CISSP Exam Dumps | During an internal audit of an organizational Information Security Management System (ISMS), nonconformities

<< Prev Question Next Question >>

Question 115/737

During an internal audit of an organizational Information Security Management System (ISMS), nonconformities are identified. In which of the following management stages are nonconformities reviewed, assessed and/or corrected by the organization?

A. Planning

B. Operation

C. Assessment

D. Improvement

Question List (737q): Question 1: An organization purchased a commercial off-the-shelf (COTS) ...; Question 2: A Java program is being developed to read a file from comput...; Question 3: What are the three key benefits that application developers ...; Question 4: A company wants to outsource its document scanning operation...; Question 5: The use of private and public encryption keys is fundamental...; Question 6: What is the FIRST step that should be considered in a Data L...; Question 7: In the cybersecurity risk management of acquisition and proc...; Question 8: A large customer of a cloud Service Provider (CSP) has serve...; Question 9: Which of the following is the FIRST step in the incident res...; Question 10: Which of the following was developed to support multiple pro...; Question 11: Which of the following is the BEST way to protect against st...; Question 12: Following project initiation, which of the following items r...; Question 13: What type of risk is related to the sequences of value-addin...; Question 14: An organization discovers a significant amount of confidenti...; Question 15: In which of the following scenarios is locking server cabine...; Question 16: Which of the following is MOST important to understand after...; Question 17: Which of the following are key activities when conducting a ...; Question 18: An organization's security policy delegates to the data owne...; Question 19: A manager bought a home version of an antivirus product and ...; Question 20: What is the PRIMARY reason that a bit-level copy is more des...; Question 21: A security audit identifies a vulnerability in a current rel...; Question 22: Recovery strategies of a Disaster Recovery planning (DRIP) M...; Question 23: What PRIMARY role does a honey pot play in overall security?...; Question 24: An Internet software application requires authentication bef...; Question 25: Which of the following BEST describes the objectives of the ...; Question 26: Which of the following is the MOST important first step in p...; 1 commentQuestion 27: The Chief Information Officer (CIO) has decided that as part...; Question 28: A director within the organization has told an employee abou...; Question 29: During a routine audit of network logs, the security adminis...; Question 30: Which of the following is PRIMARILY adopted for ensuring the...; Question 31: An organization would like to implement an authorization mec...; Question 32: What industry-recognized document could be used as a baselin...; Question 33: Which of the following would present the highert annualized ...; Question 34: Which mechanism provides the BEST protection against buffer ...; Question 35: Which of the following methods of suppressing a fire is envi...; Question 36: Which of the following represents the GREATEST risk to data ...; Question 37: What is the MOST effective method for gaining unauthorized a...; Question 38: What is the FIRST action a security professional needs to ta...; Question 39: An organization has outsourced its financial transaction pro...; Question 40: A large manufacturing organization arranges to buy an indust...; Question 41: What is considered a compensating control for not having ele...; Question 42: Why is it important that senior management clearly communica...; Question 43: Which of the following is a weakness of the Data Encryption ...; Question 44: For cellular networks, how does a rogue base station take ad...; Question 45: Which of the following is the MOST effective practice in man...; Question 46: Which of the following is the MOST important consideration i...; Question 47: Which of the following technologies is the BEST measure to p...; Question 48: Which of the following authorization standards is built to h...; Question 49: Which of the following password tokens will generate a new. ...; Question 50: An organization implements Network Access Control (NAC) ay I...; Question 51: What is the MOST effective way to ensure that a cloud servic...; Question 52: A security practitioner is tasked with securing the organiza...; Question 53: What is a warn site when conducting Business continuity plan...; Question 54: An organization plans to acquire @ commercial off-the-shelf ...; Question 55: Which is the MOST critical aspect of computer-generated evid...; Question 56: Which of the following would BEST support effective testing ...; Question 57: When designing a data protection program, which of the follo...; Question 58: Which of the following does the security design process ensu...; Question 59: An information security administrator wishes to block peer-t...; Question 60: A Denial of Service (DoS) attack on a syslog server exploits...; Question 61: Which of the following terms is used for online service prov...; Question 62: Which of the following methods is MOST effective in mitigati...; Question 63: A hacker can use a lockout capability to start which of the ...; Question 64: What Service Organization Controls (SOC) report can be freel...; Question 65: Which of the following is the MAIN benefit of a comprehensiv...; Question 66: When assessing web vulnerabilities, how can navigating the d...; Question 67: Which of the following addresses requirements of security as...; Question 68: Which of the fallowing is the FIRST step in a patch manageme...; Question 69: Which of the following MUST a security professional do in or...; Question 70: What is a key component of the Common Criteria (CC) evaluati...; Question 71: Which of the following should be included a hardware retenti...; Question 72: Which of the following is true of Service Organization Contr...; Question 73: The typical output of the National Institute of Standards an...; Question 74: A facility will experience a major power failure once in 20 ...; Question 75: Mobile devices are MOST susceptible to which of the followin...; Question 76: Who in the organization is accountable for classification of...; Question 77: Which of the following actions MUST be performed when using ...; Question 78: What type of access control determines the authorization to ...; Question 79: An organization provides its employees with laptops they can...; Question 80: Which of the following is a responsibility of the informatio...; Question 81: Security categorization of a new system takes place during w...; Question 82: A firm within the defense industry has been directed to comp...; Question 83: A security analyst has been asked to participate in a threat...; Question 84: An organization is planning a penetration test that simulate...; Question 85: Which of the following would be the MOST severe impact to ac...; Question 86: Which role is primarily responsible for reviewing an analyze...; Question 87: For a victim of a security breach to prevail in a negligence...; Question 88: When securing Hypertext Markup Language (HTML) text data, wh...; Question 89: What is the BEST control to be implemented at a login page i...; Question 90: Which of the following addresses requirements of security as...; Question 91: A developer begins employment with an information technology...; Question 92: Which of the following is a term used to describe maintainin...; Question 93: If a security requirement for a given system states that una...; Question 94: Which type of access control includes a system that allows o...; Question 95: When resolving ethical conflicts, the information security p...; Question 96: Which of the following security testing strategies is BEST s...; Question 97: Which of the following MUST be done before a digital forensi...; Question 98: What BEST describes the confidentiality, integrity, availabi...; Question 99: Which of the following BEST represents the concept of least ...; Question 100: Wi-Fi Protected Access 2 (WPA2) provides users with a higher...; Question 101: An engineer notices some late collisions on a half-duplex li...; Question 102: A retail company is looking to start a development project t...; Question 103: Which of the following is generally indicative of a replay a...; Question 104: Which of the following is a standard Access Control List (AC...; Question 105: During which of the following processes is least privilege i...; Question 106: An established information technology (IT) consulting firm i...; Question 107: Which of the fallowing statements is MOST accurate regarding...; Question 108: Which part of an operating system (OS) is responsible for pr...; Question 109: What is the MOST effective method to enhance security of a s...; Question 110: A new site's gateway isn't able to farm a tunnel to the exis...; Question 111: Which of the following is the MOST effective strategy to pre...; Question 112: When collecting a raw dump of physical memory, when should t...; Question 113: An organization is formulating a strategy to provide access ...; Question 114: How does identity as a service (IDaaS) provide an easy mecha...; Question 115: During an internal audit of an organizational Information Se...; Question 116: In order to provide dual assurance in a digital signature sy...; Question 117: What is the PRIMARY reason for implementing change managemen...; Question 118: What security technique in the Software Development Life Cyc...; Question 119: Why is it important for a security officer to report directl...; Question 120: Why are packet filtering routers used in low-risk environmen...; Question 121: Which of the following is FIRST defined in a company's data ...; Question 122: Which of the following is a technique used by database manag...; Question 123: What is the PRIMARY objective of the post-incident phase of ...; Question 124: Which of the following processes is used to align security c...; Question 125: Which of the following is the BEST action while reviewing re...; Question 126: Which of the following should be performed FIRST in a Busine...; Question 127: Which of the following contributes to secure source code han...; Question 128: What Is a risk of using commercial off-the-shelf (COTS) prod...; Question 129: Which Identity and Access Management (IAM) process can be us...; Question 130: A security engineer is assigned to work with the patch and v...; Question 131: Which of the following actions should be performed immediate...; Question 132: Passive Infrared Sensors (PIR) used in a non-climate control...; Question 133: Which security architecture strategy could be applied to sec...; Question 134: Which of the following adds end-to-end security inside a Lay...; Question 135: An organization has experienced multiple distributed denial-...; Question 136: Which of the following makes smartphones particularly vulner...; Question 137: Which step of the Risk Management Framework (RMF) identifies...; Question 138: Which of the following methods provides the MOST protection ...; Question 139: Which of the following is the PRIMARY reason a sniffer opera...; Question 140: Which of the following is the MOST important information in ...; Question 141: What term is commonly used to describe hardware and software...; Question 142: Extensible Authentication Protocol-Message Digest 5 (EAP-MD5...; Question 143: What is the PRIMARY objective of an application security ass...; Question 144: Which of the following practices provides the development of...; Question 145: Who is responsible for the protection of information when it...; Question 146: Which attack defines a piece of code that is inserted into s...; Question 147: Unused space in a disk cluster is important in media analysi...; Question 148: In the Open System Interconnection (OSI) reference model, wh...; Question 149: Which of the following techniques BEST protects against unau...; Question 150: During a disruptive event, which security continuity objecti...; Question 151: A network administrator is configuring a database server and...; Question 152: Which of the following is TRUE for an organization that is u...; Question 153: Which of the following media is LEAST problematic with data ...; Question 154: A security professional should ensure that clients support w...; Question 155: Which of the following is a second optional use of Network A...; Question 156: Which of the following is MOST important when determining ap...; Question 157: The restoration priorities of a Disaster Recovery Plan (DRP)...; Question 158: Which of the following is an ethical value?...; Question 159: An Information System Security Officer (ISSO) employed by a ...; Question 160: The security team has been tasked with performing an interfa...; Question 161: A security architect is responsible for the protection of a ...; Question 162: An application developer is developing a web application tha...; Question 163: The disaster recovery (DR) process should always include...; Question 164: Which of the following s the MAIN security benefit of having...; Question 165: Which of the following would be MOST useful to reduce risk i...; Question 166: An internal audit for an organization recently identified ma...; Question 167: Which of the following techniques is MOST useful when dealin...; Question 168: A vulnerability test on an Information System (IS) is conduc...; Question 169: Which of the following is considered the FIRST step when des...; Question 170: Which security service is served by the process of encryptio...; Question 171: Limiting the processor, memory, and Input/output (I/O) capab...; Question 172: When conducting software development, what is the BEST secur...; Question 173: The configuration management and control task of the certifi...; Question 174: What is the PRIMARY advantage of using automated application...; Question 175: Backup information that is critical to the organization is i...; Question 176: Dumpster diving is a technique used in which stage of penetr...; Question 177: Why would an administrator use a Trusted platform Module (TP...; Question 178: Which of the following is the PRIMARY purpose of installing ...; Question 179: A security practitioner needs to implement a solution to ver...; Question 180: Commercial off-the-shelf (COTS) software presents which of t...; Question 181: Which Open Systems Interconnection (OSI) layer(s) BEST corre...; Question 182: A proxy firewall operates at what layer of the Open System I...; Question 183: Which testing method requires very limited or no information...; Question 184: In a dispersed network that lacks central control, which of ...; Question 185: Which of the following is a best practice in a data handling...; Question 186: Which of the following would an attacker BEST be able to acc...; Question 187: An organization wants to implement a security service that a...; Question 188: Which of the following will allow the host system to check q...; Question 189: At which stage of the System Development Life Cycle (SDLC)ar...; Question 190: When designing a new Voice over Internet Protocol (VoIP) net...; Question 191: A cloud service provider requires its customer organizations...; Question 192: What are the MAIN Information Assurance (IA) goals of Virtua...; Question 193: What protocol is often used between gateway hosts on the Int...; Question 194: Which of the following is MOST critical in a contract in a c...; Question 195: Which one of the following is an advantage of an effective r...; Question 196: Who is responsible for classifying assists in an organizatio...; Question 197: What technique used for spoofing the origin of an email can ...; Question 198: An organization decides to evaluate the security of a system...; Question 199: Which of the following is the BEST reason for the use of sec...; Question 200: A security professional should consider the protection of wh...; Question 201: When considering a VPN solution, what possible disadvantage ...; Question 202: Which of the following features is MOST effective in mitigat...; Question 203: What is the BEST approach to annual safety training?...; Question 204: What is the BEST way to encrypt web application communicatio...; Question 205: It is better to use Elliptic Curve Cryptography (ECC) instea...; Question 206: What is the PRIMARY benefit of incident reporting and comput...; Question 207: A software architect has been asked to build a platform to d...; Question 208: What are the roles within a scrum methodoligy?...; Question 209: The PRIMARY purpose of accreditation is to:...; Question 210: Prohibiting which of the following techniques is MOST helpfu...; Question 211: Which of the following describes the BEST configuration mana...; Question 212: Which of the following is part of a Trusted Platform Module ...; Question 213: Which of the following is performed to determine a measure o...; Question 214: Which of the following is the PRIMARY purpose of due diligen...; Question 215: What is the FIRST step an organization should take if it is ...; Question 216: A security engineer is tasked with implementing a new identi...; Question 217: What does a Synchronous (SYN) flood attack do?...; Question 218: What is often referred to as front door access?...; Question 219: An organization is attempting to strengthen the configuratio...; Question 220: Which of the following Is the PRIMARY role of a security arc...; Question 221: Which of the following best practices mitigates the risk of ...; Question 222: Which of the following is the PRIMARY benefit of implementin...; Question 223: Which of the following is a characteristic of a challenge/re...; Question 224: Which one of the following considerations has the LEAST impa...; Question 225: Why Is It important to have a comprehensive inventory of Inf...; Question 226: An organization has received an initial draft of a security ...; Question 227: A web developer is completing a new web application security...; Question 228: What should be used to determine the risks associated with u...; Question 229: Which of the following is a benefit of implementing data-in-...; Question 230: Which of the following value comparisons MOST accurately ref...; Question 231: In The Open System Interconnection (OSI) model, which layer ...; Question 232: An organization has been collecting a large amount of redund...; Question 233: A large international organization that collects information...; Question 234: Which type of log collection is focused on detecting and res...; Question 235: What security tenet is BEST ensured when deployment controls...; Question 236: Which of the following encryption technologies has the abili...; Question 237: Which of the following is needed to securely distribute symm...; Question 238: Which of the following is an essential requirement of a faul...; Question 239: An organization contracts with a consultant to perform a Sys...; Question 240: How can a security engineer maintain network separation from...; Question 241: A system administrator is tasked with assigning unique ident...; Question 242: Which of the following provides the BEST method to verify th...; Question 243: Which of the following is the primary security consideration...; Question 244: A corporation does not have a formal data destruction policy...; Question 245: Which of the following is the greatest weakness with attacke...; Question 246: The design of a secured physical facility starts with identi...; Question 247: Which of the following BEST describes the use of network arc...; Question 248: What is the PRIMARY role of a scrum master in agile developm...; Question 249: A vehicle of a private courier company that transports backu...; Question 250: Which of the following is a method used to prevent Structure...; Question 251: Which one of the ciphering techniques for mobile communicati...; Question 252: Organizational leadership wants to move away from compliance...; Question 253: Attack trees are MOST useful for which of the following?...; Question 254: When assessing an organization's security policy according t...; Question 255: A company seizes a mobile device suspected of being used in ...; Question 256: When writing security assessment procedures, what is the MAI...; Question 257: A company is attempting to enhance the security of its user ...; Question 258: Which of the following is the MOST likely reason a Human Res...; Question 259: An organization has detected that the contents of a static t...; Question 260: The quality assurance (QA) department is short-staffed and i...; Question 261: Which of the following contributes MOST to the effectiveness...; Question 262: Which of the following is the BEST way to protect an organiz...; Question 263: What is the MAXIMUM number of host addresses available in a ...; Question 264: The security organization is looking for a solution that cou...; Question 265: While dealing with the consequences of a security incident, ...; Question 266: Which of the following entails identification of data end li...; Question 267: What is the PRIMARY reason for criminal law being difficult ...; Question 268: Which of the following is the BEST definition of Cross-Site ...; Question 269: A malicious user gains access to unprotected directories on ...; Question 270: A project manager for a large software firm has acquired a g...; Question 271: Which of the following is a safeguard that could be used to ...; Question 272: A developer creates an application to be distributed worldwi...; Question 273: Which of the following is TRUE about Disaster Recovery Plain...; Question 274: A user has infected a computer with malware by connecting a ...; Question 275: Which of the following management process allows ONLY those ...; Question 276: In which of the following cloud services is the service prov...; Question 277: During the change management process, which of the following...; Question 278: Which of the following documents specifies services from the...; Question 279: Once the types of information have been identified, who shou...; Question 280: Which of the following is the MOST appropriate action when r...; Question 281: Which of the following MUST be done before a digital forensi...; Question 282: The application of which of the following standards would BE...; Question 283: Company A is evaluating new software to replace an in-house ...; Question 284: Of the following, which BEST provides non-repudiation with r...; Question 285: Which of the following provides for the STRONGEST protection...; Question 286: Exploitation of knowledge regarding the response time for a ...; Question 287: The security team has determined they lack the ability to mo...; Question 288: Which of the following is the BEST defense against password ...; Question 289: Under which of the following circumstances should cryptograp...; Question 290: A financial services organization has employed a security co...; Question 291: Which of the following questions will be addressed through t...; Question 292: When investigating a possible cybercrime, which of the follo...; Question 293: Which of the following is the BEST reason for writing an inf...; Question 294: Which of the following is required to verify the authenticit...; Question 295: When adopting software as a service (Saas), which security r...; Question 296: Which of the following measures is the MOST critical in orde...; Question 297: A large law firm would like to enable employees to participa...; Question 298: Which of the following criteria ensures information is prote...; Question 299: A colleague who recently left the organization asked a secur...; Question 300: An organization wants to define its physical perimeter. What...; Question 301: Which of the following is the BEST way to mitigate circumven...; Question 302: Which of the following is a security feature of Global Syste...; Question 303: An organization's retail website provides its only source of...; Question 304: What are the roles within a scrum methodology?...; Question 305: When should the software Quality Assurance (QA) team feel co...; Question 306: Which of the following is the PRIMARY reason Android devices...; Question 307: Under which of the following circumstances should Cryptograp...; Question 308: An organization would like to use Security Assertion Markup ...; Question 309: Which of the following design elements are included in Opera...; Question 310: Which of the below strategies would MOST comprehensively add...; Question 311: Which of the following is a recommended method to control re...; Question 312: What would be the BEST action to take in a situation where c...; Question 313: An organization that has achieved a Capability Maturity Mode...; Question 314: What is a use for mandatory access control (MAC)?...; Question 315: A control to protect from a Denial-of-Service (DoS) attach h...; Question 316: A security professional has been assigned to assess a web ap...; Question 317: Which of the following is the MOST important output from a m...; Question 318: Which of the following fire suppression solutions is MOST ha...; Question 319: What type of wireless network attack BEST describes an Elect...; Question 320: A post-implementation review has identified that the Voice O...; Question 321: Between which pair of Open System Interconnection (OSI) Refe...; Question 322: What is the PRIMARY purpose for an organization to conduct a...; Question 323: A security practitioner detects an Endpoint attack on the or...; Question 324: Which of the following statements BEST describes least privi...; Question 325: Which of the following is a risk matrix?...; Question 326: Identity and Access Management (IAM) tools support the use o...; Question 327: Which is MOST important when negotiating an Internet service...; Question 328: A company is preparing to migrate part of its applications t...; Question 329: Which of the following terms is used to describe original, u...; Question 330: What is the MOST effective response to a hacker who has alre...; Question 331: Which of the following BEST ensures the integrity of transac...; Question 332: To comply with industry requirements, a security assessment ...; Question 333: What is the MOST important criterion that needs to be adhere...; Question 334: Which of the following provides the best protection of data ...; Question 335: In regard to multimedia files, which Digital Rights Manageme...; Question 336: The MAIN use of Layer 2 Tunneling Protocol (L2TP) is to tunn...; Question 337: When partnering with a third-party, it is the responsibility...; Question 338: An advantage of link encryption in a communications network ...; Question 339: Which of the following activities will be MOST significant i...; Question 340: The threat modeling identifies a man-in-the-middle (MITM) ex...; Question 341: What requirement MUST be met during internal security audits...; Question 342: An organization would like to secure a trusted and untrusted...; Question 343: A financial company has decided to move its main business ap...; Question 344: employee training, risk management, and data handling proced...; Question 345: Why would a system be structured to isolate different classe...; Question 346: In an IDEAL encryption system, who has sole access to the de...; Question 347: Which of the following access control models is MOST restric...; Question 348: In what phase of the System Development Life Cycle (SDLC) sh...; Question 349: Which of the following is a correct feature of a virtual loc...; Question 350: An information security analyst observed a device on the org...; Question 351: When determining data and information asset handling, regard...; Question 352: Which of the following is the PRIMARY purpose of routinely t...; Question 353: Which of the following is an important design feature for th...; Question 354: In a quarterly system access review, an active privileged ac...; Question 355: Which of the following is the MOST effective preventative me...; Question 356: Why might a network administrator choose distributed virtual...; Question 357: Which reporting type requires a service organization to desc...; Question 358: Which of the following was the first version of the Network ...; Question 359: A new employee formally reported suspicious behavior to the ...; Question 360: Digital certificates used in Transport Layer Security (TLS) ...; Question 361: What is the MAIN benefit of change management in an applicat...; Question 362: Which of the following is the MOST effective countermeasure ...; Question 363: Which of the following is the BEST approach to mitigate all ...; Question 364: Which of the following has the responsibility of information...; Question 365: When implementing a data classification program, why is it i...; Question 366: Which of the following BEST describes a virtual circuit wher...; Question 367: Which process presents the greatest security concern while a...; Question 368: Which of the following is the PRIMARY risk with using open s...; Question 369: If a content management system (CMC) is implemented, which o...; Question 370: A criminal organization is planning an attack on a governmen...; Question 371: Which of the following is the PRIMARY reason for selecting t...; Question 372: Why is planning the MOST critical phase of a Role Based Acce...; Question 373: Which Internet Protocol Security (IPSec) mechanism, when add...; Question 374: Which of the following is considered the PRIMARY security is...; Question 375: An organization is considering partnering with a third-party...; Question 376: A company is enrolled in a hard drive reuse program where de...; Question 377: Wi-Fi Protected Access 2 (WPA2) is a security protocol desig...; Question 378: A security operations center (SOC) discovers a recently depl...; Question 379: What is the PRIMARY benefit of relying on Security Content A...; Question 380: Which is the PRIMARY mechanism for providing the workforce w...; Question 381: Which of the following is a Key Performance Indicator (KPI) ...; Question 382: Vulnerability scanners may allow for the administrator to as...; Question 383: As part of an application penetration testing process, sessi...; Question 384: A control to protect from the Denial-of-Service (DOS) attack...; Question 385: How should the retention period for an organization's social...; Question 386: A retail company suffered a ransomware attack that compromis...; Question 387: Which open standard could l large corporation deploy for aut...; Question 388: A security professional has been requested by the Board of D...; Question 389: Which of the following is the PRIMARY objective of performin...; Question 390: Which of the following is an advantage of Star Network Topol...; Question 391: A security professional should identify special regulatory o...; Question 392: At what stage of the Software Development Life Cycle (SDLC) ...; Question 393: Functional security testing is MOST critical during which ph...; Question 394: The design review for an application has been completed and ...; Question 395: Which of the following is a process in the access provisioni...; Question 396: During a Disaster Recovery (DR) simulation, it is discovered...; Question 397: Which of the following methods of suppressing a fire is envi...; Question 398: Which of the following is the LEAST secure authentication me...; Question 399: Upon commencement of an audit within an organization, which ...; Question 400: What part of an organization's strategic risk assessment MOS...; Question 401: A security consultant is asked to make recommendations for a...; Question 402: Which of the following is responsible for establishing an en...; Question 403: During examination of internet history records, the followin...; Question 404: Drag and Drop Question Match the types of e-authentication t...; Question 405: What is the BEST approach to anonymizing personally identifi...; Question 406: Computer forensics requires which of the following MAIN step...; Question 407: Which of the following is the BEST metric to obtain when gai...; Question 408: Which of the following problems is not addressed by using Op...; Question 409: An organization decides to create a team to define its new c...; Question 410: Which of the following mechanisms are PRIMARILY used to safe...; Question 411: The security architect has been assigned the responsibility ...; Question 412: Which of the following has the HIGHEST priority when designi...; Question 413: The security team is notified that a device on the network i...; Question 414: Which service management process BEST helps information tech...; Question 415: Which would result in the GREATEST import following a breach...; Question 416: Which of the following mechanisms will BEST prevent a Cross-...; Question 417: Which of the following examples is BEST to minimize the atta...; Question 418: An organization deploys a Single Sign-On (SSO) solution for ...; Question 419: Which of the following practices provides the development te...; Question 420: Which of the following is a responsibility of a data steward...; Question 421: Knowing the language in which an encrypted message was origi...; Question 422: What is the BEST way that a closed-circuit television (CCTV)...; Question 423: The Online Certificate Status Protocol (OCSP) is used to con...; Question 424: When determining who can accept the risk associated with a v...; Question 425: An employee of a retail company has been granted an extended...; Question 426: Which of the following is the BEST method to validate secure...; Question 427: Company A acquired company B in a merger. Company A immediat...; Question 428: The PRIMARY characteristic of a Distributed Denial of Servic...; Question 429: Which part of an Operating System (OS) is responsible for pr...; Question 430: Which of the following is the FINAL step when implementing a...; Question 431: Which of the following is an environmental security control ...; Question 432: Within the company, desktop clients receive Internet Protoco...; Question 433: Which of the following goals represents a modern shift in ri...; Question 434: Which of the following provides the GREATEST level of data s...; Question 435: Which of the following BEST describes the responsibilities o...; Question 436: What is a consideration when determining the potential impac...; Question 437: The adoption of an enterprise-wide business continuilty prog...; Question 438: What type of database attack would allow a customer service ...; Question 439: What is the MOST important goal of conducting security asses...; Question 440: Which of the following is key when assessing weaknesses in a...; Question 441: Which of the following is an initial consideration when deve...; Question 442: Which of the following takes place earliest in the use of Se...; Question 443: Which type of security testing is being performed when an et...; Question 444: Write Once, Read Many (WORM) data storage devices are design...; Question 445: Which of the following is the MOST challenging issue in appr...; Question 446: When network management is outsourced to third parties, whic...; Question 447: Which of the following types of datacenter architectures wil...; Question 448: Which of the following would be the BEST guideline to follow...; Question 449: Which of the following is the MOST important activity an org...; Question 450: Which is the MOST important consideration for a policy safeg...; Question 451: An organization is the victim of a major data breach just on...; Question 452: Which of the following is a remote access protocol that uses...; Question 453: A company wants to implement two-factor authentication (2FA)...; Question 454: When are security metrics MOST effective?...; Question 455: Which of the following is a MAJOR concern when there is a ne...; Question 456: When dealing with compliance with the Payment card Industry ...; Question 457: Using the cipher text and resultant clear text message to de...; Question 458: A network administrator receives complaints from users that ...; Question 459: What is the PRIMARY purpose of peer code reviews?...; Question 460: Which action is most effective for controlling risk and mini...; Question 461: A project requires the use of an authentication mechanism wh...; Question 462: A large organization's human resources and security teams ar...; Question 463: A security architect is reviewing plans for an application w...; Question 464: Which of the following describes the order in which a digita...; Question 465: What is the motivation for use of the Online Certificate Sta...; Question 466: Which of the following techniques BEST prevents buffer overf...; Question 467: Which of the following is the MOST important consideration w...; Question 468: Which of the following would BEST describe the role directly...; Question 469: How is Remote Authentication Dial-In User Service (RADIUS) a...; Question 470: Which of the following is the MOST important action regardin...; Question 471: What are facets of trustworthy software in supply chain oper...; Question 472: In Disaster Recovery (DR) and business continuity training, ...; Question 473: What is the BEST way to correlate large volumes of disparate...; Question 474: What is the most effective form of media sanitization to ens...; Question 475: Security Software Development Life Cycle (SDLC) expects appl...; Question 476: If traveling abroad and a customs official demands to examin...; Question 477: An organization's internal audit team performed a security a...; Question 478: Which role determines the impact the information has on the ...; Question 479: An auditor carrying out a compliance audit requests password...; Question 480: A company-wide penetration test result shows customers could...; Question 481: Reciprocal backup site agreements are considered to be...; Question 482: A vulnerability assessment report has been submitted to a cl...; Question 483: Why are mobile devices something difficult to investigate in...; Question 484: Which of the following security tools will ensure authorized...; Question 485: Which of the following is the MOST important consideration w...; Question 486: The core component of Role Based Access Control (RBAC) must ...; Question 487: When conducting a third-party risk assessment of a new suppl...; Question 488: Who is accountable for the information with an Information S...; Question 489: If virus infection is suspected, which of the following is t...; Question 490: Which of the following is a key responsibility for a data st...; Question 491: When implementing a secure wireless network, which of the fo...; Question 492: What determines the level of security of a combination lock?...; Question 493: In the common criteria, which of the following is a formal d...; Question 494: What steps can be taken to prepare personally identifiable i...; Question 495: Which of the following is used to support the concept of def...; Question 496: An organization is considering outsourcing applications and ...; Question 497: Which of the following is the strongest physical access cont...; Question 498: Which of the following is a strategy of grouping requirement...; Question 499: Which of the following is the BEST statement for a professio...; Question 500: A Chief Information Officer (CIO) has delegated responsibili...; Question 501: Which of the following is the FIRST step an organization's s...; Question 502: An authentication system that uses challenge and response wa...; Question 503: Which of the following techniques is known to be effective i...; Question 504: Which of the following encryption technologies is based on t...; Question 505: An application developer receives a report back from the sec...; Question 506: The Chief Information Security Officer (CISO) of a small org...; Question 507: When recovering from an outage, what is the Recovery Point O...; Question 508: What is the MOST common component of a vulnerability managem...; Question 509: What is the GREATEST challenge of an agent based patch manag...; Question 510: Which of the following BEST describes the purpose of softwar...; Question 511: A company developed a web application which is sold as a Sof...; Question 512: Recently, an unknown event has disrupted a single Layer-2 ne...; Question 513: The design of a security system to prevent potential conflic...; Question 514: What is the MOST important factor in establishing an effecti...; Question 515: Which of the following is the BEST method to gather evidence...; Question 516: A recent security audit is reporting several unsuccessful lo...; Question 517: What is the PRIMARY consideration when testing industrial co...; Question 518: While performing a security review for a new product, an inf...; Question 519: An organization outgrew its internal data center and is eval...; Question 520: Who is accountable for the information within an Information...; Question 521: Which of the following is an effective control in preventing...; Question 522: A company wants to buy a Commercial ff-The-Shelf (CTS) appli...; Question 523: Which of the following security tools monitors devices and r...; Question 524: Which of the following BEST describes centralized identity m...; Question 525: Which of the following offers the BEST security functionalit...; Question 526: After following the processes defined within the change mana...; Question 527: Which organizational department is ultimately responsible fo...; Question 528: In designing the architecture of an access control system, i...; Question 529: When can a security program be considered effective?...; Question 530: Which of the following BEST describes a cache poisoning atta...; Question 531: Which of the following types of web-based attack is happenin...; Question 532: Which of the following statements applies to Structured Quer...; Question 533: Which of the following actions MUST be taken if a vulnerabil...; Question 534: Which of the following BEST represents a defense in depth co...; Question 535: What is the MOST common cause of Remote Desktop Protocol (RD...; Question 536: Which of the following phases involves researching a target'...; Question 537: Which of the following is an example of a Time of Check/Time...; Question 538: An information security professional is performing an intern...; Question 539: Which of the following is the PRIMARY type of cryptography r...; Question 540: Which of the following is a best practice in a data handling...; Question 541: When developing an information security policy, why is it BE...; Question 542: The MAIN purpose of placing a tamper seal on a computer syst...; Question 543: Which of the following is the MAIN benefit of off-site stora...; Question 544: A user is allowed to access the file labeled "Financial Fore...; Question 545: How should an organization determine the priority of its rem...; Question 546: Which of the following is the PRIMARY security interest of t...; Question 547: While reviewing a web application-to-application connection,...; Question 548: For a given Key size, which of the following statements corr...; Question 549: Who is essential for developing effective test scenarios for...; Question 550: What is the FIRST step in risk management?...; Question 551: A security team member was selected as a member of a Change ...; Question 552: A manufacturing organization wants to establish a Federated ...; Question 553: A security architect is implementing an authentication syste...; Question 554: How does a Host Based Intrusion Detection System (HIDS) iden...; Question 555: Which of the following VPN configurations should be used to ...; Question 556: What is the MOST appropriate hierarchy of documents when imp...; Question 557: Which of the following is the MOST critical task for a foren...; Question 558: When designing a business continuity plan (BCP), what is the...; Question 559: Which of the following would an information security profess...; Question 560: What is a security concern when considering implementing sof...; Question 561: A large human resources organization wants to integrate thei...; Question 562: Which of the following is TRUE about Disaster Recovery Plan ...; Question 563: When MUST an organization's information security strategic p...; Question 564: What is a common mistake in records retention?...; Question 565: For privacy protected data, which of the following roles has...; Question 566: An external consultant has violated an organization's Accept...; Question 567: In the last 15 years a company has experienced three electri...; Question 568: Why should Open Wab Application Secuirty Project (OWASP) App...; Question 569: Which of the following is the MOST effective method of detec...; Question 570: In a High Availability (HA) environment, what is the PRIMARY...; Question 571: Utilizing a public wireless Local Area network (WLAN) to con...; Question 572: Which is the FIRST type of Business Continuity (BC) test tha...; Question 573: Which of the following is the MOST secure password technique...; Question 574: Which of the following alarm systems is recommended to detec...; Question 575: An organization discovers that its Secure File Transfer Prot...; Question 576: XYZ Textiles has just acquired a smaller competitor, AcmeTex...; Question 577: A large organization uses biometrics to allow access to its ...; Question 578: At the destination host, which of the following OSI model la...; Question 579: What is the second step in the identity and access provision...; Question 580: Information Security continuous Monitoring (ISCM) is a criti...; Question 581: When can Authorizing Officials (AO) authorize a system to op...; Question 582: Which following data backup methods provides fast recovery t...; Question 583: Information security metrics provide the GREATEST to managem...; Question 584: In a Transmission Control Protocol/Internet Protocol (TCP/IP...; Question 585: Which of the following types of physical security testing do...; Question 586: An organization has implemented a protection strategy to sec...; Question 587: What is the FIRST step in reducing the exposure of a network...; Question 588: Which of the following roles typically works with the Inform...; Question 589: Which of the following initiates the system recovery phase o...; Question 590: Which of the following command line tools can be used in the...; Question 591: Which of the following BEST describes the purpose of the ref...; Question 592: Which of the following steps should be performed FIRST when ...; Question 593: An Internet media company produces and broadcasts highly pop...; Question 594: To ensure compliance with the General Data Protection Regula...; Question 595: Which of the following is the MOST effective measure to prev...; Question 596: Drag and Drop Question Match the following generic software ...; Question 597: In a client server application, why would there be paddling ...; Question 598: A vendor released a security patch for a dangerous vulnerabi...; Question 599: Which of the following will an organization's network vulner...; Question 600: An attacker is able to remain indefinitely logged into a exp...; Question 601: All hosts on the network are sending logs via syslog-ng to t...; Question 602: Which of the following attacks can be leveraged only against...; Question 603: The organization would like to deploy an authorization mecha...; Question 604: What information will BEST assist security and financial ana...; Question 605: In which of the following system life cycle processes should...; Question 606: An organization is implementing a bring your own device (BYO...; Question 607: Which of the following is fundamentally required to address ...; Question 608: Which of the following is the BEST way to protect privileged...; Question 609: Secure coding can be developed by applying which one of the ...; Question 610: Which of the following is most helpful in applying the princ...; Question 611: While reviewing the financial reporting risks of a third-par...; Question 612: Why are mobile devices sometimes difficult to investigate in...; Question 613: What should be the FIRST action for a security administrator...; Question 614: Which of the following aspects in an asset table is the MOST...; Question 615: Which of the following statements BEST distinguishes a state...; Question 616: Drag and Drop Question Match the level of evaluation to the ...; Question 617: An organization is trying to secure instant messaging (IM) c...; Question 618: A technician wants to install a WAP in the center of a room ...; Question 619: What is the BEST method to use for assessing the security im...; Question 620: A Distributed Denial of Service (DDoS) attack was carried ou...; Question 621: When designing a Cyber-Physical System (CPS), which of the f...; Question 622: Lack of which of the following options could cause a negativ...; Question 623: When using Security Assertion markup language (SAML), it is ...; Question 624: An application developer is deciding on the amount of idle s...; Question 625: At what level of the Open System Interconnection (OSI) model...; Question 626: A security professional needs to find a secure and efficient...; Question 627: Which of the following could be considered the MOST signific...; Question 628: Which of the following attributes could be used to describe ...; Question 629: What is static analysis intended to do when analyzing an exe...; Question 630: Which one of the following BEST augments the Lightweight Dir...; Question 631: A software engineer uses automated tools to review applicati...; Question 632: An application is used for funds transfers between an organi...; Question 633: An IT technician suspects a break in one of the uplinks that...; Question 634: Which of the following services can be deployed via a cloud ...; Question 635: For network based evidence, which of the following contains ...; Question 636: Which of the following describes total evacuation time?...; Question 637: Which of the following is the PRIMARY concern when using an ...; Question 638: How does Encapsulating Security Payload (ESP) in transport m...; Question 639: Which of the following factors should be considered characte...; Question 640: Additional padding may be added to toe Encapsulating Securit...; Question 641: An information technology (IT) employee who travels frequent...; Question 642: What technology can be used to implement Single sign-On (SSO...; Question 643: When participating in a forensic investigation, who should b...; Question 644: Which of the following is an attacker MOST likely to target ...; Question 645: Security personnel should be trained by emergency management...; Question 646: Which of the following is a source to consider when assessin...; Question 647: Which of the following poses the GREATEST privacy risk to pe...; Question 648: Which of the following is the BEST approach to implement mul...; Question 649: In software development, developers should use which type of...; Question 650: When designing a vulnerability test, which one of the follow...; Question 651: Which of the following tests MUST a Security Control Assesso...; Question 652: An organization implements a Remote Access Server (RAS). Onc...; Question 653: Determining outage costs caused by a disaster can BEST be me...; Question 654: In the "Do" phase of the Plan-Do-Check-Act model, which of t...; Question 655: When transmitting information over public networks, the deci...; Question 656: Which of the following is the key requirement for test resul...; Question 657: Which of the following types of hosts should be operating in...; Question 658: Which of the following is a characteristic of convert securi...; Question 659: Which of the following is the FIRST requirement a data owner...; Question 660: What High Availability (HA) option of database allow multipl...; Question 661: Which access control method allows an entity to make certain...; Question 662: Which element of software supply chain management has the GR...; Question 663: Which of the following authorization standards is built to h...; Question 664: In fault-tolerant systems, what do rollback capabilities per...; Question 665: Which of the following is the MOST common cause of system or...; Question 666: Why is data classification control important to an organizat...; Question 667: Which of the following is critical if an empolyee is dismiss...; Question 668: Access to which of the following is required to validate web...; Question 669: What can happen when an Intrusion Detection System (IDS) is ...; Question 670: What approach in embedded systems communication allows both ...; Question 671: Which of the following is the FIRST step in data classificat...; Question 672: Which of the following BEST describes the standard used to e...; Question 673: What is the MOST efficient way to verify the integrity of da...; Question 674: A company needs to provide employee access to travel service...; Question 675: A security professional is assessing the risk in an applicat...; Question 676: Which of the following Disaster recovery (DR) testing proces...; Question 677: What BEST describes data ownership?...; Question 678: Which of the following needs to be included in order for Hig...; Question 679: Which of the following activities is MOST likely to be perfo...; Question 680: A Business Continuity Plan/Disaster Recovery Plan (BCP/DRP) ...; Question 681: Which protocol provides confidentiality, integrity and authe...; Question 682: What method could be used to prevent passive attacks against...; Question 683: Which of the following routing protocols is used to exchange...; Question 684: Which of the following global privacy legislation principles...; Question 685: For the detection of internet of things (loT) devices, a pro...; Question 686: Which of the following is the BEST method to perform an end-...; Question 687: Which one of the following describes granularity?...; Question 688: The occurrence of a stack overflow can provide an opportunit...; Question 689: Refer to the information below to answer the question. A new...; Question 690: Which of the following countermeasures is the MOST effective...; Question 691: Which of the following is a benefit in implementing an enter...; Question 692: An organization discovers that its secure file transfer prot...; Question 693: What principle requires that changes to the plaintext affect...; Question 694: When managing supply chain risks for contingent business int...; Question 695: The security architect is designing and implementing an inte...; Question 696: Which of the following is BEST suited for exchanging authent...; Question 697: Which of the following is a credible source to validate that...; Question 698: An organization adopts a new firewall hardening standard. Ho...; Question 699: Which one of the following affects the classification of dat...; Question 700: An employee's home address should be categorized according t...; Question 701: Which inherent password weakness does a One Time Password (O...; Question 702: In a DevOps environment, which of the following actions is M...; Question 703: An access control list (ACL) on a router is a feature MOST s...; Question 704: Which of the following is the FIRST step during digital iden...; Question 705: An organization is planning to establish a connection to a t...; Question 706: Which of the following describes the BEST method of maintain...; Question 707: Which Redundant Array c/ Independent Disks (RAID) Level does...; Question 708: What should be the FIRST action for a security administrator...; Question 709: In which stage of a Software Development Life Cycle (SDLC) i...; Question 710: Which of the following vulnerabilities can be BEST detected ...; Question 711: An organization has discovered that users are visiting unaut...; Question 712: Which of the following are the three MAIN categories of secu...; Question 713: How is the session key used to encrypt a Secure Multipurpose...; Question 714: A data owner determines the appropriate job-based access for...; Question 715: Which of the following methods protects Personally Identifia...; Question 716: In a multi-tenant cloud environment, what approach will secu...; Question 717: What is the HIGHEST priority in agile development?...; Question 718: Which of the following is the MOST secure protocol for zremo...; Question 719: In a data classification scheme, the data is owned by the...; Question 720: What type of investigation applies when malicious behavior i...; Question 721: A large corporation is looking for a solution to automate ac...; Question 722: Single sign-on (SSO) for federated identity management (FIM)...; Question 723: A vulnerability in which of the following components would b...; Question 724: How does security in a distributed file system using mutual ...; Question 725: Which of the following is applicable to a publicly held comp...; Question 726: Activity to baseline, tailor, and scope security controls ti...; Question 727: Which function does 802.1X provide?...; Question 728: A continuous information security monitoring program can BES...; Question 729: How can an attacker exploit overflow to execute arbitrary co...; Question 730: A security architect plans to reference a Mandatory Access C...; Question 731: An input validation and exception handling vulnerability has...; Question 732: A recent information security risk assessment identified wea...; Question 733: Which of the following presents the PRIMARY concern to an or...; Question 734: The ability to send malicious code, generally in the form of...; Question 735: A client has reviewed a vulnerability assessment report and ...; Question 736: In a disaster recovery (DR) test, which of the following wou...; Question 737: Drag and Drop Question Given a file containing ordered numbe...

Question 115/737

LEAVE A REPLY

Download PDF File