Dump - 8

Which of the following is applicable to a publicly held company concerned about information handling and storage requirement specific to the financial reporting?

Which of the following is used to detect steganography?

Which is the MOST critical aspect of computer-generated evidence?

Which of the following media is LEAST problematic with data remanence?

Which open standard could l large corporation deploy for authorization services for single sign-on (SSO) use across multiple internal and external application?

Which of the following statements is TRUE regarding equivalence class testing?

A large corporation is looking for a solution to automate access based on where the request is coming from, who the user is, what device they are connecting with, and what and time of day they are attempting this access. What type of solution would suit their needs?

Which of the following techniques is MOST useful when dealing with Advanced persistent Threat (APT) intrusions on live virtualized environments?

Which of the following MUST an organization do to effectively communicate is security strategy to all affected parties?

When using Security Assertion markup language (SAML), it is assumed that the principal subject

A vulnerability assessment report has been submitted to a client. The client indicates that one third of the hosts that were in scope are missing from the report. In which phase of the assessment was this error MOST likely made?

Which of the below strategies would MOST comprehensively address the risk of malicious insiders leaking sensitive information?

What is the FIRST step required in establishing a records retention program?

Functional security testing is MOST critical during which phase of the system development life cycle (SDLC)?

What is the threat modeling order using process for Attack simulation and threat analysis (PASTA)?

Which is the RECOMMENDED configuration mode for sensors for an intrusion prevention system (IPS) if the prevention capabilities will be used?

An organization implements a remote access server (RAS), Once users connect to the server, digital certificates are used to authenticate their identity. What type of extensible Authentication protocol (EAP) would the organization use during this authentication?

An analysis finds unusual activity coming from a computer that was thrown away several months prior, which of the following steps ensure the proper removal of the system?

As a security manger which of the following is the MOST effective practice for providing value to an organization?

DRAG DROP Rank the Hypertext Transfer protocol (HTTP) authentication types shows below in order of relative strength. Drag the authentication type on the correct positions on the right according to strength from weakest to strongest.

Which of the following BEST provides for non-repudiation od user account actions?

What type of access control determines the authorization to resource based on pre-defined job titles within an organization?

As users switch roles within an organization, their accounts are given additional permissions to perform the duties of their new position. After a recent audit, it was discovered that many of these accounts maintained their old permissions as well. The obsolete permissions identified by the audit have been remediated and accounts have only the appropriate permissions to complete their jobs.

Continuity of operations is BEST supported by which of the following?

Which of the following is true of Service Organization Control (SOC) reports?

What testing technique enables the designer to develop mitigation strategies for potential vulnerabilities?

Asymmetric algorithms are used for which of the following when using Secure Sockets Layer/Transport Layer Security (SSL/TLS) for implementing network security?

What is the MOST common component of a vulnerability management framework?

A new Chief Information Officer (CIO) created a group to write a data retention policy based on applicable laws. Which of the following is the PRIMARY motivation for the policy?

What determines the level of security of a combination lock?

A user downloads a file from the Internet, then applies the Secure Hash Algorithm 3 (SHA-3c?

Which of the following is held accountable for the risk to organizational systems and data that result from outsourcing Information Technology (IT) systems and services?

Which of the following is the BEST definition of Cross-Site Request Forgery (CSRF)?

Which of the following is a process in the access provisioning lifecycle that will MOST likely identify access aggregation issues?

Which of the following is the PRIMARY reason a sniffer operating on a network is collecting packets only from its own host?

Which of the following is the final phase of the identity and access provisioning lifecycle?

Which of the following is mobile device remote fingerprinting?

Which of the following trust services principles refers to the accessibility of information used by the systems, products, or services offered to a third-party provider's customers?

Which of the following open source software issues pose the MOST risk to an application?

Which of the following is the PRIMARY mechanism used to limit the range of objects available to a given subject within different execution domains?

Once the types of information have been identified, who should an information security practitioner work with to ensure that the information is properly categorized?

What should be the FIRST action for a security administrator who detects an intrusion on the network based on precursors and other indicators?

Which of the following needs to be taken into account when assessing vulnerability?

For the purpose of classification, which of the following is used to divide trust domain and trust boundaries?

Which of the following is the key requirement for test results when implementing forensic procedures?

An application team is running tests to ensure that user entry fields will not accept invalid input of any length. What type of negative testing is this an example of?

An Internet software application requires authentication before a user is permitted to utilize the resource. Which testing scenario BEST validates the functionality of the application?

Which of the following techniques BEST prevents buffer overflows?

A security architect is responsible for the protection of a new home banking system. Which of the following solutions can BEST improve the confidentiality and integrity of this external system?

A security professional recommends that a company integrate threat modeling into its Agile development processes. Which of the following BEST describes the benefits of this approach?

A security consultant has been hired by a company to establish its vulnerability management program. The consultant is now in the deployment phase. Which of the following tasks is part of this process?

Directive controls are a form of change management policy and procedures. Which of the following subsections are recommended as part of the change management process?

Which of the following BEST describes how access to a system is granted to federated user accounts?

Which of the following is the primary advantage of segmenting Virtual Machines (VM) using physical networks?

Which of the following would an internal technical security audit BEST validate?

Which of the following processes has the PRIMARY purpose of identifying outdated software versions, missing patches, and lapsed system updates?

A development operations team would like to start building new applications delegating the cybersecurity responsibility as much as possible to the service provider. Which of the following environments BEST fits their need?

Change management policies and procedures belong to which of the following types of controls?

What access control scheme uses fine-grained rules to specify the conditions under which access to each data item or applications is granted?

Why is planning the MOST critical phase of a Role Based Access Control (RBAC) implementation?

Vulnerability scanners may allow for the administrator to assign which of the following in order to assist in prioritizing remediation activities?

In order for application developers to detect potential vulnerabilities earlier during the Software Development Life Cycle (SDLC), which of the following safeguards should be implemented FIRST as part of a comprehensive testing framework?

Physical assets defined in an organization's Business Impact Analysis (BIA) could include which of the following?

What is the best way for mutual authentication of devices belonging to the same organization?

Which of the following encryption types is used in Hash Message Authentication Code (HMAC) for key distribution?

Compared with hardware cryptography, software cryptography is generally

A financial company has decided to move its main business application to the Cloud. The legal department objects, arguing that the move of the platform should comply with several regulatory obligations such as the General Data Protection (GDPR) and ensure data confidentiality. The Chief Information Security Officer (CISO) says that the cloud provider has met all regulations requirements and even provides its own encryption solution with internally-managed encryption keys to address data confidentiality. Did the CISO address all the legal requirements in this situation?

An employee receives a promotion that entities them to access higher-level functions on the company's accounting system, as well as keeping their access to the previous system that is no longer needed or applicable. What is the name of the process that tries to remove this excess privilege?

Which of the following is PRIMARILY adopted for ensuring the integrity of information is preserved?

Why might a network administrator choose distributed virtual switches instead of stand-alone switches for network segmentation?

An organization has implemented a new backup process which protects confidential data by encrypting the information stored on backup tapes. Which of the following is a MAJOR data confidentiality concern after the implementation of this new backup process?

Organization A is adding a large collection of confidential data records that it received when it acquired Organization B to its data store. Many of the users and staff from Organization B are no longer available. Which of the following MUST Organization A 0do to property classify and secure the acquired data?

An organization has a short-term agreement with a public Cloud Service Provider (CSP). Which of the following BEST protects sensitive data once the agreement expires and the assets are reused?

Which of the following techniques is effective to detect taps in fiber optic cables?

When would an organization review a Business Continuity Management (BCM) system?

Which of the following is a characteristic of the independent testing of a program?

Which of the following MUST be considered when developing business rules for a data loss prevention (DLP) solution?

What is the BEST approach for maintaining ethics when a security professional is unfamiliar with the culture of a country and is asked to perform a questionable task?

Which of the following activities is MOST likely to be performed during a vulnerability assessment?

Which of the following is the BEST defense against password guessing?

Why would a security architect specify that a default route pointing to a sinkhole be injected into internal networks?

Which one of the following documentation should be included in a Disaster Recovery (DR) package?

How long should the records on a project be retained?

Which of the following phases involves researching a target's configuration from public sources when performing a penetration test?

Which of the following provides the BEST method to verify that security baseline configurations are maintained?

Which attack defines a piece of code that is inserted into software to trigger a malicious function?

Which of the following is the MOST critical success factor in the security patch management process?

A security professional should consider the protection of which of the following elements FIRST when developing a defense-in-depth strategy for a mobile workforce?

Which of the following is the BEST technique to facilitate secure software development?

What is the MAIN reason to ensure the appropriate retention periods are enforced for data stored on electronic media?

For a federated identity solution, a third-party Identity Provider (IdP) is PRIMARILY responsible for which of the following?

What is the BEST way to correlate large volumes of disparate data sources in a Security Operations Center (SOC) environment?

Which of the following steps should be conducted during the FIRST phase of software assurance in a generic acquisition process?

Assume that a computer was powered off when an information security professional arrived at a crime scene. Which of the following actions should be performed after the crime scene is isolated?

Which of the following is used to support the concept of defense in depth during the development phase of a software product?

An organization is considering outsourcing applications and data to a Cloud Service Provider (CSP). Which of the following is the MOST important concern regarding privacy?

Individual access to a network is BEST determined based on

The MAIN task of promoting security for Personal Computers (PC) is

The Secure Shell (SSH) version 2 protocol supports.

To control the scope of a Business Continuity Management (BCM) system, a security practitioner should identify which of the following?