Who determines the required level of independence for security control Assessors (SCA)?

A. Business owner

B. Authorizing Official (AO)

C. Chief Information Security Officer (CISC)

D. System owner

Which of the following attacks is dependent upon the compromise of a secondary target in order to reach the primary target?

A. Watering hole

B. Brute force

C. Spear phishing

D. Address Resolution Protocol (ARP) poisoning

What is the MOST important element when considering the effectiveness of a training program for Business Continuity (BC) and Disaster Recovery (DR)?

A. Management support

B. Consideration of organizational need

C. Technology used for delivery

D. Target audience

Which of the following is a disadvantage of a behavior-based ID system?

A. The activity and behavior of the users while in the networked system may not be static enough to effectively implement a behavior-based ID system.

B. The activity and behavior of the users while in the networked system may be dynamic enough to effectively implement a behavior-based ID system.

C. The activity and behavior of the users while in the networked system may not be dynamic enough to effectively implement a behavior-based ID system.

D. The system is characterized by high false negative rates where intrusions are missed.

What should an auditor do when conducting a periodic audit on media retention?

A. Check electronic storage media to ensure records are not retained past their destruction date

B. Ensure authorized personnel are in possession of paper copies containing Personally Identifiable Information (PII)

C. Check that hard disks containing backup data that are still within a retention cycle are being destroyed correctly

D. Ensure that data shared with outside organizations is no longer on a retention schedule

An organization is trying to secure instant messaging (IM) communications through its network perimeter. Which of the following is the MOST significant challenge?

A. IM clients can interoperate between multiple vendors.

B. IM clients can run without administrator privileges.

C. IM clients can utilize random port numbers.

D. IM clients can run as executable that do not require installation.

Which event magnitude is defined as deadly, destructive, and disruptive when a hazard interacts with human vulnerability?

A. Disaster

B. Catastrophe

C. Crisis

D. Accident

Which of the following BEST describes the use of network architecture in reducing corporate risks associated with mobile devices?

A. Maintaining a "closed applications model on all mobile devices depends on demilitarized 2one (DM2) servers

B. Split tunneling enabled for mobile devices improves demilitarized zone (DMZ) security posture

C. Segmentation and demilitarized zone (DMZ) monitoring are implemented to secure a virtual private network (VPN) access for mobile devices

D. Applications that manage mobile devices are located in an Internet demilitarized zone (DMZ)

When auditing the Software Development Life Cycle (SDLC) which of the following is one of the high-level audit phases?

A. Requirements

B. Risk assessment

C. Due diligence

D. Planning

An architect has observed the complexity of a new design has introduced increased risk. After review, the test team lead cannot determine how to test for some of the security controls the organization requires to be in place. Which of the following secure design principles has MOST likely been violated?

A. Complete remediation

B. Economy of mechanism

C. Psychological acceptability

D. Least privilege