25

Question 1

The term “Forensic artifact” is used to describe an unintentional trace of an attacker activity that can be identified on a host or network. Forensic artifacts include information that can be extracted from (among other sources) registry keys (applies to MS Windows), event logs, timestamps, web browser search history, or files left in the system trash folder.

Answer 1

True

Question 2

Which of the following can be used to validate the origin (provenance) of digital evidence? (Select 2 answers)

Answer 2

Hashing

Checksums

Question 3

The process of searching, collecting, and securing electronic data with the intent of using it in a legal proceeding or investigation is known as:

Answer 3

** E-discovery **

E-discovery is a form of digital investigation that attempts to find evidence in email, business communications and other data that could be used in litigation or criminal proceedings. The traditional discovery process is standard during litigation, but e-discovery is specific to digital evidence.

Question 4

The term “Non-repudiation” describes the inability to deny responsibility for performing a specific action. In the context of data security, non-repudiation ensures data confidentiality, provides the proof of data integrity, and proof of data origin.

Answer 4

False

Question 5

Which of the following answers can be used to describe the category of managerial security controls? (Select 3 answers)

Answer 5

• Also known as administrative controls
• Focused on managing risk
• Documented in written policies

Question 6

Which of the following examples fall into the category of managerial security controls? (Select 3 answers)

Answer 6

• Organizational security policy
• Risk assessments
• Vulnerability assessments

Question 7

Which of the following answers can be used to describe the category of operational security controls (Select 3 answers)

Answer 7

• Focused on the day-to-day procedures of an organization
• Used to ensure that the equipment continues to work as specified
• Primarily implemented and executed by people (as opposed to systems)

Question 8

Which of the following examples fall into the category of operational security controls? (Select 3 answers)

Answer 8

• Configuration management
• Data backups
• Awareness programs

Question 9

Which of the following answers can be used to describe the category of technical security controls (Select 3 answers)

Answer 9

• Sometimes called logical security controls
• Executed by computer systems (instead of people)
• Implemented with technology

Question 10

Which of the answers listed below refer to examples of technical security controls? (Select 3 answers)

Answer 10

• Encryption protocols
• Firewall ACLs
• Authentication protocols

Question 11

What are the examples of preventive security controls? (Select 3 answers)

Answer 11

• Security guards
• System hardening
• Separation of duties

Question 12

Which of the following answers refer to examples of detective security controls (Select all that apply)

Answer 12

• Log monitoring
• Security audits
• CCTV
• IDS

Question 13

Which of the answers listed below refer to examples of corrective security controls? (Select all that apply)

Answer 13

• IPS
• Backups and system recovery
• Alternate site
• Fire suppression system

Question 14

Examples of deterrent security controls include: (Select 3 answers)

Answer 14

• Warning signs
• Lighting
• Login banners

Question 15

Which of the following answers refer to compensating security controls? (Select all that apply)

Answer 15

• Backup power system
• Sandboxing
• Temporary port blocking
• Temporary service disablement

Question 16

The purpose of PCI DSS is to provide protection for:

Answer 16

Credit cardholder data

Question 16

Which of the following examples do not fall into the category of physical security controls? (Select 3 answers)

Answer 16

• IDS/IPS
• Encryption protocols
• Firewall ACLs

Question 17

Which of the following regulates personal data privacy of the European Union (EU) citizens?

Answer 17

** GDPR **

The General Data Protection Regulation (GDPR) is the European Union’s (EU) personal data protection law that aims to protect the privacy of EU citizens

Question 18

Which of the following answers refers to a nonprofit organization focused on developing globally-recognized best practices for securing IT systems and data against cyberattacks?

Answer 18

** CIS **

The Center for Internet Security is a 501 nonprofit organization

Question 19

A mandatory IT security and risk management framework for U.S. federal government developed by NIST is known as:

Answer 19

** RMF **

The Risk Management Framework (RMF), presented in NIST SP 800-37

Question 20

Which of the following answers refers to a NIST’s voluntary framework outlining best practices for computer security?

Answer 20

** CSF **

The Cybersecurity Framework (CSF) is a set of cybersecurity best practices and recommendations from the National Institute of Standards and Technology (NIST).

Question 21

An ISO/IEC standard defining requirements for information security management systems is known as:

Answer 21

** ISO/IEC 27001 **

ISO/IEC 27001 is an international standard to manage information security

Question 22

Which of the following answers refers to an ISO/IEC standard providing code of practice for information security controls?

Answer 22

** ISO/IEC 27002 **

ISO 27002 is a compliance framework that lays down guidelines and security policies that are designed to assist any company to establish, manage, and enhance its data protection protocols

Question 23

An extension to the ISO/IEC 27001 standard that focuses on privacy data management is called:

Answer 23

** ISO/IEC 27701 **

ISO 27701 was developed to provide a standard for data privacy controls, which, when coupled with an ISMS, allows an organisation to demonstrate effective privacy data management

Question 24

Which of the following answers refers to a family of standards providing principles and guidelines for risk management?

Answer 24

The ISO 31000 Risk Management framework is an international standard that provides businesses with guidelines and principles for risk management from the International Organization for Standardization.