front 1 9-1. Because it's a perimeter defense strategy, a firewall is not a critical element for cardholder data security. | back 1 B. False |
front 2 9-2. You are tasked with designing a security policy for cardholder data. Which of the following are recommended security strategies for cardholder data? | back 2 A. Verify that data is retained for a limited period of time B. Verify that data is disposed of properly C. Verify that passwords are encrypted during transmission |
front 3 9-3. Use WEP to secure communications sent over a wired network. | back 3 B. False |
front 4 9-4. Which of the following elements are typically examined during a PCI DSS Security Assessment? | back 4 A. Firewalls B. Network hardware |
front 5 9-5. When credit card transactions are handled in __________, receipts are often collected over a day or week and then sent in as multiple sets of information. | back 5 Batch processing |
front 6 9-6. PSS DSS is a set of standards designed to help organizations that process credit card payments prevent fraud by having increased control over data and its exposure. | back 6 A. True |
front 7 9-7. When credit card transactions are handled in __________, a consumer's credit card is charged immediately to complete a purchase. | back 7 Real-time processing |
front 8 9-8. You are attempting to synchronize your Web server to online timekeeping. Which of the following protocols is responsible for managing system time? | back 8 C. NTP |
front 9 9-9. Which of the following firewall considerations are recommended by the PCI Security Standards Council? | back 9 B. Block unused ports C. Use host-based firewall systems on mobile computers D. Conduct periodic reviews of firewall and router set rules |
front 10 9-10. Merchants should develop a two-factor authentication scheme to protect access to cardholder data. | back 10 A. True |
front 11 10-1. The bounce rate identifies the percentage of people who leave you site from the page they initially visited. | back 11 A. True |
front 12 10-2. You recently developed an application. In which SDLC stages would the application likely be in just prior to being released to the production environment? | back 12 A. RC1 D. Beta |
front 13 10-3. Recovery testing analyzes how an application manages the aftermath of failures and crashes. | back 13 A. True |
front 14 10-4. As a software developer, you have recently coded a security patch to a Web application. Which of the following might you do after finishing the patch? | back 14 A. Perform a regression test |
front 15 10-5. You have completed an application and now you wonder if it will work with both the Microsoft Internet Explorer and Mozilla Firefox Web browsers. Which of the following tests might you perform. | back 15 C. Compatibility test |
front 16 10-6. __________ incorporates features of black and white box testing. | back 16 Gray box testing |
front 17 10-7. Regulations are not set by organizations but by applicable laws. | back 17 A. True |
front 18 10-8. You are using a testing mechanism that looks at the input and output of an application to determine potential problems. Which mechanisms may be in use? | back 18 A. Black box testing B. White box testing C. Gray box testing |
front 19 10-9. Which of the following is often developed by first creating a risk analysis? | back 19 C. Security policies |
front 20 14-10. Which of the following professions are concerned with managing database security, such as the list of users who have access to all or part of the database? | back 20 A. Network architect |
front 21 11-1. The "percentage of vulnerabilities not found" metric is a useful way of reporting assessment data. | back 21 B. False |
front 22 11-2. How many tiers are commonly used for Web sites? | back 22 C. 3 |
front 23 11-3. The act of fixing vulnerabilities or findings resulting from an assessment is known as __________. | back 23 Remidiation |
front 24 11-4. Which of the following activities are considered parts of a Web server OS assessment? | back 24 B. Identifying the patches and updates that have been installed C. Identify the services and ports that are active |
front 25 11-5. Ping sweeps are part of what process? | back 25 B. Discovery |
front 26 11-6. Web site forms and user input fields are often attacked using cross-site scripting. | back 26 A. True |
front 27 11-7. Which section of the assessment report is intended to be a high-level briefing of the findings? | back 27 D. Executive summary |
front 28 11-8. An in-depth security assessment of a Web sever application includes performing which of the following? | back 28 C. A source code review |
front 29 11-9. SQL __________ is an attempt to manipulate a database by inserting commands into a field or URL. | back 29 Injection |
front 30 11-10. Nmap's primary features include which of the following? | back 30 B. OS fingerprinting C. Port scanning E. Ping sweeps |
front 31 11-11. What is the purpose of exploiting a vulnerability or flaw in a system to gain access to resources not otherwise available to the attacker or tester? | back 31 C. Privilege escalation |
front 32 11-12. OWASP is the organization known for developing secure application development standards and practices. | back 32 A. True |
front 33 11-13. Nessus uses thousands of __________ to identify vulnerabilities associated with services, application, and operating systems. | back 33 Plug-ins |
front 34 11-14. Which attack involves exploring the files and folders of a Web server by manipulating URLs? | back 34 D. Directory traversal attacks |
front 35 11-15. Unauthenticated scanning requires the scanner logging onto the systems being accessed. | back 35 B. False |
front 36 12-1. Which two security risks apply to IM chatting? | back 36 B. Possible data compromise C. Virus and malware |
front 37 12-2. 3G networks use packet-switching to route voice calls. | back 37 B. False |
front 38 12-3. __________ is a form of messaging used to share pictures, text pages, and ringtones. | back 38 MMS |
front 39 12-4. 4G network speeds are comparable to DSL and cable modem Internet services. | back 39 A. True |
front 40 12-5. Which of the following risks does not apply to Internet browsing? | back 40 B. Physical theft |
front 41 12-6. __________ is the threat related to voice communications and involves an unauthorized party listening in to conversations. | back 41 Eavesdropping |
front 42 12-7. The term endpoint is typically used to describe what type of device? | back 42 B. A device with server capabilities |
front 43 12-8. What is the minimum strength recommended for whole-device encryption? | back 43 D. There is no minimum |
front 44 12-9. The term __________ describes the merging of various types of devices and technologies into a common single form. | back 44 Convergence |
front 45 12-10. Which two controls provide physical security for devices? | back 45 B. Locking the device C. Remote erasure |
front 46 12-11. A hand off, or transfer of communications from on cell to another, was a significant factor regarding the mobility and popularity of cellular phones. | back 46 A. True |
front 47 12-12. Which form of communication is compatible across nearly all cellular networks and is widely considered to be the most often used communication method, by quantity, on today's phones? | back 47 A. SMS texting |
front 48 12-13. Which of these mobile risks are included among the OWASP Top 10? | back 48 A. Weak server-side controls B. Poor authorization and authentication D. Client-side injection |
front 49 12-14. The OWASP mobile security risk "Security Decisions Via Untrusted Inputs" refers to what unsecure practice? | back 49 B. Making security decisions on potentially untrusted sources |
front 50 12-15. What are two popular ways that Web sites arrange a session? | back 50 A. By creating cookies D. By creating a random string of characters in the URL or Web address |
front 51 13-1. When information is temporarily kept at one or more middle points during transmission, that technique is called __________ communication. | back 51 Store-and-forward |
front 52 13-2. Which of the following describes multiple points of presence (MPOP)? | back 52 B. Aggregating presence information from multiple applications or devices |
front 53 13-3. Phishing, social engineering, and 419 scams are some of the threats encountered when using __________. | back 53 |
front 54 13-4. Messaging or chatting on social networking sites can be considered very private and secure. | back 54 B. False |
front 55 13-5. Why are PBXs an attractive target to attackers? | back 55 A. Several services depend on the PBX's operation B. Numerous protocols are involved |
front 56 13-6. Store-and-forward communication is preferred over real-time communication in which environments? | back 56 A. When delivery is unreliable B. When the destination is not always available |
front 57 13-7. Which areas of concern are associated with SMS vulnerabilities? | back 57 B. Integrity C. Confidentiality |
front 58 13-8. SMS and MMS are primarily the same service apart from the addition of multimedia with MMS. | back 58 B. False |
front 59 13-9. Protocols such as SIP, H.323, MGCP, IP, and RTP are encountered when discussing which of the following? | back 59 C. VoIP |
front 60 13-10. This chapter discussed which issues brought on by adding VoIP devices to an organization? | back 60 A. Performance issues: significantly more network traffic B. Security issues: new attack vectors and more vulnerabilities to deal with |
front 61 13-11. A networking method of segregating VoIP traffic from data traffic is __________. | back 61 VLANs |
front 62 13-12. Select one way SIP does not assist with establishing a multimedia connection. | back 62 D. User distance |
front 63 13-13. SIP manages multimedia sessions with features similar to how the telephone system dials, rings, and manages responses from phones. | back 63 A. True |
front 64 13-14. The SIP session request and response messages are formed similarly to __________ messages. | back 64 C. HTTP |
front 65 14-1. Data typically refers to RAW unorganized facts. | back 65 A. True |
front 66 14-2. A SQL server database is an example of a relational database. | back 66 B. True |
front 67 14-3. The TOR browser is used to access which of the following? | back 67 C. Deep web |
front 68 14-4. Which of the following represents a mindset whereby programming is done with a clear understanding of current threats and how these threats potentially impact overall security? | back 68 C. Defensive programming |
front 69 14-5. Which of the following professions are concerned with the back-end development of a Web sire and will incorporate appropriate security measures from initial concept to completion? | back 69 B. Web developer |
front 70 14-6. A(n) __________ is a set of instructions understood by the computer allowing it to perform predetermined functions. | back 70 A. Program |
front 71 14-7. Which of the following professions are opensource programming languages? | back 71 B. Perl C. PHP |
front 72 14-8. __________ refers to the systems and processes used to ensure technology helps meet and organizations goals? | back 72 C. Governance |
front 73 14-9. Certification courseware and training materials are focused and directed, but degree programs often require elective courses that are not always related to the specific area of IT. | back 73 A. True |
front 74 14-10. Which of the following professions are concerned with managing database security, such as the list of users who have access to all or part of the database> | back 74 A. Network architect |
front 75 15-1. Which organization provides incident response support for the federal government? | back 75 C. US-CERT |
front 76 15-2. Which organizations investigate Internet crime? | back 76 B. IC3 C. ECTFs |
front 77 15-3. Which of the following standards are governed by NIST? | back 77 A. Advances Encryption Standard (AES) C. The United States Government Configuration Baseline |
front 78 15-4. Which of the following are (ISC)2 qualifications? | back 78 B. CISSP C. CISSP-ISSEP E. CSSLP |
front 79 15-5. You must pass an exam to become an (ISC)2 Associate. | back 79 A. True |
front 80 15-6. Which certification organization is not approved under DoD Directive 8750? | back 80 D. FLETC |
front 81 15-7. What is the purpose of open proxy honeypots in relation to Internet-based Web attacks? | back 81 A. Silently record for later analysis |
front 82 15-8. Roughly how many site reviews were used to generate the most recent WASC Web Security Report? | back 82 B. 10,000 |
front 83 15-9. ISO 17024 is the international standard for which of the following? | back 83 D. Certification programs for personal competence |
front 84 15-10. The National Institute of Standards and Technology (NIST) represents the United States in the International Standards Organization. | back 84 B. False |