Deck 3: Certified Information Systems Security Professional

Question 1

Which layer of the Open System Interconnection (OSI) model is reliant on other layers and is concerned with the structure, interpretation and handling of information?

A) Presentation Layer
B) Session Layer
C) Application Layer
D) Transport Layer

Answer 1

Transport Layer

Question 2

A group of organizations follows the same access standards and practices. One manages the verification and due diligence processes for the others. For a user to access a resource from one of the organizations, a check is made to see if that user has been certified. Which Federated Identity Management (FIM) process is this an example of?

A) One-time authentication
B) Web based access management
C) Cross-certification model
D) Bridge model

Answer 2

Cross-certification model

Question 3

When implementing a data classification program, why is it important to avoid too much granularity?

A) The process will require too many resources
B) It will be difficult to apply to both hardware and software
C) It will be difficult to assign ownership to the data
D) The process will be perceived as having value

Answer 3

The process will require too many resources

Question 4

Which of the following is the PRIMARY issue when analyzing detailed log information?

A) Logs may be unavailable when required
B) Timely review of the data is potentially difficult
C) Most systems and applications do not support logging
D) Logs do not provide sufficient details of system and individual activities

Question 5

Which of the following is a characteristic of an internal audit?

A) An internal audit is typically shorter in duration than an external audit.
B) The internal audit schedule is published to the organization well in advance.
C) The internal auditor reports to the Information Technology (IT) department
D) Management is responsible for reading and acting upon the internal audit results

Question 6

Which of the following is the MAIN reason for using configuration management?

A) To provide centralized administration
B) To reduce the number of changes
C) To reduce errors during upgrades
D) To provide consistency in security controls

Question 7

Which of the following protocols will allow the encrypted transfer of content on the Internet?

A) Server Message Block (SMB)
B) Secure copy
C) Hypertext Transfer Protocol (HTTP)
D) Remote copy

Question 8

What is the MAIN objective of risk analysis in Disaster Recovery (DR) planning?

A) Establish Maximum Tolerable Downtime (MTD) Information Systems (IS)
B) Define the variable cost for extended downtime scenarios
C) Identify potential threats to business availability
D) Establish personnel requirements for various downtime scenarios

Question 9

When writing security assessment procedures, what is the MAIN purpose of the test outputs and reports?

A) To force the software to fail and document the process
B) To find areas of compromise in confidentiality and integrity
C) To allow for objective pass or fail decisions
D) To identify malware or hidden code within the test results

Question 10

Which of the following is the MOST effective countermeasure against Man-in-the-Middle (MITM) attacks while using online banking?

A) Transport Layer Security (TLS)
B) Secure Sockets Layer (SSL)
C) Pretty Good Privacy (PGP)
D) Secure Shell (SSH)

Question 11

Which of the following is the MOST important reason for timely installation of software patches?

A) Patches are only available for a specific time
B) Attackers reverse engineer the exploit from the patch
C) Patches may not be compatible with proprietary software
D) Attackers may be conducting network analysis

Question 12

An organization allows ping traffic into and out of their network. An attacker has installed a program on the network that uses the payload portion of the ping packet to move data into and out of the network. What type of attack has the organization experienced?

A) Data leakage
B) Unfiltered channel
C) Data emanation
D) Covert channel

Question 13

Which of the following BEST describes Recovery Time Objective (RTO)?

A) Time of application resumption after disaster
B) Time of application verification after disaster.
C) Time of data validation after disaster.
D) Time of data restoration from backup after disaster.

Question 14

How should the retention period for an organization's social media content be defined?

A) By the retention policies of each social media service
B) By the records retention policy of the organization
C) By the Chief Information Officer (CIO)
D) By the amount of available storage space

Question 15

Which of the following is the MOST challenging issue in apprehending cyber criminals?

A) They often use sophisticated method to commit a crime.
B) It is often hard to collect and maintain integrity of digital evidence.
C) The crime is often committed from a different jurisdiction.
D) There is often no physical evidence involved.

Question 16

Which of the following is PRIMARILY adopted for ensuring the integrity of information is preserved?

A) Data at rest protection
B) Transport Layer Security (TLS)
C) Role Based Access Control (RBAC)
D) One-way encryption

Question 17

The adoption of an enterprise-wide Business Continuity (BC) program requires which of the following?

A) Good communication throughout the organization
B) A completed Business Impact Analysis (BIA)
C) Formation of Disaster Recovery (DR) project team
D) Well-documented information asset classification

Question 18

Which of the following BEST describes how access to a system is granted to federated user accounts?

A) With the federation assurance level
B) Based on defined criteria by the Relying Party (RP)
C) Based on defined criteria by the Identity Provider (IdP)
D) With the identity assurance level

Question 19

At a MINIMUM , audits of permissions to individual or group accounts should be scheduled

A) annually
B) to correspond with staff promotions
C) to correspond with terminations
D) continually

Question 20

Which of the following will help prevent improper session handling?

A) Ensure JavaScript and plugin support is disabled
B) Ensure that certificates are valid and fail closed
C) Ensure that tokens are sufficiently long, complex, and pseudo-random
D) Ensure that all UIWebView calls do not execute without proper input validation

Question 21

Which of the following global privacy legislation principles ensures that data handling policies and the name of the data controller are easily accessible to the public?

A) Use limitation
B) Openness
C) Purpose specification
D) Individual participation

Question 22

A company has decided that they need to begin maintaining assets deployed in the enterprise. What approach should be followed to determine and maintain ownership information to bring the company into compliance?

A) Enterprise asset management framework
B) Asset baseline using commercial off the shelf software
C) Asset ownership database using domain login records
D) A script to report active user logins on assets

Question 23

Which of the following initiates the systems recovery phase of a Disaster Recovery Plan (DRP)?

A) Evacuating the disaster site
B) Activating the organization's hot site
C) Issuing a formal disaster declaration
D) Assessing the extent of damage following the disaster

Question 24

What is the MOST important element when considering the effectiveness of a training program for Business Continuity (BC) and Disaster Recovery (DR)?

A) Management support
B) Consideration of organizational need
C) Technology used for delivery
D) Target audience

Question 25

The personal laptop of an organization executive is stolen from the office, complete with personnel and project records. Which of the following should be done FIRST to mitigate future occurrences?

A) Encrypt disks on personal laptops
B) Issue cable locks for use on personal laptops
C) Create policies addressing critical information on personal laptops
D) Monitor personal laptops for critical information

Question 26

What is the purpose of code signing?

A) The signer verifies that the software being loaded is the software originated by the signer
B) The vendor certifies the software being loaded is free of malicious code and that it was originated by the signer
C) The signer verifies that the software being loaded is free of malicious code
D) Both vendor and the signer certify the software being loaded is free of malicious code and it was originated by the signer

Question 27

Which of the following is a peer entity authentication method for Point-to-Point Protocol (PPP)?

A) Challenge Handshake Authentication Protocol (CHAP)
B) Message Authentication Code (MAC)
C) Transport Layer Security (TLS) handshake protocol
D) Challenge-response authentication mechanism

Question 28

What is the FIRST action a security professional needs to take while assessing an organization's asset security in order to properly classify and protect access to data?

A) Verify the various data classification models implemented for different environments.
B) Determine the level of access for the data and systems.
C) Verify if confidential data is protected with cryptography.
D) Determine how data is accessed in the organization.

Question 29

Which testing method requires very limited or no information about the network infrastructure?

A) White box
B) Static
C) Black box
D) Stress

Question 30

Which of the following is the FIRST thing to consider when reviewing Information Technology (IT) internal controls?

A) The risk culture of the organization
B) The impact of the control
C) The nature of the risk
D) The cost of the control

Question 31

Which of the following is the PRIMARY risk with using open source software in a commercial software construction?

A) Lack of software documentation
B) License agreements requiring release of modified code
C) Expiration of the license agreement
D) Costs associated with support of the software

Question 32

What is the MAIN reason for having a developer sign a Non-Disclosure Agreement (NDA)?

A) Signing the NDA always gives consent to the developer to access tools and privileged company information to do their work.
B) Signing the NDA allows the developer to use their developed coding methods.
C) Signing the NDA protects confidential, technical, or Intellectual Property (IP) from disclosure to others.
D) Signing the NDA is legally binding for up to one year of employment.

Question 33

Who is responsible for the protection of information when it is shared with or provided to other organizations?

A) Systems owner
B) Authorizing Official (AO)
C) Information owner
D) Security officer

Question 34

Point-to-Point Protocol (PPP) was designed to specifically address what issue?

A) A common design flaw in telephone modems
B) Speed and reliability issues between dial-up users and Internet Service Providers (ISP)
C) Compatibility issues with personal computers and web browsers
D) The security of dial-up connections to remote networks

Question 35

The application of a security patch to a product previously validate at Common Criteria (CC) Evaluation Assurance Level (EAL) 4 would

A) require an update of the Protection Profile (PP).
B) require recertification.
C) retain its current EAL rating.
D) reduce the product to EAL 3.

Question 36

When would an organization review a Business Continuity Management (BCM) system?

A) When major changes occur on systems
B) When personnel changes occur
C) Before and after Disaster Recovery (DR) tests
D) At planned intervals

Question 37

Which of the following is a security weakness in the evaluation of Common Criteria (CC) products?

A) The manufacturer can state what configuration of the product is to be evaluated
B) The product can be evaluated by labs in other countries
C) The Target of Evaluation's (TOE) testing environment is identical to the operating environment
D) The evaluations are expensive and time-consuming to perform

Question 38

During a Disaster Recovery (DR) simulation, it is discovered that the shared recovery site lacks adequate data restoration capabilities to support the implementation of multiple plans simultaneously. What would be impacted by this fact if left unchanged?

A) Recovery Point Objective (RPO)
B) Recovery Time Objective (RTO)
C) Business Impact Analysis (BIA)
D) Return on Investment (ROI)

Question 39

Which of the following will accomplish Multi-Factor Authentication (MFA)?

A) Issuing a smart card with a user-selected Personal Identification Number (PIN)
B) Requiring users to enter a Personal Identification Number (PIN) and a password
C) Performing a palm and retinal scan
D) Issuing a smart card and a One Time Password (OTP) token

Question 40

From a cryptographic perspective, the service of non-repudiation includes which of the following features?

A) Validity of digital certificates
B) Validity of the authorization rules
C) Proof of authenticity of the message
D) Proof of integrity of the message

Question 41

Which of the following is the BEST method to reduce the effectiveness of phishing attacks?

A) User awareness
B) Two-factor authentication
C) Anti-phishing software
D) Periodic vulnerability scan

Question 42

The PRIMARY purpose of accreditation is to:

A) comply with applicable laws and regulations.
B) allow senior management to make an informed decision regarding whether to accept the risk of operating the system.
C) protect an organization's sensitive data.
D) verify that all security controls have been implemented properly and are operating in the correct manner.

Question 43

Which of the following trust services principles refers to the accessibility of information used by the systems, products, or services offered to a third-party provider's customers?

A) Security
B) Privacy
C) Access
D) Availability

Question 44

Which of the following factors contributes to the weakness of Wired Equivalent Privacy (WEP) protocol?

A) WEP uses a small range Initialization Vector (IV)
B) WEP uses Message Digest 5 (MD5)
C) WEP uses Diffie-Hellman
D) WEP does not use any Initialization Vector (IV)

Question 45

Which of the following is the MOST effective practice in managing user accounts when an employee is terminated?

A) Implement processes for automated removal of access for terminated employees.
B) Delete employee network and system IDs upon termination.
C) Manually remove terminated employee user-access to all systems and applications.
D) Disable terminated employee network ID to remove all access.

Question 46

Which of the following authorization standards is built to handle Application Programming Interface (API) access for Federated Identity Management (FIM)?

A) Remote Authentication Dial-In User Service (RADIUS)
B) Terminal Access Controller Access Control System Plus (TACACS+)
C) Open Authorization (OAuth)
D) Security Assertion Markup Language (SAML)

Question 47

Between which pair of Open System Interconnection (OSI) Reference Model layers are routers used as a communications device?

A) Transport and Session
B) Data-Link and Transport
C) Network and Session
D) Physical and Data-Link

Question 48

The PRIMARY outcome of a certification process is that it provides documented

A) interconnected systems and their implemented security controls.
B) standards for security assessment, testing, and process evaluation.
C) system weakness for remediation.
D) security analyses needed to make a risk-based decision.

Question 49

Which of the following is the BEST defense against password guessing?

A) Limit external connections to the network
B) Disable the account after a limited number of unsuccessful attempts
C) Force the password to be changed after an invalid password has been entered
D) Require a combination of letters, numbers, and special characters in the password

Question 50

An external attacker has compromised an organization's network security perimeter and installed a sniffer onto an inside computer. Which of the following is the MOST effective layer of security the organization could have implemented to mitigate the attacker's ability to gain further information?

A) Implement packet filtering on the network firewalls
B) Install Host Based Intrusion Detection Systems (HIDS)
C) Require strong authentication for administrators
D) Implement logical network segmentation at the switches

Question 51

Which of the following needs to be included in order for High Availability (HA) to continue operations during planned system outages?

A) Redundant hardware, disk spanning, and patching
B) Load balancing, power reserves, and disk spanning
C) Backups, clustering, and power reserves
D) Clustering, load balancing, and fault-tolerant options

Question 52

Which factors MUST be considered when classifying information and supporting assets for risk management, legal discovery, and compliance?

A) System owner roles and responsibilities, data handling standards, storage and secure development lifecycle requirements
B) Data stewardship roles, data handling and storage standards, data lifecycle requirements
C) Compliance office roles and responsibilities, classified material handling standards, storage system lifecycle requirements
D) System authorization roles and responsibilities, cloud computing standards, lifecycle requirements

Question 53

Which of the following is the MOST important activity an organization performs to ensure that security is part of the overall organization culture?

A) Perform formal reviews of security incidents.
B) Work with senior management to meet business goals.
C) Ensure security policies are issued to all employees.
D) Manage a program of security audits.

Question 54

Which of the following is a weakness of Wired Equivalent Privacy (WEP)?

A) Length of Initialization Vector (IV)
B) Protection against message replay
C) Detection of message tampering
D) Built-in provision to rotate keys

Question 55

Which of the following is a common feature of an Identity as a Service (IDaaS) solution?

A) Single Sign-On (SSO) authentication support  
B) Privileged user authentication support
C) Password reset service support
D) Terminal Access Controller Access Control System (TACACS) authentication support

Question 56

During examination of Internet history records, the following string occurs within a Unique Resource Locator (URL): http://www.companysite.com/products/products.asp?productid=123 or 1=1 What type of attack does this indicate?

A) Directory traversal
B) Structured Query Language (SQL) injection  
C) Cross-Site Scripting (XSS)
D) Shellcode injection

Question 57

A user downloads a file from the Internet, then applies the Secure Hash Algorithm 3 (SHA-3) to it. Which of the following is the MOST likely reason for doing so?

A) It verifies the integrity of the file.
B) It checks the file for malware.
C) It ensures the entire file downloaded.
D) It encrypts the entire file.

Question 58

What is the MOST common component of a vulnerability management framework?

A) Risk analysis
B) Patch management
C) Threat analysis
D) Backup management

Question 59

Which of the following is the key requirement for test results when implementing forensic procedures?

A) The test results must be cost-effective.
B) The test result must be authorized.
C) The test results must be quantifiable.
D) The test results must be reproducible.

Question 60

Which of the following BEST describes an access control method utilizing cryptographic keys derived from a smart card private key that is embedded within mobile devices?

A) Derived credential
B) Temporary security credential
C) Mobile device credentialing service
D) Digest authentication

Question 61

When in the Software Development Life Cycle (SDLC) MUST software security functional requirements be defined?

A) After the system preliminary design has been developed and the data security categorization has been performed
B) After the vulnerability analysis has been performed and before the system detailed design begins
C) After the system preliminary design has been developed and before the data security categorization begins
D) After the business functional analysis and the data security categorization have been performed

Question 62

What is the foundation of cryptographic functions?

A) Cipher
B) Encryption
C) Hash
D) Entropy

Question 63

How does Encapsulating Security Payload (ESP) in transport mode affect in the Internet Protocol (IP)?

A) Authenticates the IP payload and selected portions of the IP header
B) Encrypts and optionally authenticates the complete IP packet
C) Encrypts and optionally authenticates the IP header, but not the IP payload
D) Encrypts and optionally authenticates the IP payload, but not the IP header

Question 64

Which of the following provides the MOST secure method for Network Access Control (NAC)?

A) Media Access Control (MAC) filtering
B) 802.1X authentication
C) Application layer filtering
D) Network Address Translation (NAT)

Question 65

Which of the following sets of controls should allow an investigation if an attack is not blocked by preventive controls or detected by monitoring?

A) Logging and audit trail controls to enable forensic analysis
B) Security incident response lessons learned procedures
C) Security event alert triage done by analysts using a Security Information and Event Management (SIEM) system
D) Transactional controls focused on fraud prevention

Question 66

Which one of the following affects the classification of data?

A) Assigned security label
B) Multilevel Security (MLS) architecture
C) Minimum query size
D) Passage of time

Question 67

Which of the following provides for the STRONGEST protection of data confidentiality in a Wi-Fi environment?

A) Wi-Fi Protected Access (WPA) + Temporal Key Integrity Protocol (TKIP)
B) Wi-Fi Protected Access 2 (WPA2) + Advanced Encryption Standard (AES)
C) Wi-Fi Protected Access 2 (WPA2) + Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP)
D) Wired Equivalent Privacy (WEP) + Advanced Encryption Standard (AES)

Question 68

Which of the following is the BEST reason for the use of security metrics?

A) They ensure that the organization meets its security objectives.
B) They provide an appropriate framework for Information Technology (IT) governance.
C) They speed up the process of quantitative risk assessment.
D) They quantify the effectiveness of security processes.

Question 69

How is it possible to extract private keys securely stored on a cryptographic smartcard?

A) Bluebugging
B) Focused ion-beam
C) Bluejacking
D) Power analysis

Question 70

Which of the following are the FIRST two steps to securing employees from threats involving workplace violence and acts of terrorism?

A) Physical barriers impeding unauthorized access and security guards at each entrance
B) Physical barriers and the ability to identify people as they enter the workplace
C) Security guards and metal detectors posted at each entrance
D) Metal detectors and the ability to identify people as they enter the workplace

Question 71

Which of the following is the MOST important security goal when performing application interface testing?

A) Confirm that all platforms are supported and function properly
B) Evaluate whether systems or components pass data and control correctly to one another
C) Verify compatibility of software, hardware, and network connections
D) Examine error conditions related to external interfaces to prevent application details leakage

Question 72

Which of the following is the MOST appropriate action when reusing media that contains sensitive data?

A) Erase
B) Sanitize
C) Encrypt
D) Degauss

Question 73

Change management policies and procedures belong to which of the following types of controls?

A) Directive
B) Detective
C) Corrective
D) Preventative

Question 74

A security professional should ensure that clients support which secondary algorithm for digital signatures when a Secure Multipurpose Internet Mail Extension (S/MIME) is used?

A) Triple Data Encryption Standard (3DES)
B) Advanced Encryption Standard (AES)
C) Digital Signature Algorithm (DSA)
D) Rivest-Shamir-Adleman (RSA)

Question 75

Why are packet filtering routers used in low-risk environments?

A) They are high-resolution source discrimination and identification tools
B) They are fast and flexible, and protect against Internet Protocol (IP) spoofing
C) They are fast, flexible, and transparent
D) They enforce strong user authentication and audit log generation

Question 76

A Virtual Machine (VM) environment has five guest Operating Systems (OS) and provides strong isolation. What MUST an administrator review to audit a user's access to data files?

A) Host VM monitor audit logs
B) Guest OS access controls
C) Host VM access controls
D) Guest OS audit logs

Question 77

A financial company has decided to move its main business application to the Cloud. The legal department objects, arguing that the move of the platform should comply with several regulatory obligations such as the General Data Protection (GDPR) and ensure data confidentiality. The Chief Information Security Officer (CISO) says that the cloud provider has met all regulations requirements and even provides its own encryption solution with internally-managed encryption keys to address data confidentiality. Did the CISO address all the legal requirements in this situation?

A) No, because the encryption solution is internal to the cloud provider.
B) Yes, because the cloud provider meets all regulations requirements.
C) Yes, because the cloud provider is GDPR compliant.
D) No, because the cloud provider is not certified to host government data.

Question 78

What is the expected outcome of security awareness in support of a security awareness program?

A) Awareness activities should be used to focus on security concerns and respond to those concerns accordingly
B) Awareness is not an activity or part of the training but rather a state of persistence to support the program
C) Awareness is training. The purpose of awareness presentations is to broaden attention of security.
D) Awareness is not training. The purpose of awareness presentation is simply to focus attention on security.

Question 79

Users require access rights that allow them to view the average salary of groups of employees. Which control would prevent the users from obtaining an individual employee's salary?

A) Limit access to predefined queries
B) Segregate the database into a small number of partitions each with a separate security level
C) Implement Role Based Access Control (RBAC)
D) Reduce the number of people who have access to the system for statistical purposes

Question 80

An organization lacks a data retention policy. Of the following, who is the BEST person to consult for such requirement?

A) Application Manager
B) Database Administrator
C) Privacy Officer
D) Finance Manager