Page : 1/16
1. Which of the following is a benefit of using a centralized identity and access management (IAM) system?
2. What is the purpose of an information retention policy?
3. What is the main advantage of using a Next-Generation Firewall (NGFW) over a traditional firewall?
4. What is the main goal of performing a security control assessment (SCA)?
5. Which of the following scenarios is an example of a Man-in-the-Middle (MitM) attack?
6. In the context of Public Key Infrastructure (PKI), what role does a Certificate Authority (CA) play?
7. What is an example of an attribute-based access control (ABAC) system?
8. How can false positives impact the effectiveness of security assessments?
9. Which software development model involves iterative cycles of development and risk analysis?
10. Which of the following is a primary security concern with virtualization technology?
Page : 2/16
11. What is the purpose of a baseline in the context of security assessments?
12. What is the PRIMARY purpose of risk management in information security?
13. Which type of access control model is based on the classification of data and clearance levels of users?
14. Which type of attack is characterized by an attacker intercepting and potentially altering communication between two parties who believe they are directly communicating with each other?
15. Which of the following controls would best help prevent collusion between employees in a critical process?
16. Which of the following best describes the purpose of asset inventory management?
17. What does the concept of "Fail Secure" entail in security systems?
18. A company is planning to expand its operations internationally and is concerned about the varied data protection laws in different countries. What is the most effective strategy for managing these legal and regulatory compliance risks?
19. Which of the following best exemplifies the principle of Privacy by Design?
20. Jim wants to implement an access control scheme that will ensure that users cannot delegate access. He also wants to enforce access control at the operating system level. What access control mechanism best fits these requirements?
Page : 3/16
21. What is the PRIMARY purpose of implementing controls to protect intellectual property rights within an organization?
22. Which of the following BEST describes the purpose of risk analysis in an organization's security and risk management process?
23. Which of the following techniques can prevent Cross-Site Scripting (XSS) attacks?
24. Which of the following is the most effective way to prevent SQL injection attacks?
25. Which of the following best describes the concept of "data at rest" encryption?
26. NAC’s posturing capability determines if a system is sufficiently secure and compliant enough to connect to a network. This is a form of what type of access control?
27. Why is it important to document security test procedures and results?
28. What is the main focus of a security policy review?
29. What is the main focus of a red team in security testing?
30. Which of the following is the best method to mitigate time-of-check to time-of-use (TOCTOU) vulnerabilities in software?
Page : 4/16
31. In a software-defined network (SDN), which component is responsible for making centralized decisions about the flow of network traffic?
32. Which concept is essential for ensuring that a system can enforce and verify a security policy on data it processes?
33. Which of the following is a characteristic of the Biba integrity model?
34. What is the main advantage of using a Security Operations Center (SOC) in an organization?
35. Which type of testing involves evaluating the security of an application by examining its source code?
36. What is the purpose of implementing a honeypot in a network?
37. Which of the following is a key component of a continuous monitoring program?
38. Which of the following describes a warm site in disaster recovery planning?
39. What is the primary security risk associated with the use of third-party libraries in software development?
40. What is the primary function of the Secure Shell (SSH) protocol?
Page : 5/16
41. What is the primary benefit of using biometric authentication methods?
42. In asset management, what is the difference between "owners" and "custodians"?
43. Which of the following best describes an identity federation?
44. Which protocol is primarily used to synchronize time across network devices?
45. Which of the following best describes the term "Third-Party Risk"?
46. Which security assessment technique involves the examination of system configurations to identify weaknesses?
47. Which access control model is based on the job function of the user?
48. What is the main difference between qualitative and quantitative risk assessment?
49. What is a common method for securely erasing data from a solid-state drive (SSD)?
50. What is the primary security concern addressed by input validation in software applications?
Page : 6/16
51. Which of the following BEST describes the goal of a Risk Appetite Statement?
52. When Chris verifies an individual’s identity and adds a unique identifier like a user ID to an identity system, what process has occurred?
53. What is a primary security concern that can be mitigated by using secure coding practices?
54. Which of the following is true regarding secure data sanitization methods?
55. Which of the following practices is essential for preventing session hijacking in web applications?
56. What is the main difference between hashing and encryption?
57. What is the PRIMARY purpose of risk management in information security?
58. Which principle of secure design emphasizes the need for a system to continue operating correctly even when components fail?
59. In the context of risk management, what is the significance of "Risk Appetite" in determining an organization's security investment?
60. Which of the following best describes the purpose of risk management in an organization's security strategy?
Page : 7/16
61. Which of the following best describes log retention policies in security operations?
62. Which type of analysis involves reviewing application logs to identify security incidents?
63. Which type of testing evaluates the performance of a system under extreme conditions?
64. Why is it important to conduct security tests in a controlled environment?
65. Which of the following is a key security risk when using open-source software components in an application?
66. Which of the following describes "Just-In-Time (JIT) provisioning"?
67. Which of the following tools is primarily used for network scanning and vulnerability detection?
68. Which of the following is a primary purpose of implementing log retention policies in an organization?
69. Which of the following authentication factors is considered "something you have"?
70. Which group causes the most risk of fraud and computer compromises?
Page : 8/16
71. Which of the following assessments focuses on the security practices of third-party vendors?
72. What is the primary purpose of implementing QoS (Quality of Service) in a network?
73. Which of the following is the primary goal of Software Composition Analysis (SCA) in secure development?
74. Which of the following activities is typically part of the change management process in security operations?
75. In the context of identity and access management, what does the term "provisioning" refer to?
76. Which of the following describes threat modeling in secure software development?
77. Which of the following is a characteristic of the BGP (Border Gateway Protocol) that makes it susceptible to routing attacks such as prefix hijacking?
78. Which of the following technologies helps prevent ARP spoofing attacks?
79. Following a data breach that exposed sensitive customer information, what is the FIRST action an organization should take?
80. Which of the following methods is used to prevent replay attacks?
Page : 9/16
81. What is the primary purpose of employing containerization in application deployment?
82. In the context of data lifecycle management, why is it important to securely delete data once it is no longer needed?
83. Which protocol is used to dynamically assign IP addresses to devices on a network?
84. Which of the following security capabilities is most directly associated with preventing eavesdropping on network communications?
85. Which advanced network security technique involves segmenting a network into smaller, isolated sections to prevent lateral movement of threats?
86. Which of the following BEST describes the purpose of risk analysis in an organization's security and risk management process?
87. What is the primary role of an Access Control List (ACL) in an information system?
88. Which of the following is a key feature of Static Application Security Testing (SAST)?
89. Which of the following network security mechanisms uses a combination of digital certificates and asymmetric cryptography to provide secure communications over an untrusted network?
90. Which of the following scenarios exemplifies a violation of data privacy principles?
Page : 10/16
91. Which of the following is the MOST secure method for disposing of paper records containing sensitive information?
92. What security mechanism can be used to detect unauthorized changes to software and data?
93. What does the principle of "least privilege" entail in the context of asset security?
94. Which of the following best describes a "blue team" in a security testing context?
95. Which of the following best describes regression testing?
96. An employee in an organization has access to classified information. Which of the following BEST ensures that this information remains secure?
97. Which of the following is the best description of a honeypot in a network environment?
98. Which of the following technologies can be used to detect unauthorized devices on a network through passive monitoring and analysis of network traffic?
99. What type of testing focuses on evaluating an application’s response to unexpected inputs or conditions?
100. Which of the following is the best example of a security measure that can prevent Cross-Site Request Forgery (CSRF) attacks?
Page : 11/16
101. Which of the following best describes the purpose of conducting a root cause analysis after a security incident?
102. What is the main difference between qualitative and quantitative risk assessment?
103. What is the primary purpose of a Data Loss Prevention (DLP) system?
104. Which testing method uses a known list of vulnerabilities to check a system's susceptibility?
105. Which of the following is an example of a physical control for asset security?
106. Which of the following is an appropriate detective control to monitor employee behavior within an organization?
107. Your organization has identified a risk with a high impact but low likelihood. Which of the following is the MOST appropriate risk response?
108. What is the primary benefit of risk-based testing in security assessments?
109. In access control models, what is the main purpose of the "separation of duties" principle?
110. What is the main purpose of using a Public Key Infrastructure (PKI) in identity management?
Page : 12/16
111. What role does "Separation of Duties" play in information security?
112. What is a common method for implementing least privilege access control?
113. Which of the following statements about a Business Continuity Plan (BCP) is correct?
114. Which of the following best describes a Zero Trust architecture?
115. What is the function of a Certificate Authority (CA) in a Public Key Infrastructure (PKI)?
116. What type of access control model uses rules that can include the attributes of users, resources, and the environment?
117. Which of the following practices helps prevent buffer overflow attacks?
118. In the context of risk management, what is the significance of "Risk Appetite" in determining an organization's security investment?
119. What principle ensures that a user only has access to the information and resources necessary for their role?
120. Which of the following is a primary function of a load balancer in a network?
Page : 13/16
121. In the context of secure asset disposal, which of the following statements is true about the method of cryptographic erasure?
122. What is the primary security benefit of using TLS over SSL for securing network communications?
123. Which secure coding practice is the most effective in preventing race conditions in multithreaded applications?
124. Which of the following BEST describes the goal of a Risk Appetite Statement?
125. What is the most critical step to ensure the security of data when an employee leaves the organization?
126. Which group causes the most risk of fraud and computer compromises?
127. What is the purpose of remediation tracking in security assessment and testing?
128. What is the purpose of implementing nonce values in web applications?
129. Which of the following protocols supports multicast traffic in IPv6, enabling the efficient distribution of data to multiple destinations?
130. Which of the following is a characteristic of dynamic application security testing (DAST)?
Page : 14/16
131. Which of the following security controls is most effective in detecting unauthorized access to systems?
132. What is the purpose of input sanitization in secure software development?
133. A company is planning to expand its operations internationally and is concerned about the varied data protection laws in different countries. What is the most effective strategy for managing these legal and regulatory compliance risks?
134. Which of the following mechanisms is used to ensure that a user can be held accountable for their actions in an information system?
135. Which network protocol is designed to provide secure, authenticated communications for directory services, particularly in Microsoft Active Directory environments?
136. Which of the following disaster recovery strategies requires the longest time to become operational after a disaster?
137. In the context of wireless network security, what is the purpose of the 802.1X standard?
138. What is the purpose of a configuration baseline in security operations?
139. Which of the following best describes the concept of "separation of duties"?
140. What is the primary objective of implementing a Data Loss Prevention (DLP) solution in an organization?
Page : 15/16
141. What is the primary purpose of implementing a data leakage prevention (DLP) system?
142. What is the primary purpose of a Recovery Point Objective (RPO) in business continuity planning?
143. What is the primary role of fuzz testing in secure software development?
144. Which of the following activities is typically performed during the containment phase of an incident response?
145. Which of the following actions is an example of a preventive control in security operations?
146. Which of the following best describes the term "privacy by design"?
147. Which of the following measures helps protect against Cross-Site Request Forgery (CSRF) attacks?
148. What is the primary consideration when implementing encryption for data at rest?
149. Your organization has identified a risk with a high impact but low likelihood. Which of the following is the MOST appropriate risk response?
150. What is the main difference between an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS)?
Page : 16/16
151. Which of the following best describes the term "Third-Party Risk"?
152. What is the primary advantage of conducting tabletop exercises in an organization's incident response program?
153. Which of the following network topologies is most resilient to a single point of failure?
