Practice Test B Review
D. Through understanding the RPO
A disaster recovery plan (DRP) should focus on restoring mission critical services. Part of the DRP is to ensure that recent data is available for processing once mission critical services are restored. How is data loss addressed in DRP? A. By avoiding failure with RAID B. By implementing redundancies C. By minimizing recovery time with a small RTO D. Through understanding the RPO
B. A method of monitoring that is used to detect risk issues within an organization
Continuous monitoring is best defined by which of the following? A. An automated system used to detect humidity and condensation in a data center B. A method of monitoring that is used to detect risk issues within an organization C. A manual system for monitoring a hot site in the event of a requirement immediate use D. An automated system that regulates the flow of traffic on a network
C. Have an offline backup.
How can a user avoid being seriously harmed by ransomware? A. Use Linux. B. Avoid becoming infected. C. Have an offline backup. D. Pay the required ransom fee.
B. Create groups with the names of jobs, assign privileges to the groups, and place users into named groups.
How can an equivalent to RBAC be implemented in a DAC operating system? A. Assign users job labels. B. Create groups with the names of jobs, assign privileges to the groups, and place users into named groups. C. Assign users classification labels. D. Use filter lists to control access, set time restrictions, and block access based on logical address.
C. Check for the user identity in the object's ACL.
How does discretionary access control determine whether a subject has valid permission to access an object? A. Assess the user's role. B. Evaluate the attributes of the subject and object. C. Check for the user identity in the object's ACL. D. Compare the classification labels of the subject and object.
A. Restore files from backup media.
How is a backup strategy tested to verify that it is a viable tool for recovery after a disaster? A. Restore files from backup media. B. Review the backup policy. C. Perform a verification pass immediately after the backup completes. D. Create an encrypted backup.
B. Need to know
How is granular control of objects and resources implemented within a mandatory access control environment? A. Logical location assessment B. Need to know C. ACLs on objects D. Job label
C. Updated configuration documentation
The disaster recovery plan (DRP) is used to guide the re-creation of mission critical processes in the event of a disaster. Which of the following is a key element that is required as part of restoration planning to ensure that the most current version of the IT infrastructure is restored? A. Troubleshooting guidelines B. Service level agreements with contractors C. Updated configuration documentation D. Qualitative analysis risk report
B. 14
What channel is defined as part of the original IEEE 802.11 in the 2.4 GHz range and is restricted from use within the United States? A. 1 B. 14 C. 11 D. 6
D. They are all potential sources of threats.
What do the following concepts have in common: weather, utilities and services, human actions, business processes, information technology, and reputation? A. They are levels of classification. B. They are elements in a qualitative risk analysis approach. C. They are examples of assets. D. They are all potential sources of threats.
C. Active monitoring
What form of monitoring involves the injection of packets into communications in order to measure performance of various elements in the network? A. Collaborative monitoring B. Passive monitoring C. Active monitoring D. Post mortem monitoring
B. A binary value
What is the composition of a cryptographic key, whether symmetric or asymmetric? A. A prime number B. A binary value C. A complex mathematical formula D. A signed object
D. eDiscovery
What is the legal process by which law enforcement officials, including attorneys, can make formal requests to obtain digital information in relation to a legal action, investigation, or court proceeding? A. Abandonment B. Encryption C. Ownership D. eDiscovery
A. A qualitative impact analysis identifies areas that require immediate improvement.
What is the main advantage of using a qualitative impact analysis? A. A qualitative impact analysis identifies areas that require immediate improvement. B. A qualitative impact analysis provides specific measurements of attack impacts. C. A qualitative impact analysis makes a cost benefit analysis simple. D. A qualitative impact analysis considers monetary facts and figures.
A. Speed of presentation
What is the most important consideration in regards to communicating findings from a security monitoring system? A. Speed of presentation B. Informing the public of each security violation C. Having the presentation include all details related to an event D. Linking each violation to a standard vulnerability reference, such as the CVE
A. Brute force guess the key
What is the only viable method a determined attacker can attempt to compromise an encrypted file, assuming a publicly available cryptography standard was used? A. Brute force guess the key B. Examine the algorithms C. Analyze the hash value D. Reverse the encryption formula
B. To verify the author and integrity of downloadable code that is signed using a private key
What is the prime objective of code signing? A. To verify the author and integrity of downloadable code that is signed using a public key B. To verify the author and integrity of downloadable code that is signed using a private key C. To verify the author and integrity of downloadable code that is signed using a master key D. To verify the author and integrity of downloadable code that is signed using a symmetric key
D. Anything that records or maintains data of interest
What is the purpose of a source system? A. The first computer B. The original gold version of a computer which is cloned for enterprise deployment C. The data warehouse were open source code is saved D. Anything that records or maintains data of interest
B. Key space
What is the term used for the range of values that can be used to control the symmetric encryption function while converting plaintext into ciphertext? A. Block size B. Key space C. Key length D. Rounds
D. Two-way trust
What is the term used to describe a relationship between two entities where resources from either side can be accessed by users from either side? A. Web of trust B. Transitive trust C. One-way trust D. Two-way trust
D. RADIUS
What standards-based technology is supported on most platforms and is used as a remote authentication service? A. Kerberos B. NTLM C. TACACS+ D. RADIUS
C. Auditing
What type of technical control can be used in the process of assessing compliance? A. Multifactor authentication B. Encryption C. Auditing D. Security camera
B. Passive FTP
When a client is located behind a firewall that does not allow inbound initiated contact, which of the following will need to be used to support file transfer? A. Active FTP B. Passive FTP C. Client-hosted FTP D. Server-initiated FTP
B. Hash the message, and then encrypt the digest with the private key.
When crafting a digital signature, what are the initial steps in the process performed by the sender? A. Encrypt the message with a symmetric key. B. Hash the message, and then encrypt the digest with the private key. C. Hash the message, and then encrypt the message with the private key. D. Sign the message with the recipient's public key.
A. Rogue access points are detected.
Which answer is most accurate regarding a wireless intrusion prevention system? A. Rogue access points are detected. B. It is used to fine-tune the traffic on a wireless network. C. It monitors all traffic arriving at a wireless access point for proper ID fields. D. It broadcasts a jamming tone at a potential intruder.
A. Interviewing fired employees
Which choice is not a common means of gathering information when performing a risk analysis? A. Interviewing fired employees B. Reviewing existing policy documents C. Distributing a multi-page form D. Utilizing automated risk poling tools
A. Asymmetric
Which cryptography concept is based on trap-door, one-way functions? A. Asymmetric B. Symmetric C. Steganography D. Hashing
A. Structured walk-through test
Which disaster recovery/emergency management plan testing type is considered the most cost-effective and efficient way to identify areas of overlap in the plan before conducting a more demanding training exercise? A. Structured walk-through test B. Full failover test C. Simulation test D. Tabletop exercise
B. The European Union's General Data Protection Regulation provides a single set of rules for all member states.
Which of the following is the most accurate statement? A. Any corporation that has done business in the European Union in excess of five years may apply for the Safe Harbor amendment. B. The European Union's General Data Protection Regulation provides a single set of rules for all member states. C. The United States leads the world in privacy legislation. D. Argentina and Brazil are members of the Asia-Pacific Privacy Pact.
B. Provide competent and diligent service
Which of the following is the third canon of the (ISC)2 Code of Ethics? A. Act honorably B. Provide competent and diligent service C. Meet all CEU requirements for this certification D. Ensure the safety of society
D. Bandwidth throttling
Which term is used when limiting the amount of network traffic a specific protocol or application is allowed to generate or consume, with the goal of keeping the remainder of the network's capacity free for other communications? A. Quality of service management B. Load balancing C. Utilization tracking D. Bandwidth throttling
D. Establish a trust between RemoteOf3 and Metroil-HQ.
Your company has recently acquired a small startup company, Metroil. Metroil has a single Microsoft Active Directory domain named Metroil-HQ. Your company has three existing domains: BaseStar1, RemoteOf2, and RemoteOf3. Your company's three existing domains are configured in a standard domain tree, with BaseStar1 linked to RemoteOf2, which is then linked to RemoteOf3. How can users from Metroil be able to access resources in BaseStar1 with the least amount of network reconfiguration? A. No new configuration is required. All domains automatically have two-way trusts between them. B. Remove each device from Metroil-HQ, and then join each device as a new member of BaseStar1. C. Break the tree trusts between BaseStar1 and RemoteOf2 and the trust between RemoteOf2 and RemoteOf3. Then establish a trust between BastStar1 and Metroil-HQ. D. Establish a trust between RemoteOf3 and Metroil-HQ.
C. Preparation
According to NIST SP 800-30 Revision 1, what is the first major step in risk assessment? A. Communicate B. Maintain C. Preparation D. Conduct
B. It is a form of trusted third-party authentication.
Many Web sites use a digital certificate to prove their identity to visitors. Why is the use of digital certificates considered a reliable form of authentication? A. It uses symmetric encryption keys. B. It is a form of trusted third-party authentication. C. It complies with 802.1x. D. It is a web of trust.
B. Apply security controls to the output of data-mining operations.
One of the security challenges for big data is controlling access to the data stored within the massive data structure. Efforts to apply traditional access control and authorization settings to individual options within the data store have produced lack-luster results or unsatisfactory performance. A new technique being applied which shows promise. What is the new technique of controlling access to the content of big data information collections? A. Reset all permissions on all data objects to group access. B. Apply security controls to the output of data-mining operations. C. Implement only physical security restrictions. D. Set all data objects as being owned by the IT manager.
