Q1. - (Topic 2) 

After reviewing a company’s NAS configuration and file system access logs, the auditor is advising the security administrator to implement additional security controls on the NFS export. The security administrator decides to remove the no_root_squash directive from the export and add the nosuid directive. Which of the following is true about the security controls implemented by the security administrator? 

A. The newly implemented security controls are in place to ensure that NFS encryption can only be controlled by the root user. 

B. Removing the no_root_squash directive grants the root user remote NFS read/write access to important files owned by root on the NAS. 

C. Users with root access on remote NFS client computers can always use the SU command to modify other user’s files on the NAS. 

D. Adding the nosuid directive disables regular users from accessing files owned by the root user over NFS even after using the SU command. 

View Answer

Q2. - (Topic 5) 

Ann, a systems engineer, is working to identify an unknown node on the corporate network. To begin her investigative work, she runs the following nmap command string: 

user@hostname:~$ sudo nmap –O 192.168.1.54 Based on the output, nmap is unable to identify the OS running on the node, but the following ports are open on the device: 

TCP/22 TCP/111 TCP/512-514 TCP/2049 TCP/32778 

Based on this information, which of the following operating systems is MOST likely running on the unknown node? 

A. Linux 

B. Windows 

C. Solaris 

D. OSX 

View Answer

Q3. - (Topic 1) 

The risk manager is reviewing a report which identifies a requirement to keep a business critical legacy system operational for the next two years. The legacy system is out of support because the vendor and security patches are no longer released. Additionally, this is a proprietary embedded system and little is documented and known about it. Which of the following should the Information Technology department implement to reduce the security risk from a compromise of this system? 

A. Virtualize the system and migrate it to a cloud provider. 

B. Segment the device on its own secure network. 

C. Install an antivirus and HIDS on the system. 

D. Hire developers to reduce vulnerabilities in the code. 

View Answer

Q4. - (Topic 4) 

A security auditor is conducting an audit of a corporation where 95% of the users travel or work from non-corporate locations a majority of the time. While the employees are away from the corporate offices, they retain full access to the corporate network and use of corporate laptops. The auditor knows that the corporation processes PII and other sensitive data with applications requiring local caches of any data being manipulated. Which of the following security controls should the auditor check for and recommend to be implemented if missing from the laptops? 

A. Trusted operating systems 

B. Full disk encryption 

C. Host-based firewalls 

D. Command shell restrictions 

View Answer

Q5. - (Topic 5) 

A security engineer is a new member to a configuration board at the request of management. The company has two new major IT projects starting this year and wants to plan security into the application deployment. The board is primarily concerned with the applications’ compliance with federal assessment and authorization standards. The security engineer asks for a timeline to determine when a security assessment of both applications should occur and does not attend subsequent configuration board meetings. If the security engineer is only going to perform a security assessment, which of the following steps in system authorization has the security engineer omitted? (Select TWO). 

A. Establish the security control baseline to be assessed 

B. Build the application according to software development security standards 

C. Write the systems functionality requirements into the security requirements traceability matrix 

D. Review the results of user acceptance testing 

E. Categorize the applications according to use 

F. Consult with the stakeholders to determine which standards can be omitted 

View Answer

Q6. - (Topic 2) 

A finance manager says that the company needs to ensure that the new system can “replay” data, up to the minute, for every exchange being tracked by the investment departments. The finance manager also states that the company’s transactions need to be tracked against this data for a period of five years for compliance. How would a security engineer BEST interpret the finance manager’s needs? 

A. Compliance standards 

B. User requirements 

C. Data elements 

D. Data storage 

E. Acceptance testing 

F. Information digest 

G. System requirements 

View Answer

Q7. - (Topic 3) 

A team is established to create a secure connection between software packages in order to list employee's remaining or unused benefits on their paycheck stubs. Which of the following business roles would be MOST effective on this team? 

A. Network Administrator, Database Administrator, Programmers 

B. Network Administrator, Emergency Response Team, Human Resources 

C. Finance Officer, Human Resources, Security Administrator 

D. Database Administrator, Facilities Manager, Physical Security Manager 

View Answer

Q8. - (Topic 3) 

Staff from the sales department have administrator rights to their corporate standard operating environment, and often connect their work laptop to customer networks when onsite during meetings and presentations. This increases the risk and likelihood of a security incident when the sales staff reconnects to the corporate LAN. Which of the following controls would BEST protect the corporate network? 

A. Implement a network access control (NAC) solution that assesses the posture of the laptop before granting network access. 

B. Use an independent consulting firm to provide regular network vulnerability assessments and biannually qualitative risk assessments. 

C. Provide sales staff with a separate laptop with no administrator access just for sales visits. 

D. Update the acceptable use policy and ensure sales staff read and acknowledge the policy. 

View Answer

Q9. - (Topic 5) 

An administrator is trying to categorize the security impact of a database server in the case of a security event. There are three databases on the server. 

Current Financial Data = High level of damage if data is disclosed. Moderate damage if the system goes offline 

Archived Financial Data = No need for the database to be online. Low damage for integrity loss 

Public Website Data = Low damage if the site goes down. Moderate damage if the data is corrupted 

Given these security categorizations of each database, which of the following is the aggregate security categorization of the database server? 

A. Database server = {(Confidentiality HIGH),(Integrity High),(Availability High)} 

B. Database server = {(Confidentiality HIGH),(Integrity Moderate),(Availability Moderate)} 

C. Database server = {(Confidentiality HIGH),(Integrity Moderate),(Availability Low)} 

D. Database server = {(Confidentiality Moderate),(Integrity Moderate),(Availability Moderate)} 

View Answer

Q10. - (Topic 1) 

An administrator wants to enable policy based flexible mandatory access controls on an open source OS to prevent abnormal application modifications or executions. Which of the following would BEST accomplish this? 

A. Access control lists 

B. SELinux 

C. IPtables firewall 

D. HIPS 

View Answer