There are four ways of dealing with risk. In the graphic that follows, which method is missing and what is the purpose of this method?

Which of the following is not a reason to develop and implement a disaster recovery plan?

A number of factors should be considered when assigning values to assets. Which of the following is not used to determine the value of an asset?

What is the chief security responsibility of a data owner?

Which of the following approaches is the most effective way for an organization to reduce its liability regarding the protection of private data?

Virtualization offers many benefits. Which of the following incorrectly describes virtualization?

Operating systems have evolved and changed over the years. The earlier operating systems were monolithic and did not segregate critical processes from noncritical processes. As time went on, operating system vendors started to reduce the amount of programming code that ran in kernel mode. Only the absolutely necessary code ran in kernel mode, and the remaining operating system code ran in user mode. This architecture introduced performance issues, which required the operating system vendors to reduce the critical operating system functionality to microkernels and allow the remaining operating system functionality to run in client/server models within kernel mode.

Which of the following best describes the last architecture described in this scenario?

There are several components involved with steganography. Which of the following refers to a file that has hidden information in it?

The CA is responsible for revoking certificates when necessary. Which of the following correctly describes a CRL and OCSP?

What is the difference between generating a message authentication code (MAC) and generating a hash MAC (HMAC)?

When a system needs to send data to an end user, that data may have to travel over different networking protocols to get to the destination. The different protocol types depend upon how far geographically the data needs to travel, the types of intermediate devices involved, and how this data needs to be protected during transmission. In the following graphic, which two WAN protocols are missing, and what is the best reasoning for their functionality in the transmission scenario being illustrated?

Which of the following does software-defined networking (SDN) technology specify?

Which of the following describes the best use of Network Access Control (NAC)?

There are several different types of centralized access control protocols. Which of the following is illustrated in the graphic that follows?

Claudia is the CISO for a global financial institution, overseeing the security of hundreds of millions of bank accounts. Which of the three main security principles should she consider most important when prioritizing the controls her enterprise should deploy?

How can a backup strategy be made most effective?

Why is “test coverage” an important consideration during an audit?

Countries around the world are focusing on cyber warfare and how it can affect their utility and power grid infrastructures. Securing water, power, oil, gas, transportation, and manufacturing systems is an increasing priority for governments. These critical infrastructures are made up of different types of industrial control systems (ICS) that provide this type of functionality. Which of the following answers is not considered a common ICS?

The operations team is responsible for defining which data gets backed up and how often. Which type of backup process backs up files that have been modified since the last time all data was backed up?

Maria has been tasked with reviewing and ultimately augmenting her organization’s physical security. Of the following controls and approaches, which should be her highest priority to ensure are properly implemented?

The following graphic contains a commonly used risk management scorecard. Identify the proper quadrant and its description.

With what phase of a business continuity plan does a company proceed when it is ready to move back into its original site or a new site?

The Zachman Architecture Framework is often used to set up an enterprise security architecture. Which of the following does not correctly describe the Zachman Framework?

Which is the most valuable technique when determining if a specific security control should be implemented?

When protecting information assets, which of the following security controls is most effective for data in motion?

Which security architecture model defines how to securely develop access rights between subjects and objects?

As with logical access controls, audit logs should be produced and monitored for physical access controls. Which of the following statements is correct about auditing physical access?

Which of the following incorrectly describes steganography?

There are several different types of technologies within cryptography that provide confidentiality. What is represented in the graphic that follows?

Why is it important to understand the life cycle of cryptography and your cryptographic needs?

Which of the following does NOT describe IP telephony security?

Determining the geographic location of a client IP address in order to route it toward the most proximal topological source of web content is an example of what technology?

What is the greatest weakness, and hence concern, with virtualized networks?

An access control matrix is used in many operating systems and applications to control access between subjects and objects. What is the column in this type of matrix referred to as?

Which of the following is an example of a credential management system, also known as an identity management (IdM) system?

What is a synthetic transaction?

Which of the following statements is true with respect to vulnerability tests versus penetration tests?

John is responsible for providing a weekly report to his manager outlining the week’s security incidents and mitigation steps. What steps should he take if a report has no information?

After a disaster occurs, a damage assessment needs to take place. Which of the following steps occurs last in a damage assessment?

Which of the following statements is true with respect to preventing and/or detecting security disasters?

What are the three types of policies that are missing from the following graphic?

What is the missing second step in the graphic that follows?

John has been told to report to the board of directors with a vendor-neutral enterprise architecture framework that will help the company reduce fragmentation that results from the misalignment of IT and business processes. Which of the following frameworks should he suggest?

Which of the following is the LEAST important stage in the life-cycle management of information?

When protecting information assets, which of the following security controls is most effective for data at rest?

Operating systems can be programmed to carry out different methods for process isolation. Which of the following refers to a method in which an interface defines how communication can take place between two processes and no process can interact with the other’s internal programming code?

An outline for a physical security design should include program categories and the necessary countermeasures for each. What category do locks and access controls belong to?

Which of the following correctly describes a drawback of symmetric key systems?

There are several different types of important architectures within public key infrastructures. Which architecture does the graphic that follows represent?

Which of the following are services that cryptosystems can provide?

When an organization splits naming zones, the names of its hosts that are accessible only from an intranet are hidden from the Internet. Which of the following best describes why this is done?

Which of the following protocols or set of protocols is used in Voice over IP (VoIP) for caller identification?

Which of the following does NOT correctly describe a directory service?

What technology within identity management is illustrated in the graphic that follows?

Which of the following attributes is used to biometrically authenticate a user’s identity?

Why are security metrics so important as performance and/or risk indicators?

Which of the following types of tests involves discursive explorations of existing response procedures, based on a likely adverse scenario, designed to determine if desired outcomes will result?

Brian, a security administrator, is responding to a virus infection. The antivirus application reports that a file has been infected with a dangerous virus and disinfecting it could damage the file. What course of action should Brian take?

Of the following plans, which establishes senior management and a headquarters after a disaster?

Miranda has been directed to investigate a possible violation of her organization’s acceptable use policy (AUP) by a coworker suspected of running cryptocurrency mining software on his desktop system. Which of the following is NOT a very likely scenario that could arise during her investigation?

List in the proper order from the table shown the learning objectives that are missing and their proper definitions.

Different threats need to be evaluated and ranked based upon their severity of business risk when developing a BCP. Which ranking approach is illustrated in the graphic that follows?

The Information Technology Infrastructure Library (ITIL) consists of five sets of instructional books. Which of the following is considered the core set and focuses on the overall planning of the intended IT services?

Which of the following are effective methods of preventing data remanence on solid-state devices (SSDs)?

i. Clearing
ii. Purging
iii. Degaussing
iv. Destruction

Which of the following is the LEAST effective security control regarding sensitive data stored on mobile devices?

Which of the following is not a responsibility of the memory manager?

What discipline combines the physical environment and the sociology issues that surround it to reduce crime rates and the fear of crime?

Which of the following occurs in a PKI environment?

There are different ways of providing integrity and authentication within cryptography. What type of technology is shown in the graphic that follows?

Which of the following statements is true with respect to the physical security of distribution and storage facilities?

Which of the following best describes why e-mail spoofing is easily executed?

Encryption can happen at different layers of an operating system and network stack. Where does PPTP encryption take place?

Hannah has been assigned the task of installing web access management (WAM) software. What is the best description for what WAM is commonly used for?

There are different ways that specific technologies can create one-time passwords for authentication purposes. What type of technology is illustrated in the graphic that follows?

Within biometric authentication, what is a Type II error rate?

When providing a security report to management, which of the following is the most important component?

Camellia has just concluded a security audit of some critical services within her environment and the state of the controls deployed to protect them. She has the results of a battery of technical tests and must now organize them into a written report to her chain of management. In analyzing these results, what must her immediate goal be?

Guidelines should be followed to allow secure remote administration. Which of the following is not one of those guidelines?

Gizmos and Gadgets has restored its original facility after a disaster. What should be moved in first?

What type of risk analysis approach does the following graphic provide?

Sean has been hired as business continuity coordinator. He has been told by management that he needs to ensure that the company is in compliance with the ISO/IEC standard that pertains to technology readiness for business continuity. He has also been instructed to find a way to transfer the risk of being unable to carry out critical business functions for a period of time because of a disaster. Which of the following is most likely the standard that Sean has been asked to comply with?

Sarah and her security team have carried out many vulnerability tests over the years to locate the weaknesses and vulnerabilities within the systems on the network. The CISO has asked her to oversee the development of a threat model for the network. Which of the following best describes what this model is and what it would be used for?

The requirement of erasure is the end of the media life cycle if the media contains sensitive information. Which of the following best describes purging?

In the modern era, are paper records still a significant concern in the protection of enterprise data assets? If so, why? If not, why not?

Frank is responsible for the security of his company’s online applications, web servers, and web-based activities. The web applications have the capability of being dynamically “locked” so that multiple users cannot edit a web page at the same time and overwrite each other’s work. An audit uncovered that although this software-locking capability was properly configured, multiple users were still able to modify the same web page at the same time. Which of the following best describes what is taking place in this situation?

David is preparing a server room at a new branch office. What locking mechanisms should he use for the primary and secondary server room entry doors?

Which of the following correctly describes the difference between public key cryptography and public key infrastructure?

A widely used family of symmetric algorithms is called block ciphers. When these types of algorithms are being used, a message that needs to be encrypted is segmented into individual blocks and each block is encrypted. These algorithms work in different modes, and each mode has a specific use case. Which mode is being represented in the graphic and what is its most common use case?

Layer 2 of the OSI model has two sublayers. What are those sublayers, and what are two IEEE standards that describe technologies at that layer?

Which of the following is not a benefit of VoIP?

Which of the following INCORRECTLY describes IP spoofing and session hijacking?

There are several types of password management approaches used by identity management systems. Which of the following reduces help-desk call volume, but is also criticized for the ease with which a hacker could gain access to multiple resources if a password is compromised?

Which of the following best describes how SAML, SOAP, and HTTP commonly work together in an environment that provides web services?

Which of the following criteria is the most important consideration for the selection and deployment of a biometric authentication system?

What is the difference between security training and a security awareness program, and which is most important?

As a security analyst writing a technical report about the findings of a technical security assessment, what should your primary goal be?

In a redundant array of inexpensive disks (RAID) system, data and parity information are striped over several different disks. What is parity information?

Several teams should be involved in carrying out the business continuity plan. Which team is responsible for starting the recovery of the original site?

ISO/IEC 27000 is part of a growing family of ISO/IEC information security management systems (ISMS) standards. It comprises information security standards published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Which of the following provides an incorrect mapping of the individual standards that make up this family of standards ?

Which organization has been developed to deal with economic, social, and governance issues and with how sensitive data is transported over borders?

Health Tracking Apps, Inc. (HTA) is a U.S.-based corporation that develops and sells apps that its customers can use to track various aspects of their own health, from their daily exercise regimes to various medical test results and comparative statistics over time. These apps utilize cloud-based storage so that customers can access their data from multiple platforms, including smart mobile devices and desktop systems. Customers can also easily share the data the apps generate with their personal trainers and healthcare providers if they choose, on a subscription basis.
HTA’s products are available in several languages, including English, French, Spanish, German, and Italian. All of HTA’s software is developed by a dedicated staff within the United States, though HTA occasionally hires interns from the local university to assist with language translations for its various user interfaces.
The following entity relationship diagram illustrates HTA’s business model dependencies:

Would HTA be required to comply with the General Data Protection Regulation (GDPR)? If so, why? If not, why?
1. Maybe, because HTA’s HR records could contain protected privacy data about European citizens if any of HTA’s interns are students studying from abroad.
2. No, because the GDPR applies only to European-based companies.
3. Yes, to the extent that HTA’s stored private data includes that of any European customers.
4. No, because any private data regarding European citizens that HTA’s HR and customer records contain is stored within the United States.

Sam plans to establish mobile phone service using the personal information he has stolen from his former boss. What type of identity theft is this?

When selecting and implementing information asset protection standards, the process of scoping refers to which of the following?

There are several different important pieces to the Common Criteria. Which of the following best describes the first of the missing components?

Before an effective physical security program can be rolled out, a number of steps must be taken. Which of the following steps comes first in the process of rolling out a security program?

Which of the following best describes Key Derivation Functions (KDFs)?

If Marge uses her private key to create a digital signature on a message she is sending to George, but she does not show or share her private key with George, what is it an example of ?

Which of the following is not an effective counter measure against spam?

Today, satellites are used to provide wireless connectivity between different locations. What two prerequisites are needed for two different locations to communicate via satellite links?

A small medical institution’s IT security team has become overwhelmed with having to operate and maintain IDSs, firewalls, enterprise-wide antimalware solutions, data leak prevention technologies, and centralized log management. Which of the following best describes what type of solution this organization should implement to allow for standardized and streamlined security operations?

In the United States, federal agencies must adhere to Federal Information Processing Standard (FIPS) 201-2 “Personal Identity Verification,” which discusses technical measures of authentication for federal employees and contractors. This standard must be followed in order to ensure which of the following?

Jill is establishing a companywide sales program that will require different user groups with different privileges to access information on a centralized database. How should the security manager secure the database?

Though “something you know,” in the form of passwords, is the most common authentication factor still used today, it is considered one of the weakest. This is because passwords are easy for users to share, and relatively easy for adversaries to steal or guess. Which of the following measures is the best way to counter attacks on this form of authentication?

Which of the following describes a parallel test during disaster recovery testing?

Why is a “Methodology” section as critical to a technical security assessment report as the findings themselves?

Mirroring of drives is when data is written to two drives at once for redundancy purposes. What similar type of technology is shown in the graphic that follows?

ACME, Inc., paid a software vendor to develop specialized software, and that vendor has gone out of business. ACME, Inc., does not have access to the code and therefore cannot keep it updated. What mechanism should the company have implemented to prevent this from happening?

Which of the following is the criteria Sam’s company was most likely certified under?

Widgets, Inc., wishes to protect its logo from unauthorized use. Which of the following will protect the logo and ensure that others cannot copy and use it?

Health Tracking Apps, Inc. (HTA) is a U.S.-based corporation that develops and sells apps that its customers can use to track various aspects of their own health, from their daily exercise regimes to various medical test results and comparative statistics over time. These apps utilize cloud-based storage so that customers can access their data from multiple platforms, including smart mobile devices and desktop systems. Customers can also easily share the data the apps generate with their personal trainers and healthcare providers if they choose, on a subscription basis.
HTA’s products are available in several languages, including English, French, Spanish, German, and Italian. All of HTA’s software is developed by a dedicated staff within the United States, though HTA occasionally hires interns from the local university to assist with language translations for its various user interfaces.
The following entity relationship diagram illustrates HTA’s business model dependencies:

HTA’s customer data is breached via a vulnerability in its application programming interface (API). This vulnerability is discovered to be a result of a recently announced security flaw in the underlying Java framework that HTA uses for the development of its apps. Which of the following best describes the root of this problem?

Which of the following are common military categories of data classification?

When selecting and implementing information asset protection standards, why is tailoring an important process?

Different access control models provide specific types of security measures and functionality in applications and operating systems. What model is being expressed in the graphic that follows?

A number of measures should be taken to help protect devices and the environment from electric power issues. Which of the following is best to keep voltage steady and power clean?

An elliptic curve cryptosystem is an asymmetric algorithm. What sets it apart from other asymmetric algorithms?

There are two main functions that Trusted Platform Modules (TPMs) carry out within systems today. Which of the following best describes these two functions?

Robert is responsible for implementing a common architecture used when customers need to access confidential information through Internet connections. Which of the following best describes this type of architecture?

Brad is a security manager at Thingamabobs, Inc. He is preparing a presentation for his company’s executives on the risks of using instant messaging (IM) and his reasons for wanting to prohibit its use on the company network. Which of the following should not be included in his presentation?

Which of the following protocols blurs the lines between the OSI model layers, performing the tasks of several at once?

Which of the following does NOT describe privacy-aware role-based access control?

Bethany is working on a mandatory access control (MAC) system. She has been working on a file that was classified as Secret. She can no longer access this file because it has been reclassified as Top Secret. She deduces that the project she was working on has just increased in confidentiality and she now knows more about this project than her clearance and need-to-know allows. Which of the following refers to a concept that attempts to prevent this type of scenario from occurring?

Which of the following is the correct sequence in the Kerberos authentication process with respect to passwords, Key Distribution Centers (KDCs), ticket granting servers (TGSs), ticket granting tickets (TGTs), services, and service tickets?

Which of the following describes a structured walk-through test during disaster recovery testing?

Which of the following types of vulnerabilities CANNOT be discovered in the course of a routine vulnerability assessment?

There are several different types of important architectures within backup technologies. Which architecture does the graphic that follows represent?

Which of the following incorrectly describes the concept of executive succession planning?

Which of the following best describes the relationship between COBIT and ITIL?

What is the associated single loss expectancy value in this scenario?

Which of the following means that a company did all it could have reasonably done to prevent a security breach?

Health Tracking Apps, Inc. (HTA) is a U.S.-based corporation that develops and sells apps that its customers can use to track various aspects of their own health, from their daily exercise regimes to various medical test results and comparative statistics over time. These apps utilize cloud-based storage so that customers can access their data from multiple platforms, including smart mobile devices and desktop systems. Customers can also easily share the data the apps generate with their personal trainers and healthcare providers if they choose, on a subscription basis.
HTA’s products are available in several languages, including English, French, Spanish, German, and Italian. All of HTA’s software is developed by a dedicated staff within the United States, though HTA occasionally hires interns from the local university to assist with language translations for its various user interfaces.
The following entity relationship diagram illustrates HTA’s business model dependencies:

HTA stores its customers’ private data in a third-party cloud. What is the primary means through which HTA can ensure that its cloud service provider maintains compliance with any regulations—including the GDPR, if necessary—that HTA is subject to?

Joan needs to document a data classification scheme for her organization. Which criteria should she use to guide her decisions?

When implementing data leak prevention (DLP), which is the first, most critical step?

There are many different types of access control mechanisms that are commonly embedded into all operating systems. Which of the following is the mechanism that is missing in this graphic?

Crime Prevention Through Environmental Design (CPTED) is a discipline that outlines how the proper design of a physical environment can reduce crime by directly affecting human behavior. Of CPTED’s three main components, what is illustrated in the following photo?

If implemented properly, a one-time pad is a perfect encryption scheme. Which of the following incorrectly describes a requirement for implementation?

Jack has been told that successful attacks have been taking place and data that has been encrypted by his company’s software systems has leaked to the company’s competitors. Through Jack’s investigation he has discovered that the lack of randomness in the seeding values used by the encryption algorithms in the company’s software exposed patterns and allowed for successful reverse engineering.

Which of the following is most likely the item that is the root of the problem when it comes to the necessary randomness explained in the scenario?

Since sending spam (unwanted messages) has increased over the years and e-mail has become a common way of sending out malicious links and malware, the industry has developed different ways to combat these issues. One approach is to use a Sender Policy Framework, which is an e-mail validation system. In the following graphic, what type of system receives the request in step 2 and replies in step 3 ?

There are several different types of authentication technologies. Which type is being shown in the graphic that follows?

Which of the following correctly describes the relationship between SSL and TLS?

Security Assertion Markup Language (SAML) is an XML-based standard for exchanging authentication and authorization data between systems on different security domains. SAML allows for the sharing of authentication information, such as how authentication took place, entity attributes, and what the entity is authorized to access. SAML is most commonly used in web-based environments that require single sign-on (SSO) capability. Which of the following has a correct definition associated with the corresponding SAML component?

A number of attacks can be performed against smart cards. Side-channel is a class of attacks that doesn’t try to compromise a flaw or weakness. Which of the following is NOT a side-channel attack?

In practical use, which of the following best describes a “session”?

John and his team are conducting a penetration test of a client’s network. The team will conduct its testing armed only with knowledge it acquired from the Web. The network staff is aware that the testing will take place, but the penetration testing team will only work with publicly available data and some information from the client. What is the degree of the team’s knowledge, and what type of test is the team carrying out?

Which of the following is not a common component of configuration management change control steps?

______  provides for availability and scalability. It groups physically different systems and combines them logically, which helps to provide immunity to faults and improves performance.

What type of infrastructural setup is illustrated in the graphic that follows?

Global organizations that transfer data across international boundaries must abide by guidelines and transborder information flow rules developed by an international organization that helps different governments come together and tackle the economic, social, and governance challenges of a globalized economy. What organization is this?

The NIST organization has defined best practices for creating continuity plans. Which of the following phases deals with identifying and prioritizing critical functions and systems?

Which of the following is a U.S. copyright law that criminalizes the production and dissemination of technology, devices, or services that circumvent access control measures put into place to protect copyright material?

Health Tracking Apps, Inc. (HTA) is a U.S.-based corporation that develops and sells apps that its customers can use to track various aspects of their own health, from their daily exercise regimes to various medical test results and comparative statistics over time. These apps utilize cloud-based storage so that customers can access their data from multiple platforms, including smart mobile devices and desktop systems. Customers can also easily share the data the apps generate with their personal trainers and healthcare providers if they choose, on a subscription basis.
HTA’s products are available in several languages, including English, French, Spanish, German, and Italian. All of HTA’s software is developed by a dedicated staff within the United States, though HTA occasionally hires interns from the local university to assist with language translations for its various user interfaces.
The following entity relationship diagram illustrates HTA’s business model dependencies:

Many of HTA’s employees have either direct or indirect access to its customers’ private data. HTA has to ensure that newly hired employees are aware of all security policies and procedures that apply to them, have only the necessary access through the accounts created for them, and have signed an agreement not to disclose the data inappropriately. Which of the following terms describes this process?

Which of the following means of data removal makes the data unrecoverable even with extraordinary effort, such as with physical forensics in a laboratory?

Lacy’s manager has tasked her with researching an intrusion detection system for a new dispatching center. Lacy identifies the top five products and compares their ratings. Which of the following is the evaluation criteria framework most in use today for these types of purposes?

There are several security enforcement components that are commonly built into operating systems. Which component is illustrated in the graphic that follows?

There are five different classes of fire. Each depends upon what is on fire. Which of the following is the proper mapping for the items missing in the provided table?

Sally is responsible for key management within her organization. Which of the following incorrectly describes a principle of secure key management?

Jack has been told that successful attacks have been taking place and data that has been encrypted by his company’s software systems has leaked to the company’s competitors. Through Jack’s investigation he has discovered that the lack of randomness in the seeding values used by the encryption algorithms in the company’s software exposed patterns and allowed for successful reverse engineering.

Which of the following best describes the role of the values that is allowing for patterns as described in the scenario?

Which of the following indicates to a packet where to go and how to communicate with the right service or protocol on the destination computer?

What type of security encryption component is missing from the table that follows?

End-to-end encryption is used by users, and link encryption is used by service providers. Which of the following correctly describes these technologies?

Brian has been asked to work on the virtual directory of his company’s new identity management system. Which of the following best describes a virtual directory?

Emily is listening to network traffic and capturing passwords as they are sent to the authentication server. She plans to use the passwords as part of a future attack. What type of attack is this?

The use of “resource servers” and “authorization servers” to enable a “client” web service (such as LinkedIn) to access a “resource owner” (such as Google) for federated authorization is a hallmark of what open standard?

Fred is a new security officer who wants to implement a control for detecting and preventing users who attempt to exceed their authority by misusing the access rights that have been assigned to them. Which of the following best fits this need?

A change management process should include a number of procedures. Which of the following incorrectly describes a characteristic or component of a change control policy?

Bob is a new security administrator at a financial institution. The organization has experienced some suspicious activity on one of the critical servers that contain customer data. When reviewing how the systems are administered, he uncovers some concerning issues pertaining to remote administration. Which of the following should not be put into place to reduce these concerns?

i. Commands and data should not be sent in cleartext.

ii. SSH should be used, not Telnet.

iii. Truly critical systems should be administered locally instead of remotely.

iv. Only a small number of administrators should be able to carry out remote functionality.

v. Strong authentication should be in place for any administration activities.

There are several types of redundant technologies that can be put into place. What type of technology is shown in the graphic that follows?

Steve, a department manager, has been asked to join a committee that is responsible for defining an acceptable level of risk for the organization, reviewing risk assessment and audit reports, and approving significant changes to security policies and programs. What committee is he joining?

As his company’s business continuity coordinator, Matthew is responsible for helping recruit members to the business continuity planning (BCP) committee. Which of the following does not correctly describe this effort?

What role does the Internet Architecture Board play regarding technology and ethics?

Health Tracking Apps, Inc. (HTA) is a U.S.-based corporation that develops and sells apps that its customers can use to track various aspects of their own health, from their daily exercise regimes to various medical test results and comparative statistics over time. These apps utilize cloud-based storage so that customers can access their data from multiple platforms, including smart mobile devices and desktop systems. Customers can also easily share the data the apps generate with their personal trainers and healthcare providers if they choose, on a subscription basis.
HTA’s products are available in several languages, including English, French, Spanish, German, and Italian. All of HTA’s software is developed by a dedicated staff within the United States, though HTA occasionally hires interns from the local university to assist with language translations for its various user interfaces.
The following entity relationship diagram illustrates HTA’s business model dependencies:

HTA has an awareness program designed to educate all employees about security-relevant issues that apply to them, based on their role. IT staff members are specifically instructed that it is important to be aware of new vulnerabilities as they are discovered, not only in the OSs that are used by HTA, but also in the applications and frameworks the developers use to build their software. The awareness program also stresses the importance of rapid mitigation by IT staff. As stated in question 48, HTA’s customer data has been breached via a vulnerability in its API, a vulnerability discovered to be a result of a recently announced security flaw in the underlying Java framework that HTA uses for the development of its apps. Which of the following most likely contributed to the breach with respect to the security awareness program?

When classifying information, its sensitivity refers to:

Certain types of attacks have been made more potent by which of the following advances to microprocessor technology?

A multitasking operating system can have several processes running at the same time. What are the components within the processes that are shown in the graphic that follows?

Electrical power is being provided more through smart grids, which allow for self- healing, resistance to physical and cyberattacks, increased efficiency, and better integration of renewable energy sources. Countries want their grids to be more reliable, resilient, flexible, and efficient. Why does this type of evolution in power infrastructure concern many security professionals?

Mandy needs to calculate how many keys must be generated for the 260 employees using the company’s PKI asymmetric algorithm. How many keys are required?

Sometimes when studying for an industry certification exam like the CISSP, people do not fully appreciate that the concepts and technologies that they need to learn to pass the test directly relate to real-world security issues. To enforce how exam-oriented theoretical concepts directly relate to the practical world of security, choose the correct answer that best describes the Heartbleed SSL/TLS vulnerability, which is considered to be one of the most critical attack vectors in the history of the Internet.

Several different tunneling protocols can be used in dial-up situations. Which of the following would be best to use as a VPN tunneling solution?

What type of technology is represented in the graphic that follows?

What do the SA values in the graphic of IPSec that follows represent?

Which of the following accurately describes Identity as a Service (IDaaS)?

Which of the following is the best way to reduce brute-force attacks that allow intruders to uncover users’ passwords?