Which of the following best describes the relationship between COBIT and ITIL?

What is the associated single loss expectancy value in this scenario?

Which of the following means that a company did all it could have reasonably done to prevent a security breach?

Health Tracking Apps, Inc. (HTA) is a U.S.-based corporation that develops and sells apps that its customers can use to track various aspects of their own health, from their daily exercise regimes to various medical test results and comparative statistics over time. These apps utilize cloud-based storage so that customers can access their data from multiple platforms, including smart mobile devices and desktop systems. Customers can also easily share the data the apps generate with their personal trainers and healthcare providers if they choose, on a subscription basis.
HTA’s products are available in several languages, including English, French, Spanish, German, and Italian. All of HTA’s software is developed by a dedicated staff within the United States, though HTA occasionally hires interns from the local university to assist with language translations for its various user interfaces.
The following entity relationship diagram illustrates HTA’s business model dependencies:

HTA stores its customers’ private data in a third-party cloud. What is the primary means through which HTA can ensure that its cloud service provider maintains compliance with any regulations—including the GDPR, if necessary—that HTA is subject to?

Joan needs to document a data classification scheme for her organization. Which criteria should she use to guide her decisions?

When implementing data leak prevention (DLP), which is the first, most critical step?

There are many different types of access control mechanisms that are commonly embedded into all operating systems. Which of the following is the mechanism that is missing in this graphic?

Crime Prevention Through Environmental Design (CPTED) is a discipline that outlines how the proper design of a physical environment can reduce crime by directly affecting human behavior. Of CPTED’s three main components, what is illustrated in the following photo?

If implemented properly, a one-time pad is a perfect encryption scheme. Which of the following incorrectly describes a requirement for implementation?

Jack has been told that successful attacks have been taking place and data that has been encrypted by his company’s software systems has leaked to the company’s competitors. Through Jack’s investigation he has discovered that the lack of randomness in the seeding values used by the encryption algorithms in the company’s software exposed patterns and allowed for successful reverse engineering.

Which of the following is most likely the item that is the root of the problem when it comes to the necessary randomness explained in the scenario?

Since sending spam (unwanted messages) has increased over the years and e-mail has become a common way of sending out malicious links and malware, the industry has developed different ways to combat these issues. One approach is to use a Sender Policy Framework, which is an e-mail validation system. In the following graphic, what type of system receives the request in step 2 and replies in step 3 ?

There are several different types of authentication technologies. Which type is being shown in the graphic that follows?

Which of the following correctly describes the relationship between SSL and TLS?

Security Assertion Markup Language (SAML) is an XML-based standard for exchanging authentication and authorization data between systems on different security domains. SAML allows for the sharing of authentication information, such as how authentication took place, entity attributes, and what the entity is authorized to access. SAML is most commonly used in web-based environments that require single sign-on (SSO) capability. Which of the following has a correct definition associated with the corresponding SAML component?

A number of attacks can be performed against smart cards. Side-channel is a class of attacks that doesn’t try to compromise a flaw or weakness. Which of the following is NOT a side-channel attack?

In practical use, which of the following best describes a “session”?

John and his team are conducting a penetration test of a client’s network. The team will conduct its testing armed only with knowledge it acquired from the Web. The network staff is aware that the testing will take place, but the penetration testing team will only work with publicly available data and some information from the client. What is the degree of the team’s knowledge, and what type of test is the team carrying out?

Which of the following is not a common component of configuration management change control steps?

______  provides for availability and scalability. It groups physically different systems and combines them logically, which helps to provide immunity to faults and improves performance.

What type of infrastructural setup is illustrated in the graphic that follows?

Which of the following correctly best describes an object-oriented database?

There are several types of attacks that programmers need to be aware of. What attack does the graphic that follows illustrate?

Which of the following best describes “change control?”

Global organizations that transfer data across international boundaries must abide by guidelines and transborder information flow rules developed by an international organization that helps different governments come together and tackle the economic, social, and governance challenges of a globalized economy. What organization is this?

The NIST organization has defined best practices for creating continuity plans. Which of the following phases deals with identifying and prioritizing critical functions and systems?

Which of the following is a U.S. copyright law that criminalizes the production and dissemination of technology, devices, or services that circumvent access control measures put into place to protect copyright material?

Health Tracking Apps, Inc. (HTA) is a U.S.-based corporation that develops and sells apps that its customers can use to track various aspects of their own health, from their daily exercise regimes to various medical test results and comparative statistics over time. These apps utilize cloud-based storage so that customers can access their data from multiple platforms, including smart mobile devices and desktop systems. Customers can also easily share the data the apps generate with their personal trainers and healthcare providers if they choose, on a subscription basis.
HTA’s products are available in several languages, including English, French, Spanish, German, and Italian. All of HTA’s software is developed by a dedicated staff within the United States, though HTA occasionally hires interns from the local university to assist with language translations for its various user interfaces.
The following entity relationship diagram illustrates HTA’s business model dependencies:

Many of HTA’s employees have either direct or indirect access to its customers’ private data. HTA has to ensure that newly hired employees are aware of all security policies and procedures that apply to them, have only the necessary access through the accounts created for them, and have signed an agreement not to disclose the data inappropriately. Which of the following terms describes this process?

Which of the following means of data removal makes the data unrecoverable even with extraordinary effort, such as with physical forensics in a laboratory?

Lacy’s manager has tasked her with researching an intrusion detection system for a new dispatching center. Lacy identifies the top five products and compares their ratings. Which of the following is the evaluation criteria framework most in use today for these types of purposes?

There are several security enforcement components that are commonly built into operating systems. Which component is illustrated in the graphic that follows?

There are five different classes of fire. Each depends upon what is on fire. Which of the following is the proper mapping for the items missing in the provided table?

Sally is responsible for key management within her organization. Which of the following incorrectly describes a principle of secure key management?

Jack has been told that successful attacks have been taking place and data that has been encrypted by his company’s software systems has leaked to the company’s competitors. Through Jack’s investigation he has discovered that the lack of randomness in the seeding values used by the encryption algorithms in the company’s software exposed patterns and allowed for successful reverse engineering.

Which of the following best describes the role of the values that is allowing for patterns as described in the scenario?

Which of the following indicates to a packet where to go and how to communicate with the right service or protocol on the destination computer?

What type of security encryption component is missing from the table that follows?

End-to-end encryption is used by users, and link encryption is used by service providers. Which of the following correctly describes these technologies?

Brian has been asked to work on the virtual directory of his company’s new identity management system. Which of the following best describes a virtual directory?

Emily is listening to network traffic and capturing passwords as they are sent to the authentication server. She plans to use the passwords as part of a future attack. What type of attack is this?

The use of “resource servers” and “authorization servers” to enable a “client” web service (such as LinkedIn) to access a “resource owner” (such as Google) for federated authorization is a hallmark of what open standard?

Fred is a new security officer who wants to implement a control for detecting and preventing users who attempt to exceed their authority by misusing the access rights that have been assigned to them. Which of the following best fits this need?

A change management process should include a number of procedures. Which of the following incorrectly describes a characteristic or component of a change control policy?

Bob is a new security administrator at a financial institution. The organization has experienced some suspicious activity on one of the critical servers that contain customer data. When reviewing how the systems are administered, he uncovers some concerning issues pertaining to remote administration. Which of the following should not be put into place to reduce these concerns?

i. Commands and data should not be sent in cleartext.

ii. SSH should be used, not Telnet.

iii. Truly critical systems should be administered locally instead of remotely.

iv. Only a small number of administrators should be able to carry out remote functionality.

v. Strong authentication should be in place for any administration activities.

There are several types of redundant technologies that can be put into place. What type of technology is shown in the graphic that follows?

Fred has been told he needs to test a component of the new content management application under development to validate its data structure, logic, and boundary conditions. What type of testing should he carry out?

Databases and applications commonly carry out the function that is illustrated in the graphic that follows. Which of the following best describes the concept that this graphic is showing?

What are the three major elements crucial to the security of software development environments?

Steve, a department manager, has been asked to join a committee that is responsible for defining an acceptable level of risk for the organization, reviewing risk assessment and audit reports, and approving significant changes to security policies and programs. What committee is he joining?

As his company’s business continuity coordinator, Matthew is responsible for helping recruit members to the business continuity planning (BCP) committee. Which of the following does not correctly describe this effort?

What role does the Internet Architecture Board play regarding technology and ethics?

Health Tracking Apps, Inc. (HTA) is a U.S.-based corporation that develops and sells apps that its customers can use to track various aspects of their own health, from their daily exercise regimes to various medical test results and comparative statistics over time. These apps utilize cloud-based storage so that customers can access their data from multiple platforms, including smart mobile devices and desktop systems. Customers can also easily share the data the apps generate with their personal trainers and healthcare providers if they choose, on a subscription basis.
HTA’s products are available in several languages, including English, French, Spanish, German, and Italian. All of HTA’s software is developed by a dedicated staff within the United States, though HTA occasionally hires interns from the local university to assist with language translations for its various user interfaces.
The following entity relationship diagram illustrates HTA’s business model dependencies:

HTA has an awareness program designed to educate all employees about security-relevant issues that apply to them, based on their role. IT staff members are specifically instructed that it is important to be aware of new vulnerabilities as they are discovered, not only in the OSs that are used by HTA, but also in the applications and frameworks the developers use to build their software. The awareness program also stresses the importance of rapid mitigation by IT staff. As stated in question 48, HTA’s customer data has been breached via a vulnerability in its API, a vulnerability discovered to be a result of a recently announced security flaw in the underlying Java framework that HTA uses for the development of its apps. Which of the following most likely contributed to the breach with respect to the security awareness program?

When classifying information, its sensitivity refers to:

Certain types of attacks have been made more potent by which of the following advances to microprocessor technology?

A multitasking operating system can have several processes running at the same time. What are the components within the processes that are shown in the graphic that follows?

Electrical power is being provided more through smart grids, which allow for self- healing, resistance to physical and cyberattacks, increased efficiency, and better integration of renewable energy sources. Countries want their grids to be more reliable, resilient, flexible, and efficient. Why does this type of evolution in power infrastructure concern many security professionals?

Mandy needs to calculate how many keys must be generated for the 260 employees using the company’s PKI asymmetric algorithm. How many keys are required?

Sometimes when studying for an industry certification exam like the CISSP, people do not fully appreciate that the concepts and technologies that they need to learn to pass the test directly relate to real-world security issues. To enforce how exam-oriented theoretical concepts directly relate to the practical world of security, choose the correct answer that best describes the Heartbleed SSL/TLS vulnerability, which is considered to be one of the most critical attack vectors in the history of the Internet.

Several different tunneling protocols can be used in dial-up situations. Which of the following would be best to use as a VPN tunneling solution?

What type of technology is represented in the graphic that follows?

What do the SA values in the graphic of IPSec that follows represent?

Which of the following accurately describes Identity as a Service (IDaaS)?

Which of the following is the best way to reduce brute-force attacks that allow intruders to uncover users’ passwords?

Which of the following is NOT true of OpenID Connect (OIDC)?

What is the difference between a test and an assessment?

Device backup and other availability solutions are chosen to balance the value of having information available against the cost of keeping that information available. Which of the following best describes fault-tolerant technologies?

A suspected crime has been reported within your organization. Which of the following steps should the incident response team take first?

Here is a graphic of a business continuity policy. Which component is missing from this graphic?

Which of the following is the best description of a component-based system development method?

There are several different types of databases. Which type does the graphic that follows illustrate?

Which of the following are key elements of secure coding practices?

Which of the following is not included in a risk assessment?

A business impact analysis is considered a functional analysis. Which of the following is not carried out during a business impact analysis?

As a CISSP candidate, you must sign a Code of Ethics. Which of the following is from the (ISC)² Code of Ethics for the CISSP?

As head of sales, Jim is the data owner for the sales department. Which of the following is not Jim’s responsibility as data owner?

When classifying information, its criticality refers to:

CPUs and operating systems can work in two main types of multitasking modes. What controls access and the use of system resources in preemptive multitasking mode?

Charlie is a new security manager at a textile company that develops its own proprietary software for internal business processes. Charlie has been told that the new application his team needs to develop must comply with the ISO/IEC 42010 standard. He has found out that many of the critical applications have been developed in the C programming language and has asked for these applications to be reviewed for a specific class of security vulnerabilities.

Which of the following best describes the standard Charlie’s team needs to comply with?

Mike is the new CSO of a large pharmaceutical company. He has been asked to revamp the company’s physical security program and better align it with the company’s information security practices. Mike knows that the new physical security program should be made up of controls and processes that support the following categories: deterrent, delaying, detection, assessment, and response.

Mike’s team has decided to implement new perimeter fences and warning signs against trespassing around the company’s facility. Which of the categories listed in the scenario do these countermeasures map to?

Which of the following works similarly to stream ciphers?

What type of exploited vulnerability allows more input than the program has allocated space to store it?

Which of the following correctly describes Bluejacking?

What type of telecommunication technology is illustrated in the graphic that follows?

What is the process depicted in the illustration below referred to as?

Which of the following correctly describes a federated identity and its role within identity management processes?

Phishing and pharming are similar. Which of the following correctly describes the difference between phishing and pharming?

Which of the following attributes are added beyond traditional access control mechanisms (RBAC, MAC, and DAC) in order to implement ABAC?

Which of the following statements is most true with regard to internal security audits versus external, second-party audits?

Which of the following refers to the expected amount of time it will take to get a device fixed and back into production after its failure?

Which of the following is a correct statement regarding digital forensics?

The recovery time objective (RTO) and maximum tolerable downtime (MTD) metrics have similar roles, but their values are very different. Which of the following best describes the difference between RTO and MTD metrics?

There are many types of viruses that hackers can use to damage systems. Which of the following is not a correct description of a polymorphic virus?

Trent is the new manager of his company’s internal software development department. He has been told by his management that the group needs to be compliant with the international standard that provides guidance to organizations in integrating security into the processes used for managing their applications. His new boss told him that he should join and get familiar with the Open Web Application Security Project (OWASP), and Trent just received an e-mail stating that one of the company’s currently deployed applications has a zero-day vulnerability.

Which of the following is most likely the standard Trent’s company wants to comply with?

The integrity of data is not related to which of the following?

Which of the following steps comes first in a business impact analysis?

Which of the following was the first international treaty seeking to address computer crimes by coordinating national laws and improving investigative techniques and international cooperation?

Assigning data classification levels can help with all of the following except:

Which of the following classification levels are most commonly used in commercial industry?

Virtual storage combines RAM and secondary storage for system memory. Which of the following is a security concern pertaining to virtual storage?

Charlie is a new security manager at a textile company that develops its own proprietary software for internal business processes. Charlie has been told that the new application his team needs to develop must comply with the ISO/IEC 42010 standard. He has found out that many of the critical applications have been developed in the C programming language and has asked for these applications to be reviewed for a specific class of security vulnerabilities.

Which of the following is Charlie most likely concerned with in this situation?

Mike is the new CSO of a large pharmaceutical company. He has been asked to revamp the company’s physical security program and better align it with the company’s information security practices. Mike knows that the new physical security program should be made up of controls and processes that support the following categories: deterrent, delaying, detection, assessment, and response.

Mike’s team has decided to implement stronger locks on the exterior doors of the new company’s facility. Which of the categories listed in the scenario does this countermeasure map to?

There are two main types of symmetric ciphers: stream and block. Which of the following is not an attribute of a good stream cipher?

There are common cloud computing service models. usually requires companies to deploy their own operating systems, applications, and software onto the provided infrastructure. is the software environment that runs on top of the infrastructure. In the model the provider commonly gives the customers network-based access to a single copy of an application.

DNS is a popular target for attackers due to its strategic role on the Internet. What type of attack uses recursive queries to poison the cache of a DNS server?

Which type of WAN tunneling protocol is missing from the right table in the graphic that follows?

Which of the following is a purpose of the transport layer?

Security countermeasures should be transparent to users and attackers. Which of the following does NOT describe transparency?

There are several types of intrusion detection systems (IDSs). What type of IDS builds a profile of an environment’s normal activities and assigns an anomaly score to packets based on the profile?

How is interface testing different from misuse case testing?

Which of the following is the most critical best practice when conducting an internal security audit?

Which of the following correctly describes direct access and sequential access storage devices?

Which of the following dictates that all evidence be labeled with information indicating who secured and validated it?

High availability (HA) is a combination of technologies and processes that work together to ensure that specific critical functions are always up and running at the necessary level. To provide this level of high availability, a company has to have a long list of technologies and processes that provide redundancy, fault tolerance, and failover capabilities. Which of the following best describes these characteristics?

Which of the following best describes the role of the Java Virtual Machine in the execution of Java applets?

Trent is the new manager of his company’s internal software development department. He has been told by his management that the group needs to be compliant with the international standard that provides guidance to organizations in integrating security into the processes used for managing their applications. His new boss told him that he should join and get familiar with the Open Web Application Security Project (OWASP), and Trent just received an e-mail stating that one of the company’s currently deployed applications has a zero-day vulnerability.

Which of the following best describes the consortium Trent’s boss wants him to join?

As his company’s CISO, George needs to demonstrate to the board of directors the necessity of a strong risk management program. Which of the following should George use to calculate the company’s residual risk?

It is not unusual for business continuity plans to become out of date. Which of the following is not a reason why plans become outdated?

Lee is a new security manager who is in charge of ensuring that his company complies with the European Union Principles on Privacy when his company is interacting with their European partners. The set of principles that deals with transmitting data considered private is encompassed within which of the following laws or regulations?

Susan, an attorney, has been hired to fill a new position at Widgets, Inc.: chief privacy officer (CPO). What is the primary function of her new role?

Which of the following classification levels are most commonly used in military environments?

Which of the following is a common association of the Clark-Wilson access model?

Tim’s development team is designing a new operating system. One of the requirements of the new product is that critical memory segments need to be categorized as nonexecutable, with the goal of reducing malicious code from being able to execute instructions in privileged mode. The team also wants to make sure that attackers will have a difficult time predicting execution target addresses.

Which of the following best describes the type of protection that needs to be provided by this product?

Mike is the new CSO of a large pharmaceutical company. He has been asked to revamp the company’s physical security program and better align it with the company’s information security practices. Mike knows that the new physical security program should be made up of controls and processes that support the following categories: deterrent, delaying, detection, assessment, and response.

Mike’s team has decided to hire and deploy security guards to monitor activities within the company’s facility. Which of the categories listed in the scenario does this countermeasure map to?

Which of the following best describes how a digital signature is created?

A company has decided that it no longer wants to maintain its own servers and network environment because of increasing costs and liabilities. The company wants to move to a cloud-based solution, but needs to determine which type of solution best fits its needs. Which of the following provides a correct definition and mapping of a typical cloud-based solution?

IP telephony networks require the same security measures as those implemented on an IP data network. Which of the following is unique to IP telephony?

IPv6 has many new and different characteristics and functionality compared to IPv4. Which of the following is an incorrect functionality or characteristic of IPv6?

i.IPv6 allows for nonscoped addresses, which enables an administrator to restrict specific addresses for specific servers or file and print sharing, for example.
ii.IPv6 has IPSec integrated into the protocol stack, which provides application-based secure transmission and authentication.
iii.IPv6 has more flexibility and routing capabilities compared to IPv4 and allows for Quality of Service (QoS) priority values to be assigned to time-sensitive transmissions.
iv.The protocol offers autoconfiguration, which makes administration much easier
compared to IPv4, and it does not require network address translation (NAT) to extend its address space.

Which of the following statements is NOT true about the IPv4 address 192.168.10.129\25?

What markup language allows for the sharing of application security policies to ensure that all applications are following the same security rules?

A rule-based IDS takes a different approach than a signature-based or anomaly- based system. Which of the following is characteristic of a rule-based IDS?

What are the key stages of account management?

With respect to external audits, what is the difference between a second-party audit and a third-party audit?

Various levels of RAID dictate the type of activity that will take place within the RAID system. Which level is associated with byte-level parity?

Which of the following is not true of a forensic investigation?

Jeff is leading the business continuity group in his company. They have completed a business impact analysis and have determined that if the company’s credit card processing functionality was unavailable for 48 hours the company would most likely experience such a large financial hit that it would have to go out of business. The team has calculated that this functionality needs to be up and running within 28 hours after experiencing a disaster for the company to stay in business. The team has also determined that the restoration steps must be able to restore data that is 60 minutes old or less.

In this scenario, which of the following is the work recovery time value?

What type of database software integrity service guarantees that tuples are uniquely identified by primary key values?

Trent is the new manager of his company’s internal software development department. He has been told by his management that the group needs to be compliant with the international standard that provides guidance to organizations in integrating security into the processes used for managing their applications. His new boss told him that he should join and get familiar with the Open Web Application Security Project (OWASP), and Trent just received an e-mail stating that one of the company’s currently deployed applications has a zero-day vulnerability.

Which of the following best describes the type of vulnerability mentioned in this scenario?

Capability Maturity Model Integration (CMMI) came from the software engineering world and is used within organizations to help lay out a pathway of how incremental improvement can take place. This model is used by organizations in self-assessment and to develop structured steps that can be followed so an organization can evolve from one level to the next and constantly improve its processes. In the CMMI model graphic shown, what is the proper sequence of the levels?

Preplanned business continuity procedures provide organizations a number of benefits. Which of the following is not a capability enabled by business continuity planning?

Brandy could not figure out how Sam gained unauthorized access to her system, since he has little computer experience. Which of the following is most likely the attack Sam used?

Jared plays a role in his company’s data classification system. In this role, he must practice due care when accessing data and ensure that the data is used only in accordance with allowed policy while abiding by the rules set for the classification of the data. He does not determine, maintain, or evaluate controls, so what is Jared’s role?

Which of the following is true regarding data retention requirements?

Which of the following correctly describes the relationship between the reference monitor and the security kernel?

Tim’s development team is designing a new operating system. One of the requirements of the new product is that critical memory segments need to be categorized as nonexecutable, with the goal of reducing malicious code from being able to execute instructions in privileged mode. The team also wants to make sure that attackers will have a difficult time predicting execution target addresses.

Which of the following best describes the type of technology the team should implement to increase the work effort of buffer overflow attacks?

Greg is the security facility officer of a financial institution. His boss has told him that visitors need a secondary screening before they are allowed into sensitive areas within the building. Greg has also been told by the network administrators that after the new HVAC system was installed throughout the facility, they have noticed that power voltage to the systems in the data center sags.

Which of the following is the best control that Greg should ensure is implemented to deal with his boss’s concern?

In cryptography, different steps and algorithms provide different types of security services. Which of the following provides only authentication, non repudiation, and integrity?

Sally is carrying out a software analysis on her company’s proprietary application. She has found out that it is possible for an attacker to force an authorization step to take place before the authentication step is completed successfully. What type of issue would allow for this type of compromise to take place?

Angela wants to group together computers by department to make it easier for them to share network resources. Which of the following will best allow her to group computers logically?

Hanna is a new security manager for a computer consulting company. She has found out that the company has lost intellectual property in the past because malicious employees installed rogue devices on the network, which were used to capture sensitive traffic. Hanna needs to implement a solution that ensures only authorized devices are allowed access to the company network. Which of the following IEEE standards was developed for this type of protection?

Which of the following statements describes a “converged” protocol?

The importance of protecting audit logs generated by computers and network devices is highlighted by the fact that it is required by many of today’s regulations. Which of the following does NOT explain why audit logs should be protected?

Tom works at a large retail company that recently deployed radio-frequency identification (RFID) to better manage its inventory processes. Employees use scanners to gather product-related information instead of manually looking up product data. Tom has found out that malicious customers have carried out attacks on the RFID technology to reduce the amount they pay on store items. Which of the following is the most likely reason for the existence of this type of vulnerability?

What is a code review?

Which of the following statements is true of audits conducted by external parties?

RAID systems use a number of techniques to provide redundancy and performance. Which of the following activities divides and writes data over several drives?

Stephanie has been put in charge of developing incident response and forensics procedures her company needs to carry out if an incident occurs. She needs to ensure that their procedures map to the international principles for gathering and protecting digital evidence. She also needs to ensure that if and when internal forensics teams are deployed, they have labels, tags, evidence bags, cable ties, imaging software, and other associated tools. Which of the following best describes what Stephanie needs to build for the deployment teams?

Jeff is leading the business continuity group in his company. They have completed a business impact analysis and have determined that if the company’s credit card processing functionality was unavailable for 48 hours the company would most likely experience such a large financial hit that it would have to go out of business. The team has calculated that this functionality needs to be up and running within 28 hours after experiencing a disaster for the company to stay in business. The team has also determined that the restoration steps must be able to restore data that is 60 minutes old or less.

In this scenario, what would the 60-minute time period be referred to as?

In computer programming, cohesion and coupling are used to describe modules of code. Which of the following is a favorable combination of cohesion and coupling?

__________  provides a machine-readable description of the specific operations provided by a specific web service. ____________ provides a method for web services to be registered by service providers and located by service consumers.

Risk assessment has several different methodologies. Which of the following official risk methodologies was not created for the purpose of analyzing security risks?

Management support is critical to the success of a business continuity plan. Which of the following is the most important to be provided to management to obtain their support?

Jane has been charged with ensuring that the privacy of clients’ personal health information is adequately protected before it is exchanged with a new European partner. What data security requirements must she adhere to?

Michael is charged with developing a data classification program for his company. Which of the following should he do first?

Why is the issue of data remanence sometimes problematic?

The trusted computing base (TCB) ensures security within a system when a process in one domain must access another domain in order to retrieve sensitive information. What function does the TCB initiate to ensure that this is done in a secure manner?

Operating systems have evolved and changed over the years. The earlier operating systems were monolithic and did not segregate critical processes from noncritical processes. As time went on, operating system vendors started to reduce the amount of programming code that ran in kernel mode. Only the absolutely necessary code ran in kernel mode, and the remaining operating system code ran in user mode. This architecture introduced performance issues, which required the operating system vendors to reduce the critical operating system functionality to microkernels and allow the remaining operating system functionality to run in client/server models within kernel mode.

Which of the following best describes the second operating system architecture described in the scenario?

Greg is the security facility officer of a financial institution. His boss has told him that visitors need a secondary screening before they are allowed into sensitive areas within the building. Greg has also been told by the network administrators that after the new HVAC system was installed throughout the facility, they have noticed that power voltage to the systems in the data center sags.

Which of the following best describes the situation that the network administrators are experiencing?

Advanced Encryption Standard is an algorithm used for which of the following?

Which of the following is true about information flow models?

Which of the following incorrectly describes how routing commonly takes place on the Internet?

________  is a set of extensions to DNS that provides to DNS clients (resolvers) origin authentication of DNS data to reduce the threat of DNS poisoning, spoofing, and similar attack types.

Ethernet uses a shared medium for all stations on a LAN to communicate, and uses a carrier sense multiple access with collision detection (CSMA/CD) approach to managing communications between stations. Which of the following statements about this protocol best explains how it works?

Of the following, what is the primary item that a capability table is based upon?

Tanya is the security administrator for a large distributed retail company. The company’s network has many different network devices and software appliances that generate logs and audit data. Tanya and her staff have become overwhelmed with trying to review all of the log files when attempting to identify if anything suspicious is taking place within the network. Which of the following is the best solution for this company to implement?

Which of the following statements is true with respect to security audits, vulnerability assessments, and penetration tests?

Which of the following is an advantage of having an audit performed by an external, third party?

What is the difference between hierarchical storage management and storage area network technologies?

When developing a recovery and continuity program within an organization, different metrics can be used to properly measure potential damages and recovery requirements. These metrics help us quantify our risks and the benefits of controls we can put into place. Two metrics commonly used in the development of recovery programs are recovery point objective (RPO) and recovery time objective (RTO). Data restoration (RPO) requirements can be different from service restoration (RTO) requirements. Which of the following best defines these two main recovery measurements in this type of scenario?

For evidence to be legally admissible, it must be relevant, complete, sufficient, and reliably obtained. Which characteristic refers to the evidence having a reasonable and sensible relationship to the findings?

Which of the following statements does not correctly describe SOAP and Remote Procedure Calls?

Sally has found out that software programmers in her company are making changes to software components and uploading them to the main software repository without following version control or documenting their changes. This is causing a lot of confusion and has caused several teams to use the older versions. Which of the following would be the best solution for this situation?

Which of the following is not a characteristic of a company with a security governance program in place?

Which of the following is a critical first step in disaster recovery and contingency planning?

Sue has been tasked with implementing a number of security controls, including antivirus and antispam software, to protect the company’s e-mail system. What type of approach is her company taking to handle the risk posed by the system?

Which of the following is NOT a factor in determining the sensitivity of data?

For which of the following physical media is degaussing a relatively cheap and effective means of eradicating data?

Which of the following best defines a virtual machine?

Operating systems have evolved and changed over the years. The earlier operating systems were monolithic and did not segregate critical processes from noncritical processes. As time went on, operating system vendors started to reduce the amount of programming code that ran in kernel mode. Only the absolutely necessary code ran in kernel mode, and the remaining operating system code ran in user mode. This architecture introduced performance issues, which required the operating system vendors to reduce the critical operating system functionality to microkernels and allow the remaining operating system functionality to run in client/server models within kernel mode.

Which of the following best describes why there was a performance issue in the context of the scenario?

Greg is the security facility officer of a financial institution. His boss has told him that visitors need a secondary screening before they are allowed into sensitive areas within the building. Greg has also been told by the network administrators that after the new HVAC system was installed throughout the facility, they have noticed that power voltage to the systems in the data center sags.

Which of the following is a control that Greg’s team could implement to address the network administrators’ issue?

SSL is a protocol used for securing transactions that occur over untrusted networks. Which of the following best describes what takes place during a SSL connection setup process?

Which of the following is true with respect to distributed systems?

Both de facto and proprietary interior protocols are in use today. Which of the following is a proprietary interior protocol that chooses the best path between the source and destination?