Q1. - (Topic 1) 

The Chief Executive Officer (CEO) of a small start-up company wants to set up offices around the country for the sales staff to generate business. The company needs an effective communication solution to remain in constant contact with each other, while maintaining a secure business environment. A junior-level administrator suggests that the company and the sales staff stay connected via free social media. Which of the following decisions is BEST for the CEO to make? 

A. Social media is an effective solution because it is easily adaptable to new situations. 

B. Social media is an ineffective solution because the policy may not align with the business. 

C. Social media is an effective solution because it implements SSL encryption. 

D. Social media is an ineffective solution because it is not primarily intended for business applications. 

View Answer

Q2. - (Topic 4) 

A university Chief Information Security Officer is analyzing various solutions for a new project involving the upgrade of the network infrastructure within the campus. The campus has several dorms (two-four person rooms) and administrative buildings. The network is currently setup to provide only two network ports in each dorm room and ten network ports per classroom. Only administrative buildings provide 2.4 GHz wireless coverage. 

The following three goals must be met after the new implementation: 

1. Provide all users (including students in their dorms) connections to the Internet. 

2. Provide IT department with the ability to make changes to the network environment to improve performance. 

3. Provide high speed connections wherever possible all throughout campus including sporting event areas. 

Which of the following risk responses would MOST likely be used to reduce the risk of network outages and financial expenditures while still meeting each of the goals stated above? 

A. Avoid any risk of network outages by providing additional wired connections to each user and increasing the number of data ports throughout the campus. 

B. Transfer the risk of network outages by hiring a third party to survey, implement and manage a 5.0 GHz wireless network. 

C. Accept the risk of possible network outages and implement a WLAN solution to provide complete 5.0 GHz coverage in each building that can be managed centrally on campus. 

D. Mitigate the risk of network outages by implementing SOHO WiFi coverage throughout the dorms and upgrading only the administrative buildings to 5.0 GHz coverage using a one for one AP replacement. 

View Answer

Q3. - (Topic 4) 

A security engineer is troubleshooting a possible virus infection, which may have spread to multiple desktop computers within the organization. The company implements enterprise antivirus software on all desktops, but the enterprise antivirus server’s logs show no sign of a virus infection. The border firewall logs show suspicious activity from multiple internal hosts trying to connect to the same external IP address. The security administrator decides to post the firewall logs to a security mailing list and receives confirmation from other security administrators that the firewall logs indicate internal hosts are compromised with a new variant of the Trojan.Ransomcrypt.G malware not yet detected by most antivirus software. Which of the following would have detected the malware infection sooner? 

A. The security administrator should consider deploying a signature-based intrusion detection system. 

B. The security administrator should consider deploying enterprise forensic analysis tools. 

C. The security administrator should consider installing a cloud augmented security service. 

D. The security administrator should consider establishing an incident response team. 

View Answer

Q4. - (Topic 1) 

An organization would like to allow employees to use their network username and password to access a third-party service. The company is using Active Directory Federated Services for their directory service. Which of the following should the company ensure is supported by the third-party? (Select TWO). 

A. LDAP/S 

B. SAML 

C. NTLM 

D. OAUTH 

E. Kerberos 

View Answer

Q5. - (Topic 5) 

A security engineer is a new member to a configuration board at the request of management. The company has two new major IT projects starting this year and wants to plan security into the application deployment. The board is primarily concerned with the applications’ compliance with federal assessment and authorization standards. The security engineer asks for a timeline to determine when a security assessment of both applications should occur and does not attend subsequent configuration board meetings. If the security engineer is only going to perform a security assessment, which of the following steps in system authorization has the security engineer omitted? (Select TWO). 

A. Establish the security control baseline to be assessed 

B. Build the application according to software development security standards 

C. Write the systems functionality requirements into the security requirements traceability matrix 

D. Review the results of user acceptance testing 

E. Categorize the applications according to use 

F. Consult with the stakeholders to determine which standards can be omitted 

View Answer

Q6. - (Topic 2) 

An accountant at a small business is trying to understand the value of a server to determine if the business can afford to buy another server for DR. The risk manager only provided the accountant with the SLE of $24,000, ARO of 20% and the exposure factor of 25%. Which of the following is the correct asset value calculated by the accountant? 

A. $4,800 

B. $24,000 

C. $96,000 

D. $120,000 

View Answer

Q7. - (Topic 5) 

A security manager has started a new job and has identified that a key application for a new client does not have an accreditation status and is currently not meeting the compliance requirement for the contract’s SOW. The security manager has competing priorities and wants to resolve this issue quickly with a system determination and risk assessment. Which of the following approaches presents the MOST risk to the security assessment? 

A. The security manager reviews the system description for the previous accreditation, but does not review application change records. 

B. The security manager decides to use the previous SRTM without reviewing the system description. 

C. The security manager hires an administrator from the previous contract to complete the assessment. 

D. The security manager does not interview the vendor to determine if the system description is accurate. 

View Answer

Q8. - (Topic 4) 

A systems administrator establishes a CIFS share on a Unix device to share data to windows systems. The security authentication on the windows domain is set to the highest level. Windows users are stating that they cannot authenticate to the Unix share. Which of the following settings on the Unix server is the cause of this problem? 

A. Refuse LM and only accept NTLMv2 

B. Accept only LM 

C. Refuse NTLMv2 and accept LM 

D. Accept only NTLM 

View Answer

Q9. - (Topic 4) 

Company XYZ is in negotiations to acquire Company ABC for $1.2millon. Due diligence activities have uncovered systemic security issues in the flagship product of Company ABC. It has been established that a complete product rewrite would be needed with average estimates indicating a cost of $1.6millon. Which of the following approaches should the risk manager of Company XYZ recommend? 

A. Transfer the risk 

B. Accept the risk 

C. Mitigate the risk 

D. Avoid the risk 

View Answer

Q10. - (Topic 2) 

Which of the following would be used in forensic analysis of a compromised Linux system? (Select THREE). 

A. Check log files for logins from unauthorized IPs. 

B. Check /proc/kmem for fragmented memory segments. 

C. Check for unencrypted passwords in /etc/shadow. 

D. Check timestamps for files modified around time of compromise. 

E. Use lsof to determine files with future timestamps. 

F. Use gpg to encrypt compromised data files. 

G. Verify the MD5 checksum of system binaries. 

H. Use vmstat to look for excessive disk I/O. 

View Answer