CNL_CH_1
問題一覧
1
After returning from a conference, a user's laptop has been operating slower than normal and overheating and the fans have been running constantly During the diagnosis process, an unknown piece of hardware is found connected to the laptop's motherboard. Which of the following attack vectors was exploited to install the hardware?
Removable media
2
Physical access to the organization's servers in the data center requires entry and exit through multiple access points: a lobby, an access control vestibule, three doors leading to the server floor itself and eventually to a caged area solely for the organization's hardware.
Which of the following controls is described in this scenario?
Preventive
3
Which of the following control Types would be BEST to use in an accounting department to reduce losses from fraudulent transactions?
Detective
4
Which of the following control types is focused primarily on reducing risk before an incident occurs?
Preventive
5
Which of the following control types is patch management classified under?
Corrective
6
A security analyst is tasked with classifying data to be stored on company servers. Which of the following should be classified as proprietary?
. Marketing strategies
7
An organization implemented a process that compares the settings currently configured on systems against secure configuration guidelines in order to identify any gaps. Which of the following control types has the organization implemented?
Detective
8
A company is focused on reducing risks from removable media threats. Due to certain primary applications, removable media cannot be entirely prohibited at this time. Which of the following best describes the company's approach?
Mitigating controls
9
Which of the following documents provides expectations at a technical level for quality, availability, and responsibilities?
SLA
10
Which of the following is an example of transference of risk?
Purchasing insurance
11
An organization has decided to purchase an insurance policy because a risk assessment determined that the cost to remediate the risk is greater than the five- year cost of the insurance policy. The organization is enabling risk;
transference
12
A security team is conducting a security review of a hosted data provider. The management team has asked the hosted data provider to share proof that customer data is being appropriately protected. Which of the following would provide the best proof that customer data is being protected?
SOC2
13
Which of the following should be monitored by threat intelligence researchers who search for leaked credentials?
Dark web
14
Which of the following risk management strategies would an organization use to maintain a legacy system with known risks for operational purposes?
Acceptance
15
The Chief Compliance Officer from a bank has approved a background check policy for all new hires Which of the following is the policy MOST likely protecting against?
Hiring an employee who has been convicted of theft to adhere to industry compliance
16
An IT manager is estimating the mobile device budget for the upcoming year Over the last five years, the number of devices that were replaced due to loss damage or theft steadily increased by 10%. Which of the following would BEST describe the estimated number of devices to be replaced next year?
ARO
17
A security analyst is designing the appropriate controls to limit unauthorized access to a physical site. The analyst has a directive to utilize the lowest possible budget Which of the following would BEST meet the requirements?
Deterrent controls
18
A routine audit of medical billing claims revealed that several claims were submitted without the subscriber's knowledge. A review of the audit logs for the medical billing company's system indicated a company employee downloaded customer records and adjusted the direct deposit information to a personal bank account. Which of the following does this action describe?
Insider threat
19
Which of the following terms describes a broad range of information that is sensitive to a specific organization?
Proprietary
20
Which of the following would most likely include language prohibiting end users from accessing personal email from a company device?
AUP
21
Which of the following organizations sets frameworks and controls for optimal security configuration on systems?
NIST
22
Two organizations plan to collaborate on the evaluation of new SIEM solutions for their respective companies. A combined effort from both organizations' SOC teams would speed up the effort. Which of the following can be written to document this agreement?
MOU
23
A technician enables full disk encryption on a laptop that will be taken on a business trip. Which of the following does this process BEST protect?
Data at rest
24
The board of doctors at a company contracted with an insurance firm to limit the organization’s liability. Which of the following risk management practices does this BEST describe?
Transference
25
Which of the following is a benefit of including a risk management framework into an organization's security approach?
It incorporates control, development, policy, and management activities into IT operations.
26
A company is auditing the manner in which its European customers' personal information is handled. Which of the following should the company consult?
GDPR
27
Two hospitals merged into a single organization. The privacy officer requested a review of all records to ensure encryption was used during record storage, in compliance with regulations. During the review, the officer discovered that medical diagnosis codes and patient names were left unsecured. Which of the following types of data does this combination BEST represent?
Personal health information
28
An organization recently completed a security control assessment The organization determined some controls did not meet the existing security measures. Additional mitigations are needed to lessen the risk of the non- compliant controls. Which of the following best describes these mitigations?
Compensating
29
Which of the following is an example of risk avoidance?
Not installing new software to prevent compatibility errors
30
A company policy requires third-party suppliers to self-report data breaches within a specific time frame. Which of the following third-party risk management policies is the company complying with?
SLA
31
Which of the following documents provides guidance regarding the recommended deployment of network security systems from the manufacturer?
Reference architecture
32
A major political party experienced a server breach. The hacker then publicly posted stolen internal communications concerning campaign strategies to give the opposition party an advantage. Which of the following BEST describes these threat actors?
State actors
33
Which of the following should a Chief Information Security Officer consider using to take advantage of industry standard guidelines?
NIST CSF
34
Which of the following measures the average time that equipment will operate before it breaks?
MTBF
35
A company is required to continue using legacy software to support a critical service. Which of the following BEST explains a risk of this practice?
Lack of vendor support
36
Which of the following control types is patch management classified under?
Corrective
37
Which of the following best describes a tool used by an organization to identify, log, and track any potential risks and corresponding risk information?
Risk register
38
Which of the following prevents an employee from seeing a colleague who is visiting an inappropriate website?
AUP
39
A company discovered that terabytes of data have been exfiltrated over the past year after an employee clicked on an email link. The threat continued to evolve and remain undetected until a security analyst noticed an abnormal amount of external connections when the employee was not working. Which of the following is the MOST likely threat actor?
APT
40
The president of a regional bank likes to frequently provide SOC tours to potential investors. Which of the following policies BEST reduces the risk of malicious activity occurring after a tour?
Clean desk
41
Which of the following prevents an employee from seeing a colleague who is visiting an inappropriate website?
AUP
42
Which of the following is a policy that provides a greater depth of knowledge across an organization?
Job Rotation policy
43
Users are presented with a banner upon each login to a workstation. The banner mentions that users are not entitled to any reasonable expectation of privacy and access is for authorized personnel only. In order to proceed past that banner. users must click the OK button. Which of the following is this an example of?
AUP
44
A company's security team received notice of a critical vulnerability affecting a high-profile device within the web infrastructure. The vendor patch was just made available online but has not yet been regression tested in development environments. In the interim, firewall rules were implemented to reduce the access to the interface affected by the vulnerability. Which of the following controls does this scenario describe?
Compensating
45
Which of the following explains why RTO is included in a BIA?
It identifies the amount of allowable downtime for an application or system,
46
After a recent external audit, the compliance team provided a list of several non- compliant, in-scope hosts that were not encrypting cardholder data at rest, Which of the following compliance frameworks would address the compliance team's GREATEST concern?
PCI DSS
47
A security analyst has been tasked with finding the maximum amount of data loss that can occur before ongoing business operations would be impacted. Which of the following terms BEST defines this metric?
RPO
48
An attacker has determined the best way to impact operations is to infiltrate third- party software vendors. Which of the following vectors is being exploited?
Supply chain
49
Which of the following controls is used to make an organization initially aware of a data compromise?
Detective
50
A vulnerability has been discovered and a known patch to address the vulnerability does not exist. Which of the following controls works BEST until a proper fix is released?
Compensating
51
Which of the following control types fixes a previously identified issue and mitigates a risk?
Corrective
52
A company recently set up an e-commerce portal to sell its product online. The company wants to start accepting credit cards for payment, which requires compliance with a security standard. Which of the following standards must the company comply with before accepting credit cards on its e-commerce platform?
PCI DSS
53
A recent audit uncovered a key finding regarding the use of a specific encryption standard in a web application that is used to communicate with business customers. Due to the technical limitations of its customers the company is unable to upgrade the encryption standard. Which of the following types of controls should be used to reduce the risk created by this scenario?
Compensating
54
A company posts a sign indicating its server room is . Which of the following control types is represented?
Deterrent
55
Which of the following threat actors is MOST likely to be motivated by ideology?
Hacktivist
56
A social media company based in North America is looking to expand into new global markets and needs to maintain compliance with international standards With which of the following is the company's data protection officer MOST likely concerned''
ISO 27001
57
Which of the following secure coding techniques makes compromised code more difficult for hackers to use?
Obfuscation
58
Which of the following would a security analyst use to determine if other companies in the same sector have seen similar malicious activity against their systems?
Threat feeds
59
A retail executive recently accepted a job with a major competitor. The following
week, a security analyst reviews the security logs and identifies successful logon attempts to access the departed executive's accounts. Which of the following security practices would have addressed the issue?
Offboarding
60
Which of the following describes business units that purchase and implement scripting software without approval from an organization's technology Support staff?
Shadow IT
61
A company's Chief Information Office (CIO) is meeting with the Chief Information Security Officer (CISO) to plan some activities to enhance the skill levels of the company's developers. Which of the following would be MOST suitable for training the developers?
A capture-the-flag competition
62
When selecting a technical solution for identity management, an architect chooses to go from an in-house to a third-party SaaS provider. Which of the following risk management strategies is this an example of?
Transference
63
A preventive control differs from a compensating control in that a preventive control is:
designed to specifically mitigate a risk.
64
A security team discovered a large number of company-issued devices with non-work-related software installed. Which of the following policies would most likely contain language that would prohibit this activity?
AUP
65
An audit Identified Pll being utilized In the development environment of a critical application. The Chief Privacy Officer (CPO) Is adamant that this data must be removed; however, the developers are concerned that without real data they cannot perform functionality tests and search for specific data.
Which of the following should a security professional implement to BEST satisfy both the CPO's and the development team's requirements?
Data masking
66
A network administrator has been asked to install an IDS to improve the security posture of an organization.
Which of the following control types is an IDS?
Detective
67
A security administrator is setting up a SIEM to help monitor for notable events across the enterprise.
Which of the following control types does this BEST represent?
Detective
68
A recent audit uncovered a key finding regarding the use of a specific encryption standard in a web application that is used to communicate with business customers. Due to the technical limitations of its customers, the company is unable to upgrade the encryption standard. Which of the following types of controls should be used to reduce the risk created by this scenario?
Compensating
69
The following is an administrative control that would be MOST effective to reduce the occurrence of malware execution?
Security awareness training
70
Which of the following can be used to calculate the total loss expected per year due to a threat targeting an Asset?
SLE x ARO
71
A company has a "right to forgotten" request to legally comply, the company must remove data related to the requester from its systems. Which Of the following Companies most likely complying with?
GDPR
72
A financial institution recently joined a bug bounty program to identify security issues in the institution's new public platform. Which of the following best describes who the institution is working with to identify security Issues?
Authorized hacker
73
Which of the following control types is focused primarily on reducing risk before an incident occurs?
Preventive
74
Which of the following control types would be BEST to use to identify violations and incidents?
A.Detective
75
A security personnel is tasked with restricting access to a military site. He has a directive to use the possible lowest budget.
Which one of the following would be best?
Deterrent
76
Security analyst (or technician) has to implement a control in a cost effective way (with low budget) in order to limit unauthorized access physically?
Deterrent
77
Which of the following provides a catalog of security and privacy controls related to the United States federal information systems?
NIST 800-53
78
A company's Chief Information Security Officer (CISO) recently warned the security manager that the company’s Chief Executive Officer (CEO) is planning to publish a controversial option article in a national newspaper, which may result in new cyberattacks. Which of the following would be BEST for the security manager to use in a threat mode?
Hacktivists
79
The IT department at a university is concerned about professors placing servers on the university network in an attempt to bypass security controls. Which of the following BEST represents this type of threat?
Shadow IT
80
A public relations team will be taking a group of guests on a tour through the facility of a large e-commerce company. The day before the tour, the company sends out an email to employees to ensure all whiteboards are cleaned and all desks are cleared. The company is MOST likely trying to protect against.
Loss of proprietary information (clean desk policy)
81
Which of the following refers to applications and systems that are used within an organization without consent or approval?
Shadow IT
82
A Chief Executive Officer's (CEO) personal information was stolen in a social engineering attack. Which of the following sources would reveal if the CEO's personal information is for sale?
The dark web
83
An organization just experienced a major cyber attack incident.
The attack was well coordinated, sophisticated and highly skilled. Which of the following targeted the organization?
An advanced persistent threat
84
A security analyst is concerned about traffic initiated to the dark web from the corporate LAN. Which of the following networks should the analyst monitor?
TOR
85
The database administration team is requesting guidance for a secure solution that will ensure confidentiality of cardholder data at rest only in certain fields in the database schema. The requirement is to substitute a sensitive data field with a non-sensitive field that is rendered useless if a data breach occurs. Which of the following is the BEST solution to meet the requirement?
Tokenization
86
A security monitoring company offers a service that alerts ifs customers if their credit cards have been stolen. Which of the following is the MOST likely source of this information?
The dark web
87
Which of the following should be monitored by threat intelligence researchers who search for leaked credentials?
Dark web
88
A security practitioner is performing due diligence on a vendor that is being considered for cloud services.Which of the following should the practitioner consult for the best insight into the current security posture of the vendor?
SOC 2 report
89
A security analyst needs to find real-time data on the latest malware and locs which of the following best describe the solution the analyst should pursue?Threat feeds
Threat feeds
90
A company recently set up an e-commerce portal to sell its product online. The company wants to start accepting credit cards for payment, which requires compliance with a security standard. Which of the following standards must the company comply with before accepting credit cards on its e-commerce platform?
PCI DSS
91
Which of the following would be BEST for a technician to review to determine the total risk an organization can bear when assessing a "cloud-first" adoption strategy?
Risk appetite
92
A multinational organization that offers web-based services has datacenters that are located only in the United States; however, a large number of its customers are in Australia, Europe, and China. Payments for services are managed by a third party in the United Kingdom that specializes in payment gateways. The management team is concerned the organization is not compliant with privacy laws that cover some of its customers. Which of the following frameworks should the management team follow?
General Data Protection Regulation
93
After consulting with the Chief Risk Officer (CRO), a manager
decides to acquire cybersecurity insurance for the company.
Which of the following risk management strategies is the
manager adopting?
Risk transference
94
Which of the following serves to warn users against downloading and installing pirated software on company devices?
AUP (Acceptable Use Policy)
95
In which of the following risk management strategies would cybersecurity insurance be used?
Transference
96
Which of the following are requirements that must be configured for PCI DSS compliance? (Select TWO)
A. Testing security systems and processes regularly
B. Installing and maintaining a web proxy to protect cardholder data
C. Assigning a unique ID to each person with computer access
D. Encrypting transmission of cardholder data across private
networks
E. Benchmarking security awareness training for contractors
F. Using vendor-supplied default passwords for system passwords
Testing security systems and processes regularly, Assigning a unique ID to each person with computer access
97
When selecting a technical solution for identity management, an architect chooses to go from an in-house to a third-party SaaS provider. Which of the following risk management strategies is this an example of?
Transference
98
Which of the following is the MOST likely motivation for a script kiddie threat actor?
Notoriety - (Söhret)
99
Which of the following scenarios BEST describes a risk reduction technique?
A security control objective cannot be met through a technical change, so the company implements a policy to train users on a more secure method of operation
100
Which of the following is the purpose of a risk register?
To identify the risk, the risk owner, and the risk measures
CNL_CH_2
CNL_CH_2
Son Cagrı · 109問 · 2年前CNL_CH_2
CNL_CH_2
109問 • 2年前CNL_CH_3
CNL_CH_3
Son Cagrı · 90問 · 2年前CNL_CH_3
CNL_CH_3
90問 • 2年前CNL_CH_4
CNL_CH_4
Son Cagrı · 48問 · 2年前CNL_CH_4
CNL_CH_4
48問 • 2年前CNL_CH_5
CNL_CH_5
Son Cagrı · 83問 · 2年前CNL_CH_5
CNL_CH_5
83問 • 2年前CNL_CH_6
CNL_CH_6
Son Cagrı · 100問 · 2年前CNL_CH_6
CNL_CH_6
100問 • 2年前CNL_CH_7
CNL_CH_7
Son Cagrı · 43問 · 2年前CNL_CH_7
CNL_CH_7
43問 • 2年前CNL_CH_8
CNL_CH_8
Son Cagrı · 66問 · 2年前CNL_CH_8
CNL_CH_8
66問 • 2年前CNL_CH_9
CNL_CH_9
Son Cagrı · 49問 · 2年前CNL_CH_9
CNL_CH_9
49問 • 2年前CNL_CH_10
CNL_CH_10
Son Cagrı · 75問 · 2年前CNL_CH_10
CNL_CH_10
75問 • 2年前CNL_CH_11
CNL_CH_11
Son Cagrı · 118問 · 2年前CNL_CH_11
CNL_CH_11
118問 • 2年前CNL_CH_12
CNL_CH_12
Son Cagrı · 124問 · 2年前CNL_CH_12
CNL_CH_12
124問 • 2年前CNL_CH_13
CNL_CH_13
Son Cagrı · 95問 · 2年前CNL_CH_13
CNL_CH_13
95問 • 2年前21 Mayis
21 Mayis
Son Cagrı · 69問 · 1年前21 Mayis
21 Mayis
69問 • 1年前20 Mayis -175-
20 Mayis -175-
Son Cagrı · 174問 · 1年前20 Mayis -175-
20 Mayis -175-
174問 • 1年前30 Mayis
30 Mayis
Son Cagrı · 209問 · 1年前30 Mayis
30 Mayis
209問 • 1年前A-1
A-1
Son Cagrı · 216問 · 1年前A-1
A-1
216問 • 1年前A-2
A-2
Son Cagrı · 184問 · 1年前A-2
A-2
184問 • 1年前A-3
A-3
Son Cagrı · 68問 · 1年前A-3
A-3
68問 • 1年前exam topics
exam topics
Son Cagrı · 306問 · 1年前exam topics
exam topics
306問 • 1年前pass4future
pass4future
Son Cagrı · 330問 · 1年前pass4future
pass4future
330問 • 1年前son 1
son 1
Son Cagrı · 349問 · 1年前son 1
son 1
349問 • 1年前son 2
son 2
Son Cagrı · 113問 · 1年前son 2
son 2
113問 • 1年前son 3
son 3
Son Cagrı · 63問 · 1年前son 3
son 3
63問 • 1年前問題一覧
1
After returning from a conference, a user's laptop has been operating slower than normal and overheating and the fans have been running constantly During the diagnosis process, an unknown piece of hardware is found connected to the laptop's motherboard. Which of the following attack vectors was exploited to install the hardware?
Removable media
2
Physical access to the organization's servers in the data center requires entry and exit through multiple access points: a lobby, an access control vestibule, three doors leading to the server floor itself and eventually to a caged area solely for the organization's hardware.
Which of the following controls is described in this scenario?
Preventive
3
Which of the following control Types would be BEST to use in an accounting department to reduce losses from fraudulent transactions?
Detective
4
Which of the following control types is focused primarily on reducing risk before an incident occurs?
Preventive
5
Which of the following control types is patch management classified under?
Corrective
6
A security analyst is tasked with classifying data to be stored on company servers. Which of the following should be classified as proprietary?
. Marketing strategies
7
An organization implemented a process that compares the settings currently configured on systems against secure configuration guidelines in order to identify any gaps. Which of the following control types has the organization implemented?
Detective
8
A company is focused on reducing risks from removable media threats. Due to certain primary applications, removable media cannot be entirely prohibited at this time. Which of the following best describes the company's approach?
Mitigating controls
9
Which of the following documents provides expectations at a technical level for quality, availability, and responsibilities?
SLA
10
Which of the following is an example of transference of risk?
Purchasing insurance
11
An organization has decided to purchase an insurance policy because a risk assessment determined that the cost to remediate the risk is greater than the five- year cost of the insurance policy. The organization is enabling risk;
transference
12
A security team is conducting a security review of a hosted data provider. The management team has asked the hosted data provider to share proof that customer data is being appropriately protected. Which of the following would provide the best proof that customer data is being protected?
SOC2
13
Which of the following should be monitored by threat intelligence researchers who search for leaked credentials?
Dark web
14
Which of the following risk management strategies would an organization use to maintain a legacy system with known risks for operational purposes?
Acceptance
15
The Chief Compliance Officer from a bank has approved a background check policy for all new hires Which of the following is the policy MOST likely protecting against?
Hiring an employee who has been convicted of theft to adhere to industry compliance
16
An IT manager is estimating the mobile device budget for the upcoming year Over the last five years, the number of devices that were replaced due to loss damage or theft steadily increased by 10%. Which of the following would BEST describe the estimated number of devices to be replaced next year?
ARO
17
A security analyst is designing the appropriate controls to limit unauthorized access to a physical site. The analyst has a directive to utilize the lowest possible budget Which of the following would BEST meet the requirements?
Deterrent controls
18
A routine audit of medical billing claims revealed that several claims were submitted without the subscriber's knowledge. A review of the audit logs for the medical billing company's system indicated a company employee downloaded customer records and adjusted the direct deposit information to a personal bank account. Which of the following does this action describe?
Insider threat
19
Which of the following terms describes a broad range of information that is sensitive to a specific organization?
Proprietary
20
Which of the following would most likely include language prohibiting end users from accessing personal email from a company device?
AUP
21
Which of the following organizations sets frameworks and controls for optimal security configuration on systems?
NIST
22
Two organizations plan to collaborate on the evaluation of new SIEM solutions for their respective companies. A combined effort from both organizations' SOC teams would speed up the effort. Which of the following can be written to document this agreement?
MOU
23
A technician enables full disk encryption on a laptop that will be taken on a business trip. Which of the following does this process BEST protect?
Data at rest
24
The board of doctors at a company contracted with an insurance firm to limit the organization’s liability. Which of the following risk management practices does this BEST describe?
Transference
25
Which of the following is a benefit of including a risk management framework into an organization's security approach?
It incorporates control, development, policy, and management activities into IT operations.
26
A company is auditing the manner in which its European customers' personal information is handled. Which of the following should the company consult?
GDPR
27
Two hospitals merged into a single organization. The privacy officer requested a review of all records to ensure encryption was used during record storage, in compliance with regulations. During the review, the officer discovered that medical diagnosis codes and patient names were left unsecured. Which of the following types of data does this combination BEST represent?
Personal health information
28
An organization recently completed a security control assessment The organization determined some controls did not meet the existing security measures. Additional mitigations are needed to lessen the risk of the non- compliant controls. Which of the following best describes these mitigations?
Compensating
29
Which of the following is an example of risk avoidance?
Not installing new software to prevent compatibility errors
30
A company policy requires third-party suppliers to self-report data breaches within a specific time frame. Which of the following third-party risk management policies is the company complying with?
SLA
31
Which of the following documents provides guidance regarding the recommended deployment of network security systems from the manufacturer?
Reference architecture
32
A major political party experienced a server breach. The hacker then publicly posted stolen internal communications concerning campaign strategies to give the opposition party an advantage. Which of the following BEST describes these threat actors?
State actors
33
Which of the following should a Chief Information Security Officer consider using to take advantage of industry standard guidelines?
NIST CSF
34
Which of the following measures the average time that equipment will operate before it breaks?
MTBF
35
A company is required to continue using legacy software to support a critical service. Which of the following BEST explains a risk of this practice?
Lack of vendor support
36
Which of the following control types is patch management classified under?
Corrective
37
Which of the following best describes a tool used by an organization to identify, log, and track any potential risks and corresponding risk information?
Risk register
38
Which of the following prevents an employee from seeing a colleague who is visiting an inappropriate website?
AUP
39
A company discovered that terabytes of data have been exfiltrated over the past year after an employee clicked on an email link. The threat continued to evolve and remain undetected until a security analyst noticed an abnormal amount of external connections when the employee was not working. Which of the following is the MOST likely threat actor?
APT
40
The president of a regional bank likes to frequently provide SOC tours to potential investors. Which of the following policies BEST reduces the risk of malicious activity occurring after a tour?
Clean desk
41
Which of the following prevents an employee from seeing a colleague who is visiting an inappropriate website?
AUP
42
Which of the following is a policy that provides a greater depth of knowledge across an organization?
Job Rotation policy
43
Users are presented with a banner upon each login to a workstation. The banner mentions that users are not entitled to any reasonable expectation of privacy and access is for authorized personnel only. In order to proceed past that banner. users must click the OK button. Which of the following is this an example of?
AUP
44
A company's security team received notice of a critical vulnerability affecting a high-profile device within the web infrastructure. The vendor patch was just made available online but has not yet been regression tested in development environments. In the interim, firewall rules were implemented to reduce the access to the interface affected by the vulnerability. Which of the following controls does this scenario describe?
Compensating
45
Which of the following explains why RTO is included in a BIA?
It identifies the amount of allowable downtime for an application or system,
46
After a recent external audit, the compliance team provided a list of several non- compliant, in-scope hosts that were not encrypting cardholder data at rest, Which of the following compliance frameworks would address the compliance team's GREATEST concern?
PCI DSS
47
A security analyst has been tasked with finding the maximum amount of data loss that can occur before ongoing business operations would be impacted. Which of the following terms BEST defines this metric?
RPO
48
An attacker has determined the best way to impact operations is to infiltrate third- party software vendors. Which of the following vectors is being exploited?
Supply chain
49
Which of the following controls is used to make an organization initially aware of a data compromise?
Detective
50
A vulnerability has been discovered and a known patch to address the vulnerability does not exist. Which of the following controls works BEST until a proper fix is released?
Compensating
51
Which of the following control types fixes a previously identified issue and mitigates a risk?
Corrective
52
A company recently set up an e-commerce portal to sell its product online. The company wants to start accepting credit cards for payment, which requires compliance with a security standard. Which of the following standards must the company comply with before accepting credit cards on its e-commerce platform?
PCI DSS
53
A recent audit uncovered a key finding regarding the use of a specific encryption standard in a web application that is used to communicate with business customers. Due to the technical limitations of its customers the company is unable to upgrade the encryption standard. Which of the following types of controls should be used to reduce the risk created by this scenario?
Compensating
54
A company posts a sign indicating its server room is . Which of the following control types is represented?
Deterrent
55
Which of the following threat actors is MOST likely to be motivated by ideology?
Hacktivist
56
A social media company based in North America is looking to expand into new global markets and needs to maintain compliance with international standards With which of the following is the company's data protection officer MOST likely concerned''
ISO 27001
57
Which of the following secure coding techniques makes compromised code more difficult for hackers to use?
Obfuscation
58
Which of the following would a security analyst use to determine if other companies in the same sector have seen similar malicious activity against their systems?
Threat feeds
59
A retail executive recently accepted a job with a major competitor. The following
week, a security analyst reviews the security logs and identifies successful logon attempts to access the departed executive's accounts. Which of the following security practices would have addressed the issue?
Offboarding
60
Which of the following describes business units that purchase and implement scripting software without approval from an organization's technology Support staff?
Shadow IT
61
A company's Chief Information Office (CIO) is meeting with the Chief Information Security Officer (CISO) to plan some activities to enhance the skill levels of the company's developers. Which of the following would be MOST suitable for training the developers?
A capture-the-flag competition
62
When selecting a technical solution for identity management, an architect chooses to go from an in-house to a third-party SaaS provider. Which of the following risk management strategies is this an example of?
Transference
63
A preventive control differs from a compensating control in that a preventive control is:
designed to specifically mitigate a risk.
64
A security team discovered a large number of company-issued devices with non-work-related software installed. Which of the following policies would most likely contain language that would prohibit this activity?
AUP
65
An audit Identified Pll being utilized In the development environment of a critical application. The Chief Privacy Officer (CPO) Is adamant that this data must be removed; however, the developers are concerned that without real data they cannot perform functionality tests and search for specific data.
Which of the following should a security professional implement to BEST satisfy both the CPO's and the development team's requirements?
Data masking
66
A network administrator has been asked to install an IDS to improve the security posture of an organization.
Which of the following control types is an IDS?
Detective
67
A security administrator is setting up a SIEM to help monitor for notable events across the enterprise.
Which of the following control types does this BEST represent?
Detective
68
A recent audit uncovered a key finding regarding the use of a specific encryption standard in a web application that is used to communicate with business customers. Due to the technical limitations of its customers, the company is unable to upgrade the encryption standard. Which of the following types of controls should be used to reduce the risk created by this scenario?
Compensating
69
The following is an administrative control that would be MOST effective to reduce the occurrence of malware execution?
Security awareness training
70
Which of the following can be used to calculate the total loss expected per year due to a threat targeting an Asset?
SLE x ARO
71
A company has a "right to forgotten" request to legally comply, the company must remove data related to the requester from its systems. Which Of the following Companies most likely complying with?
GDPR
72
A financial institution recently joined a bug bounty program to identify security issues in the institution's new public platform. Which of the following best describes who the institution is working with to identify security Issues?
Authorized hacker
73
Which of the following control types is focused primarily on reducing risk before an incident occurs?
Preventive
74
Which of the following control types would be BEST to use to identify violations and incidents?
A.Detective
75
A security personnel is tasked with restricting access to a military site. He has a directive to use the possible lowest budget.
Which one of the following would be best?
Deterrent
76
Security analyst (or technician) has to implement a control in a cost effective way (with low budget) in order to limit unauthorized access physically?
Deterrent
77
Which of the following provides a catalog of security and privacy controls related to the United States federal information systems?
NIST 800-53
78
A company's Chief Information Security Officer (CISO) recently warned the security manager that the company’s Chief Executive Officer (CEO) is planning to publish a controversial option article in a national newspaper, which may result in new cyberattacks. Which of the following would be BEST for the security manager to use in a threat mode?
Hacktivists
79
The IT department at a university is concerned about professors placing servers on the university network in an attempt to bypass security controls. Which of the following BEST represents this type of threat?
Shadow IT
80
A public relations team will be taking a group of guests on a tour through the facility of a large e-commerce company. The day before the tour, the company sends out an email to employees to ensure all whiteboards are cleaned and all desks are cleared. The company is MOST likely trying to protect against.
Loss of proprietary information (clean desk policy)
81
Which of the following refers to applications and systems that are used within an organization without consent or approval?
Shadow IT
82
A Chief Executive Officer's (CEO) personal information was stolen in a social engineering attack. Which of the following sources would reveal if the CEO's personal information is for sale?
The dark web
83
An organization just experienced a major cyber attack incident.
The attack was well coordinated, sophisticated and highly skilled. Which of the following targeted the organization?
An advanced persistent threat
84
A security analyst is concerned about traffic initiated to the dark web from the corporate LAN. Which of the following networks should the analyst monitor?
TOR
85
The database administration team is requesting guidance for a secure solution that will ensure confidentiality of cardholder data at rest only in certain fields in the database schema. The requirement is to substitute a sensitive data field with a non-sensitive field that is rendered useless if a data breach occurs. Which of the following is the BEST solution to meet the requirement?
Tokenization
86
A security monitoring company offers a service that alerts ifs customers if their credit cards have been stolen. Which of the following is the MOST likely source of this information?
The dark web
87
Which of the following should be monitored by threat intelligence researchers who search for leaked credentials?
Dark web
88
A security practitioner is performing due diligence on a vendor that is being considered for cloud services.Which of the following should the practitioner consult for the best insight into the current security posture of the vendor?
SOC 2 report
89
A security analyst needs to find real-time data on the latest malware and locs which of the following best describe the solution the analyst should pursue?Threat feeds
Threat feeds
90
A company recently set up an e-commerce portal to sell its product online. The company wants to start accepting credit cards for payment, which requires compliance with a security standard. Which of the following standards must the company comply with before accepting credit cards on its e-commerce platform?
PCI DSS
91
Which of the following would be BEST for a technician to review to determine the total risk an organization can bear when assessing a "cloud-first" adoption strategy?
Risk appetite
92
A multinational organization that offers web-based services has datacenters that are located only in the United States; however, a large number of its customers are in Australia, Europe, and China. Payments for services are managed by a third party in the United Kingdom that specializes in payment gateways. The management team is concerned the organization is not compliant with privacy laws that cover some of its customers. Which of the following frameworks should the management team follow?
General Data Protection Regulation
93
After consulting with the Chief Risk Officer (CRO), a manager
decides to acquire cybersecurity insurance for the company.
Which of the following risk management strategies is the
manager adopting?
Risk transference
94
Which of the following serves to warn users against downloading and installing pirated software on company devices?
AUP (Acceptable Use Policy)
95
In which of the following risk management strategies would cybersecurity insurance be used?
Transference
96
Which of the following are requirements that must be configured for PCI DSS compliance? (Select TWO)
A. Testing security systems and processes regularly
B. Installing and maintaining a web proxy to protect cardholder data
C. Assigning a unique ID to each person with computer access
D. Encrypting transmission of cardholder data across private
networks
E. Benchmarking security awareness training for contractors
F. Using vendor-supplied default passwords for system passwords
Testing security systems and processes regularly, Assigning a unique ID to each person with computer access
97
When selecting a technical solution for identity management, an architect chooses to go from an in-house to a third-party SaaS provider. Which of the following risk management strategies is this an example of?
Transference
98
Which of the following is the MOST likely motivation for a script kiddie threat actor?
Notoriety - (Söhret)
99
Which of the following scenarios BEST describes a risk reduction technique?
A security control objective cannot be met through a technical change, so the company implements a policy to train users on a more secure method of operation
100
Which of the following is the purpose of a risk register?
To identify the risk, the risk owner, and the risk measures