Loading demo links...
Showing 1–20 of 20 questions
Match the types of e-authentication tokens to their description.
Drag each e-authentication token on the left to its corresponding description on the right.
Answer is in the explanation below.
Match the access control type to the example of the control type.
Drag each access control type net to its corresponding example.
Answer is in the explanation below.
HOT SPOT
Which Web Services Security (WS-Security) specification handles the management of security tokens and the underlying policies for granting access? Click on the correct specification in the image below.
Answer is in the explanation below.
Which of the following is the PRIMARY reason for employing physical security personnel at entry points in facilities where card access is in operation?
Select an option, then click Submit answer.
To verify that only employees have access to the facility.
To identify present hazards requiring remediation.
To monitor staff movement throughout the facility.
To provide a safe environment for employees.
What is the GREATEST challenge of an agent-based patch management solution?
Select an option, then click Submit answer.
Time to gather vulnerability information about the computers in the program
Requires that software be installed, running, and managed on all participating computers
The significant amount of network bandwidth while scanning computers
The consistency of distributing patches to each participating computer
In a change-controlled environment, which of the following is MOST likely to lead to unauthorized changes to production programs?
Select an option, then click Submit answer.
Modifying source code without approval
Promoting programs to production without approval
Developers checking out source code without approval
Developers using Rapid Application Development (RAD) methodologies without approval
Which of the following is the PRIMARY purpose of due diligence when an organization embarks on a merger or acquisition?
Select an option, then click Submit answer.
Assess the business risks.
Formulate alternative strategies.
Determine that all parties are equally protected.
Provide adequate capability for all parties.
Strategy and program management, project delivery, governance, operations
A cybersecurity engineer has been tasked to research and implement an ultra-secure communications channel to protect the organization's most valuable intellectual property (IP). The primary directive in this initiative is to ensure there Is no possible way the communications can be intercepted without detection. Which of the following Is the only way to ensure this
‘outcome?
Select an option, then click Submit answer.
Diffie-Hellman key exchange
Symmetric key cryptography
[Public key infrastructure (PKI)
Quantum Key Distribution
A software developer installs a game on their organization-provided smartphone. Upon installing the game, the software developer is prompted to allow the game access to call logs, Short Message Service (SMS) messaging, and Global Positioning System (GPS) location data. What has the game MOST likely introduced to the smartphone?
Select an option, then click Submit answer.
Alerting
Vulnerability
Geo-fencing
Monitoring
Which reporting type requires a service organization to describe its system and define its control objectives and controls that are relevant to users internal control over financial reporting?
Select an option, then click Submit answer.
Statement on Auditing Standards (SAS)70
Service Organization Control 1 (SOC1)
Service Organization Control 2 (SOC2)
Service Organization Control 3 (SOC3)
An attack utilizing social engineering and a malicious Uniform Resource Locator (URL) link to take advantage of a victim's existing browser session with a web application is an example of which of the following types of attack?
Select an option, then click Submit answer.
Cross-Site Scripting (XSS)
Cross-site request forgery (CSRF)
Injection
Click jacking
What is the PRIMARY purpose of auditing, as it relates to the security review cycle?
Select an option, then click Submit answer.
To ensure the organization’s controls and policies are working as intended
To ensure the organization can still be publicly traded
To ensure the organization’s executive team won’t be sued
To ensure the organization meets contractual requirements
Which of the following is true of Service Organization Control (SOC) reports?
Select an option, then click Submit answer.
SOC 1 Type 2 reports assess the security, confidentiality, integrity, and availability of an organization’s controls
SOC 2 Type 2 reports include information of interest to the service organization’s management
SOC 2 Type 2 reports assess internal controls for financial reporting
SOC 3 Type 2 reports assess internal controls for financial reporting
What is the FINAL step in the waterfall method for contingency planning?
Select an option, then click Submit answer.
Maintenance
Testing
Implementation
Training
What are the PRIMARY responsibilities of security operations for handling and reporting violations and incidents?
Select an option, then click Submit answer.
Monitoring and identifying system failures, documenting incidents for future analysis, and scheduling patches for systems
Scheduling patches for systems, notifying the help desk, and alerting key personnel
Monitoring and identifying system failures, alerting key personnel, and containing events
Documenting incidents for future analysis, notifying end users, and containing events
Access to which of the following is required to validate web session management?
Select an option, then click Submit answer.
Log timestamp
Live session traffic
Session state variables
Test scripts
Which of the following would be considered an incident if reported by a security information and event management (SIEM) system?
Select an option, then click Submit answer.
An administrator is logging in on a server through a virtual private network (VPN).
A log source has stopped sending data.
A web resource has reported a 404 error.
A firewall logs a connection between a client on the Internet and a web server using Transmission Control Protocol (TCP) on port 80.
What is the PRIMARY reason for implementing change management?
Select an option, then click Submit answer.
Certify and approve releases to the environment
Provide version rollbacks for system changes
Ensure that all applications are approved
Ensure accountability for changes to the environment
Which type of disaster recovery plan (DRP) testing carries the MOST operational risk?
Select an option, then click Submit answer.
Cutover
Walkthrough
Tabletop
Parallel
Physical Access Control Systems (PACS) allow authorized security personnel to manage and monitor access control for subjects through which function?
Select an option, then click Submit answer.
Remote access administration
Personal Identity Verification (PIV)
Access Control List (ACL)
Privileged Identity Management (PIM)
