style="font-size:15px;"> 109 As a security architect, you implemented dual firewalls, an IPS, and ACLs. All the files on this network are copied to a tape backup every 24 hours. This backup solution addresses which security tenet?AvailabilityDistributionIntegrityConfidentiality110 You need to perform a test where a BCP is tested but no actions take place. It needs to be scheduled periodically. Which of the following is the BEST type of test to perform?Full interruption testParallel testStructured walk-throughSimulation test
111 You completed a structured walk-through of your disaster recovery plan. Senior management would like you to use the absolute best way to verify that the DRP is sufficient and has no deficiencies. What test do you choose next?Roundtable exercisesDry-run exercisesFull interruption testExternal audit
112 Over the last month, you reviewed security reports that state there was a significant increase in the number of inappropriate activities on the network by employees. What is the first step in improving the security level in your organization?Awareness sessionsStronger auditingReduce employee permissionsTermination
113 You have been contacted by senior management to conduct an investigation. They suspect that malicious activities are caused by internal personnel and need to know if it is intentional or unintentional. After investigating, you believe it is unintentional and that the most likely cause is which of the following?FraudEspionageEmbezzlementSocial engineering
114 A white-hat penetration test showed your organization to be susceptible to social engineering attacks. One victim in your organization was phished successfully, while another clicked a link in an email and downloaded possible malware. What steps do you take to prevent social engineering in the future?Use IPSec on critical systemsPublish a policy and educate users on risksUse encryptionEstablish KPIs
115 With the rise of malware spread with removable media, your company wrote an amendment to include a ban of all flashcards and memory drives. They pose a threat due to all but which of the following?Physical sizeTransportabilityStorage capacityBeing cheap and easy to use
116 You received final documentation from your compliance audit. They suggested you implement a complementary security tool to work with your firewall to detect any attempt at scanning. Which device do you choose?RASPBXIDSDDT
117 Your company is using a traditional signature-based IDS system, and it seems to have some problems. You and your fellow analysts are seeing more and more false positives. What might be the issue?Anomaly detection requires vast amounts of resources.FIM.Excessive FTP traffic.Poorly written signatures.
118 One of your end users contacted the security administrator because the mouse on his computer seems to be moving all by itself. If your company's focus is confidentiality, which of the following is the best action to take?Delay the intruder.Disconnect the intruder.Record the intruder.Monitor the intruder.
119 You disconnected a computer from the network because of a suspected breach. Which of the following should you do next?Back up all security and audit logs on that computer.Update the security policy.Reimage the machine.Deploy new countermeasures.
120 You are developing a security policy regarding password management. Which of these is not important?Account lockoutTraining users to create complex, easy-to-remember passwords Preventing users from using personal information in a password, such as their birthday or spouse's nameStoring passwords securely
121 As a hospital, you rely on some assets running high-end customized legacy software. What precaution should you implement to protect yourself if this developer goes out of business?Access controlService level agreementCode escrowOutsourcing
122 A security analyst on your team was written up for a multitude of offenses. The latest transgression left you no choice but to terminate this employee. Which of the following is most important to do when informing the employee of their separation from the company?Allowing them to complete their projectGiving them two weeks' severanceAllowing them to collect their personal belongingsDisabling network access and changing the passwords to devices to which they had access
123 As a CISO, you built a team of developers, managers, educators, architects, and administrators. Some of the people in these roles are finding they are duplicating efforts and not utilizing their time well. What can you use to initiate solid administrative control over the situation?AUPTCOMandatory vacationJob descriptions
124 You have an amazing developer on staff. They are a great problem-solver and work very well with others. However, this developer continues to perform risky behavior on the network even after security awareness sessions and several warnings. What should you do next?Begin a separation of duties.Terminate them and perform an exit interview.Employ mandatory vacation.Decrease permissions.
125 Your vulnerability manager contacted you because of an operating system issue. There are a few security-related issues due to patches and upgrades needed for an application on the systems in question. When is the BEST time to complete this task?As quickly as possible after testing.After experiencing the issue the vulnerability manager described. After other organizations have tested the patch or upgrade.During the usual monthly maintenance.
126 You need to assign permissions so that users can access only the resources they need to complete specific tasks. Which security tenet should you utilize to meet the need?Separation of dutiesNeed to knowJob rotationLeast privilege
127 You recorded data that includes security logs, object access, FIM, and other activities that your SIEM often uses to detect unwanted activity. Which of the following BEST describes this collection of data?Due diligenceSyslogIDRAudit trail
128 You are tasked with hiring a third party to perform a security assessment of your manufacturing plant. What type of testing gives the most neutral review of your security profile?White hatGray hatBlack hatBlue hat
129 You work in law enforcement supporting a network with HA. High availability is mandatory, as you also support emergency 911 services. Which of the following would hinder your HA ecosystem?Clustered serversPrimary firewallSwitched networksRedundant communication links
130 You are tasked to with creating a security plan for your point-of-sale systems. What is the BEST methodology when you begin architecting?Outside inAssets outNo write upNo write down
131 Alice needs some help developing security policy documentation. She turns to you for help in developing a document that contains instructions or information on how to remain in compliance with regulations. What document do you need to develop?ProceduresStandardsPolicyGuidelines
132 You are the security administrator for a large governmental agency. You implemented port security, restricted network traffic, and installed NIDS, firewalls, and spam filters. You think the network is secure. Now you want to focus on endpoint security. What is the most comprehensive plan to follow?Anti-malware/virus/spyware, host-based firewall, and MFAAntivirus/spam, host-based IDS, and TFAAnti-malware/virus, host-based IDS, and biometricsAntivirus/spam, host-based IDS, and SSO
133 You oversee hardware distribution for your global enterprise. You conduct a data analysis to figure out failure rates of a certain brand and model of laptop. You need to calculate the average number of times that specific model is likely to break in a year. Which of the following BEST describes your calculation?Annualized rate of occurrenceExposure factorSingle loss expectancyAnnualized loss expectancy
134 Prioritization is an important part of your job as a security analyst. You are trying to calculate the ALE for all assets and risks. What purpose will this serve?To estimate insuranceTo arrive at a budget and head countTo prioritize countermeasuresTo inform design
135 You need to calculate the ALE for an asset. Which of these is the proper formula?ARO × EF × AVARO
