical operation, when substituted for the blank lines
shown here, would make the equations correct?
- AA. MOD
- BB. XOR
- CC. NAND
- DD. DIV
42The organization that Ben works for has a traditional onsite Active
Directory environment that uses a manual provisioning process for
each addition to their 350-employee company. As the company
adopts new technologies, they are increasingly using software as a
service applications to replace their internally developed software
stack.
Ben has been tasked with designing an identity management
implementation that will allow his company to use cloud services
while supporting their existing systems. Using the logical diagram
shown here, answer the following questions about the identity
recommendations Ben should make.
If availability of authentication services is the organization’s biggest
priority, what type of identity platform should Ben recommend?
- AA. Onsite
- BB. Cloud based
- CC. Hybrid
- DD. Outsourced
43The organization that Ben works for has a traditional onsite Active
Directory environment that uses a manual provisioning process for
each addition to their 350-employee company. As the company
adopts new technologies, they are increasingly using software as a
service applications to replace their internally developed software
stack.
Ben has been tasked with designing an identity management
implementation that will allow his company to use cloud services
while supporting their existing systems. Using the logical diagram
shown here, answer the following questions about the identity
recommendations Ben should make.
If Ben needs to share identity information with the business partner
shown, what should he investigate?- AA. Single sign-on
- BB. Multifactor authentication
- CC. Federation
- DD. IDaaS
44The organization that Ben works for has a traditional onsite Active
Directory environment that uses a manual provisioning process for
each addition to their 350-employee company. As the company
adopts new technologies, they are increasingly using software as a
service applications to replace their internally developed software
stack.
Ben has been tasked with designing an identity management
implementation that will allow his company to use cloud services
while supporting their existing systems. Using the logical diagram
shown here, answer the following questions about the identity
recommendations Ben should make.
What technology is likely to be involved when Ben’s organization
needs to provide authentication and authorization assertions to their
cloud e-commerce application?- AA. Active Directory
- BB. SAML
- CC. RADIUS
- DD. SPML
45Dave is responsible for password security in his organization and
would like to strengthen the security of password files. He would like
to defend his organization against the use of rainbow tables. Which
one of the following techniques is specifically designed to frustrate the
use of rainbow tables?- AA. Password expiration policies
- BB. Salting
- CC. User education
- DD. Password complexity policies
46Which one of the following is a single system designed to attract
attackers because it seemingly contains sensitive information or other
attractive resources?- AA. Honeynet
- BB. Darknet
- CC. Honeypot
- DD. Pseudoflaw
47When evaluating biometric devices, what is another term used to
describe the equal error rate?- AA. FAR
- BB. FRR
- CC. CER
- DD. EER
48Cable modems, ISDN, and DSL are all examples of what type of
technology?- AA. Baseband
- BB. Broadband
- CC. Digital
- DD. Broadcast
49Sean suspects that an individual in his company is smuggling out
secret information despite his company’s careful use of data loss
prevention systems. He discovers that the suspect is posting photos,
including the one shown here, to public Internet message boards.
What type of technique may the individuals be using to hide messages
inside this image?
- AA. Watermarking
- BB. VPN
- CC. Steganography
- DD. Covert timing channel
50Roger is concerned that a third-party firm hired to develop code for an
internal application will embed a backdoor in the code. The developer
retains rights to the intellectual property and will only deliver the
software in its final form. Which one of the following languages would
be least susceptible to this type of attack because it would provide
Roger with code that is human-readable in its final form?- AA. JavaScript
- BB. C
- CC. C++
- DD. Java
Information
- Description
- Good Luck!
- Author
- Requiemdust Sheena
- Language
- English
- Views
- 315
- Tags
- Rating
- 3.0 out of 5 · 1 rating Rate this quiz