Introducing The New!
Surepassexam Collection
Get Unlimited Access to all
Surepassexam's PREMIUM files
Q1. Refer.to the information below to answer the question.
During the investigation of a security incident, it is determined that an unauthorized individual accessed a system which hosts a database containing financial information.
If it is discovered that large quantities of information have been copied by the unauthorized individual, what attribute of the data has been compromised?
A. Availability
B. Integrity
C. Accountability
D. Confidentiality
Answer: D
Q2. An organization is selecting a service provider to assist in the consolidation of multiple computing sites including development, implementation and ongoing support of various computer systems. Which of the following MUST be verified by the Information Security Department?
A. The service provider's policies are consistent with ISO/IEC27001 and there is evidence that the service provider is following those policies.
B. The service provider will segregate the data within its systems and ensure that each region's policies are met.
C. The service provider will impose controls and protections that meet or exceed the current systems controls and produce audit logs as verification.
D. The service provider's policies can meet the requirements imposed by the new environment even if they differ from the organization's current policies.
Answer: D
Q3. What is the MOST effective method of testing custom application code?
A. Negative testing
B. White box testing
C. Penetration testing
D. Black box testing
Answer: B
Q4. An organization has decided to contract with a cloud-based service provider to leverage their identity as a service offering. They will use.Open Authentication (OAuth) 2.0 to authenticate external users to the organization's services.
.As part of the authentication process, which of the following.must.the end user provide?
A. An access token
B. A username and password
C. A username
D. A password
Answer: A
Q5. The overall goal of a penetration test is to determine a system's
A. ability to withstand an attack.
B. capacity management.
C. error recovery capabilities.
D. reliability under stress.
Answer: A
Q6. Which of the following BEST describes a rogue Access Point (AP)?
A. An AP that is not protected by a firewall
B. An.AP not configured to use Wired Equivalent Privacy (WEP) with Triple Data Encryption Algorithm (3DES)
C. An.AP connected to the wired infrastructure but not under the management of authorized network administrators
D. An.AP infected by any kind of Trojan or Malware
Answer: C
Q7. Which of the following prevents improper aggregation of privileges in Role Based Access Control (RBAC)?
A. Hierarchical inheritance
B. Dynamic separation of duties
C. The Clark-Wilson security model
D. The Bell-LaPadula security model
Answer: B
Q8. When implementing controls in a heterogeneous end-point network for an organization, it is critical that
A. hosts are able to establish network communications.
B. users can make modifications to their security software configurations.
C. common software security components be implemented across all hosts.
D. firewalls running on each host are fully customizable by the user.
Answer: C
Q9. Which of the following defines the key exchange for Internet Protocol Security (IPSec)?
A. Secure Sockets Layer (SSL) key exchange
B. Internet Key Exchange (IKE)
C. Security Key Exchange (SKE)
D. Internet Control Message Protocol (ICMP)
Answer: B
Q10. Which of the following MOST influences the design of the organization's electronic monitoring policies?
A. Workplace privacy laws
B. Level of organizational trust
C. Results of background checks
D. Business ethical considerations
Answer: A
Q11. The BEST method of demonstrating a company's security level to potential customers is
A. a report from an external auditor.
B. responding to a customer's security questionnaire.
C. a formal report from an internal auditor.
D. a site visit by a customer's security team.
Answer: A
Q12. In Disaster Recovery (DR) and business continuity training, which BEST describes a functional drill?
A. A full-scale simulation of an emergency and the subsequent response functions
B. A specific test by response teams of individual emergency response functions
C. A functional evacuation of personnel
D. An activation of the backup site
Answer: B
Q13. Which type of control recognizes that a transaction amount is excessive in accordance with corporate policy?
A. Detection
B. Prevention
C. Investigation
D. Correction
Answer: A
Q14. In a basic SYN flood attack, what is the attacker attempting to achieve?
A. Exceed the threshold limit of the connection queue for a given service
B. Set the threshold to zero for a given service
C. Cause the buffer to overflow, allowing root access
D. Flush the register stack, allowing hijacking of the root account
Answer: A
Q15. Which of the following BEST.avoids data remanence disclosure for cloud hosted
resources?
A. Strong encryption and deletion of.the keys after data is deleted.
B. Strong encryption and deletion of.the virtual.host after data is deleted.
C. Software based encryption with two factor authentication.
D. Hardware based encryption on dedicated physical servers.
Answer: A