20 If Renee receives a digitally signed message from Mike, what key does she use to verify that the message truly came from Mike?Renee's public keyRenee's private keyMike's public keyMike's private key
21 A systems administrator is setting up a new data management system. It will be gathering data from numerous locations across the network, even from remote offsite locations. The data will be moved to a centralized facility, where it will be stored on a massive RAID array. The data will be encrypted on the storage system using AES-256, and most files will be signed as well. The location of this data warehouse is secured so that only authorized personnel can enter the room and all digital access is limited to a set of security administrators. Which of the following describes the data?The data is encrypted in transit.The data is encrypted in processing.The data is redundantly stored.The data is encrypted at rest.
22 The __________ is the entity assigned specific responsibility for a data asset in order to ensure its protection for use by the organization.Data ownerData controllerData processorData custodian
23 A security auditor is seeking evidence of how sensitive documents made their way out of the organization and onto a public document distribution site. It is suspected that an insider exfiltrated the data over a network connection to an external server, but this is only a guess. Which of the following would be useful in determining whether this suspicion is accurate? (Choose two.)NACDLP alertsSyslogLog analysisMalware scanner reportsIntegrity monitoring
24 A new Wireless Application Protocol (WAP) is being installed to add wireless connectivity to the company network. The configuration policy indicates that WPA3 is to be used and thus only newer or updated endpoint devices can connect. The policy also states that ENT authentication will not be implemented. What authentication mechanism can be implemented in this situation?IEEE 802.1XIEEE 802.1qSimultaneous authentication of equals (SAE)EAP-FAST
25 When securing a mobile device, what types of authentication can be used that depend on the user's physical attributes? (Choose all that apply.)FingerprintTOTP (time-based one-time password)VoiceSMS (short message service)RetinaGaitPhone callFacial recognitionSmartcardPassword
26 A recently acquired piece of equipment is not working properly. Your organization does not have a trained repair technician on staff, so you have to bring in an outside expert. What type of account should be issued to a trusted third-party repair technician?Guest accountPrivileged accountService accountUser account
27 Security should be designed and integrated into the organization as a means to support and maintain the business objectives. However, the only way to know if the implemented security is sufficient is to test it. Which of the following is a procedure designed to test and perhaps bypass a system's security controls?Logging usage dataWar dialingPenetration testingDeploying secured desktop workstations
28 Security needs to be designed to support the business objectives, but it also needs to be legally defensible. To defend the security of an organization, a log of events and activities must be created. Auditing is a required factor to sustain and enforce what?AccountabilityConfidentialityAccessibilityRedundancy
29 Risk assessment is a process by which the assets, threats, probabilities, and likelihoods are evaluated in order to establish criticality prioritization. What is the formula used to compute the ALE?ALE = AV * EF * AROALE = ARO * EFALE = AV * AROALE = EF * ARO
30 Incident response plans, business continuity plans, and disaster recovery plans are crafted when implementing business-level redundancy. These plans are derived from the information obtained when performing a business impact assessment (BIA). What is the first step of the BIA process?Identification of prioritiesLikelihood assessmentRisk identificationResource prioritization
31 Many events can threaten the operation, existence, and stability of an organization. Some of those threats are human caused, whereas others are from natural events. Which of the following represent natural events that can pose a threat or risk to an organization?EarthquakeFloodTornadoAll of the above
32 What kind of recovery facility enables an organization to resume operations as quickly as possible, if not immediately, upon failure of the primary facility?Hot siteWarm siteCold siteAll of the above
33 During an account review, an auditor provided the following report:UserLast Login LengthLass Password ChangeBob4 hours87 daysSue3 hours38 daysJohn1 hour935 daysKesha3 hours49 daysThe security manager reviews the account policies of the organization and takes note of the following requirements:Passwords must be at least 12 characters long.Passwords must include at least one example of three different character types.Passwords must be changed every 180 days.Passwords cannot be reused.Which of the following security controls should be corrected to enforce the password policy?Minimum password lengthAccount lockoutPassword history and minimum agePassword maximum age
34 Any evidence to be used in a court proceeding must abide by the Rules of Evidence to be admissible. What type of evidence refers to written documents that are brought into court to prove a fact?Best evidenceParol evidenceDocumentary evidenceTestimonial evidence
35 DevOps manager John is concerned with the CEO's plan to minimize his department and outsource code development to a foreign programming group. John has a meeting scheduled with the board of directors to encourage them to retain code development in house due to several concerns. Which of the following should John include in his presentation? (Choose all that apply.)Code from third parties will need to be manually reviewed for function and security.If the third party goes out of business, existing code may need to be abandoned.Third-party code development is always more expensive.A software escrow agreement should be established.
36 When TLS is being used to secure web communications, what URL prefix appears in the web browser address bar to signal this fact?SHTTP://TLS://FTPS://HTTPS://
37 A new update has been released by the vendor of an important software product that is an essential element of a critical business task. The chief security officer (CSO) indicates that the new software version needs to be tested and evaluated in a virtual lab, which has a cloned simulation of many of the company's production systems. Furthermore, the results of this evaluation must be reviewed before a decision is made as to whether the software update should be installed and, if so, when to install it. What security principle is the CSO demonstrating?Business continuity planning (BCP)OnboardingChange managementStatic analysis
38 What type of token device produces new time-derived passwords on a specific time interval that can be used only a single time when attempting to authenticate?HOTPHMACSAMLTOTP
39 Your organization is moving a significant portion of their data processing from an on-premises solution to the cloud. When evaluating a cloud service provider (CSP), which of the following is the most important security concern?Data retention policyNumber of customersHardware used to support VMsWhether they offer MaaS, IDaaS, and SaaS
40 Most software vulnerabilities exist because of a lack of secure or defensive coding practices used by the developers. Which of the following is not considered a secure coding technique? (Choose all that apply.)Using immutable systemsUsing stored proceduresUsing code signingUsing server-side validationOptimizing file sizesUsing third-party software libraries
Answers to Assessment Test
1 C. Detective access controls are used to discover (and document) unwanted or unauthorized activity. Preventive access controls block the ability to perform unwanted activity. Deterrent access controls attempt to persuade the perpetrator not to perform unwanted activity. Corrective access controls restore a system to normal function in the event of a failure or system interruption.
2 D. Strong password choices are difficult to guess, unpredictable, and of specified minimum lengths to ensure that