CISSP (10TH Edition) Practice Exam 1 (125 questions) TEST

1. If a security mechanism offers availability, then it offers a high level of assurance that authorized subjects can _____________________ the data, objects, and resources. A. Control B. Audit C. Access D. Repudiate

C

2. Which of the following statements is false? A. Security governance is the collection of practices related to supporting, defining, and directing the security efforts of an organization. B. Security governance is the implementation of a security solution and a management method that are tightly interconnected. C. Security governance is an IT issue only. D. Security governance directly oversees and gets involved in all levels of security.

C

3. One of the first and most important security planning steps is to consider the overall security control framework or structure of the security solution desired by the organization. Which of the following frameworks establish a U.S. government-wide program designed to standardize the security assessment, authorization, and continuous monitoring processes for cloud products and services used by federal agencies? A. FedRAMP B. Cybersecurity Framework C. ISO 27001 D. Center for Internet Security

A

3a. The _____________________ is designed for critical infrastructure and commercial organizations. A. FedRAMP B. Cybersecurity Framework C. ISO 27001 D. Center for Internet Security

B

3b. ______________ establishes guidelines for implementing an information security management system (ISMS) but is nation- and industry-agnostic. A. FedRAMP B. Cybersecurity Framework C. ISO 27001 D. Center for Internet Security

C

3c. Which security method provides OS, applications, and hardware security configuration guides for a wide range of products? A. FedRAMP B. Cybersecurity Framework C. ISO 27001 D. Center for Internet Security

D

4. The DREAD risk rating system is designed to provide a flexible rating solution that is based on the answers to five main questions about each threat. Which of the following are the subjects of those questions? (Choose all that apply.) A. Exploitability B. Elevation of privilege C. Damage (potential) D. Repudiation E. Affected users F. Discoverability G. Denial of service H. Reproducibility

A, C, E, F, H

5. Third-party governance is the system of external entity oversight that may be mandated by law, regulation, industry standards, contractual obligation, or licensing requirements. Often third-party assessment is necessary to evaluate the security of a supply chain. Which of the following means of third-party assessment is used to interview personnel and observe their operating habits? A. On-site assessment B. Document exchange and review C. Process/policy review D. Third-party audit

A

6. No one control can protect against all possible threats. Using a multilayered solution allows for numerous, different controls to guard against whatever threats come to pass. Which of the following is the most important and distinctive concept in relation to layered security? A. Multiple B. Series C. Parallel D. Filter

B

7. You are updating the employee termination procedures in order to reduce risk and avoid liability. A few recent termination events did not go well, which resulted in several very uncomfortable confrontations between the to-be-fired employee and the company leadership. When an employee is to be terminated, which of the following should be done? A. Inform the employee a few hours before they are officially terminated. B. Disable the employee's network access just as they are informed of the termination. C. Send out a broadcast email informing everyone that a specific employee is to be terminated. D. Wait until the manager and the employee are the only people remaining in the building before announcing the termination.

B

8. What term is used to reference the different lenses through which organizations and individuals can view and address risks? A. Risk response B. Risk perspectives C. Risk register D. Risk acceptance

B

9. Which of the following is not an element of the risk analysis process? A. Analyzing an environment for risks B. Creating a cost/benefit report for safeguards to present to upper management C. Selecting appropriate safeguards and implementing them D. Evaluating each threat event as to its likelihood of occurring and cost of the resulting damage

C

10. There is a risk that an avalanche may damage your $3 million manufacturing facility. Experts claim that there is a 5% chance that an avalanche will occur each year. They further advise you that an avalanche would completely destroy your building. Your business insurance will cover the loss, but such coverage would require you to rebuild on the same land. The building and its contents account for 90% of the value of the facility; the remainder is attributed to the land itself. What is the single loss expectancy of your shipping facility to avalanches? A. $3 million B. $2,700,000 C. $270,000 D. $135,000

B

11. Which of the following best describes an access control category that includes hiring and firing policies, data classifications and labels, and security awareness and training? A. Administrative access controls B. Technical access controls C. Logical access controls D. Physical access controls

A

12. Which of the following is true? A. A security control should only support external monitoring. B. If a security control's benefits cannot be quantified, evaluated, or compared, then it does not actually provide any security. C. Measuring the effectiveness of a countermeasure is always an absolute value. D. Most countermeasures offer specific hard numbers as to the number of breaches prevented or attack attempts thwarted.

B

13. Your organization has a strictly enforced email security policy that attempts to block problematic messages. However, you have received a message which seems odd and notice several concerning characteristics. Which of the following are indicators that this message is a hoax? (Choose three.) A. Claimed sender confirms they did not send the message B. Use of poor grammar C. Lack of correct spelling D. Threat of damage to your computer system E. Encouragement to take specific steps to resolve a concern F. Claim to be from a trusted authority G. Inclusion of hyperlinks in the body of the message

A, D, E

14. The CISO has put you in charge of improving the security awareness and training program. The concern they want you to focus on is that it is unknown whether the training efforts are having any effect or benefit. If you cannot establish proof of a positive return on security investment (ROSI), then the program will be terminated. Which of the following would be useful in establishing an effectiveness evaluation procedure? (Choose all that apply.) A. Taking attendance B. Administering a quiz immediately after the awareness event C. Requiring workers to pay $10 for each security incident they are involved in D. Having workers take a test 6 months after a training class E. Collecting key security indicators that relate to insider security incidents over time F. Posting a list of employees who cause a security incident on the primary bulletin board in the break room

B, D, E

15. The Roscommon Rangers baseball team is concerned about the risk that a storm might result in the cancellation of a baseball game. There is a 30% chance that the storm will occur, and if it does, the team must refund all single-game tickets because the game cannot be rescheduled. Season ticket holders will not receive a refund and account for 20% of ticket sales. The ticket sales for the game are $1,500,000. What is the single loss expectancy in this scenario? A. $300,000 B. $1,050,000 C. $1,200,000 D. $1,500,000

C

16. Patricia recently discovered that passwords to systems and user accounts belonging to her organization were for sale on the dark web. She believes that she knows the individual who stole and is selling those passwords and wishes to contact law enforcement. What law has most likely been violated? A. Electronic Communications Privacy Act B. Computer Fraud and Abuse Act C. Federal Sentencing Guidelines D. National Infrastructure Protection Act

B

17. What U.S. federal law prohibits attempts to circumvent copyright protection mechanisms placed on a protected work by the copyright holder? A. Digital Millennium Copyright Act B. Trade Secrets Act C. Copyright Enhancement Act D. USA PATRIOT Act

A

18. Barry is the privacy officer for a college that accepts federal funds. He is reviewing the security of student educational records and wants to ensure that his college is compliant with all relevant laws and regulations. What law protects the privacy rights of students? A. HIPAA B. SOX C. GLBA D. FERPA

D

19. An organization plans to donate several older computers to a local school. Chad will sanitize the hard drives in these computers. Which of the following methods is Chad most likely to use? A. Erasing B. Clearing C. Purging D. Overwriting

C

20. Which of the following choices would be the most important consideration when identifying the classification of assets? A. Value of the asset B. Value of the data it holds or processes C. Security controls used to protect the asset D. The user of the assets

B

21. You are creating a data policy identifying data that should be destroyed at the end of its life cycle. You want to stress one of the problems that can result from incomplete sanitization. Which of the following statements correctly identifies a problem statement you should add? A. Methods are not available to remove data, ensuring that unauthorized personnel cannot retrieve data. B. Even fully incinerated media can offer extractable data. C. Personnel can perform sanitization steps improperly. D. Stored data is physically etched into the media.

C

22. A small business is planning to outsource payroll. This requires the business to pass some data to the payroll company to handle payroll functions. In this scenario, which of the following roles best describes the payroll company? A. Data controller B. Data subject C. Data processor D. Data custodian

C

23. A grocery store chain collects customer data used in a customer loyalty program. When registering, customers fill out a lengthy form about themselves. The chain uses this data to email customers and allows customers to claim discounts when checking out using their customer loyalty cards. Which of the following identifies a best practice to reduce risks when implementing this program? A. Data retention B. Data labeling C. Collection limitation D. Destruction

C

24. You need to identify a method to embed unobtrusive labels in digital data. After they are embedded, other methods should be able to detect these labels. Which of the following is the best choice to meet these requirements? A. Watermarking B. Remanence C. Signature D. Encryption

A

25. An organization is decommissioning several older computers and replacing them with new ones. The CIO wants to ensure that data remanence is not a problem with the hard disk drives within these computers. Which of the following methods will most likely result in data remanence? A. Clearing B. Purging C. Cryptoshredding D. Erasing

D

26. Which of the following best describes the difference between end of support (EOS) and end of life (EOL)? A. EOL identifies when a vendor will no longer support a product, and EOS identifies when a vendor will no longer offer a product for sale. B. EOL identifies when an organization destroyed a product, and EOS identifies when a vendor stopped selling a product. C. EOS identifies when a product is removed from service, and EOL identifies when a product is destroyed. D. EOS identifies when a vendor will no longer support a product, and EOL identifies when a vendor will no longer produce or offer a product for sale.

D

27. Which of the following actions is the best method to protect data in transit? A. Disk-level encryption B. Column-level encryption C. Purging memory buffers D. Network-level encryption

D

28. Your company is planning to launch an e-commerce website. Management wants to ensure this website has adequate security controls in place before the site goes live. Administrators started with a baseline of security controls. What else should be a primary consideration related to security controls? A. Identifying the data controller B. Identifying the data processor C. Selecting a standard D. Preventing data loss

C

29. Your organization has a database that includes residents of the EU. Management wants to transfer this to a third party for research and aggregation, but they want to modify the data so it can be transferred without GDPR compliance problems. Which of the following techniques will meet these requirements? A. Pseudonymization B. Anonymization C. Tokenization D. None of the above

B

30. You recently wrote and published a book on how to pass the CISSP exam. You want to protect your rights under copyright law. Which of the following would you use? A. DLP B. DRM C. CASB D. EOS

B

31. Which of the following actions, when made to a file, would result in a change in the hash value created by running the SHA-2 algorithm against the contents of that file? (Choose all that apply.) A. Changing a single character in the file B. Removing a line from the file C. Adding a blank line to end of the file D. Backing up the file

A, B, C

32. What is the maximum key length supported by the Advanced Encryption Standard's Rijndael encryption algorithm? A. 128 bits B. 192 bits C. 256 bits D. 512 bits

C

33. Which of the following is the best method to protect against rainbow-table attacks? A. Encrypting passwords sent over the network B. Enabling firewalls C. Locking out accounts D. Salting passwords

D

34. What protocol replaces certificate revocation lists with a real-time method of verifying the status of a digital certificate? A. SAE B. LDAP C. OCSP D. BGP

C

35. You are deploying a new product into the production environment. It is a self-contained next-generation firewall (NGFW), which should be able to filter unwanted traffic by keyword, application, and protocol. You position the new device between the client network segment and the server network segment. However, once it is installed, users report that they can no longer access company servers or the Internet. What is the potential cause of this issue? A. There is poor network segmentation. B. The firewall is a fail-open solution. C. The new device has secure defaults. D. The new product is a closed system.

C

36. "Trust but verify" is a security approach that leaves an organization vulnerable to insider attacks and grants intruders the ability to easily perform lateral movement among internal systems. Often, this approach depends on an initial authentication process to gain access to the internal "secured" environment, and then relies on generic access control methods. What new security approach replaces trust but verify? A. Keep it simple B. Zero trust C. Fail securely D. Privacy by design

B

37. Security needs to be designed, architected, engineered, integrated, and implemented to be reliable and cost-effective. There are numerous security design principles that can be adopted and woven into the crafting of company policies as well as deployed solutions. Which of the following are considered secure design principles? (Choose all that apply.) A. People are the weakest link B. Least privilege C. Secure defaults D. Fail securely E. Security is always top priority F. Threat modeling G. Keep it simple H. Risk should be eliminated I. Separation of Duties J. Zero Trust K. Privacy by design

B, C, D, F, G, I, J, K

38. An industrial processing facility has implemented SCADA systems to monitor and manage the mission-critical production lines. These ICSs cannot adhere to the company's 14-day patch application policy. How can these systems be secured to minimize malware infection? A. Prohibit unauthorized nonessential software from executing. B. Implement software firewalls. C. Deploy the devices in a screened subnet. D. Use an IDS.

A

39. Your organization has decided to update their IT environment to take advantage of advancements in virtualization solutions. They are primarily focused on containerization products. Which of the following are features or capabilities of some containerization solutions? (Choose all that apply.) A. Operate a full guest OS within a cell. B. Allow for multiple concurrent applications within a single container. C. Automate the processes of network monitoring and response. D. Offer customization of interaction between applications in separate containers.

B, D

40. A large manufacturer is deploying various sensors and devices throughout its operation to monitor and remotely control certain aspects of its operations. It is essential that all data collected by these devices be analyzed on a central server. What type of system is likely being installed? A. Edge computing B. MSSP C. Microservices D. Fog computing

D

41. Which of the following is typically not a culprit in causing damage to computer equipment in the event of a fire and a triggered suppression? A. Heat B. Suppression medium C. Smoke D. Light

D

42. Mark approaches the building where he works. At the door a small black box is attached to the wall. Mark retrieves an object from his pocket and waves it near the black box. The door to the building unlocks and opens automatically. Once Mark reaches his work area, he sits down at the desk in front of his workstation. He takes the same object he used earlier to enter the building and slides it into a slot on the side of his keyboard. The computer wakes up, and he is prompted for a password. The two events of authentication performed by Mark are known as? A. "Something you have" B. "Something you are" C. "Something you know" D. "Something you can do"

A

43. An important reason to maintain separate work areas between different levels of employees is the prevention of which of the following? A. Collision B. Collusion C. Shoulder surfing D. Loss of portable storage devices

C

44. Your facility has just been upgraded with a new burglar alarm system. This intrusion monitoring mechanism is able to detect both perimeter breaches as well as internal movement. Which of the following is not a typical type of alarm that can be triggered for physical security? A. Preventive B. Deterrent C. Repellant D. Notification

A

45. Your organization has recently decided to allow workers to telecommute from home. However, the CISO requires that the connections be protected by encryption using a standard VPN solution. Which of the following secure protocols can be used as a VPN? (Choose all that apply.) A. Kerberos B. IPSec C. SSH D. Signal E. TLS F. S-RPC

B, C, E

46. Your organization is considering an upgrade of the internal network to support IPv6. You have been asked to provide an evaluation of the benefits and drawbacks of this project. Which of the following are true in regard to IPv6? (Choose all that apply.) A. Uses 32 bit addresses B. Uses 16-byte addresses C. Reserves an entire subnet for loopback D. Supports autoconfiguration without DHCP E. Requires NAT to convert between internal and external addresses F. Supports quality of service (QoS) priority values

B, D, F

47. Johnnie is learning about the network protocol stack. While evaluating the Data Link and Network layers she notices a protocol, ARP, that is indicated as operating in between those layers. What function does ARP perform in typical network communications? A. It is a routing protocol. B. It resolves IP addresses into MAC addresses. C. It resolves logical addresses into an FQDN. D. It manages multicasting streaming.

B

48. A worker attempts to use a 15-year-old laptop under the BYOD policy of his organization. When connecting to the company Wi-Fi network, it shows connectivity, but there is no network access. The network admin confirms that the WAP is requiring WPA3. No other worker is reporting a problem with their mobile device. What is the cause of this connection problem? A. The WAP's antenna are disconnected. B. The DHCP has a reservation for the MAC address of the laptop. C. DLP is blocking access. D. The laptop supports only WEP and WPA.

D

49. Xzavier has been tasked with redesigning the network to minimize the risk related to users in one department accessing the systems in another. Which of the following is not used to segment a network? A. Screened subnet B. VPN C. VLAN D. ISFW

B

50. Which of the following are technologies specifically defined as part of 802.11 wireless networking? (Choose all that apply.) A. 802.1X B. WPA3 C. SAE D. 802.11i E. WPS

B, C, D, E

51. While traveling, a worker connects their company-issued computer to a hotel Wi-Fi network, rather than the cellular data service included with the system. After checking email, performing online research, posting a message to a company discussion forum, and updating his itinerary in the company scheduling service, the worker disconnects. A few days later, the company experiences an intrusion and trade secrets are stolen by an unknown attacker. The incident investigation revealed that the credentials used to gain access to company during the breach belonged to the remote worker. What was the cause of the company compromise? A. Social engineering B. Not using a 4G or 5G link C. Pivoting D. ARP poisoning

B

52. A review of end-user and endpoint security has uncovered the concern that most systems will indefinitely display confidential data on the screen even when a user is no longer sitting at the workstation. How should this issue be resolved? A. Enforce screen savers after a timeout B. Implement MFA C. Implement TEMPEST countermeasures D. Require WPA3

A

53. Michael has been asked to perform an analysis of company network traffic to look for anomalies, inefficiencies, or potential vulnerabilities. You were asked to specifically divide your assessment report into two sections, one focusing on east-west traffic and the other on north-south traffic. What do those terms mean? [reconstructed] A. East-west traffic is the traffic flow that occurs between servers/resource hosts and clients/endpoint devices. North-south traffic is the traffic flow that occurs between the layers of the OSI stack. B. East-west traffic is the traffic flow that occurs within a specific network, data center, or cloud environment. North-south traffic is the traffic flow that occurs inbound or outbound between internal systems and external systems. C. East-west traffic is the traffic flow that occurs inbound or outbound between internal systems and external systems. North-south traffic is the traffic flow that occurs within a specific network, data center, or cloud environment. D. East-west traffic is the traffic flow that occurs between wireless and wired network segments. North-south traffic is the traffic flow that occurs between cloud regions in different geographic zones.

B

54. Transmission media is used to carry network traffic. This can include copper wires, fiber-optic cables, and radio waves. What are the three media management or control modes that can be used on typical transmission media? (Choose all that apply.) A. Full-duplex B. Simplex C. 802.1X D. Half-duplex E. Multiplexing

A, B, D

55. A security manager is implementing technologies to prohibit rogue devices from gaining network access. After they install a network access control (NAC), what additional tool would be able to ensure that only known and authenticated systems gain connectivity? A. IEEE 802.1X B. PFX C. CRL D. PEAP

A

56. Wireless clients connect to the private network through a firewall after being properly authenticated by authentication, authorization, and accounting (AAA) services. The network uses both TACACS+ and RADIUS. What ports should be open to support the logon process? A. TCP 389 and UDP 53 B. UDP 1812 and TCP 49 C. TCP 49 and UDP 162 D. UDP 19 and TCP 3389

B

57. A worker reports that they are unable to access an internal web application from their workstation. After you confirm that the worker has been assigned correct authorization, you review the logs from the workstation for clues. You discover the following entries: 2020-01-08 12:15:36 DROP TCP 192.168.6.104 192.168.255.255 443 ---------- RECEIVE 2020-01-08 12:15:51 DROP UDP 192.168.6.104 192.168.255.255 443 ---------- RECEIVE Based on this information, which of the following should you adjust to address this situation? A. Host-based firewall B. VLAN membership C. WAF D. Proxy

A

58. While performing a risk assessment, you need to create a list of threats. You are focusing on email as an asset, but you then realize email can be used as a weapon as well. What is it called when email itself is used as an attack mechanism? A. Masquerading B. Mail-bombing C. Spoofing D. Smurf attack

B

59. Remi is evaluating several multimedia collaboration products for use in her company. She needs to determine which products provide the best solution for her organization's business objectives. The product will be used in-house as well as by remote workers using broadband internet services. Which of the following questions should she ask when evaluating each option? (Choose all that apply.) A. Does the communication occur across an open protocol or an encrypted tunnel? B. Are icons and graphics used as avatars in the user profiles? C. Does the service use strong authentication techniques? D. Are activities of users audited and logged? E. What tracking mechanisms are used, can the tracking be disabled, and what is the data collected for? F. What is the minimum bandwidth requirement for chat and voice services?

A, C, D, E

60. Telecommuting is performing work at a remote location. Telecommuting clients use many remote access techniques to establish connectivity to the central office LAN. Which of the following are examples of a remote access techniques? (Choose all that apply.) A. Remote node operation B. Cross-site request forgery C. Remote control D. Port address translation E. Service specific

A, C, E

61. While researching the deployment of a new firewall solution, you realize that it supports several services that could benefit your organization that you did not initially consider evaluating when making the firewall selection. Which of the following is a benefit of NAT? (Choose all that apply.) A. Hiding the internal IP addressing scheme B. Sharing a few public Internet addresses with a large number of internal clients C. Using the private IP addresses from RFC 1918 on an internal network D. Filtering network traffic to prevent brute-force attacks

A, B, C

62. The previous PSTN system is being replaced by a VoIP solution. The CEO wants a briefing of the benefits of the technology. Which of the following is not a typical security concern with VoIP? A. VLAN hopping B. Caller ID falsification C. Vishing D. Remote dialing

A

63. Your company has just initiated an IPSec policy that requires all systems to request an encrypted session for each communication. While attempting to monitor the network, you want to configure a capture filter in Wireshark to collect just the IPSec negotiations. At which OSI model layer does the IPSec protocol function? A. Data Link B. Transport C. Session D. Network

D

64. Users normally log on with a username and password. Management wants to increase security by adding an authentication method in the something you are category. Which of the following is the best choice? A. A smartcard B. The maiden name of the user's mother C. Fingerprints D. A PIN

C

65. Administrators are installing a database application on a server in the server room. Management wants to ensure only authorized personnel can access the server and modify any of the application settings. Which of the following is the best choice of a logical access control that can help meet this goal? [reconstructed] A. Authentication B. Authorization C. Single sign-on D. Turnstile

B

66. An administrator reset the password expiration for 7 days. Which of the following is a benefit of this change? A. It prevents users from reusing the same passwords. B. It forces all active users to change their password within a week. C. It identifies the minimum age of a password. D. It identifies the lockout period after a user enters the incorrect password time.

B

67. Which of the following is in the something you have factor of authentication and doesn't generate a password? A. A TOTP authenticator B. An HOTP authenticator device C. An HOTP authenticator app D. Smartcard

D

68. A bank has a website that allows customers to log on and access their accounts, pay bills, and transfer funds. Of the following choices, when should online customer sessions automatically be closed? A. Never B. After 5 minutes C. After an hour of inactivity D. After 2 minutes of inactivity

D

69. A customer created an online saving account using a web browser. Before the bank created the account, it asked the customer a series of questions about past addresses where they'd lived and current payment amounts for their car and mortgage. Which of the following best describes this process? A. A cognitive password B. Knowledge-based authentication C. Registration D. Two-factor authentication

B

70. An organization wants to enforce strong passwords, with most users logging on with a single set of credentials. Which of the following is the best choice to meet these needs? A. Single sign-on B. Password policy C. Service accounts D. Tokens

A

71. A software company with a worldwide footprint recently bought out another software company based in the United States. The U.S. company needs to maintain its name and domain infrastructure. However, employees in both companies need to access resources in the other network. Which of the following would best meet this need? A. A federation B. Session management C. Credential management D. Single sign-on

A

72. Security administrators suspect that many users have excessive privileges due to creeping privileges. What can be used to verify this? A. Account provisioning B. Disabling an account C. Account review D. Account revocation

C

73. A company's security policy states that user accounts should be disabled during the exit interview for any employee leaving the company. Which of the following is the most likely reason for this policy? A. To prevent supervisors from accessing the employee's data B. To ensure employees return company property C. To terminate employee benefits D. To retain the decryption key

D

74. Attackers have exploited the KRBTGT account in an organization's domain. What will this allow them to do? A. Create golden tickets B. Create silver tickets C. Run Python scripts D. Identify accounts with Kerberos preauthentication disabled

A

75. Firewalls use a set of administrator-defined filters. Which of the following access control models does this describe? A. Rule-based access control B. Role-based access control (RBAC) C. Mandatory access control (MAC) D. Attribute-based access control (ABAC)

A

76. A small business owner has created a network to support employees. When an employee creates a file, the employee is the owner and can assign access to the file. Which of the following access control models does this describe? A. Mandatory access control (MAC) B. Rule-based access control C. Discretionary access control (DAC) D. Role-based access control (RBAC)

C

77. IT personnel are concerned that attackers may take over some Internet of Things (IoT) devices on the network's border. They want to ensure that any malicious traffic from these devices is blocked. Which of the following access control models has the best chance of blocking this traffic? A. Attribute-based access control (ABAC) B. Mandatory access control (MAC) C. Role-based access control (RBAC) D. Risk-based access control

D

78. A junior administrator is installing an application on a Windows server. The application needs to run in the context of an account with specific privileges. Which of the following is the best choice? A. LocalSystem account B. Service account C. Administrator account D. Sudo account

B

79. Which of the following is the best choice to support authentication and authorization in federated organizations? A. Kerberos B. Hypertext Markup Language (HTML) C. Extensible Markup Language (XML) D. Security Assertion Markup Language (SAML)

D

80. Which of the following AAA services does Remote Authentication Dial-in User Service (RADIUS) provide? (Choose three.) A. Authentication B. Availability C. Authorization D. Accounting

A, C, D

81. When performing access review audits, which type of account is the most important to audit? A. None is more important. They are all equal. B. Regular user accounts. C. Auditor accounts. D. Privileged accounts.

D

82. What contractual obligation requires credit card merchants to report the potential compromise of credit card data? A. GLBA B. Sarbanes-Oxley C. FERPA D. PCI DSS

D

83. Mark is planning to conduct a penetration test against his organization's systems and is documenting the tactics he will use. Which one of the following would not be considered a penetration testing best practice? A. Mimicking attacks previously perpetrated against your system B. Performing the attacks without management's consent C. Using manual and automated attack tools D. Reconfiguring the system to resolve any discovered vulnerabilities

B

84. What type of network discovery scan attempts to simulate an already open network connection? A. TCP connect scan B. Xmas scan C. TCP SYN scan D. TCP ACK scan

D

85. Kevin is conducting a software assessment and does not have access to the underlying source code. What type of test is he performing? A. Static testing B. White-box testing C. Gray-box testing D. DAST

D

86. Juniper Enterprises' data center lies in a 500-year FEMA flood plain. What is the likelihood that a flood will affect the data center in any given year? A. 1% B. 5% C. 0.2% D. 0.1%

C

87. What type of interface testing would identify flaws in a program's ability to interact with other programs via web services? A. Application programming interface testing B. User interface testing C. Physical interface testing D. Security interface testing

A

88. Victoria is conducting a third-party audit of a cloud service provider and is preparing to generate a SOC audit report. During her engagement, she limited her review to assessing the organization's controls that might impact the accuracy of financial reporting. What type of engagement did she conduct under SSAE 18? A. SOC 1 B. SOC 2 C. SOC 3 D. SOC 4

A

89. Tom is preparing to conduct a penetration test and would like to use a testing framework that allows him to easily deploy exploits. Which one of the following tools would best meet his needs? A. Nessus B. Nmap C. sqlmap D. Metasploit

D

90. Jon is testing a new software application. He has developed a list of possible ways that an attacker might exploit the application and is now working through each scenario, testing the application to see if it is vulnerable to that exploit. What type of testing is Jon conducting? A. Test coverage analysis B. Fagan inspection C. Synthetic transactions D. Misuse case testing

D

91. Eric is conducting a compliance check to determine whether controls in his organization are effectively enforcing credit card processing requirements. What security standard would be most appropriate for this check? A. HIPAA B. GLBA C. PCI DSS D. SOX

C

92. Which one of the following techniques would be the least effective way to perform backup verification? A. Interview of backup administrator B. Review of system logs C. Restoration of requested files D. Inspection of hash values

A

93. Which one of the following tools is specifically designed to identify database vulnerabilities in web applications? A. Nessus B. Nexpose C. QualysGuard D. sqlmap

D

94. Which one of the following third-party frameworks is commonly used during audits of information technology systems? A. COBIT B. ATT&CK C. Cyber Kill Chain D. PCI DSS

A

95. An administrator is tasked with provisioning eight computers for new software developers. Each computer needs the same applications and settings. Which of the following is the easiest method of provision these computers? A. Setting up the computers individually B. Using baselines C. Implementing change management processes D. Using images

D

96. An organization wants to reduce vulnerabilities against fraud from malicious employees. Of the following choices, what would help with this goal? (Choose three.) A. Job rotation B. Segregation of duties C. Mandatory vacations D. Baselining

A, B, C

97. Security administrators want to implement a method to identify when personnel are using elevated privileges, and detect violations of the least privilege principle. Which of the following is the best choice to meet these requirements? A. Privileged account management B. Review of security logs C. Review of inactive accounts D. Traffic analysis

A