Oct 2023 – CISSP Exam emulation practice test #1 – Hard difficulty – Results

Oct 8, 2023

Attempt 4

Question 1: Correct

Given the short time to produce code and deploy it for end user testing in the test environment, Helen prefers SAST (Static application security testing) over DAST (Dynamic application security testing). What is the MOST likely reason for her preference?

Negative findings in DAST take longer to remediate
SAST can be conducted earlier in the software development phase

(Correct)
The security awareness and solutions training ensures the developers are aware of best practices
SAST is less expensive to perform

Explanation

OBJ-6.2: The Static Application Security Test (SAST) can discover software vulnerabilities before the code is compiled, allowing developers to correct the problems before the executable code is subject to the Dynamic Application Security Testing (DAST).

Question 4:

Skipped

Frank notices that users at his company can read data in files in a folder for which they are explicitly denied having access, when they use a program that they are allowed to run, and the program can read the files in question. Which is the BEST principle proposed by Saltzer and Schroeder to deal with this problem?

Least Common Methodology

(Correct)
Economy of Mechanism
Psychological Acceptability
Complete Mediation

Explanation

OBJ-3.2: Least Common Mechanism reduces transitive trust relationships; it also ensures access control mechanisms are not created for each subsystem, but rather all access controls ought to use a single well-designed and thoroughly tested mechanism. Complete Mediation requires every access to every object be checked every time, meaning your system must make it possible for the identity and authorizations of every request to be authenticated at every step. Economy of Mechanism reduces the complexity of the mechanism; the smaller and simpler the mechanism, the more secure it is and the easier it will be to verify and test. Psychological Acceptability ensures that the system works in the expected manner.

Question 5:

Skipped

Robert is the CIO at a company that has decided to allow customers to pay by credit card. How should he address the requirements of PCI DSS?

Change all vendor-supplied defaults for passwords.
Restrict access to cardholder data according to the need to know of the business departments.
Update the policies and process procedures to include the requirements.

(Correct)
Update the guidelines for customers who use credit cards.

Explanation

OBJ-1.4: Senior management updates the policies, and lower management set the process procedures to implement the policies. PCI DSS is the standard, so it already has the requirements and does not need updating. Guidelines are optional steps that are referred to when implementing the standards, whereas all the steps in PCI DSS are mandatory. Changing vendor-supplied passwords and restricting access are two specific requirements of PCI DSS; there are 10 other requirements that must also be met.

Question 8: Correct

Natalie wants to implement measures to protect the encryption keys from brute force attacks. Which combination of controls is MOST likely to be successful? 1. Increase key length 2. Change keys every day 3. Change key management protocol 4. Change cryptographic algorithm

1 and 2

(Correct)
1 and 3
3 and 4
2 and 3

Explanation

OBJ-3.7: The time to conduct a brute force attacks can be increased dramatically by increasing the key length (AES to 256, RSA to 4096) – a 4096 bit key will take more than 100 years to crack by brute force. The payoff in conducting a brute force attack can be minimized by changing symmetric keys frequently (daily or hourly). Changing the key management protocol or the cryptographic algorithm will not prevent or deter an attempt to perform a brute force attack.

Question 10: Correct

Robert has the result of the inherent and residual risks for a particular set of assets for which he is responsible. The inherent risk level is very high and the residual risk level is not nearly so high, but still above the maximum boundary level of risk. Which of the following is the MOST likely step Robert will now take?

Enhance existing controls
Implement new controls
Advise senior managers to change the business processes that use those assets

(Correct)
Purchase additional insurance

Explanation

OBJ-1.10: When the residual risk level exceeds the maximum boundary risk, there is a strong possibility the company will not remain in operation when the attacks occur; hence the prudent course of action would be to change the business processes to avoid the risk. Implementing additional controls, enhancing existing controls, and purchasing additional insurance will not mitigate the risk in the short term, or change the business processes that rely on those assets.

Question 12:

Skipped

Mark is sending a long email to 50 employees, each of whom has an entry in the company’s PKI. What is the BEST way to ensure the email is kept confidential?

Mark encrypts the email using his Private Key and sends copies to the recipients.
Mark encrypts the email using a new symmetric key and then sends 50 copies of the encrypted message, each copy including the symmetric key that is encrypted using the recipient’s Public Key.

(Correct)
Mark sends 50 different encrypted messages, one to each recipient encrypted using the recipient’s Public Key.
Mark saves the long email to a file encrypted by a random symmetric key, and sends an email to each recipient that includes the new symmetric key and a link to the encrypted file.

Explanation

OBJ-3.6: The best way is to ensure each recipient receives a separate copy of the encrypted email, with the symmetric key used to encrypt and decrypt the email that is encrypted using the recipient’s Public Key, so that only the intended recipient can decrypt the symmetric key using his/her Private Key. Asymmetric encryption is slower than symmetric encryption and produces cipher text much longer than the plaintext, so it is better to use symmetric encryption to protect the long email, although the difference in negligible when encrypting short text like the symmetric key. The symmetric key must be protected by asymmetric encryption. It is generally a good idea to send a link to the encrypted file rather than embedding the encrypted ciphertext in the email, but the answer shown here does not protect the symmetric key. Lastly, if Mark encrypts the email with his Private Key then anyone can fetch his Public Key to decrypt the message; doing so proves Mark is the person who sent the email but does not protect the confidentiality from unintended recipients.

Question 16: Correct

Dee wants to monitor her systems to guard against distributed denial-of-service attacks. Which is the MOST likely pair of metrics that will indicate such an attack is in progress?

CPU utilization and disk activity
Disk activity and network utilization
Memory utilization and network utilization
CPU utilization and network utilization

(Correct)

Explanation

OBJ-3.7: A distributed denial of service (DDOS) is a network attack in which the attacker consumes so much of the computer’s resources that it is unable to respond to other users, resulting in loss of service. The best indicators are high CPU utilization and high network utilization. The DDOS attack is unlikely to affect the memory utilization by very much (most servers and desktops now have at least 8 Gb memory), and the disk activity will not be impacted.

Question 17: Correct

Naomi is trying to convince her managers that penetration tests are more useful than vulnerability scans. Which is not a valid reason that would support her case?

Penetration test results are kept confidential
Penetration testing offers proof that the data can be breached but refrains from actually doing so
Penetration tests do not exploit the vulnerabilities found on the system

(Correct)
Penetration tests mirror real-world attacks from intruders

Explanation

OBJ-6.2: Penetration tests do seek to exploit the vulnerabilities found on the system, and in this way mirror the actions of real-world attacks by intruders. Penetration tests do gather evidence to show management that the data can be breached but does not copy or retain the data, so the data is kept under the company’s control. The penetration test results are kept confidential, to give the company time to improve the security controls.

Question 18:

Skipped

Over the past five years, Linda has moved positions seven times. She claims she has a need to know the problems facing her former co-workers so that she can better help them in her latest role as Service Desk Manager. What is the MOST likely reason that her access may be removed after a management review of her access privileges?

Integrity of data
Least privilege

(Correct)
Need to know
Availability of data

Explanation

OBJ-7.4: According to the principle of least privilege, Linda’s access should be reduced to only the functions she needs in her current role. Although knowing the problems that face the end workers may seem desirable for the Service Desk Manager, she should not retain the access to read (affects Confidentiality), modify (affects Integrity), or delete (affects Availability) the data in those applications.

Question 20: Correct

Our company uses a lot of contractors and temporary employees. What would be the BEST way to ensure their access is removed when they no longer need it?

Request the overseeing manager emails Information Security when the contractor has completed their work.
Send an audit of their account activity to the manager overseeing them.
Have all contractors and temporary employees sign an NDA (Non-Disclosure Agreement).
Set automatic expiration dates.

(Correct)

Explanation

OBJ-5.2: Before the contractor or temporary employee starts, we would know how long their contract is set for. We would use that and set automatic expiration dates on their access. If the contract is extended, the overseeing manager would request an extension (with a new automatic expiration). Requesting the overseeing manager to send an email when the contractor is done, will often not happen, automation is always better than remembering. We may send the audit and have the contractors sign and NDA, but neither of those would help with access removal, once the contract is completed.

Question 23: Correct

In her company, access controls are rule-based. Naomi is creating an access control list for files in the financial department’s share. Naomi wants all managers to have read access to any file, but only employees in Accounts Receivable (AR) to be able to update the file and only employees in Accounts Payable (AP) to read the files; no-one else should be permitted access. Given these four rules, what is MOST likely the sequence to place them in the ACL? 1. Deny 2. Allow Managers read access 3. Allow AR update access 4. Allow AP read access

4, 3, 2, 1
2, 3, 4, 1
1, 2, 4, 3
3, 4, 2, 1

(Correct)

Explanation

OBJ-5.4: In rule-based ACLs the most specific rules comes first (Allow AR update; Allow AP read), then the more general rule (Allow Managers read); the Deny rule may be implicit but it never hurts to add an explicit Deny as the last rule. The greater access (update) should precede the lower access (read).

Question 24: Correct

Francis wants to detect spoofing attacks. Which of the following attack vectors is LEAST likely to be associated with a spoofing attack?

Sniffing

(Correct)
Impersonating a user
Mimicking the output of a program
Injecting false packets with the correct next sequence number

Explanation

OBJ-3.7: Sniffing (in promiscuous mode) captures all network traffic on the subnet and attempts to read any unencrypted data. Spoofing attacks occur when a program or user successfully identifies as another, by falsifying data to gain an illegitimate advantage. Examples of these attacks are impersonating a user, mimicking the output of a program, and injecting false packets with the correct next sequence number (so the true packet with the same sequence number will be ignored).

Question 27: Correct

Which of the following would be the MOST important for our security policies to be?

Have verbiage about our network vulnerabilities.
Address the process for communication internally and externally during a security incidence.
Be in clear and easily understood language.

(Correct)
Be tailored to each business unit.

Explanation

OBJ-1.7: Our security policies should be clear and easy to understand, they should be available to our entire staff. We would not have network vulnerabilities in our policies, and we do not want our entire organization to know about them. The process for communication would be in our DRP (Disaster Recovery Plan) or CCP (Crisis Communication Plan). The security policies are high level and vague, we would never want to have tailored versions for each business unit. The security policies are built from the vision and mission of the business, they should be consistent across the organization.

Question 29: Correct

As VP of Sales, Naomi is the data owner of a file that has been created by people who report to her. She does not wish to be involved in the day-to-day tasks of granting and revoking access, taking backups, restoring files from backups, and correcting problems with referential integrity. What is the MOST likely action Naomi will take?

Transfer the ownership to the IT department
Delegate the role of data custodian to a junior manager in the Sales department
Delegate the role of data custodian to an IT support specialist

(Correct)
Delegate the role of data custodian to a senior sales representative in the Sales department

Explanation

OBJ-2.4: Naomi can, and probably should, delegate the role of data custodian to someone who is trained in such day-to-days tasks, such as an IT support specialist. It is likely the junior manager or senior sales rep will not have the training to handle such tasks. It would be poor practice to transfer the ownership to IT, because the IT department is not involved in the business processes which gave rise to creating and maintaining the data.

Question 32: Correct

As the firewall administrator, Claire notices a rule that permits traffic to tcp ports 20 and 21 on a range of internal servers. What is the MOST likely reason Claire would have to be suspicious of this rule?

FTP is deprecated and should be replaced by TFTP
There should be one specific firewall rule for each FTP server
FTP servers should all be replaced with SFTP servers
It is uncommon to have more than one FTP server

(Correct)

Explanation

OBJ-4.1: It is uncommon to have more than one FTP server. Sometimes a large corporation might have several FTP servers running in parallel behind a load balancer, in which case the firewall rule would allow FTP traffic to the single IP address of the load balancer, not to all possible FTP servers. It is true that servers should use SSH FTP (SFTP) instead of FTP, but this is not the most likely reason for Claire to be suspicious of this rule. FTP is not yet deprecated.

Question 33: Correct

John is a manager of communications at Thorteaches.com. The senior managers of the company use VoIP for their conference calls and they have been complaining that sometimes their voices sound muffled or indistinct. What is the MOST likely action that John can do to improve the situation?

Implement QoS (Quality of service) protocol

(Correct)
Implement fault tolerance
Improve system resilience
Add VoIP (Voice Over Internet Protocol) application to the whitelist

Explanation

OBJ-4.3: The Quality of Service (QoS) protocol provides priority service to a specified application or type of communication. By prioritizing the VoIP traffic John can maximize the performance of the VoIP application, possibly at the expense of another service. Implementing fault tolerance, improving system resilience, or adding VoIP to the whitelist of permitted applications would not specifically help the network utilization by the VoIP application.

Question 36: Correct

Francis is choosing documented techniques established by expert groups outside his company that prescribe the lists of security controls that align with senior management’s directives and should apply equally to all departments in his company. What is the MOST likely term for the type of documents that Francis is using?

Procedures
Standards

(Correct)
Policies
Guidelines

Explanation

OBJ-2.6: Security standards are documents that have been exhaustively reviewed before publication by groups of experts, as the best practices for a particular class of applications and apply across all departments in the company. Guidelines are documents that help companies to implement the standards. Policies are determined by the company’s senior management to specify the desired goals to protect assets and resources. Procedures or processes are the documents that describe the day to day tasks to be followed by departments in compliance with the selected standards, and may differ between departments.

Question 38: Correct

Several years ago, Wanda’s company used Open System Authentication (OSA) for wireless communications. Which is the MOST likely reason why Wanda’s company should have changed, and what is the BEST replacement her company could use today?

OSA does not require user authentication: use Lightweight Extensible Authentication Protocol (LEAP)
OSA does not require user authentication: use Wired Equivalent Privacy
OSA transmissions are not encrypted: use Wi-Fi Protected Access 2

(Correct)
OSA transmissions are not encrypted: use Wi-Fi Protected Access

Explanation

OBJ-4.1: Using OSA does not require user authentication; any communication is allowed as long as the radio signal reaches the wireless access point, and hence OSA transmission are not required to be encrypted. The current standard is to use Wi-Fi Protected Access (WPA)-2. Note WPA2 is not version 2 of WPA. Wireless Equivalent Privacy (WEP) and WPA are deprecated because they have been broken. LEAP depends on WPA and it too is deprecated; it has been replaced by Protected Extensible Authentication Protocol (PEAP).

Question 39: Correct

Dee knows that it is important to ensure the integrity of data and program code by applying the principle of separation of duty. Which controls are Dee MOST likely to apply?

Program library controls

(Correct)
Data file naming conventions
Program & job naming conventions
File placement controls

Explanation

OBJ-8.2: Program library controls are based on the principle of separation of duties, in that only assigned programs from the library can run in production; these controls ensure only production code and data are used in normal production. File placement controls ensure that files reside on the proper server. Naming conventions help to implement the separation of duties by uniquely identifying production and test entities but are not the most likely controls Dee will apply.

Question 40: Correct

Jack wants to secure the only door to the server room, through which several dozen people come and go every day. He installs CCTV to monitor people’s movements, but after a week discovers the security guards fail to pay attention. What is the BEST action Jack can take to ensure the security guards do pay attention?

Install silent alarm that triggers an alert at the security officer’s desk, triggered when the door opens

(Correct)
Install a motion detector just inside the door
Require people to call the security guard’s desk to have the door opened
Install a motion detector just outside the door

Explanation

OBJ-3.7: Although security guards can act as a deterrent, having an alarm silent alarm that triggers at the guard station can remind them to see who is entering or exiting the data center. Installing motion detectors inside or outside the door will send an alarm for every normal event when anyone passes through the door, and the abnormal events will not stand out from the sea of normal events. Requiring people to call the security guard’s desk will quickly become burdensome and is not a reasonable action for Jack to take.

Question 41: Correct

Jon wants to use on-line banking to check his account balance at a credit union. When he starts, he sees a warning message that the certificate is not trusted. What is the certificate that is not trusted, and what is the MOST likely reason it is not trusted?

Jon’s SSL certificate; credit union cannot trust Jon as a certificate authority
Credit union’s X.509 certificate; CA that signed the certificate is not trusted by a root CA

(Correct)
Credit union’s X.500 certificate; Jon’s browser cannot find root of directory
Credit union’s X.400 certificate; Jon’s browser uses SMTP instead

Explanation

OBJ-4.1: The X.509 certificate (aka SSL certificate) is presented by the credit union, but Jon’s browser finds the certificate authority (CA) that signed the X.509 certificate is not trusted by a root CA, probably because the CA’s owner did not re-register the CA. The credit union would not ask for nor expect Jon to provide his SSL certificate. On-line banking does not use X.500 (hierarchical directory services) or X.400 (email protocol pre-dating SMTP).

Question 42: Incorrect

Cassandra has been directed to not use OSS (Open Source Software) code for any part of her next project that will implement her company’s proprietary database. What is the MOST likely reason behind this directive?

OSS code is not tailored to particular requirements

(Correct)
OSS code will not be kept up to date by the author
OSS code is not supported
OSS code is not warranted to be free of defects

(Incorrect)

Explanation

OBJ-8.4: Open Source Software is not tailored to the particular requirements of Cassandra’s company’s proprietary database. Although OSS code may be rewritten to accommodate these particular requirements, doing so would negate any warranty or support for the OSS code. This is a clear case for using closed source code developed by Cassandra’s company’s internal development team. OSS code available from trusted and reputable sites such as GitHub may very well be warranted, supported, and updated on a regular basis.

Question 45: Correct

Dee wants her application to integrate more easily with upstream applications from which she will receive input, and possibly with downstream applications which may use her output. What kind of system should Dee look at building?

System where she publishes the source code
System with proprietary source code
Closed system
Open system

(Correct)

Explanation

OBJ-3.5: The open system allows for many programmers to review and test the code, resulting in more robust solutions and making it much easier to integrate with other applications. Although publishing the source code makes it easier for downstream applications to use Dee’s output, doing so will not facilitate integrating with upstream applications that provide her input. A closed system is a system with proprietary source code that is not shared, making it more difficult to integrate with other applications.

Question 46:

Skipped

As the administrator of the perimeter firewall, Claire notices a rule that permits traffic to port 80 on the server at address 10.23.56.45. What is the MOST likely reason Claire would have to be suspicious of this rule?

External users should use port 22 to connect to the web servers.
The server’s given address cannot be used by an external computer to connect to the web server.
External users should use port 443 to connect to the web servers.
The address space 10.0.0.0/8 is not routable on the Internet.

(Correct)

Explanation

OBJ-4.1: The address space 10/8 is not routable on the Internet, so any computer external to the perimeter firewall would not be able to send traffic to the server at the given address. By the same token, the specific address 10.23.56.45 cannot be used by an external computer to connect to the web server; this answer falls out of the correct answer. Although external users may have to authenticate themselves at the web server, and such authentications should use either HTTPS (port 443) or SSH (port 22) in order to encrypt the username and password, neither is not the most likely reason why Claire would be suspicious of this rule.

Question 48: Correct

Dee is trying to determine how much insurance coverage to purchase. What is MOST likely to be the greatest factor that will determine the size of the financial loss from a disaster?

The side effects of the disaster

(Correct)
The effects on suppliers
The effects on investors
The disaster itself

Explanation

OBJ-7.10: The greatest financial losses in the event of a disaster are not from the disaster itself, but from the side effects or consequential impacts. Dee needs to consider not just the disaster, whatever it may be, but also how the disaster affects the power and internet connections, the city’s infrastructure services, communication with employees & suppliers, the possible loss of reputation or confidence among investors & customers, and other possible effects, which together are the side effects.

Question 50: Correct

We use both IDSs (Intrusion Detection Systems) and IPSs (Intrusion Prevention Systems) in our environment. What is the MAIN purpose of the IDSs?

To identify network misconfigurations.
To identify potential attacks on our internal network.

(Correct)
To block traffic seen as malicious.
To alert on true negatives.

Explanation

OBJ-7.7: IDSs (Intrusion Detection Systems) are detection systems, they do not act, and their MAIN purpose is to identify potential attacks on our internal network. They do not block malicious traffic, that would be an IPSs (Intrusion Prevention Systems). We could discover potential misconfigurations with vulnerability scanners, not IDSs. Finally, an IDS would alert on “True Positives” (which is good); an attack is happening, and the system detected it, and “False Positives” the system seems normal traffic as malicious (which is bad). The system would not alert on “True Negatives”; that is normal traffic and the system seeing it as such.

Question 51: Correct

Francis is considering the purchase of an electronic data vault. Which of the following aspects is MOST likely to help Francis make the decision?

Electronic vaults can restore data to servers at any location

(Correct)
Electronic vaults provide faster retrieval than tapes
Electronic vaults can be connected to any server OS
Electronic vaults reduce the storage space required for physical backup media

Explanation

OBJ-7.10: Electronic vaults can restore data to servers at any location, bypassing the need to physically transport the backup media to the alternate site and saving the time to do so. Once connected over the network, electronic vaults provide faster retrieval of the backup data than tapes. The aspects of reducing the storage space and supporting any server OS are relatively minor considerations.

Question 54: Correct

As a data owner you get notified there has been a suspected breach of your files on the Windows network share drive. Which audit log should be reviewed for evidence and by whom?

The Windows application event log should be reviewed by an administrator or forensic investigator.
The Windows security event log should be reviewed by an administrator or forensic investigator.

(Correct)
The Windows system log should be reviewed by an IT auditor.
The Windows security event log should be reviewed by an IT auditor.

Explanation

OBJ-6.2: Evidence of who accessed the files on the Windows file server is captured in the Windows security event log. Despite the common name of “audit log”, these logs should be reviewed by an administrator on a regular basis, rather than just by the IT auditor during a system audit. Not all IT auditors are trained to be forensic investigators. The application event log does not contain evidence of the operating system events, and the system log does not show which users accessed each file.

Question 55: Correct

Nayeli has discovered that the firewall her company uses will fail open if it tries to handle more than 10,000 concurrent sessions. There are 50 application servers on the subnet behind the firewall. Which statement BEST describes how the firewall will behave if each of these application servers allows 201 sessions to be opened?

The firewall will allow malicious attacks

(Correct)
The firewall will block any further use of the previously allowed traffic
The firewall will block malicious attacks
The firewall will allow only the previously allowed traffic

Explanation

OBJ-4.2: If each of the 50 servers allows 201 sessions to be opened, the firewall will need to handle 10,050 sessions; the firewall will fail, and in fail open mode it will cease to block any traffic and allow any traffic, possibly including malicious attacks, until it is restarted. Most sites on the internet see on average of 1000 malicious attacks every hour. If the firewall failed into a fail-safe mode, then it would block all traffic until it is restarted.

Question 57: Correct

What is the BEST way to simplify security management efforts when users are assigned to one of a few roles?

Provide details on what types of data an object can contain, what types of functions can be performed, and what capabilities an object has.

(Correct)
Use the separation of duties principle to ensure no user is assigned to more than one role.
Use principles of least privilege and need to know to assign permissions.
Use shortcuts to link to similar folders with the desired security settings.

Explanation

OBJ-1.3: Abstraction enables security managers to assign security controls to groups of subjects and/or objects collected by type of function. The three principles mentioned will guide the security manager to limit the assignment of privileges to users but will not by themselves save any effort. Linking to similar folders does not modify the security settings of either the source or target folder.

Question 58:

Skipped

Dee’s company requires her to authenticate using both the PIN assigned to her and the code displayed on her token. She has been told the software relies on a hidden counter, and the next code is generated from that counter. What is the MOST likely description of this one-time password (OTP) code?

Hardcopy OTP
Synchronous dynamic OTP
Asynchronous dynamic OTP

(Correct)
S/KEY OTP

Explanation

OBJ-5.2: Asynchronous one-time password (OTP) uses a certain algorithm to generate the next code based on the hidden counter. Synchronous OTP depends on the token being synchronized with the remote access server; the code displayed is only valid in a certain time window. With hardcopy OTP, European banks send a list of OTPs to each customer who works down the list in order. S/KEY calculates the hash of the user’s OTP (Hash[N-1](secret-key)) where N is a decrementing counter and compares this to the stored password (Hash[N](secret-key)).

Question 59:

Skipped

Cassandra has gone on two weeks’ vacation and her replacement worker Bob has found the ledger accounts do not balance. Nayeli is called to investigate. What is Nayeli MOST likely to do?

Nayeli asks Cassandra’s manager to meet with Cassandra and Bob when she returns from vacation to walk through the problem and determine what has happened.
Nayeli removes the hard disk from Cassandra’s computer, makes a bit-by-bit copy and places the original hard drive in a safe location. She inserts a new hard drive with all the correct programs and data in Cassandra’s machine.

(Correct)
Nayeli notifies HR and makes a copy of the files in the affected folders.
Nayeli meets Cassandra when she returns from vacation and asks her to explain what is going on.

Explanation

OBJ-7.6: Because embezzlement and fraud are criminal matters, Nayeli will want to keep the evidence that may lead to a criminal prosecution in a safe location. To show chain of custody, Nayeli will make a bit-by-bit copy of the hard drive to be used in the forensic investigation. To see if Cassandra continues her practices, Nayeli may insert a new hard drive with the correct programs and data in Cassandra’s machine. Nayeli may choose to work with HR to prosecute Cassandra, and HR may want Cassandra’s manager to interview Cassandra upon her return.

Question 60:

Skipped

We are wanting to promote Information Security awareness within our organization. Which of these tactics would be the MOST efficient and positive way to do so?

Rewards and competitions for users and business units who are able to act on the Information Security awareness training we provided.

(Correct)
Locking user accounts if they have mistyped their password 3 times or clicked on a phishing email.
Strict rules around phishing emails and reprimands and written warnings when employees click on phishing emails.
Weekly reports sent to managers highlighting how their staff performed the previous week in regard to phishing other topics we covered in our Information Security awareness training.

Explanation

OBJ-1.13: Rewarding employees for good behavior is much more effective than punishing them for bad behavior. Highlighting the competitions and getting different business units to compete with each other is a great way for employees to keep each other accountable for good Information Security practices. Warnings, locking accounts, and reports sent to the managers may be needed, but it should never be the first or second course of action.

Question 62:

Skipped

As the firewall administrator, Claire notices a rule that permits traffic to port 80 on the server at address 47.23.56.255. What is the MOST likely reason Claire would have to be suspicious of this rule?

This address cannot be reached by the firewall
The web server would never be assigned this address
This address is missing the subnet mask
This address is used to send a broadcast to all servers on the subnet

(Correct)

Explanation

OBJ-4.1: An IPv4 address with 255 as the last octet broadcasts the traffic to all servers on the subnet, in this case the 47.23.56/24 subnet. By the same token, any server (web or otherwise) would never be assigned this address, but this is the result of the reason behind the correct answer. Port 80 is used by podcast servers to broadcast their traffic. The broadcast IP address can be reached by the firewall. In IPv4 if the address lacks a subnet mask, /32 is assumed.

Question 63:

Skipped

Cassandra wants to use a risk-centric approach to assess the risks facing her business process. Which of the following models is BEST suited to her goals?

PASTA

(Correct)
DREAD
OCTAVE
STRIDE

Explanation

OBJ-1.10: PASTA (Process for Attack Simulation and Threat Analysis) is a risk-centric approach that, because it includes the business objectives, is more useful for assessing business risks. STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, DOS, Elevation of privilege) is a software-centric approach. DREAD (Damage potential, Reproducibility, Exploitability, Affected users, Discoverability) is an approach to prioritize the threats. OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) is an approach for managing security risks.

Question 64:

Skipped

In a room of tapes that have varying levels of sensitive data, Yvonne discovers a tape is not labeled. What is the MOST appropriate way for her to protect this tape?

Assume the label fell off and is to be found somewhere close by
Assume the data should be erased to prevent it from being disclosed
Assume the data is at the highest sensitivity level

(Correct)
Assume the data is at the lowest sensitivity level

Explanation

OBJ-2.1: Any data container without labels should be assumed to have the highest sensitivity level until proven otherwise (err on the side of caution). All the data contained needs to be reviewed to determine the highest sensitivity level, and then the asset should be labeled with that level. Until this is completed, Yvonne should follow the procedures to protect the data at the highest sensitivity level to protect this tape, even if this tape is later found to contain only Public unclassified data. While is true that tapes that have been degaussed no longer contain data and the label can then be removed, the blank tapes should not be kept in the same room of tapes with data. It is possible the label has fallen off, but it is not reasonable to assume that a label lying close by was affixed to this particular tape; the tape should be treated with suspicion (assume the highest sensitivity level) until proven otherwise.

Question 65:

Skipped

Attackers determine that for every username that ends with an A, there is a similar username that ends in a digit.

What is the MOST likely explanation?

These users have a hyphenated first name, such as Jean-Andre
The usernames that end with A were created after the usernames that end with 9
The usernames that end with A denote users who are in an Acting position, such as Acting Vice-President
The usernames that end with A are administrator accounts

(Correct)

Explanation

OBJ-5.2: For years it has been a misguided attempt to use the suffix A to identify an administrator account, to keep them separate from the non-privileged accounts that administrators use when not requiring the elevated privileges; doing so makes these accounts more attractive to attackers. It is very unlikely that there are nine other usernames with the same surname and first initial (e.g. irvingp1 to irvingp9) for each user with an administrator account (irvingpa). Other than administrators, it is highly unusual to create a username for people in a specific role, especially for those who have a temporary position such as Acting Vice-President.

Question 67:

Skipped

Francis’ company is located in the middle of a flood plain. Which of the following is MOST likely to require a great deal of advance planning?

Water pumps and sandbags for dikes
Environmental controls and remote monitoring
Power supply and environmental controls

(Correct)
Power supply and remote monitoring

Explanation

OBJ-7.10: With the company being located in a flood plain, it is likely Francis’ company will face floods almost every year. When a flood occurs, it will be crucial to ensure the power supply lines, the transformers, and the data center remain dry and functioning, not least to ensure the sump pumps continue to run. Also, the floods will bring excessive amounts of humidity, and if the humidity exceeds 80% then the computer connections may become corroded, so it will be crucial to maintain the environmental controls over humidity and temperature. These will require advance planning, especially as Francis’ company contends with other businesses dealing with the same issues. Remote monitoring, water pumps, and sandbags for dikes are measures that can be set up closer to the flood occurring.

Question 69:

Skipped

Naomi is tuning the intrusion detection system (IDS) to present a more accurate portrayal of the level of risk. What is the MOST likely aspect that Naomi will adjust, and how will it help?

Decrease the false rejections rate
Make the rules less strict, thereby reducing the rate of false positives
Make the rules more strict

(Correct)
Increase the false rejections rate

Explanation

OBJ-4.2: Businesses are attacked very frequently, usually more than 1000 times an hour. To show the level of risk more accurately, Naomi should make the rules more strict, which will increase the number of false positives; in turn, more time will be required to investigate the false positives, and this will mean the security operations team will find more indicators when a compromise occurs. If false positives are reduced, the security operations team may miss indicators that a compromise has occurred. Modifying the false rejections rate will not help or hinder the portrayal of the level of risk.

Question 70:

Skipped

We are making an entirely new set of user awareness training materials. Which of these is the MOST important element?

Detailed information about social engineering.
Detailed information about our security policies and consequences for not following them.
The buy-in from the information security steering committee.
That the materials are easy to read and understand.

(Correct)

Explanation

OBJ-1.13: It is critical that the information is easy to read and understand. If it is too confusing or use too many technical words, many employees will either not read it at all or forget it almost right away. We would want senior managements buy-in, but for the materials to be effective, it is more important they are easy to understand. Staff should learn about social engineering and our policies, but in a simplified language they can understand and relate to.

Question 71:

Skipped

Claire is concerned that some conditions may exist that can put her IT assets at a high risk of loss. Which pair of conditions is MOST likely to place the assets at high risk?

System interconnectivity and inadequate physical security
System interconnectivity and lack of system backups
System interconnectivity and poor security management

(Correct)
System interconnectivity and poor controls over data sensitivity

Explanation

OBJ-2.1: Poor security management does not proactively and systematically assess risks, monitor the effectiveness of security controls, and respond to identified problems.

This situation can become much weaker with interconnected systems where the risk is the greatest.

The other three answers are part of this same combination of conditions.

Question 72:

Skipped

Mark has been working at ThorTeaches.com for five years, and he has a friend working for a competitor. What is the MOST likely document that would prevent Mark from sharing his inside knowledge with his friend?

Non-Compete Agreement
Acceptable Use Policy
Non-Disclosure Agreement

(Correct)
Third-party Access Policy

Explanation

OBJ-7.4: The Non-Disclosure Agreement prohibits Mark from disclosing proprietary information outside the company. The Non-Compete Agreement specifies that for a period of one to three years after Mark leaves the company, he is not allowed to bring his expertise to the competitor’s products that directly compete against his old company. The Acceptable Use Policy governs what conduct is permissible and non-permissible while using company resources. The Third-party Access Policy governs how vendors, consultants, and contractors can obtain and use remote access to the company resources.

Question 73:

Skipped

Dee is trying to infer information that is kept in a file to which she does not have access. However, she does have access to other files which contain metadata about the data in the first file. What is the MOST common term for what Dee is attempting?

Inference attack

(Correct)
Inductive attack
Fallacious attack
Deductive attack

Explanation

OBJ-3.6: An inference attack occurs when a user who lacks access to files can infer the data from the content in other files. Deductive attacks occur when a user draws logical conclusions from the data to which they have access. Inductive attacks occur when users attempt to draw conclusions based on partial data in the files to which they have access. A fallacious attack attempts to include invalid data when making a decision.

Question 75:

Skipped

What is the MOST important reason we have Information Security review our contracts throughout the enterprise?

To ensure the right to audit is a requirement.
To ensure no confidential information is included in the contract.
To ensure appropriate controls are included.

(Correct)
To ensure that both parties can perform their contractual promises.

Explanation

OBJ-6.2: When our organization signs contracts with other entities, we need to ensure that the proper security controls are in place. Some contracts would have confidential information included, we can’t eliminate it completely, but we should limit it to what is strictly needed. We would possibly also reserve the right to audit, but not always, and it is less important than the security controls. If both parties can fulfil their obligations is important, but it is rarely a security concern.

Question 76:

Skipped

As VP of Sales, Naomi is the data owner of a file that has been created by people who report to her. What is the LEAST likely task that Naomi needs to perform?

Categorize the data
Define the asset retention requirements
Verify the accuracy of the data

(Correct)
Manage the data quality requirements

Explanation

OBJ-2.4: Data owners do not verify the accuracy of the data; data custodians do that. Data owners (aka data stewards) are responsible to categorize the data (i.e. assign the security classification level), define the asset retention (where it is stored, how it is used, how long it should be retained, how it should be disposed), and manage the data quality requirements to ensure the data is fit for use in the Sales department. Fitness of data ensures the data is available when needed in order to fulfill the purposes of creating and maintaining the data, and the data is available in a format that is useful.

Question 77:

Skipped

Susan has ensured backups are taken every day and kept secure in off-site storage as the two most important steps to safeguard the applications. Which of the following steps is next important for Susan to address?

How old are the backup tapes
How many times the backup tapes have been written
How often the backup is used

(Correct)
How well the tapes are protected from extreme temperatures during transport

Explanation

OBJ-6.3: If files are being restored from backups on a regular basis, there is an increased chance the backup tapes will not be in the offsite location when a disaster occurs. It is possible to change the backup schedule to diminish this risk; for instance, keep daily differential backups on site and send weekly full backups offsite, or backup to disks each night and create weekly offsite backups from those disks. The other answers are not so important but should be tracked. Tapes wear out after a specified number of writes. Tapes become unreliable after a specified number of years, or if they are exposed to extreme temperatures. [Note if full backups are created weekly, they must be kept on site for at least seven days, in order to restore files from the daily backups, whether incremental or differential.]

Question 78:

Skipped

Which project management tool would be the BEST to determine how long a security project should take to implement?

The ideal path.
The critical path.

(Correct)
The SWAT charts.
The Gantt chart.

Explanation

OBJ-8.1: We would look at the critical path to determine how long a project would take to complete. The critical path is the longest distance between the start and the finish of your project, including all the tasks, their duration, which gives you a clear picture of the project’s actual schedule. We would use SWOT analysis to determine our strengths, weaknesses, opportunities, and threats. The Gannt chart is used to estimate required resources and resource allocation, as well as task sequencing. Ideal path is not a project management term.

Question 80:

Skipped

Jane is our Information Security manager. Which of these metrics would be the BEST for her to use to evaluate the results of an Information Security program?

How many percent we are compliant with our security policies.
How many percent of our control objectives we have achieved.

(Correct)
How many controls we have implemented.
How large reduction in reported security incidences we see.

Explanation

OBJ-6.3: Our control objectives relate to our business objectives, making then the best metric. Everything we do should tie back to our business vision, mission and objectives. How many controls we have implemented, the percentage of our policy compliance and reduction in incidences are all indicators, but control objectives achieved is the better answer.

Question 81:

Skipped

As part of our forensics after a security incident, we are looking at the slack space on the compromised servers’ hard drives. Why do we do that?

The slack space can contain hidden data.

(Correct)
The slack space can contain unused data sectors.
The slack space can contain system log files.
The slack space can contain the login information the attackers used.

Explanation

OBJ-7.6: Slack space is leftover space from when a file does not need the entire cluster for the data it is storing. The slack space is whatever is left over of the cluster, it may contain old data, or can be used intentionally by attackers to hide information. The slack space could technically contain login information or log files, but hidden data is MORE correct. Sectors can contain slack space, not the other way around.

Question 82:

Skipped

In an internal security audit, we notice in an entire department, all have super user access to a critical application. What should the Information Security manager do FIRST?

Restrict the access until it is confirmed all members of the department has a need the access.
Meet with the data owner to understand the business needs.

(Correct)
Review our procedures for granting access to the critical application.
Change the access rights policies.

Explanation

OBJ-5.2: The Information Security manager should meet with the data owner to understand the business needs, and why an entire department has access. There may be a good reason for it, we just need to ensure it is there. We would never restrict access without investigation. We may later want to change the access right policies, but we would advise, and senior management would decide. If we find access is being granted incorrectly or without proper security, we may review the procedures, but not at this stage.

Question 86:

Skipped

Jamie would like to remove all errors from the data set but her manager says this is inadvisable.

What is the MOST likely reason why her manager feels this way?

Removing all errors may create a cascading effect as new errors are found.
Eliminating all errors may take longer than the refresh cycle.
Cost of eliminating all errors may be prohibitive.

(Correct)
Removing all errors in one data set will cast aspersions on the other data sets.

Explanation

OBJ-2.4: The cost of eliminating all errors may be prohibitive, both in terms of time and the payment of employees working on this.

The other answers may be true but are not as likely to be the reason of Jamie’s manager. Eliminating all errors may take longer than the refresh cycle between data loads – if the data is refreshed daily, it may take longer than 24 hours to eliminate all errors.

New errors may be found when trying to remove all the errors, creating an endless loop. If one data set is at last found to be free of errors, the errors in the other data sets should be removed as well, by which time new errors will have crept back into the first data set.

Question 87:

Skipped

In the US state of Montana, Dee is storing information about employees in her company. Which of the following types of information are NOT considered to be personal information under the state data breach laws?

Montana identification card number
A membership number from a grocery store

(Correct)
Debit card number
Driver’s license

Explanation

OBJ-2.4: Most state data breach notification laws are modeled after CaliforniaΓÇÖs law, which says that numbers that are well-known within an organization are *not* personal information. PII includes social security number, driverΓÇÖs license number, state identification card number, credit/debit card numbers, bank account numbers (in conjunction with a PIN or password), medical records, and health insurance information.

Question 88:

Skipped

As the firewall administrator, Claire notices a rule that permits traffic to ports 80 and 443 on the server at address ::1. What is the MOST likely reason Claire would have to be suspicious of this rule?

This address is used to send a broadcast to all servers on the subnet
This address is missing the subnet mask
The web server would never be assigned this address
This address cannot be reached by the firewall

(Correct)

Explanation

OBJ-4.1: The IPv6 address ::1 is the default local address of the Network Interface Card (NIC). Traffic sent to this address never leaves the computer; the traffic is only used as a self-test of the NIC. By the same token, any server (web or otherwise) would never be assigned this address, but this is the result of the reason behind the correct answer. In IPv6 if the address lacks a subnet mask, /128 is assumed. A different reserved address is used to send a broadcast to all servers on the subnet.

Question 90:

Skipped

At the insurance company, Dee finds that a male claimant has submitted a maternity claim. What is the MOST likely type of control that flagged this error and and what is a reasonable check could the system have performed?

Detective control, reporting check
Preventive control, edit check

(Correct)
Preventive control, log review
Detective control, limit check

Explanation

OBJ-8.2: This type of error can be prevented using an edit check to ensure only females can claim maternity leave. Reporting checks do not detect input errors. Limit checks are preventive, not detective; in any case here the high and low values are the same, so it is redundant to say this is a limit check. Log reviews are detective, and would not detect errors in the application input.

Question 94: Correct

Cassandra is developing a new add-on for an application. The month values will be entered between 1 and 12 and Cassandra’s code must ensure the months are sorted correctly, as in “1, 2, 3…”. Which of the following techniques is Cassandra MOST likely to use?

Use type checking to ensure numbers are not confused with text, and input validation to ensure numbers are between 1 and 12 inclusive

(Correct)
Use input validation to ensure the numbers are between 1 and 12 inclusive
Use conversion to store zero-padded value as in “01”, “02”, …
Use array of valid input values and store the index of the value the user has entered

Explanation

OBJ-8.2: Type checking ensures numerical values are stored as numbers and cannot be confused with text. If the months are stored as text, the sorted order would be “1, 10, 11, 12, 2, 3, …” The input validation guards against invalid input such as 0 or 13. Using an array of valid input values may be useful in some circumstances, for instance if the user were prompted to enter the three letter abbreviation of the month name instead of the number. Converting the number to a zero padded value ensures the text will be sorted “01, 02,..,09, 10,..” but storing numbers as text consumes more memory and is generally avoided.

Question 95: Correct

Tanya is reviewing the physical layout of the new data center located close to the intersection of a major highway. She notices the short driveway leads straight from the road to the front door with the employee parking lot accessible only from the rear of the site. What is the MOST likely concern Tanya has with this arrangement?

Customers and visitors will not be able to park their vehicles in the short driveway and may have to park some distance from the front doors.
The short driveway to the intersection and the proximity of the major highway will not delay the departure of intruders or thieves.

(Correct)
The proximity of the major highway will create a high level of traffic noise which will distract workers inside the data center.
Employees will have to walk outside the perimeter of the building to get from their car to the front door, increasing the risk of personal danger.

Explanation

OBJ-3.8: Ideally buildings with sensitive data and resources should be protected by deterring, detecting, and delaying unwanted or unauthorized people; the short driveway with easy access to the major highway fails in these regards.

Question 96: Correct

As a security operations member, Todd has found evidence in the logs that an unauthorized user was able to use a certain application. Which control is MOST likely to have failed?

Authorization tests

(Correct)
Integrity tests
Security label checks
Validity checks

Explanation

OBJ-5.4: Authorization tests use identification, authentication, and authorization to determine whether a user is permitted access. If Todd is able to determine the user was unauthorized, then the identification and authentication worked properly, and it was only the authorization check that failed. Security label checks test for the classification of a system resource. Integrity tests ensure that data can only be modified by users with sufficient clearance. Validity checks test for the accuracy of codes such as country code or customer number.

Question 97: Incorrect

As the firewall administrator, Claire notices a rule that permits traffic to port 443 on the internal server and the comment states the rule permits SSL. What is the MOST likely reason Claire would have to be suspicious of this rule?

Port 443 was used by Transport Layer Security version 1 (TLS-1) which is now deprecated

(Incorrect)
Port 443 was used by Secure Sockets Layer (SSL) which is now deprecated

(Correct)
P0rt 443 is used by either TLS-2 or TLS-3
Port 443 was used by Secure Hash Algorithm version 1 (SHA-1) which is now deprecated

Explanation

OBJ-4.1: Port 443 was used by SSL and TLS-1, both now deprecated and no longer in use. Port 443 is currently used by TLS-2 and TLS-3. The most likely reason Claire would be suspicious of the rule is the fact the comment has not been updated. SSL v2 and v3 were deprecated in 2011 and 2015 respectively, whereas TLS-1 was deprecated in Sept 2020; the comment’s reference to SSL indicates the firewall rules have not been reviewed and updated for a long time. SHA-1 is also deprecated (no longer in use) but it does not use port 443.

Question 98: Correct

Trisha works for the Internal Audit department of a small company, ThorTeaches.com. To whom is her final report MOST likely be sent?

C-level executives and specific managers
C-level executives

(Correct)
Stakeholders and investors
C-level executives and Board of Directors

Explanation

OBJ-6.5: Trisha will be conducting an Internal Audit and her final report is most likely to be delivered to the C-level executives, who may (but not always) share the report with Board of Directors. Specific managers will receive a draft of the Audit Report from internal auditors, so they can review the findings and prepare the Management Action Plans to remediate the shortcomings. Stakeholders and investors are very unlikely to receive a copy of the Audit Report from Internal Audit.

Question 99: Correct

Thor wants to authenticate the user credentials against the LDAP server. His web site prompts for the user’s account name and password. Which of the following LDAP commands should Thor use to compare what the user entered against the userPassword attribute for that user?

ldapmodify
ldapsearch
ldapbind

(Correct)
ldapmoddn

Explanation

OBJ-5.6: The “ldapbind” command checks the password the user has entered against the userPassword attribute. The “ldapsearch” command retrieves user attributes for the specified user, but does not return the userPassword field. The “ldapmodify” command allows the administrator to sign on to the LDAP server and modify attribute values for one or more users. The “ldapmoddn” command allows the administrator to sign on to the LDAP server and modify the relative distinguished name (RDN) for a single user. [source: https://docs.oracle.com/cd/B10501_01/network.920/a96579/comtools.htm]

Question 100: Correct

Juanita has disabled ICMP broadcast pings on her network to prevent attempts to flood the network with ping reply packets in order to deny the service. What type of attack is Juanita MOST likely attempting to halt?

Sequence number attack
Salami attack
Smurf attack

(Correct)
Spoofing attack

Explanation

OBJ-3.7: Smurf attacks occur when the network is flooded with ping reply packets in response to fallacious broadcast pings; each ping reply packet is very small but in sufficient numbers can deny the availability of services. Salami attacks carry out many different small attacks which are hard to detect and the aggregate result is that of a large attack. Spoofing attacks occur when a program successfully identifies as another, by falsifying data to gain an illegitimate advantage. A sequence number attack attempts to hijack the TCP session by injecting fallacious packets with the next sequence number.

Question 103: Correct

Adam wants to place the threats in order of priority, so he can decide which threats need to be addressed first. Which of the following models is BEST suited to his goals?

DREAD

(Correct)
STRIDE
OCTAVE
PASTA

Explanation

OBJ-1.10: DREAD (Damage potential, Reproducibility, Exploitability, Affected users, Discoverability) is an approach to prioritize the threats. OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) is an approach for managing security risks. STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, DOS, Elevation of privilege) is a software-centric approach to assess risks regarding the use of software. PASTA (Process for Attack Simulation and Threat Analysis) is a risk-centric approach that, because it includes the business objectives, is more useful for assessing business risks.

Question 104:

Skipped

Juanita is replacing the actual names of customers with fictitious names and is removing the street address although she is leaving the city and state name. Which is the BEST name for what Juanita is doing?

Pseudonymization

(Correct)
Anonymization
Obfuscation
Randomization

Explanation

OBJ-1.5: Pseudonymization replaces the data with artificial or fictitious values, known as pseudonyms. Anonymization refers to the process of removing all the relevant data (including the city and state names) making it impossible to identify the original person. Although Juanita may be choosing fictitious names at random, randomization usually refers to transposing real values into different records. Obfuscation is to make the data not readily understood, meaning to hide but not delete the data.

Question 105: Correct

Francis’ company uses role-based access control and has a policy that managers can read any file, but only the people in the same role as the data owner can update a file. Francis’ manager Dee, as a developer, wants to update a file in the development team’s share. What type of policy is in place, and can Dee update the file?

Restrictive policy; as a developer Dee can update the file
Restrictive policy; Dee cannot update the file

(Correct)
Permissive policy; as a developer Dee can update the file
Permissive policy; Dee can update the file

Explanation

OBJ-5.2: In Francis’ company the policy is restrictive, so the least privileges will apply; the least privileges come from Dee’s role as a manager, so Dee cannot update the file. If Francis’ company had a permissive policy, Dee would be granted the sum of all her privileges, so Dee could update the file.

Question 109: Correct

Nayeli is entering information for employees in the ThorTeaches.com’s payroll system. The information includes the list of past medical conditions. Which standard BEST applies to the protection of this information?

HIPAA (Health Insurance Portability and Accountability Act)

(Correct)
GLBA (Gramm-Leach-Bliley Act)
ECPA (Electronic Communications Privacy Act)
The USA PATRIOT Act

Explanation

OBJ-2.1: Health Insurance Portability and Accountability Act (HIPAA) includes information related to the past, present, or future mental or physical condition or health of an individual. Gramm-Leach-Bliley Act (GLBA) regulates the exchange of financial information between institutions. Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT) Act allows NSA to monitor all communications sent over US soil. Electronic Communications Privacy Act (ECPA) prevents unauthorized government access to private electronic communications.

Question 110: Correct

Linda wants to improve the controls over accountability. Which biometric device for performing iris scans is BEST suited to her needs?

The device that rejects the fewest legitimate users
The device with the lowest CER
The device that accepts the fewest imposters

(Correct)
The vendor claims the device will decrease the error rate as the sensitivity increases

Explanation

OBJ-5.2: In order to provide strong accountability, the Type II failure, False Acceptance Rate (FAR) needs to be kept low; the device that accepts the fewest imposters has the lowest FAR. Type II failure decreases the error rate as the sensitivity increases; insofar as all devices suffer Type I and II failures, this claim by itself does not recommend the device. Here the device with the lowest Crossover Error Rate (CER) is the not necessarily desirable. The device that rejects the fewest legitimate users (Type I failure, False Rejection Rate (FRR)) may have a higher Type II failure.

Question 111:

Skipped

Juanita is asked to review the daily log files on a Windows server where a disgruntled employee had access to the application data. She finds two sections in the log files where there was no activity recorded in the middle of the day. What is the most likely reason for the gaps, and what is the BEST recommendation Juanita can make going forward?

The disgruntled user turned off logging to prevent his activities being recorded; the commands to disable logging should be themselves disabled
The logging service did not find any activity to record; a “heartbeat” job should be used to ensure logging continues throughout the day
The disgruntled user overwrote the log records; the access permissions to the log files should be changed to prevent overwriting the entries
The disgruntled user wiped the log records to conceal his activities; the log files should be sent to the syslog server

(Correct)

Explanation

OBJ-6.2: It is highly likely that the disgruntled user wiped the log records to conceal his activities. Juanita should recommend going forward that the log files should be sent to the off-board syslog server to prevent modifications by the intruder who seeks to conceal his tracks. The other answers are not entirely implausible but are not the most likely explanations and best recommendations Juanita can make.

Question 112: Correct

John wants to purchase goods from a store online but does not want to set up a new account and password. Instead, he logs on using Facebook. What is the term that BEST describes this type of identification and authentication?

Delegated Identity Management (DIM)

(Correct)
Single Sign-On (SSO)
Federated Identity Management (FIM)
Active Directory Domain Services (AD DS)

Explanation

OBJ-5.6: Delegated Identity Management (DIM) lets the store rely on the Facebook Connect service, whereby Facebook is the identity provider and has been delegated the responsibility to authenticate users. Federated Identity Management (FIM) would let the store rely on an OpenID account with which the user has been authenticated in a related OpenID service at another store. Single Sign-On (SSO) would allow the user to sign on once using credentials managed by the store and thereafter use other services in that store. Active Directory Domain Services (AD DS) is deployed in the store where it manages the user credentials.

Question 113: Correct

John signs on at the local bookstore and browses for a book which he discovers at a different store location in the same chain of bookstores. He is not prompted to sign in at the second store. What is the BEST explanation for how the second store lets John browse and purchase books?

The second store uses Delegated Identity Management (DIM)
The second store uses Single Sign-On (SSO)
The second store uses Active Directory Domain Services (AD DS)
The second store uses Federated Identity Management (FIM)

(Correct)

Explanation

OBJ-5.6: Federated Identity Management (FIM) lets the second store rely on an OpenID account with which the user has been authenticated in a related OpenID service at the first store. Delegated Identity Management (DIM) would let the store rely on a service such as Facebook Connect, whereby Facebook is the identity provider and has been delegated the responsibility to authenticate users. Single Sign-On (SSO) would allow the user to sign on once using credentials managed by the store and thereafter use other services in that same store. Active Directory Domain Services (AD DS) is deployed in the store where it manages the user credentials.

Question 114:

Skipped

Claire is checking the file integrity of application code installed on the production servers. She finds a problem with the file integrity and alerts the Security Operations center (SOC). What has MOST likely indicated the problem, and what does this tell Claire?

Message digest is close to the same value, and using the reverse hash algorithm tells her what changes have been made
Message digest is the same, but the timestamp of the file has been changed, so she knows the file was changed and then restored
Message digest is different, indicating that the file has changed; does not tell her what changes have been made

(Correct)
Message digest is different, and comparing this to the previous value tells her how the file has been changed

Explanation

OBJ-8.2: Using the hash function each night, the message digest changes whenever a file changes in some way; this does not tell Claire what about the file has changed – the file could have been changed in any number of ways. Hash functions are one way and cannot be reversed. If the message digest is the same, then this problem was not detected by checking the file integrity; this problem was detected by checking the file timestamp, although the fact the file integrity did not change does indicates the file had been changed and then restored – leading to the questions who changed it, and why?

Question 115: Correct

Shane is looking to improve the handling of computer security incidents. Which is the MOST likely mechanism by which Shane can decrease the response time?

Website update
Message of the day (MOTD) banner
Netmsg

(Correct)
Email

Explanation

OBJ-7.6: Net message (netmsg) sends a small text message to all users on the network that is not easily ignored. Pager alerts are the most rapid means of communication (not shown as an answer). Although emails may contain more information and context than the pager alert, emails are more likely to be ignored in the short term. Websites can be updated quickly and again it may some time before users check the most recent updates. The MOTD banner can be quickly updated but it is unlikely any users will see it until they log on again, often the next day.

Question 120:

Skipped

ThorTeaches.com’s data files appear to be encrypted, but no-one in your company has encrypted them. What is the MOST LIKELY action to restore your files?

Use a brute force algorithm to find the key to decrypt your files.
Pay the ransom and wait for the key to decrypt your files.
Restore from the most recent backup.
Restore from an old backup, making sure the files do not contain the ransom-ware executable code.

(Correct)

Explanation

OBJ-3.7: In face of a ransomware attack, the MOST LIKELY course of action is to find an older set of backup files that do not contain the ransom-ware code and restore the files from there. It is highly likely the most recent backup contains the ransom-ware code which will run again the night after the files have been restored. Ransom attackers rarely send the decryption key after a ransom has been paid. Depending on the key size used by the attacker, it could take several months or years to carry out a brute force algorithm to find the key.

Question 122:

Skipped

As VP of Sales, Naomi is the data owner of a file that contains personally identifiable information (PII) about customers. She decides to run a report on the length of time the customers stay in the same house; that is, their address does not change. Naomi contracts a third-party to build and generate this report. In such a situation, what role is MOST likely given to the third-party?

Data custodian
Data controller
Data steward
Data processor

(Correct)

Explanation

OBJ-2.4: When handling PII, the data processor is the person or company, if different from the data controller, who performs the data processing on behalf of the data controller. In this question, the data is being processed by a third-party contractor, so that contractor is acting in the data processor role. The data controller is the person or company who decides which data is collected, how the data will be stored, and how the data will be processed or used. The data steward is another term for the data owner, and in some cases the data owner may be the data controller, although this is not as likely. The data custodian is the person who is delegated the day-to-day tasks to safeguard the data.

Question 124:

Skipped

As an application developer, Frank is considering whether to enable single sign-on. What is likely to be the MOST important advantage that may help Frank decide?

Authenticates a user only once a day
May be used with passwords or MFA
Provides access to multiple applications

(Correct)
Reduces management work

Explanation

OBJ-5.2: Single sign-on allows a user to authenticate once to gain access to multiple applications. The single sign-on system provides fewer areas to manage when compared to multiple sign-on systems, and it is an option whether to use MFA or passwords when setting up single sign-on, although these considerations are often less important a factor in the developer’s mind. Users still have to re-authenticate themselves after using a screen saver to lock their workstations when they are not using them.

Question 125: Correct

Ted wants to find the best data that represents how often a severe flood will affect the city where his data center will be located. What is the MOST likely source on which he can base his estimates?

Farmer’s Almanac
Historical reports on similar events
Insurance reports on risk realization

(Correct)
Weather forecasts for long term

Explanation

OBJ-3.8: Insurance reports are an excellent source on how frequently events occur. Insurance companies have dedicated staff who determine these occurrence rates, to the benefit of insurance companies who offer policies against risks. However, history is a poor prognosticator. Long term weather forecasts only cover the next six months. Although the Farmer’s Almanac has been surprisingly accurate in some regards, it is considered an unreliable source.

anakyst

Protected: Rotary VI EAST

Feb 28, 2026

anakyst

Protected: BetterCyberCareer Group

Feb 28, 2026

anakyst

Protected: Benin Club 1931 – Official

Feb 28, 2026

OWASP TOP !0

Injection. Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization. Broken Authentication. Application functions related to authentication and session management are often implemented incorrectly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities temporarily or permanently. Sensitive Data Exposure. Many web applications and APIs do not properly protect sensitive data, such as financial, healthcare, and PII. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data may be compromised without extra protection, such as encryption at rest or in transit, and requires special precautions when exchanged with the browser. XML External Entities (XXE). Many older or poorly configured XML processors evaluate external entity references within XML documents. External entities can be used to disclose internal files using the file URI handler, internal file shares, internal port scanning, remote code execution, and denial of service attacks. Broken Access Control. Restrictions on what authenticated users are allowed to do are often not properly enforced. Attackers can exploit these flaws to access unauthorized functionality and/or data, such as access other users’ accounts, view sensitive files, modify other users’ data, change access rights, etc. Security Misconfiguration. Security misconfiguration is the most commonly seen issue. This is commonly a result of insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information. Not only must all operating systems, frameworks, libraries, and applications be securely configured, but they must be patched/upgraded in a timely fashion. Cross-Site Scripting XSS. XSS flaws occur whenever an application includes untrusted data in a new web page without proper validation or escaping, or updates an existing web page with user-supplied data using a browser API that can create HTML or JavaScript. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites. Insecure Deserialization. Insecure deserialization often leads to remote code execution. Even if deserialization flaws do not result in remote code execution, they can be used to perform attacks, including replay attacks, injection attacks, and privilege escalation attacks. Using Components with Known Vulnerabilities. Components, such as libraries, frameworks, and other software modules, run with the same privileges as the application. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications and APIs using components with known vulnerabilities may undermine application defenses and enable various attacks and impacts. Insufficient Logging & Monitoring. Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers to further attack systems, maintain persistence, pivot to more systems, and tamper, extract, or destroy data. Most breach studies show time to detect a breach is over 200 days, typically detected by external parties rather than internal processes or monitoring.