Question 1

When in the Software Development Life Cycle (SDLC) MUST software security functional requirements be defined?

Accepted Answer

The answer of When in the Software Development Life Cycle...

Question 2

What is the foundation of cryptographic functions?

Accepted Answer

The answer of What is the foundation of cryptographic functions?
...

Question 3

How does Encapsulating Security Payload (ESP) in transport mode affect in the Internet Protocol (IP)?

Accepted Answer

In transport mode, ESP encrypts and optionally authenticates only the IP payload, leaving the IP header unchanged.

Question 4

Which of the following provides the MOST secure method for Network Access Control (NAC)?

Accepted Answer

The answer of Which of the following provides the MOST...

Question 5

Which of the following sets of controls should allow an investigation if an attack is not blocked by preventive controls or detected by monitoring?

Accepted Answer

The answer of Which of the following sets of controls...

Question 6

Which one of the following affects the classification of data?

Accepted Answer

The answer of Which one of the following affects the...

Question 7

Which of the following provides for the STRONGEST protection of data confidentiality in a Wi-Fi environment?

Accepted Answer

The answer of Which of the following provides for the...

Question 8

Which of the following is the BEST reason for the use of security metrics?

Accepted Answer

The answer of Which of the following is the BEST...

Question 9

How is it possible to extract private keys securely stored on a cryptographic smartcard?

Accepted Answer

The answer of How is it possible to extract private...

Question 10

Which of the following are the FIRST two steps to securing employees from threats involving workplace violence and acts of terrorism?

Accepted Answer

The answer of Which of the following are the FIRST...

Question 11

Which of the following is the MOST important security goal when performing application interface testing?

Accepted Answer

The answer of Which of the following is the MOST...

Question 12

Which of the following is the MOST appropriate action when reusing media that contains sensitive data?

Accepted Answer

The answer of Which of the following is the MOST...

Question 13

Change management policies and procedures belong to which of the following types of controls?

Accepted Answer

The answer of Change management policies and procedures belong to...

Question 14

A security professional should ensure that clients support which secondary algorithm for digital signatures when a Secure Multipurpose Internet Mail Extension (S/MIME) is used?

Accepted Answer

The answer of A security professional should ensure that clients...

Question 15

Why are packet filtering routers used in low-risk environments?

Accepted Answer

The answer of Why are packet filtering routers used in...

Question 16

A Virtual Machine (VM) environment has five guest Operating Systems (OS) and provides strong isolation. What MUST an administrator review to audit a user's access to data files?

Accepted Answer

To audit a user's access to data files in a VM environment with strong isolation, the administrator must review the access controls of the specific guest OS where the data files reside.

Question 17

A financial company has decided to move its main business application to the Cloud. The legal department objects, arguing that the move of the platform should comply with several regulatory obligations such as the General Data Protection (GDPR) and ensure data confidentiality. The Chief Information Security Officer (CISO) says that the cloud provider has met all regulations requirements and even provides its own encryption solution with internally-managed encryption keys to address data confidentiality. Did the CISO address all the legal requirements in this situation?

Accepted Answer

The CISO did not fully address the legal requirements because using internally-managed encryption keys by the cloud provider may not satisfy data confidentiality concerns, as the keys are not controlled by the company itself.

Question 18

What is the expected outcome of security awareness in support of a security awareness program?

Accepted Answer

Awareness is not training; it is meant to focus attention on security issues, making individuals more conscious of security practices.

Question 19

Users require access rights that allow them to view the average salary of groups of employees. Which control would prevent the users from obtaining an individual employee's salary?

Accepted Answer

The answer of Users require access rights that allow them...

Question 20

An organization lacks a data retention policy. Of the following, who is the BEST person to consult for such requirement?

Accepted Answer

The Privacy Officer is responsible for ensuring that the organization complies with data protection laws and regulations, which includes establishing data retention policies.

Exam 3: Certified Information Systems Security Professional