In a federated identity access management solution, what task is most commonly handled by the identity provider (IdP)?

You recently performed a vulnerability assessment and found hundreds of vulnerabilities in your organization's infrastructure. It will take months to address all of these issues. What factors should you use to prioritize these vulnerabilities?

You are attempting to secure a wired network belonging to your organization. You would like to deploy technology that limits network access to authorized users. Which one of the following technologies would best meet that need?

A user connected a device to your network and, when they open their web browser, are redirected to a website advising them that they have been placed on an isolation network because their system does not meet the organization's security requirements. They are unable to access any network resources until they remediate their device to comply with the organization's security policy. What type of security solution is in use on this network?

You are working with the team developing a new web application and you would like to perform a test that evaluates whether the application is able to successfully handle malicious input that it receives through that interface. Which one of the following activities would best meet this need?

What is the primary goal of change management in an organization?

Amy's organization uses quite a bit of open source software in their custom development work and she is concerned about the security impact of that use. What program can she deploy to help track the use of this software and identify outdated components?

You are encrypting a message that you plan to send to your supervisor using asymmetric encryption. Your goal is to protect the confidentiality of the message while it is in transit. What key should you use to encrypt the message?

What is the most common standard of evidence used in a criminal investigation?

You are interviewing business leaders as part of a business impact assessment (BIA) of an enterprise resource planning (ERP) system. The goal of these conversations is to determine how long each business function can operate effectively during an incident that disrupts access to the ERP. What term describes the output of these conversations?

Francis is an identity and access management professional at a very large corporation. She is reviewing her organization's process for revoking access assigned to terminated employees. What action would BEST protect the organization against the risks associated with a terminated employee's account?

Which layer of the OSI model is primarily concerned with MAC addresses?

You are upgrading servers in your organization to use the latest version of the TLS protocol in conjunction with approved cipher suites. What type of data will this control best protect?

Carla is the security compliance officer for a large chain of retail stores. As part of her PCI DSS compliance work, Carla discovers that the organization routinely sends cardholder data to a service provider who helps detect fraudulent transactions. Under PCI DSS, what is Carla obligated to do?

In an organization's identity management (IdM) program, which one of the following technologies is commonly used as an authorization mechanism for internal users?

You are designing a back-end authentication system for your company and would like to choose an approach that allows you to implement single sign-on (SSO) and directly integrates with the Windows and Linux systems you have in place. Which one of the following technologies would best meet this need?

You are reviewing the security controls for a banking website and would like to ensure that the site is protected against man-in-the-middle (MITM) attacks. Which one of the following security controls would best protect against this type of attack?

You are evaluating possible upgrades to a physical data center used by your organization. Your primary concern is ensuring that the facility is able to continue operating during an extended power outage. What control would best meet this goal?

Which one of the following events should be considered the final deadline for discontinuing the use of an IT product or service in an organization?

You are deploying a redundant array of inexpensive disks (RAID) to improve the redundancy of your storage system. You have chosen to implement RAID level 5. What is the minimum number of disks that you must use to implement this solution?

Your organization recently signed a contract with a service provider who will be maintaining manufacturing equipment at a variety of field sites. The provider requires access to some of your internal systems in order to view and update work orders so you are establishing connectivity to your network for them. The connection will be an always-on virtual private network (VPN) between your locations. What is the most appropriate location on your network to terminate the connection?

You are deploying a virtual private network (VPN) to support remote users who will be telecommuting but require access to internal resources. Where would be the most appropriate location to place the VPN server?

Which one of the following is the best example of a security awareness activity that might be used as part of an organization's information security program?

You are responsible for managing your organization's firewall and require remote command-line access to the device. Which one of the following tools will best meet this requirement?

Please refer to the following scenario: Ben owns a coffeehouse and wants to provide wireless internet service for his customers. Ben's network is simple and uses a single consumer-grade wireless router and a cable modem connected via a commercial cable data contract.  

Ben intends to run an open (unencrypted) wireless network. How should he connect his business devices?

The organization that Ben works for has a traditional on-site Active Directory environment that uses a manual provisioning process for each addition to their 350-employee company. As the company adopts new technologies, they are increasingly using software as a service applications to replace their internally developed software stack. Ben has been tasked with designing an identity management implementation that will allow his company to use cloud services while supporting their existing systems. Using the logical diagram shown here, answer the following questions about the identity recommendations Ben should make.

If availability of authentication services is the organization's biggest priority, what type of identity platform should Ben recommend?

The organization that Ben works for has a traditional on-site Active Directory environment that uses a manual provisioning process for each addition to their 350-employee company. As the company adopts new technologies, they are increasingly using software as a service applications to replace their internally developed software stack. Ben has been tasked with designing an identity management implementation that will allow his company to use cloud services while supporting their existing systems. Using the logical diagram shown here, answer the following questions about the identity recommendations Ben should make.

If Ben needs to share identity information with the business partner shown, what should he investigate?

The organization that Ben works for has a traditional on-site Active Directory environment that uses a manual provisioning process for each addition to their 350-employee company. As the company adopts new technologies, they are increasingly using software as a service applications to replace their internally developed software stack. Ben has been tasked with designing an identity management implementation that will allow his company to use cloud services while supporting their existing systems. Using the logical diagram shown here, answer the following questions about the identity recommendations Ben should make.

What technology is likely to be involved when Ben's organization needs to provide authentication and authorization assertions to their cloud e-commerce application?

Alex has been with the university he works at for more than 10 years. During that time, he has been a system administrator and a database administrator, and he has worked in the university's help desk. He is now a manager for the team that runs the university's web applications.

Alex hires a new employee and the employee's account is provisioned after HR manually inputs information into the provisioning system based on data Alex provides via a series of forms, what type of provisioning has occurred?

During a web application vulnerability scanning test, Steve runs Nikto against a web server he believes may be vulnerable to attacks. Using the Nikto output shown here, answer the following questions.

Why does Nikto identify directory indexing as an issue?

During a web application vulnerability scanning test, Steve runs Nikto against a web server he believes may be vulnerable to attacks. Using the Nikto output shown here, answer the following questions.

Nikto lists OSVDB-877, noting that the system may be vulnerable to XST. What would this type of attack allow an attacker to do?