Domain 7 - Security Operations

Question 1

1. Assuming a working IDS is in place, which of the following groups is BEST capable of stealing sensitive information due to the absence of system auditing?

A. Malicious software (malware)
B. Hacker or cracker
C. Disgruntled employee
D. Auditors

Answer 1

C

Question 2

2. Which of the following provides controlled and un-intercepted interfaces into privileged user functions?

A. Ring protection
B. Anti-malware
C. Maintenance hooks
D. Trusted paths

Answer 2

D

Question 3

3. The doors of a data center spring open in the event of a fire. This is an example of…

A. Fail-safe
B. Fail-secure
C. Fail-proof
D. Fail-closed

Answer 3

A

Question 4

4. Which of the following ensures constant redundancy and fault-tolerance?

A. Cold spare
B. Warm spare
C. Hot spare
D. Archives

Answer 4

C

Question 5

5. If speed is preferred over resilience, which of the following RAID configuration is the most suited?

A. RAID 0
B. RAID 1
C. RAID 5
D. RAID 10

Answer 5

A

Question 6

6. Updating records in multiple locations or copying an entire database on to a remote location as a means to ensure the appropriate levels of fault-tolerance and redundancy is known as…

A. Data mirroring
B. Shadowing
C. Backup
D. Archiving

Answer 6

B

Question 7

7. When the backup window is not long enough to backup all of the data and the restoration of backup must be as fast as possible. Which of the following type of high-availability backup strategy is BEST?

A. Full
B. Incremental
C. Differential
D. Increase the backup window so a full backup can be performed

Answer 7

C

Question 8

8. At a restricted facility, visitors are requested to provide identification and verified against a pre-approved list by the guard at the front gate before being let in. This is an example of checking for…

A. Least privilege
B. Separation of duties
C. Fail-safe
D. Psychological acceptability

Answer 8

A

Question 9

9. When sensitive information is no longer critical but still within scope of a record retention policy, that information is BEST…

A. Destroyed
B. Re-categorized
C. Degaussed
D. Released

Answer 9

B

Question 10

10. Which of the following BEST determines access and suitability of an individual?

A. Job rank or title
B. Partnership with the security team
C. Role
D. Background investigation

Answer 10

D

Question 11

11. Which of the following can help with ensuring that only the needed logs are collected for monitoring?

A. Clipping level
B. Aggregation
C. XML Parsing
D. Inference

Answer 11

A

Question 12

12. The main difference between a Security Event Information Management (SEIM) system and a log management system is that SEIM systems are useful for log collection, collation, and analysis…

A. In real time
B. For historical purposes
C. For admissibility in court
D. In discerning patterns

Answer 12

A

Question 13

13. The best way to ensure that there is no data remnant of sensitive information that was once stored on a DVD-R media is by…

A. Deletion
B. Degaussing
C. Destruction
D. Overwriting

Answer 13

C

Question 14

14. Which of the following processes is concerned with not only identifying the root cause but also addressing the underlying issue?

A. Incident management
B. Problem management
C. Change management
D. Configuration management

Answer 14

B

Question 15

15. Before applying a software update to production systems, it is MOST important that…

A. Full disclosure information about the threat that the patch addresses is available
B. The patching process is documented
C. The production systems are backed up
D. An independent third party attests the validity of the patch

Answer 15

C

Question 16

16. Computer forensics is the marriage of computer science, information technology, and engineering with…

A. Law
B. Information systems
C. Analytical thought
D. The scientific method

Answer 16

A

Question 17

17. What principal allows an investigator to identify aspects of the person responsible for a crime when, whenever committing a crime, the perpetrator leaves traces while stealing assets?

A. Meyer’s principal of legal impunity
B. Criminalistic principals
C. IOCE/Group of 8 Nations principals for computer forensics
D. Locard’s principle of exchange

Answer 17

D

Question 18

18. Which of the following is part of the five rules of evidence?

A. Be authentic, be redundant and be admissible.
B. Be complete, be authentic and be admissible.
C. Be complete, be redundant and be authentic.
D. Be redundant, be admissible and be complete

Answer 18

B

Question 19

19. What is not mentioned as a phase of an incident response?

A. Documentation
B. Prosecution
C. Containment
D. Investigation

Answer 19

B

Question 20

20. Which BEST emphasizes the abstract concepts of law and is influenced by the writings of legal scholars and academics.

A. Criminal law
B. Civil law
C. Religious law
D. Administrative law

Answer 20

B

Question 21

21. Which of the following are computer forensics guidelines?

A. IOCE, MOM and SWGDE.
B. MOM, SWGDE and IOCE.
C. IOCE, SWGDE and ACPO.
D. ACPO, MOM and IOCE.

Answer 21

C

Question 22

22. Triage encompasses which of the following incident response sub-phases?

A. Collection, transport, testimony
B. Traceback, feedback, loopback
C. Detection, identification, notification
D. Confidentiality, integrity, availability

Answer 22

C

Question 23

23. The integrity of a forensic bit stream image is determined by:

A. Comparing hash totals to the original source
B. Keeping good notes
C. Taking pictures
D. Encrypted keys

Answer 23

A

Question 24

24. When dealing with digital evidence, the crime scene:

A. Must never be altered
B. Must be completely reproducible in a court of law
C. Must exist in only one country
D. Must have the least amount of contamination that is possible

Answer 24

D

Question 25

25. When outsourcing IT systems… A. all regulatory and compliance requirements must be passed on to the provider. B. the outsourcing organization is free from compliance obligations. C. the outsourced IT systems are free from compliance obligations. D. the provider is free from compliance obligations.

Answer 25

A

Question 26

26. When dealing with digital evidence, the chain of custody: A. Must never be altered B. Must be completely reproducible in a court of law C. Must exist in only one country D. Must follow a formal documented process

Answer 26

D

Question 27

27. To ensure proper forensics action when needed, an incident response program must: A. avoid conflicts of interest by ensuring organization legal council is not part of the process. B. routinely create forensic images of all desktops and servers. C. only promote closed incidents to law enforcement. D. treat every incident as though it may be a crime.

Answer 27

D

Question 28

28. A hard drive is recovered from a submerged vehicle. The drive is needed for a court case. What is the best approach to pull information off the drive? A. Wait for the drive to dry and then install it in a desktop and attempt to retrieve the information via normal operating system commands. B. Place the drive in a forensic oven to dry it and then use a degausser to remove any residual humidity prior to installing the drive in a laptop and using the OS to pull off information. C. While the drive is still wet use a forensic bit to bit copy program to ensure the drive is preserved in its “native” state. D. Contact a professional data recovery organization, explain the situation and request they pull a forensic image.

Answer 28

D

Question 29

29. To successfully complete a vulnerability assessment, it is critical that protection systems are well understood through: A. Threat definition, target identification and facility characterization B. Threat definition, conflict control and facility characterization C. Risk assessment, threat identification and incident review D. Threat identification, vulnerability appraisal and access review

Answer 29

A

Question 30

30. The strategy of forming layers of protection around an asset or facility is known as: A. Secured Perimeter B. Defense-in-Depth C. Reinforced Barrier Deterrent D. Reasonable Asset Protection

Answer 30

B

Question 31

31. The key to a successful physical protection system is the integration of: A. people, procedures, and equipment B. technology, risk assessment, and human interaction C. protecting, offsetting, and transferring risk D. detection, deterrence, and response

Answer 31

A

Question 32

32. For safety considerations in perimeter areas such as parking lots or garages what is the advised lighting? A. 3 fc B. 5 fc C. 7 fc D. 10 fc

Answer 32

B

Question 33

33. What would be the most appropriate interior sensor used for a building that has windows along the ground floor? A. infrared glass-break sensor B. ultrasonic glass-break sensors C. acoustic/shock glass-break sensors D. volumetric sensors

Answer 33

C

Question 34

34. Which of the following BEST describe three separate functions of CCTV? A. surveillance, deterrence, and evidentiary archives B. intrusion detection, detainment and response C. optical scanning, infrared beaming and lighting D. monitoring, white balancing and inspection

Answer 34

A

Question 35

35. What is the BEST means of protecting the physical devices associated with the alarm system? A. Tamper protection B. Target hardening C. Security design D. UL 2050

Answer 35

A