Dump - 4

What should happen when an emergency change to a system must be performed?

Which of the following is the BEST approach to take in order to effectively incorporate the concepts of business continuity into the organization?

HOTSPOT Which Web Services Security (WS-Security) specification maintains a single authenticated identity across multiple dissimilar environments? Click on the correct specification in the image below.

Which of the following has the GREATEST impact on an organization's security posture?

The application of which of the following standards would BEST reduce the potential for data breaches?

In order for a security policy to be effective within an organization, it MUST include

Which of the following roles has the obligation to ensure that a third party provider is capable of processing and handling data in a secure manner and meeting the standards set by the organization?

To protect auditable information, which of the following MUST be configured to only allow read access?

What type of encryption is used to protect sensitive data in transit over a network?

Which of the following entities is ultimately accountable for data remanence vulnerabilities with data replicated by a cloud service provider?

Which of the following is a recommended alternative to an integrated email encryption system?

In the Open System Interconnection (OSI) model, which layer is responsible for the transmission of binary data over a communications network?

What is the PRIMARY goal for using Domain Name System Security Extensions (DNSSEC) to sign records?

While inventorying storage equipment, it is found that there are unlabeled, disconnected, and powered off devices. Which of the following is the correct procedure for handling such equipment?

The PRIMARY characteristic of a Distributed Denial of Service (DDoS) attack is that it

Which of the following is generally indicative of a replay attack when dealing with biometric authentication?

During a fingerprint verification process, which of the following is used to verify identity and authentication?

The BEST example of the concept of "something that a user has" when providing an authorized user access to a computing system is

A security professional is asked to provide a solution that restricts a bank teller to only perform a savings deposit transaction but allows a supervisor to perform corrections after the transaction. Which of the following is the MOST effective solution?

Sensitive customer data is going to be added to a database. What is the MOST effective implementation for ensuring data privacy?

DRAG DROP Order the below steps to create an effective vulnerability management process.

Which of the following types of security testing is the MOST effective in providing a better indication of the everyday security challenges of an organization when performing a security risk assessment?

What is the MOST effective method of testing custom application code?

Which one of the following is a common risk with network configuration management?

What type of test assesses a Disaster Recovery (DR) plan using realistic disaster scenarios while maintaining minimal impact to business operations?

How can lessons learned from business continuity training and actual recovery incidents BEST be used?

HOTSPOT Which Web Services Security (WS-Security) specification handles the management of security tokens and the underlying policies for granting access? Click on the correct specification in the image below.

An Intrusion Detection System (IDS) has recently been deployed in a Demilitarized Zone (DMZ). The IDS detects a flood of malformed packets. Which of the following BEST describes what has occurred?

In configuration management, what baseline configuration information MUST be maintained for each computer system?

Which Radio Frequency Interference (RFI) phenomenon associated with bundled cable runs can create information leakage?

An Org. information security strategic plan MUST be reviewed

When building a data classification scheme, which of the following is the PRIMARY concern?

Which technology is a prerequisite for populating the cloud-based directory in a federated identity solution?

What is an advantage of Elliptic Curve Cryptography (ECC)?

Backup information that is critical to the organization is identified through a

When using Generic Routing Encapsulation (GRE) tunneling over Internet Protocol version 4 (IPv4), where is the GRE header inserted?

An application developer is deciding on the amount of idle session time that the application allows before a timeout. The BEST reason for determining the session timeout requirement is

Knowing the language in which an encrypted message was originally produced might help a cryptanalyst to perform a

During the Security Assessment and Authorization process, what is the PRIMARY purpose for conducting a hardware and software inventory?

When evaluating third-party applications, which of the following is the GREATEST responsibility of Information Security?

An employee of a retail company has been granted an extended leave of absence by Human Resources (HR). This information has been formally communicated to the access provisioning team. Which of the following is the BEST action to take?

The goal of a Business Impact Analysis (BIA) is to determine which of the following?

What does the Maximum Tolerable Downtime (MTD) determine?

What is a characteristic of Secure Socket Layer (SSL) and Transport Layer Security (TLS)?

How does a Host Based Intrusion Detection System (HIDS) identify a potential attack?

From a cryptographic perspective, the service of non-repudiation includes which of the following features?

Which of the following BEST represents the concept of least privilege?

When designing a vulnerability test, which one of the following is likely to give the BEST indication of what components currently operate on the network?

Which of the following approaches is the MOST effective way to dispose of data on multiple hard drives?

Which of the following is the BEST method to reduce the effectiveness of phishing attacks?

The PRIMARY purpose of accreditation is to:

Which of the following is a weakness of Wired Equivalent Privacy (WEP)?

When writing security assessment procedures, what is the MAIN purpose of the test outputs and reports?

Which of the following is the MAIN reason for using configuration management?

Which of the following is BEST suited for exchanging authentication and authorization messages in a multi-party decentralized environment?

Which of the following is MOST important when deploying digital certificates?

A user sends an e-mail request asking for read-only access to files that are not considered sensitive. A Discretionary Access Control (DAC) methodology is in place. Which is the MOST suitable approach that the administrator should take?

How should an organization determine the priority of its remediation efforts after a vulnerability assessment has been conducted?

Which of the following is the MOST important consideration when developing a Disaster Recovery Plan (DRP)?

A proxy firewall operates at what layer of the Open System Interconnection (OSI) model?

Which of the following restricts the ability of an individual to carry out all the steps of a particular process?

Although code using a specific program language may not be susceptible to a buffer overflow attack,

What is the BEST way to encrypt web application communications?

Which of the following are effective countermeasures against passive network-layer attacks?

What is the MOST important element when considering the effectiveness of a training program for Business Continuity (BC) and Disaster Recovery (DR)?

DRAG DROP Match the name of access control model with its associated restriction. Drag each access control model to its appropriate restriction access on the right.

A database administrator is asked by a high-ranking member of management to perform specific changes to the accounting system database. The administrator is specifically instructed to not track or evidence the change in a ticket. Which of the following is the BEST course of action?

Which of the following is the MOST important goal of information asset valuation?

Which of the following is a strategy of grouping requirements in developing a Security Test and Evaluation (ST&E)?

Which one of the following activities would present a significant security risk to organizations when employing a Virtual Private Network (VPN) solution?

Which of the following BEST describes a chosen plaintext attack?

For network based evidence, which of the following contains traffic details of all network sessions in order to detect anomalies?

Which of the following is the PRIMARY reason to perform regular vulnerability scanning of an organization network?

Which of the following would BEST describe the role directly responsible for data within an organization?

The restoration priorities of a Disaster Recovery Plan (DRP) are based on which of the following documents?

A security architect plans to reference a Mandatory Access Control (MAC) model for implementation. This indicates that which of the following properties are being prioritized?

A vulnerability in which of the following components would be MOST difficult to detect?

During which of the following processes is least privilege implemented for a user account?

Which of the following is a document that identifies each item seized in an investigation, including date and time seized, full name and signature or initials of the person who seized the item, and a detailed description of the item?

Which of the following is needed to securely distribute symmetric cryptographic keys?

Reciprocal backup site agreements are considered to be

In which identity management process is the subject's identity established?

In order to assure authenticity, which of the following are required?

At which layer of the Open Systems Interconnect (OSI) model are the source and destination address for a datagram handled?

An organization regularly conducts its own penetration tests. Which of the following scenarios MUST be covered for the test to be effective?

A company was ranked as high in the following National Institute of Standards and Technology (NIST) functions: Protect, Detect, Respond and Recover. However, a low maturity grade was attributed to the Identify function. In which of the following the controls categories does this company need to improve when analyzing its processes individually?

What is the difference between media marking and media labeling?

What balance MUST be considered when web application developers determine how informative application error messages should be constructed?

What operations role is responsible for protecting the enterprise from corrupt or contaminated media?

Which of the following is a characteristic of the initialization vector when using Data Encryption Standard (DES)?

DRAG DROP Match the access control type to the example of the control type. Drag each access control type net to its corresponding example.

In general, servers that are facing the Internet should be placed in a demilitarized zone (DMZ). What is MAIN purpose of the DMZ?

Network-based logging has which advantage over host-based logging when reviewing malicious activity about a victim machine?

Which of the following is the PRIMARY reason for employing physical security personnel at entry points in facilities where card access is in operation?

Between which pair of Open System Interconnection (OSI) Reference Model layers are routers used as a communications device?

Which type of security testing is being performed when an ethical hacker has no knowledge about the target system but the testing target is notified before the test?

Which of the following countermeasures is the MOST effective in defending against a social engineering attack?

Which of the following information MUST be provided for user account provisioning?

Which of the following adds end-to-end security inside a Layer 2 Tunneling Protocol (L2TP) Internet Protocol Security (IPSec) connection?

A company has decided that they need to begin maintaining assets deployed in the enterprise. What approach should be followed to determine and maintain ownership information to bring the company into compliance?