| Question | Answer |
| QUESTION NO: 1
An achievement in providing worldwide Internet security was the signing of certificates associated
with which of the following protocols? | SSL |
| QUESTION NO: 2
A Chief Information Security Officer (CISO) wants to implement two-factor authentication within
the company. Which of the following would fulfill the CISO’s requirements? | USB token and PIN |
| QUESTION NO: 3
Which of the following can a security administrator implement on mobile devices that will help
prevent unwanted people from viewing the data if the device is left unattended? | Screen lock |
| QUESTION NO: 4
Which of the following would a security administrator implement in order to identify a problem
between two systems that are not communicating properly? | Protocol analyzer |
| QUESTION NO: 5
Which of the following can result in significant administrative overhead from incorrect reporting? | False positives |
| QUESTION NO: 6
A security administrator wants to perform routine tests on the network during working hours when certain applications are being accessed by the most people. Which of the following would allow
the security administrator to test the lack of | Vulnerability scan |
| QUESTION NO: 6
certain applications are being accessed by the most people. Which of the following would allow
the security administrator to test the lack of security controls for those applications with the least | Vulnerability scan |
| QUESTION NO: 7
Which of the following risk concepts requires an organization to determine the number of failures
per year? | ALE |
| QUESTION NO: 8
A system security analyst using an enterprise monitoring tool notices an unknown internal host
exfiltrating files to several foreign IP addresses. Which of the following would be an appropriate
mitigation technique? | Rogue machine detection |
| QUESTION NO: 9
Three of the primary security control types that can be implemented are. | Operational, technical, and management. |
| QUESTION NO: 10
The helpdesk reports increased calls from clients reporting spikes in malware infections on their
systems. Which of the following phases of incident response is MOST appropriate as a FIRST
response? | Identification |
| QUESTION NO: 11
Which of the following protocols operates at the HIGHEST level of the OSI model? | SCP |
| QUESTION NO: 12
Joe, the system administrator, has been asked to calculate the Annual Loss Expectancy (ALE) for
a $5,000 server, which often crashes. In the past year, the server has crashed 10 times, requiring
a system reboot to recover with only 10% | $5,000 |
| QUESTION NO: 13
Which of the following should an administrator implement to research current attack
methodologies? | Honeypot |
| QUESTION NO: 14
Which of the following can be implemented in hardware or software to protect a web server from
cross-site scripting attacks? | Web Application Firewall |
| QUESTION NO: 15
Which of the following means of wireless authentication is easily vulnerable to spoofing? | MAC Filtering |
| The BEST methods for a web developer to prevent the website application code from being
vulnerable to cross-site request forgery (XSRF) are to: (Select TWO). | -Validate and filter input on the server side and client side.
-Restrict and sanitize use of special characters in input and URLs. |
| QUESTION NO: 17
Jane, a security administrator, needs to implement a secure wireless authentication method that
uses a remote RADIUS server for authentication.
Which of the following is an authentication method Jane should use? | LEAP |
| QUESTION NO: 18
Computer evidence at a crime scene is documented with a tag stating who had possession of the
evidence at a given time.
Which of the following does this illustrate? | Chain of custody |
| QUESTION NO: 19
A network administrator is configuring access control for the sales department which has high
employee turnover. Which of the following is BEST suited when assigning user rights to individuals
in the sales department? | Group based privileges |
| QUESTION NO: 20
Which of the following is being tested when a company’s payroll server is powered off for eight
hours? | Continuity of operations plan |
| QUESTION NO: 21
A security analyst, Ann, is reviewing an IRC channel and notices that a malicious exploit has been
created for a frequently used application. She notifies the software vendor and asks them for
remediation steps, but is alarmed to find t | Zero-day |
| QUESTION NO: 22
A security administrator has concerns about new types of media which allow for the mass
distribution of personal comments to a select group of people. To mitigate the risks involved with
this media, employees should receive training on | Social networking |
| QUESTION NO: 23
A network administrator is responsible for securing applications against external attacks. Every
month, the underlying operating system is updated. There is no process in place for other software
updates.
Which of the following process | Application patch management |
| QUESTION NO: 24
A software developer is responsible for writing the code on an accounting application. Another
software developer is responsible for developing code on a system in human resources. Once a
year they have to switch roles for several weeks | Job rotation |
| QUESTION NO: 25
A network engineer is designing a secure tunneled VPN. Which of the following protocols would
be the MOST secure? | IPsec |
| QUESTION NO: 26
Which of the following implementation steps would be appropriate for a public wireless hot-spot? | Open system authentication |
| QUESTION NO: 27
Which of the following is a step in deploying a WPA2-Enterprise wireless network? | Install a digital certificate on the authentication server |
| QUESTION NO: 28
Which of the following controls would allow a company to reduce the exposure of sensitive
systems from unmanaged devices on internal networks? | 802.1x |
| QUESTION NO: 29
Which of the following preventative controls would be appropriate for responding to a directive to | Disabling unnecessary services |
| QUESTION NO: 30
A security manager must remain aware of the security posture of each system. Which of the
following supports this requirement? | Establishing baseline reporting |
| QUESTION NO: 31
Deploying a wildcard certificate is one strategy to: | Reduce the certificate management burden. |
| QUESTION NO: 32
The security administrator needs to manage traffic on a layer 3 device to support FTP from a new remote site. Which of the following would need to be implemented? | Access control lists |
| QUESTION NO: 33
Which of the following ports is used for SSH, by default? | 22 |
| QUESTION NO: 34
A network administrator has been tasked with securing the WLAN. Which of the following
cryptographic products would be used to provide the MOST secure environment for the WLAN? | WPA2 CCMP |
| QUESTION NO: 35
A server with the IP address of 10.10.2.4 has been having intermittent connection issues. The logs show repeated connection attempts from the following IPs:
10.10.3.16
10.10.3.23
212.178.24.26
217.24.94.83
These attempts are overload | DDoS |
| QUESTION NO: 36
Which of the following ciphers would be BEST used to encrypt streaming video? | RC4 |
| QUESTION NO: 37
A user attempting to log on to a workstation for the first time is prompted for the following
information before being granted access: username, password, and a four-digit security pin that
was mailed to him during account registration. | Single factor authentication |
| QUESTION NO: 38
After analyzing and correlating activity from multiple sensors, the security administrator has
determined that a group of very well organized individuals from an enemy country is responsible
for various attempts to breach the company ne | Advanced persistent threat |
| QUESTION NO: 39
Which of the following is true about input validation in a client-server architecture, when data
integrity is critical to the organization? | It should be performed on the server side. |
| QUESTION NO: 40
A merchant acquirer has the need to store credit card numbers in a transactional database in a
high performance environment. Which of the following BEST protects the credit card data? | Database field encryption |
| QUESTION NO: 41
A bank has a fleet of aging payment terminals used by merchants for transactional processing.
The terminals currently support single DES but require an upgrade in order to be compliant with
security standards. Which of the following is | 3DES |
| QUESTION NO: 42
Which of the following is BEST at blocking attacks and providing security at layer 7 of the OSI
model? | WAF |
| QUESTION NO: 43
Which of the following is BEST used to capture and analyze network traffic between hosts on the same network segment? | Protocol analyzer |
| QUESTION NO: 44
After a number of highly publicized and embarrassing customer data leaks as a result of social
engineering attacks by phone, the Chief Information Officer (CIO) has decided user training will
reduce the risk of another data leak. Which | Information Security Awareness |
| QUESTION NO: 45
Which of the following functions provides an output which cannot be reversed and converts data
into a string of characters? | Hashing |
| QUESTION NO: 46
Which of the following encrypts data a single bit at a time? | Stream cipher |
| QUESTION NO: 47
Which of the following is used to verify data integrity? | SHA |
| QUESTION NO: 48
By default, which of the following uses TCP port 22? (Select THREE). | SCP
SSH
SFTP |
| QUESTION NO: 49
Access mechanisms to data on encrypted USB hard drives must be implemented correctly
otherwise: | the security controls on the USB drive can be bypassed. |
| QUESTION NO: 50
Maintenance workers find an active network switch hidden above a dropped-ceiling tile in the
CEO’s office with various connected cables from the office. Which of the following describes the
type of attack that was occurring? | Packet sniffing |
| QUESTION NO: 51
A security administrator is segregating all web-facing server traffic from the internal network and
restricting it to a single interface on a firewall. Which of the following BEST describes this new
network? | DMZ |
| QUESTION NO: 52
Which of the following was based on a previous X.500 specification and allows either unencrypted
authentication or encrypted authentication through the use of TLS? | LDAP |
| QUESTION NO: 53
The Quality Assurance team is testing a new third party developed application. The Quality team
does not have any experience with the application. Which of the following is the team performing? | Black box testing |
| QUESTION NO: 54
Which of the following has a storage root key? | TPM |
| QUESTION NO: 55
A datacenter requires that staff be able to identify whether or not items have been removed from
the facility. Which of the following controls will allow the organization to provide automated
notification of item removal? | RFID |
| QUESTION NO: 56
A malicious person gained access to a datacenter by ripping the proximity badge reader off the
wall near the datacenter entrance. This caused the electronic locks on the datacenter door to
release because the: | system was designed to fail open for life-safety. |
| QUESTION NO: 57
The concept of rendering data passing between two points over an IP based network impervious
to all but the most sophisticated advanced persistent threats is BEST categorized as which of the
following? | Transport encryption |
| QUESTION NO: 58
On Monday, all company employees report being unable to connect to the corporate wireless
network, which uses 802.1x with PEAP. A technician verifies that no configuration changes were
made to the wireless network and its supporting inf | The Remote Authentication Dial-In User Service server certificate has expired. |
| QUESTION NO: 59
Which of the following would BEST deter an attacker trying to brute force 4-digit PIN numbers to
access an account at a bank teller machine? | Account lockout settings |
| QUESTION NO: 60
An administrator discovers that many users have used their same passwords for years even
though the network requires that the passwords be changed every six weeks. Which of the
following, when used together, would BEST prevent users fro | Password history
Minimum password age |
| QUESTION NO: 61
A recent audit has discovered that at the time of password expiration clients are able to recycle the
previous credentials for authentication. Which of the following controls should be used together to
prevent this from occurring? (Sele | Password age
Password history |
| QUESTION NO: 62
A system administrator is configuring UNIX accounts to authenticate against an external server.
The configuration file asks for the following information DC=ServerName and DC=COM. Which of
the following authentication services is being | LDAP |
| QUESTION NO: 63
In Kerberos, the Ticket Granting Ticket (TGT) is used for which of the following? | Authentication |
| QUESTION NO: 64
Which of the following network design elements allows for many internal devices to share one
public IP address? | PAT |
| QUESTION NO: 65
Which of the following components of an all-in-one security appliance would MOST likely be
configured in order to restrict access to peer-to-peer file sharing websites? | URL filter |
| QUESTION NO: 66
When considering a vendor-specific vulnerability in critical industrial control systems which of the
following techniques supports availability? | Incorporating diversity into redundant design |
| QUESTION NO: 67
During the information gathering stage of a deploying role-based access control model, which of
the following information is MOST likely required? | Matrix of job titles with required access privileges |
| QUESTION NO: 68
The Chief Technical Officer (CTO) has been informed of a potential fraud committed by a
database administrator performing several other job functions within the company. Which of the
following is the BEST method to prevent such activiti | Separation of duties |
| QUESTION NO: 69
Ann would like to forward some Personal Identifiable Information to her HR department by email,
but she is worried about the confidentiality of the information. Which of the following will
accomplish this task securely? | Encryption |
| QUESTION NO: 70
A company is trying to limit the risk associated with the use of unapproved USB devices to copy
documents. Which of the following would be the BEST technology control to use in this scenario? | DLP |
| QUESTION NO: 71
A company is trying to implement physical deterrent controls to improve the overall security
posture of their data center. Which of the following BEST meets their goal? | Hardware locks |
| QUESTION NO: 72
A company’s employees were victims of a spear phishing campaign impersonating the CEO. The
company would now like to implement a solution to improve the overall security posture by
assuring their employees that email originated from the | Digital signatures |
| QUESTION NO: 73
A security technician is attempting to improve the overall security posture of an internal mail
server. Which of the following actions would BEST accomplish this goal? | Disabling unnecessary services |
| QUESTION NO: 74
A bank has recently deployed mobile tablets to all loan officers for use at customer sites. Which of
the following would BEST prevent the disclosure of customer data in the event that a tablet is lost or stolen? | Remote wiping |
| QUESTION NO: 75
Which of the following is the primary security concern when deploying a mobile device on a
network? | Data security |
| QUESTION NO: 76
Which of the following technical controls is BEST used to define which applications a user can
install and run on a company issued mobile device? | Whitelisting |
| QUESTION NO: 77
After a company has standardized to a single operating system, not all servers are immune to a
well-known OS vulnerability. Which of the following solutions would mitigate this issue? | Patch management system |
| QUESTION NO: 78
A security administrator discovers an image file that has several plain text documents hidden in
the file. Which of the following security goals is met by camouflaging data inside of other files? | Steganography |
| QUESTION NO: 79
A company determines a need for additional protection from rogue devices plugging into physical
ports around the building.
Which of the following provides the highest degree of protection from unauthorized wired network
access? | 802.1x |
| QUESTION NO: 80
A company is preparing to decommission an offline, non-networked root certificate server. Before
sending the server’s drives to be destroyed by a contracted company, the Chief Security Officer
(CSO) wants to be certain that the data wil | Full disk encryption
Disk wiping procedures |
| QUESTION NO: 81
During the analysis of a PCAP file, a security analyst noticed several communications with a
remote server on port 53. Which of the following protocol types is observed in this traffic? | DNS |
| QUESTION NO: 82
A compromised workstation utilized in a Distributed Denial of Service (DDOS) attack has been
removed from the network and an image of the hard drive has been created. However, the system
administrator stated that the system was left una | Chain of custody |
| QUESTION NO: 83
During which of the following phases of the Incident Response process should a security
administrator define and implement general defense against malware? | Preparation |
| QUESTION NO: 84
Due to hardware limitation, a technician must implement a wireless encryption algorithm that uses
the RC4 protocol. Which of the following is a wireless encryption solution that the technician
should implement while ensuring the STRONGE | WPA-TKIP |
| QUESTION NO: 85
Joe, a user, wants to send an encrypted email to Ann. Which of the following will Ann need to use
to verify that the email came from Joe and decrypt it? (Select TWO). | Ann’s private key
Joe’s public key |
| QUESTION NO: 86
Joe, a user, wants to send an encrypted email to Ann. Which of the following will Ann need to use
to verify the validity’s of Joe’s certificate? (Select TWO). | The CA’s public key
Joe’s public key |
| QUESTION NO: 87
A technician wants to implement a dual factor authentication system that will enable the
organization to authorize access to sensitive systems on a need-to-know basis. Which of the
following should be implemented during the authorizatio | Biometrics |
| QUESTION NO: 88
A security researcher wants to reverse engineer an executable file to determine if it is malicious.
The file was found on an underused server and appears to contain a zero-day exploit. Which of
the following can the researcher do to det | OS Baseline comparison |
| QUESTION NO: 89
A recent spike in virus detections has been attributed to end-users visiting www.compnay.com.
The business has an established relationship with an organization using the URL of
www.company.com but not with the site that has been causing | Typo squatting |
| QUESTION NO: 90
A company has proprietary mission critical devices connected to their network which are
configured remotely by both employees and approved customers. The administrator wants to
monitor device security without changing their baseline con | IDS |
| QUESTION NO: 91
An administrator has a network subnet dedicated to a group of users. Due to concerns regarding
data and network security, the administrator desires to provide network access for this group only.
Which of the following would BEST address | Configure the switch to allow only traffic from computers based upon their physical address. |
| QUESTION NO: 92
Which of the following is a security concern regarding users bringing personally-owned devices
that they connect to the corporate network? | Lack of controls in place to ensure that the devices have the latest system patches and
signature files |
| QUESTION NO: 93
Due to issues with building keys being duplicated and distributed, a security administrator wishes
to change to a different security control regarding a restricted area. The goal is to provide access
based upon facial recognition. Which | Place a guard at the entrance to approve access. |
| QUESTION NO: 94
A security administrator has concerns regarding employees saving data on company provided
mobile devices. Which of the following would BEST address the administrator’s concerns? | Configure the devices so that removable media use is disabled |
| QUESTION NO: 95
Identifying residual risk is MOST important to which of the following concepts? | Risk acceptance |
| QUESTION NO: 96
The information security technician wants to ensure security controls are deployed and functioning
as intended to be able to maintain an appropriate security posture. Which of the following security
techniques is MOST appropriate to do | Continuous security monitoring |
| QUESTION NO: 97
A small company can only afford to buy an all-in-one wireless router/switch. The company has 3
wireless BYOD users and 2 web servers without wireless access. Which of the following should
the company configure to protect the servers fro | Create a server VLAN
Create an ACL to access the server |
| QUESTION NO: 98
Users can authenticate to a company's web applications using their credentials from a popular
social media site. Which of the following poses the greatest risk with this integration? | Password breaches to the social media site affect the company application as well |
| QUESTION NO: 99
A security team has established a security awareness program. Which of the following would
BEST prove the success of the program? | Metrics |
| QUESTION NO: 100
A company needs to receive data that contains personally identifiable information. The company
requires both the transmission and data at rest to be encrypted. Which of the following achieves
this goal? (Select TWO). | SSH
PGP/GPG |
