Question 1

What is the PRIMARY purpose for an organization to conduct a security audit?

Accepted Answer

The primary purpose of a security audit is to ensure that an organization is applying security controls effectively to mitigate identified risks, thereby protecting its assets and information.

Question 2

Which of the following is the PRIMARY benefit of a formalized information classification program?

Accepted Answer

A formalized information classification program helps in identifying the value and sensitivity of information, which is crucial for conducting effective risk assessments.

Question 3

What is the PRIMARY role of a scrum master in agile development?

Accepted Answer

The primary role of a scrum master is to facilitate the agile process, ensuring the team adheres to agile practices and principles, and to help manage the process of software delivery, rather than making technical decisions like choosing languages or tools.

Question 4

What is the second phase of Public Key Infrastructure (PKI) key/certificate life-cycle management?

Accepted Answer

The second phase of PKI key/certificate life-cycle management is the "Issued Phase," where the certificate is actually issued and becomes active after the initialization phase.

Question 5

An Intrusion Detection System (IDS) is based on the general hypothesis that a security violation is associated with a pattern of system usage, which can be

Accepted Answer

The answer of An Intrusion Detection System (IDS) is based...

Question 6

A security engineer is tasked with implementing a new identity solution. The client doesn't want to install or maintain the infrastructure. Which of the following would qualify as the BEST solution?

Accepted Answer

The answer of A security engineer is tasked with implementing...

Question 7

What is the second step in the identity and access provisioning lifecycle?

Accepted Answer

The answer of What is the second step in the...

Question 8

A system with Internet Protocol (IP) address 10.102.10.2 has a physical address of 00:00:08:00:12:13:14:2f. The following static entry is added to its Address Resolution Protocol (ARP) table: 10.102.10.6: 00:00:08:00:12:13:14:2f. What form of attack could this represent?

Accepted Answer

This represents a masquerading attack, also known as ARP spoofing, where the attacker associates their MAC address with the IP address of another device (10.102.10.6), causing packets intended for 10.102.10.6 to be sent to 10.102.10.2 instead.

Question 9

What should be used immediately after a Business Continuity Plan (BCP) has been invoked?

Accepted Answer

Emergency procedures should be used immediately after a BCP has been invoked to address the immediate actions needed to manage the incident and ensure safety and continuity.

Question 10

What is a common mistake in records retention?

Accepted Answer

Adopting a retention policy with the longest requirement period can lead to unnecessary storage costs and potential legal risks if data is kept longer than needed.

Question 11

Which of the following MUST a security policy include to be effective within an organization?

Accepted Answer

A security policy must include disciplinary measures for non-compliance to ensure that there are consequences for violating the policy, which helps enforce adherence and maintain security standards within the organization.

Question 12

Which of the following is a credible source to validate that security testing of Commercial Off-The-Shelf (COTS) software has been performed with international standards?

Accepted Answer

Common Criteria (CC) is an internationally recognized framework for evaluating the security features and capabilities of IT products, including COTS software, against defined standards.

Question 13

Which of the following is MOST appropriate for protecting confidentially of data stored on a hard drive?

Accepted Answer

AES is a strong encryption standard widely used for securing data, making it most appropriate for protecting the confidentiality of data stored on a hard drive.

Question 14

What is the PRIMARY objective of an application security assessment?

Accepted Answer

The primary objective of an application security assessment is to identify vulnerabilities within the application to ensure it is secure against potential threats.

Question 15

Sensitive customer data is going to be added to a database. What is the MOST effective implementation for ensuring data privacy?

Accepted Answer

The answer of Sensitive customer data is going to be...

Question 16

When designing a vulnerability test, which one of the following is likely to give the BEST indication of what components currently operate on the network?

Accepted Answer

Mapping tools are specifically designed to discover and identify the components and devices operating on a network, providing a comprehensive view of the network's current state.

Question 17

Which of the following is the BEST technique to facilitate secure software development?

Accepted Answer

The answer of Which of the following is the BEST...

Question 18

The implementation of which features of an identity management system reduces costs and administration overhead while improving audit and accountability?

Accepted Answer

The answer of The implementation of which features of an...

Question 19

Which of the following techniques is effective to detect taps in fiber optic cables?

Accepted Answer

The answer of Which of the following techniques is effective...

Question 20

An important principle of defense in depth is that achieving information security requires a balanced focus on which PRIMARY elements?

Accepted Answer

Defense in depth emphasizes a balanced approach to information security by integrating people, technology, and operations to create multiple layers of defense.

Exam 3: Certified Information Systems Security Professional