Chad is a security practitioner tasked with ensuring that the information on the organization’s public website is not changed by anyone outside the organization.This task is an example of ensuring _. (D1, L1.1.1)

Which of the following is an example of a “something you know” authentication factor? (D1, L1.1.1)

Which of the following is an example of a “something you are” authentication factor? (D1, L1.1.1)

A system that collects transactional information and stores it in a record in order to show which users performed which actions is an example of providing _. (D1,L1.1.1)

The European Union (EU) law that grants legal protections to individual human privacy is. (D1, L1.1.1)

For which of the following systems would the security concept of availability probably be most important? (D1, L1.1.1)

For which of the following assets is integrity probably the most important security aspect? (D1, L1.1.1)

In risk management concepts, a(n) is something a security practitioner might need to protect. (D1, L1.2.1)

In risk management concepts, a(n) is something or someone that poses risk to an organization or asset. (D1, L1.2.1)

Of the following, which would probably not be considered a threat? (D1, L1.2.1)

Which of the following probably poses the most risk? (D1, L1.2.1)

Within the organization, who can identify risk? (D1, L1.2.2)

Kerpak works in the security office of a medium-sized entertainment company. Kerpak is asked to assess a particular threat, and he suggests that the best way to counter this threat would be to purchase and implement a particular security solution. This is an example of _. (D1, L1.2.2)

Sophia is visiting Las Vegas and decides to put a bet on a particular number on a roulette wheel. This is an example of _. (D1, L1.2.2)

Phrenal is selling a used laptop in an online auction. Phrenal has estimated the value of the laptop to be $100, but has seen other laptops of similar type and quality sell for both more and less than that amount. Phrenal hopes that the laptop will sell for $100 or more, but is prepared to take less for it if nobody bids that amount. This is an example of ___________. (D1, L1.2.2)

A software firewall is an application that runs on a device and prevents specific types of traffic from entering that device. This is a type of control. (D1, L1.3.1)

Preenka works at an airport. There are red lines painted on the ground next to the runway; Preenka has been instructed that nobody can step or drive across a red line unless they request, and get specific permission from, the control tower. This is an example of a(n)______ control. (D1, L1.3.1)

A bollard is a post set securely in the ground in order to prevent a vehicle from entering an area or driving past a certain point. Bollards are an example of ______ controls. (D1, L1.3.1)

Jengi is setting up security for a home network. Jengi decides to configure MAC address filtering on the router, so that only specific devices will be allowed to join the network. This is an example of a(n)_______ control. (D1, L1.3.1)

Druna is a security practitioner tasked with ensuring that laptops are not stolen from the organization’s offices. Which sort of security control would probably be best for this purpose? (D1, L1.3.1)

Triffid Corporation has a rule that all employees working with sensitive hardcopy documents must put the documents into a safe at the end of the workday, where they are locked up until the following workday. What kind of control is the process of putting the documents into the safe? (D1, L1.3.1)

Triffid Corporation has a policy that all employees must receive security awareness instruction before using email; the company wants to make employees aware of potential phishing attempts that the employees might receive via email. What kind of control is this instruction? (D1, L1.3.1)

The city of Grampon wants to know where all its public vehicles (garbage trucks, police cars, etc.) are at all times, so the city has GPS transmitters installed in all the vehicles. What kind of control is this? (D1, L1.3.1)

(ISC)2 publishes a Common Body of Knowledge (CBK) that IT security practitioners should be familiar with; this is recognized throughout the industry as a set of material that is useful for practitioners to refer to. Certifications can be issued for demonstrating expertise in this Common Body of Knowledge. What kind of document is the Common Body of Knowledge? (D1, L1.4.1)

The city of Grampon wants to ensure that all of its citizens are protected from malware, so the city council creates a rule that anyone caught creating and launching malware within the city limits will receive a fine and go to jail. What kind of rule is this? (D1, L1.4.1)

The Triffid Corporation publishes a strategic overview of the company’s intent to secure all the data the company possesses. This document is signed by Triffid senior management. What kind of document is this? (D1, L1.4.1)

The Triffid Corporation publishes a policy that states all personnel will act in a manner that protects health and human safety. The security office is tasked with writing a detailed set of processes on how employees should wear protective gear such as hardhats and gloves when in hazardous areas. This detailed set of processes is a _________. (D1, L1.4.1)

Grampon municipal code requires that all companies that operate within city limits will have a set of processes to ensure employees are safe while working with hazardous materials. Triffid Corporation creates a checklist of activities employees must follow while working with hazardous materials inside Grampon city limits. The municipal code is a ______, and the Triffid checklist is a _. (D1, L1.4.2)

The senior leadership of Triffid Corporation decides that the best way to minimize liability for the company is to demonstrate the company’s commitment to adopting best practices recognized throughout the industry. Triffid management issues a document that explains that Triffid will follow the best practices published by SANS, an industry body that addresses computer and information security. The Triffid document is a ______, and the SANS documents are ________. (D1, L1.4.2)

A vendor sells a particular operating system (OS). In order to deploy the OS securely on different platforms, the vendor publishes several sets of instructions on how to install it, depending on which platform the customer is using. This is an example of ________. (D1, L1.4.2)

The Payment Card Industry (PCI) Council is a committee made up of representatives from major credit card providers (Visa, Mastercard, American Express) in the United States. The PCI Council issues rules that merchants must follow if the merchants choose to accept payment via credit card. These rules describe best practices for securing credit card processing technology, activities for securing credit card information, and how to protect customers’ personal data. This set of rules is a _.(D1, L1.4.2)

Hoshi is an (ISC)2 member who works for the Triffid Corporation as a data manager. Triffid needs a new firewall solution, and Hoshi is asked to recommend a product for Triffid to acquire and implement. Hoshi’s cousin works for a firewall vendor; that vendor happens to make the best firewall available. What should Hoshi do? (D1, L1.5.1)

Siobhan is an (ISC)2 member who works for Triffid Corporation as a security analyst. Yesterday, Siobhan got a parking ticket while shopping after work. What should Siobhan do? (D1, L1.5.1)

Zarma is an (ISC)2 member and a security analyst for Triffid Corporation. One of Zarma’s colleagues is interested in getting an (ISC)2 certification and asks Zarma what the test questions are like. What should Zarma do? (D1, L1.5.1)

At Parvi’s place of work, the perimeter of the property is surrounded by a fence; there is a gate with a guard at the entrance. All inner doors only admit personnel with badges, and cameras monitor the hallways. Sensitive data and media are kept in safes when not in use. (D3, L3.1.1) This is an example of:

Gelbi is a Technical Support analyst for Triffid, Inc. Gelbi sometimes is required to install or remove software. Which of the following could be used to describe Gelbi’s account? (D3, L3.1.1)

Trina is a security practitioner at Triffid, Inc. Trina has been tasked with selecting a new product to serve as a security control in the environment. After doing some research, Trina selects a particular product. Before that product can be purchased, a manager must review Trina’s selection and determine whether to approve the purchase. This is a description of: (D3, L3.1.1)

Guillermo logs onto a system and open a document file. In this example, Guillermo is: (D3, L3.1.1)

Which of the following is not an appropriate control to add to privileged accounts? (D3, L3.1.1)

Which of the following roles does not typically require privileged account access? (D3, L3.1.1)

Prachi works as a database administrator for Triffid, Inc. Prachi is allowed to add or delete users, but is not allowed to read or modify the data in the database itself. When Prachi logs onto the system, an access control list (ACL) checks to determine which permissions Prachi has. In this situation, what is the ACL? (D3, L3.1.1)

Prachi works as a database administrator for Triffid, Inc. Prachi is allowed to add or delete users, but is not allowed to read or modify the data in the database itself. When Prachi logs onto the system, an access control list (ACL) checks to determine which permissions Prachi has. In this situation, what is the database? (D3, L3.1.1)

Prachi works as a database administrator for Triffid, Inc. Prachi is allowed to add or delete users, but is not allowed to read or modify the data in the database itself. When Prachi logs onto the system, an access control list (ACL) checks to determine which permissions Prachi has. this situation, what is Prachi? (D3, L3.1.1)

Prachi works as a database administrator for Triffid, Inc. Prachi is allowed to add or delete users, but is not allowed to read or modify the data in the database itself. When Prachis logs onto the system, an access control list (ACL) checks to determine which permissions Prachi has. Which security concept is being applied in this situation? (D3, L3.1.1)

Larry and Fern both work in the data center. In order to enter the data center to begin their workday, they must both present their own keys (which are different) to the key reader, before the door to the data center opens. Which security concept is being applied in this situation? (D3, L3.1.1)

Which of these is an example of a physical access control mechanism? (D3, L3.2.1)

Which of the following is a biometric access control mechanism? (D3, L3.2.1)

Which of the following is probably most useful at the perimeter of a property? (D3, L3.2.1)

Visitors to a secure facility need to be controlled. Controls useful for managing visitors include all of the following except: (D3, L3.2.1)

All visitors to a secure facility should be _. (D3, L3.2.1)

In order for a biometric security to function properly, an authorized person’s physiological data must be ______. (D3, L3.2.1)

All of the following are typically perceived as drawbacks to biometric systems, except: (D3, L3.2.1)

A human guard monitoring a hidden camera could be considered a _______ control. (D3, L3.2.1)

Which of the following will have the most impact on determining the duration of log retention? (D3, L3.2.1)

A _____ is a record of something that has occurred. (D3, L3.2.1)

Network traffic originating from outside the organization might be admitted to the internal IT environment or blocked at the perimeter by a ________. (D3, L3.2.1)

Bruce is the branch manager of a bank. Bruce wants to determine which personnel at the branch can get access to systems, and under which conditions they can get access. Which access control methodology would allow Bruce to make this determination? (D)

Tekila works for a government agency. All data in the agency is assigned a particular sensitivity level, called a “classification.” Every person in the agency is assigned a “clearance” level, which determines the classification of data each person can access. What is the access control model being implemented in Tekila’s agency? (D)

Which of the following would be considered a logical access control? (D)

Trina and Doug both work at Triffid, Inc. Doug is having trouble logging into the network. Trina offers to log in for Doug, using Trina’s credentials, so that Doug can get some work done. What is the problem with this? (D)

Gary is unable to log in to the production environment. Gary tries three times and is then locked out of trying again for one hour. Why? (D)

Suvid works at Triffid, Inc. When Suvid attempts to log in to the production environment, a message appears stating that Suvid has to reset the password. What may have occurred to cause this? (D)

Which of the following statements is true? (D)

Prina is a database manager. Prina is allowed to add new users to the database, remove current users, and create new usage functions for the users. Prina is not allowed to read the data in the fields of the database itself. This is an example of: (D)