Which of the following is not a weakness in Kerberos?

Authentication information is not encrypted.

Which objects and subjects have a label in a MAC model?

All objects and subjects have a label

Which of the following data assets may be safely and effectively disposed of using shredding? (Select all that apply.)

Credit Cards, SSD Drives, Removable media, Paper records

Deepak intends to run an open (unencrypted) wireless network. How should he connect his business devices?

Set up a separate SSID using WPA3.

Which of the following best defines a virtual machine?

A virtual instance of an operating system

Which of the following is not a common component of configuration management change control steps?

Service level agreement approval

Which one of the following would be a reasonable application for the use of self-signed digital certificates?

Internal scheduling application

Refer The Scenario & Answer The Question

stateful packet inspection firewall

studbud

CISSP MOCK TEST-1 DEC BATCH

100 termsStudBud Administration62 plays

Imported from external platform

Flashcards100 cardsFPractice quizPHost liveL

Questions 100

Answers

1
Answer the Question
TACACS+
RADIUS
XTACACS
OAuth
2
Refer The Question & Answer The Scenario
DES
Data masking
Tokenization
Anonymization
3
Answer The Question
Full interruption test
Parallel test
Checklist review
Tabletop exercise
4
Answer The Question
Kerberos
OpenID Connect
SAML
RADIUS
5
Lauren implements ASLR to help prevent system compromises. What technique has she used to protect her system?
Discretionary access control
Mandatory access control
Encryption
Memory address randomization
6
Refer The Scenario & Answer The Question
Log Repositories
SOAR
IPS
SIEM
7
What class of fire extinguisher is capable of fighting electrical fires?
Class B
Class D
Class C
Class A
8
Answer The Question
STRIDE
CVSS
ATT&CK
PASTA
9
Answer The Question
Smishing
Phishing
A Human trojan
Social Engineering
10
Answer The Question
Recipient’s private key
Ria's public key
Recipient’s public key
Ria's private key
11
Answer The Question
Masquerading
Spoofing
Modification
Replay
12
Answer the Question
x
Hashed passwords
Encrypted passwords
Plaintext passwords
13
Which of the following is not a weakness in Kerberos?
Compromise of the KDC would allow attackers to impersonate any user
It is susceptible to password guessing.
Authentication information is not encrypted.
The KDC is a single point of failure.
14
Which objects and subjects have a label in a MAC model?
All objects have only label
All objects and subjects have a label
. All subjects have a label and all objects have a compartment.
All objects have a label, and all subjects have a compartment
15
Answer The Question
Bluelisting
BlackListing
Graylisting
Whitelisting
16
Answer The Question
Due diligence
Least privilege
Separation of duties
Due care
17
What OASIS standard markup language is used to generate provisioning requests both within & Outside of organizations?
SAML
SOA
SPML
XACML
18
Which one of the following tools may be used to achieve the goal of nonrepudiation?
Symmetric Encryption
Digital Signature
Firewall
IDS
19
Which of the following means that a company did all it could have reasonably done to prevent a security breach?
Downstream liability
Responsibility
Due diligence
Due care
20
Refer The Scenario & Answer The Question
Software analysis
Network analysis
Hardware analysis
Media analysis
21
Answer The Question
Honeypot
Pseudoflaw
Honeynet
Darknet
22
Which of the following is NOT a factor in determining the sensitivity of data?
The level of damage that could be caused should the data be exposed
How the data will be used
The value of the data
Who should be accessing the data
23
What type of inbound packet is characteristic of a ping flood attack?
ICMP Echo request
ICMP echo reply
ICMP route changed
ICMP destination unreachable
24
Refer The Scenario & Answer The Question
3
2
4
1
25
Answer The Question
SYN, SYN/ACK, ACK
PSH, RST, ACK
SYN, ACK, SYN/ACK
SYN, RST, FIN
26
Which of the following data assets may be safely and effectively disposed of using shredding? (Select all that apply.)
Credit Cards
SSD Drives
Removable media
Paper records
27
Answer The Question
Disk Dumping
Virtualization
RAID
Clustering
28
What type of error occurs when a valid subject using a biometric authenticator is not authenticated?
Type 2 error
Type 1 error
Type 4 error
Type 3 error
29
What is the best way to provide accountability for the use of identities?
Digital Signature
Authorization
Logging
Type 1 Authentication
30
Answer The Question
Separation of duties
. Job rotation
Least privilege
Two- Person control
31
A Type 2 authentication factor that generates dynamic passwords based on a time- or algorithm-based system is called...
Smart Card
CAC
PIV
Token
32
Answer The QUestion
MTD
RPO
RTO
SLA
33
Which one of the following techniques is not commonly used to remove unwanted remnant data from magnetic tapes?
Reformatting
Overwriting
Degaussing
Physical destruction
34
Deepak intends to run an open (unencrypted) wireless network. How should he connect his business devices?
Run the open network in Enterprise mode
Run WPA3 on the same SSID.
Set up a separate SSID using WPA3.
Set up a separate wireless network using WEP.
35
Answer The Question
PCIDSS
HIPAA
FERPA
SOX
36
Refer The Scenario & answer the question
Reduction
Annualized loss expectancy
Qualitative
Quantitative
37
What RADIUS alternative is commonly used for Cisco network gear and supports two factor authentication?
XTACAS
TACAS+
Kerberos
RADIUS+
38
Refer the scenario & Answer the question
A CDN
A P2P CDN
Redundant Servers
A hot site
39
What term best describes data that is resident in system memory?
Data in Motion
Data at Rest
Data in Use
Buffered Data
40
Bell-LaPadula is an example of what type of access control model?
ABAC
RBAC
MAC
DAC
41
Which of the following is responsible for user authentication for Google users?
Google servers
The diagram does not provide enough information to determine this.
The e-commerce application
Both the e-commerce application and Google servers.
42
Which of the following best defines a virtual machine?
A physical environment for multiple guests
A virtual instance of an operating system
Piece of Hardware running multiple OS simultaneously
environment that can be fully utilized while running legacy applications
43
Which of the following is not a common component of configuration management change control steps?
Approval of the change
Tested and presented
Report change to management
Service level agreement approval
44
Which one of the following would be a reasonable application for the use of self-signed digital certificates?
Banking application
Digital commerce website
Internal scheduling application
Customer portal
45
Answer The Question
Trojan
Logic Bomb
Virus
Worm
46
Answer The Question
Physical
Preventive
Detective
Directive
47
Answer The Question
ALE
EF
SLE
ARO
48
Answer The Question
FRR
FAR
CER
FDR
49
Refer The Scenario & Answer The Question
application-level gateway firewall
circuit-level gateway firewall
stateful packet inspection firewall
static packet filtering firewall
50
What two types of attacks are VoIP call managers and VoIP phones most likely to be susceptible to?
Host OS attacks and buffer overflows
DoS and malware
DoS and host OS attacks
Worms and Trojans
51
What is the final stage of the Software Capability Maturity Model (SW-CMM)?
Managed
Defined
Optimized
Repeatable
52
Refer The Scenario & Answer The Question
The Application layer
The Physical layer
The Data Link layer
The Session layer
53
Refer The Question & Answer The Scenario
Compartmented
Single State
Unclassified
Multistate
54
Which one of the following techniques can an attacker use to exploit a TOC/TOU vulnerability?
Concurrency control
Exception handling
File locking
Algorithmic complexity
55
Which of the following is not a single sign-on implementation?
RADIUS
ADFS
CAS
Kerberos
56
Which of the following is a critical first step in disaster recovery and contingency planning?
Complete a business impact analysis.
Organize and create relevant documentation.
. Plan testing and drills
Determine offsite backup facility alternatives.
57
Which of the following dictates that all evidence be labeled with information indicating who secured and validated it?
Due care
Investigation
Chain of Custody
Guidelines
58
What role does the Internet Architecture Board play regarding technology and ethics?
. It issues ethics-related statements concerning the use of the Internet.
It maintains the Ten Commandments of Computer Ethics.
It edits Request for Comments.
It creates criminal sentencing guidelines.
59
Answer The Question
Reconnaissance
Malicious insider
Denial-Of-Service
Compromise
60
What three types of interfaces are typically tested during software testing?
Network interfaces, APIs, and UIs
Network, physical, and application interfaces
APIs, UIs, and physical interfaces
Application, programmatic, and user interfaces
61
Answer The Question
Mobile devices
Files stored on servers
Intellectual property
Server hardware
62
Refer The Scenario & Answer the Question
Open Source
Managed
COTS
Third Party
63
. What type of networking device is most commonly used to assign endpoint systems to VLANs?
Hub
Router
Switch
Firewall
64
Answer The question
Create rule
Remote Rule
Take Rule
Grant Rule
65
Answer The Question
Confidentiality
Integrity
Privacy
Availability
66
When a Windows system is rebooted, what type of log is generated?
Warning
Failure Audit
Error
Information
67
Rfer the Scenario & Answer the Question
Physical Destruction
Reformatting
Disk Encryption
Degaussing
68
Answer The Question
Salting
User education
. Password expiration policies
Password complexity policies
69
Application banner information is typically recorded during what penetration testing phase?
Planning
Discovery
Attack
Reporting
70
Answer The Question
RTO
ALE
RPO
MTD
71
Which of the following attributes is used to biometrically authenticate a user’s identity?
Something You are
Someplace You are
Something You Have
Something you know
72
Which of the following AAA protocols is the most commonly used?
TACACS
Super TACACS
XTACACS
TACACS+
73
Which one of the following is not a principle of the Agile approach to software development?
Working software is the primary measure of progress.
Simplicity is essential.
Businesspeople and developers must work together daily.
The most efficient method of conveying information is electronic.
74
Refer The Scenario & Answer The Question
SPML
SAML
XACML
SOAP
75
Which of the following is not a reason to develop and implement a disaster recovery plan?
Provide procedures for emergency responses
Outline business functions and systems.
Extend backup operations to include more than just backing up data.
Provide steps for a post-disaster recovery
76
Which of the following is not included in a risk assessment?
Identifying assets
Analyzing risk in order of cost or criticality
Discontinuing activities that introduce risk
Identifying threats
77
Which one of the following data roles bears ultimate organizational responsibility for data?
Business Owners
Data Owners
Systems Owners
Mission Owners
78
Answer The Question
Policy
Guideline
Procedure
Standard
79
Answer The Question
Likelihood of Data Theft
Likelihood of Data Loss
Sensitivity
Source
80
Answer The Question
Reactive
Passive
Replay
Proactive
81
Answer the Question
Mirroring
Stripping
Parity
Hot-Swapping
82
Answer The Question
10.8.15.9
192.168.109.55
129.53.44.124
12.8.195.15
83
ICMP, RIP, and network address translation all occur at what layer of the OSI model?
Layer 1
Layer 4
Layer 2
Layer 3
84
Which of the following statements about SSAE-18 are correct? (Select all that apply.)
It is used for external audits
It mandates a specific control set.
It USes framework, including SOC 1, SOC 2, and SOC 3 reports.
It is an attestation standard.
85
When might an organization using biometrics choose to allow a higher FRR instead of a higher FAR?
When security is more important than usability
When false rejection is not a concern due to data quality
When false rejection is not a concern due to data quality
When the CER of the system is not known
86
Which of the following are common military categories of data classification?
Top Secret, Secret, Confidential, Private
Classified, Unclassified, Public
. Top Secret, Secret, Confidential, Unclassified
Top Secret, Secret, Classified, Unclassified
87
What is the default subnet mask for a Class B network?
255.255.255.0
255.255.0.0
255.0.0.0
255.254.0.0
88
What type of access controls allow the owner of a file to grant other users access to it using an access control list?
Rule-based
Role-based
Discretionary
Nondiscretionary
89
Which accounts are typically assessed during an account management assessment?
A random sample
Accounts that have existed for long periods of time
Highly Privileged Accounts
Recently generated accounts
90
Answer the Question
Interference
Social Engineering
Data Diddling
Salami Slicing
91
When you input a user ID and password, you are performing what important identity and access management activity?
Validation
Authorization
Login
Authentication
92
This firewall uses multiple proxy servers that filter traffic based on analysis of the protocols used for each services.
A stateful inspection firewall
A circuit-level gateway firewall
A static packet filtering firewall
An application-level gateway firewall
93
Which one of the following activities transforms a zero-day vulnerability into a less dangerous attack vector?
Release of a security patch
Implementation of transport-layer encryption
Discovery of the vulnerability
Reconfiguration of a firewall
94
Which of the following is not a valid use for key risk indicators?
Provide warnings before issues occur.
Provide historical views of past risks.
Provide insight into risk tolerance for the organization.
Provide real-time incident response information.
95
Jim is implementing an IDaaS solution for his organization. What type of technology is he putting in place?
OAuth
Identity as a Service
Employee ID as a service
Intrusion detection as a service
96
Refer The Scenario & Answer The Question
Clearing
Transmitting Data
Remanance
Data Classification
97
In the OSI model, when a packet changes from a datastream to a segment or a datagram, what layer has it traversed?
The Physical layer
The Application layer
The Transport layer
The Data Link layer
98
What business process typically requires sign-off from a manager before modifications are made to a system?
Change management
Versioning
SDN
Release management
99
Refer The Question & Answer The Scenario
Data Collection
Data Retention
Data Maintenance
Data Remanance
100
Refer the scenario & answer the question
CTO
CIO
CISO
CEO

CISSP MOCK TEST-1 DEC BATCH Flashcards | StudBud