Access to Free 2022 CISSP Certification Training Questions

1. Which of the following is the MOST important part of an awareness and training plan to prepare employees for emergency situations?

2. Between which pair of Open System Interconnection (OSI) Reference Model layers are routers used as a communications device?

3. Which one of the following affects the classification of data?

4. What security risk does the role-based access approach mitigate MOST effectively?

5. An organization publishes and periodically updates its employee policies in a file on their intranet.

Which of the following is a PRIMARY security concern?

6. Which of the following questions can be answered using user and group entitlement reporting?

7. DRAG DROP

Rank the Hypertext Transfer protocol (HTTP) authentication types shows below in order of relative strength.

Drag the authentication type on the correct positions on the right according to strength from weakest to strongest.

8. Refer to the information below to answer the question.

Desktop computers in an organization were sanitized for re-use in an equivalent security environment. The data was destroyed in accordance with organizational policy and all marking and other external indications of the sensitivity of the data that was formerly stored on the magnetic drives were removed.

Organizational policy requires the deletion of user data from Personal Digital Assistant (PDA) devices before disposal. It may not be possible to delete the user data if the device is malfunctioning.

Which destruction method below provides the BEST assurance that the data has been removed?

9. Why MUST a Kerberos server be well protected from unauthorized access?

10. DRAG DROP

Place in order, from BEST (1) to WORST (4), the following methods to reduce the risk of data remanence on magnetic media.

11. Which of the following is the BEST way to determine if a particular system is able to identify malicious software without executing it?

12. A security professional should ensure that clients support which secondary algorithm for digital signatures when a Secure Multipurpose Internet Mail Extension (S/MIME) is used?

13. In the common criteria (CC) for information technology (IT) security evaluation, increasing Evaluation Assurance Levels (EAL) results in which of the following?

14. Which of the following is the PRIMARY reason to perform regular vulnerability scanning of an organization network?

15. What is the PRIMARY reason for implementing change management?

16. Which of the following BEST represents the concept of least privilege?

17. Which one of the following operates at the session, transport, or network layer of the Open System Interconnection (OSI) model?

18. An employee receives a promotion that entities them to access higher-level functions on the company’s accounting system, as well as keeping their access to the previous system that is no longer needed or applicable.

What is the name of the process that tries to remove this excess privilege?

19. A. Obtain information security management approval.

B. Maintain the integrity of the application.

C. Obtain feedback before implementation.

D. Identify vulnerabilities.

20. Which of the following is a responsibility of a data steward?

21. A risk assessment report recommends upgrading all perimeter firewalls to mitigate a particular finding.

Which of the following BEST supports this recommendation?

22. Which of the following is an advantage of on-premise Credential Management Systems?

23. What is the PRIMARY difference between security policies and security procedures?

24. An organization has outsourced its financial transaction processing to a Cloud Service Provider (CSP) who will provide them with Software as a Service (SaaS).

If there was a data breach who is responsible for monetary losses?

25. Assume that a computer was powered off when an information security professional

arrived at a crime scene.

Which of the following actions should be performed after the crime scene is isolated?

26. Which one of the following data integrity models assumes a lattice of integrity levels?

27. Which of the following is the MOST common method of memory protection?

28. What is the MAIN goal of information security awareness and training?

29. Which security approach will BEST minimize Personally Identifiable Information (PII) loss from a data breach?

30. Which of the following is used to support the of defense in depth during development phase of a software product?

31. What is the BEST approach for maintaining ethics when a security professional is unfamiliar with the culture of a country and is asked to perform a questionable task?

32. Refer to the information below to answer the question.

An organization experiencing a negative financial impact is forced to reduce budgets and the number of Information Technology (IT) operations staff performing basic logical access security administration functions. Security processes have been tightly integrated into normal IT operations and are not separate and distinct roles.

When determining appropriate resource allocation, which of the following is MOST important to monitor?

33. Which of the following is the key requirement for test results when implementing forensic procedures?

34. Assessing a third party’s risk by counting bugs in the code may not be the best measure of an attack surface within the supply chain.

Which of the following is LEAST associated with the attack surface?

35. A Business Continuity Plan (BCP) is based on

36. Topic 8, . Software Development Security



A Java program is being developed to read a file from computer A and write it to computer B, using a third computer C. The program is not working as expected.

What is the MOST probable security feature of Java preventing the program from operating as intended?

37. Refer to the information below to answer the question.

During the investigation of a security incident, it is determined that an unauthorized individual accessed a system which hosts a database containing financial information.

If it is discovered that large quantities of information have been copied by the unauthorized individual, what attribute of the data has been compromised?

38. Which of the following is the BEST method to reduce the effectiveness of phishing attacks?

39. A Virtual Machine (VM) environment has five guest Operating Systems (OS) and provides strong isolation.

What MUST an administrator review to audit a user’s access to data files?

40. Which of the following BEST describes the standard used to exchange authorization information between different identity management systems?

41. In a Transmission Control Protocol/Internet Protocol (TCP/IP) stack, which layer is responsible for negotiating and establishing a connection with another node?

42. Which of the following is a critical factor for implementing a successful data classification program?

43. How can a security engineer maintain network separation from a secure environment while allowing remote users to work in the secure environment?

44. Which of the following is considered the PRIMARY security issue associated with encrypted e-mail messages?

45. Which of the following MUST system and database administrators be aware of and apply when configuring systems used for storing personal employee data?

46. Which of the following is the MOST important security goal when performing application interface testing?

47. Which of the following access management procedures would minimize the possibility of an organization's employees retaining access to secure werk areas after they change roles?

48. Refer to the information below to answer the question.

A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive e-mail, search the web, and use instant messaging. The organization’s Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee's access.

Which of the following solutions would have MOST likely detected the use of peer-to-peer programs when the computer was connected to the office network?

49. Which of the following is the MOST secure protocol for zremote command access to the firewall?

50. How can an attacker exploit overflow to execute arbitrary code?

51. The adoption of an enterprise-wide Business Continuity (BC) program requires which of the following?

52. DRAG DROP

Match the name of access control model with its associated restriction.

Drag each access control model to its appropriate restriction access on the right.

53. What do Capability Maturity Models (CMM) serve as a benchmark for in an organization?

54. What security management control is MOST often broken by collusion?

55. Which of the following encryption types is used in Hash Message Authentication Code (HMAC) for key distribution?

56. Which of the following is applicable to a publicly held company concerned about information handling and storage requirement specific to the financial reporting?

57. An organization has hired a security services firm to conduct a penetration test.

Which of the following will the organization provide to the tester?

58. In a High Availability (HA) environment, what is the PRIMARY goal of working with a virtual router address as the gateway to a network?

59. When implementing controls in a heterogeneous end-point network for an organization, it is critical that

60. Which of the following is a network intrusion detection technique?

61. Functional security testing is MOST critical during which phase of the system development life cycle (SDLC)?

62. Which of the following is included in the Global System for Mobile Communications (GSM) security framework?

63. Which of the following is used to support the concept of defense in depth during the development phase of a software product?

64. An organization has discovered that users are visiting unauthorized websites using anonymous proxies.

Which of the following is the BEST way to prevent future occurrences?

65. The implementation of which features of an identity management system reduces costs and administration overhead while improving audit and accountability?

66. Which of the following provides the GREATEST level of data security for a Virtual Private Network (VPN) connection?

67. A security consultant has been hired by a company to establish its vulnerability management program. The consultant is now in the deployment phase.

Which of the following tasks is part of this process?

68. Within the company, desktop clients receive Internet Protocol (IP) address over Dynamic Host Configuration Protocol (DHCP).

Which of the following represents a valid measure to help protect the network against unauthorized access?

69. As a security manger which of the following is the MOST effective practice for providing value to an organization?

70. Which of the following findings would MOST likely indicate a high risk in a vulnerability assessment report?

71. A global organization wants to implement hardware tokens as part of a multifactor authentication solution for remote access. The PRIMARY advantage of this implementation is

72. Which of the following System and Organization Controls (SOC) report types should an organization request if they require a period of time report covering security and availability for a particular system?

73. An organization is outsourcing its payroll system and is requesting to conduct a full audit on the third-party information technology (IT) systems. During the due diligence process, the third party provides previous audit report on its IT system.

Which of the following MUST be considered by the organization in order for the audit reports to be acceptable?

74. If virus infection is suspected, which of the following is the FIRST step for the user to take?

75. What determines the level of security of a combination lock?

76. DRAG DROP

Given the various means to protect physical and logical assets, match the access management area to the technology.

77. Copyright provides protection for which of the following?

78. Which of the following actions MUST be taken if a vulnerability is discovered during the maintenance stage in a System Development Life Cycle (SDLC)?

79. An input validation and exception handling vulnerability has been discovered on a critical web-based system.

Which of the following is MOST suited to quickly implement a control?

80. From a security perspective, which of the following is a best practice to configure a Domain Name Service (DNS) system?

81. Attack trees are MOST useful for which of the following?

82. Which of the following media sanitization techniques is MOST likely to be effective for an organization using public cloud services?

83. What is the process called when impact values are assigned to the security objectives for information types?

84. Which one of the following transmission media is MOST effective in preventing data interception?

85. If an attacker in a SYN flood attack uses someone else's valid host address as the source address, the system under attack will send a large number of Synchronize/Acknowledge (SYN/ACK) packets to the

86. What is the MOST effective way to determine a mission critical asset in an organization?

87. Which of the following is the PRIMARY risk associated with Extensible Markup Language (XML) applications?

88. Which of the following was developed to support multiple protocols as well as provide as well as provide login, password, and error correction capabilities?

89. The Rivest-Shamir-Adleman (RSA) algorithm is BEST suited for which of the following operations?

90. In the area of disaster planning and recovery, what strategy entails the presentation of information about the plan?

91. Topic 9, Exam Set A



Which of the following is a physical security control that protects Automated Teller Machines (ATM) from skimming?

92. Which is the MOST critical aspect of computer-generated evidence?

93. Which of the following is a common characteristic of privacy?

94. A vulnerability in which of the following components would be MOST difficult to detect?

95. The MAIN reason an organization conducts a security authorization process is to

96. Which of the following is a function of Security Assertion Markup Language (SAML)?

97. What is the MAIN reason to ensure the appropriate retention periods are enforced for data stored on electronic media?

98. What is the MAIN feature that onion routing networks offer?

99. For an organization considering two-factor authentication for secure network access, which of the following is MOST secure?

100. Which of the following is generally indicative of a replay attack when dealing with biometric authentication?

101. What is the MOST effective countermeasure to a malicious code attack against a mobile system?

102. Which of the following activities BEST identifies operational problems, security misconfigurations, and malicious attacks?

103. What is the second step in the identity and access provisioning lifecycle?

104. Which of the following could elicit a Denial of Service (DoS) attack against a credential management system?

105. What is the PRIMARY goal for using Domain Name System Security Extensions (DNSSEC) to sign records?

106. DRAG DROP

During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant.

What is the best approach for the CISO?

Below are the common phases to creating a Business Continuity/Disaster Recovery (BC/DR) plan. Drag the remaining BCDR phases to the appropriate corresponding location.

107. Which of the following is the MOST important reason for using a chain of custody from?

108. Retaining system logs for six months or longer can be valuable for what activities?

109. Which of the following provides effective management assurance for a Wireless Local Area Network (WLAN)?

110. Which of the following methods protects Personally Identifiable Information (PII) by use of a full replacement of the data element?

111. The configuration management and control task of the certification and accreditation process is incorporated in which phase of the System Development Life Cycle (SDLC)?

112. Which of the following is the primary advantage of segmenting Virtual Machines (VM) using physical networks?

113. Backup information that is critical to the organization is identified through a

114. Which of the following is a BEST practice when traveling internationally with laptops containing Personally Identifiable Information (PII)?

115. Which of the following roles has the obligation to ensure that a third party provider is capable of processing and handling data in a secure manner and meeting the standards set by the organization?

116. Which of the following techniques is effective to detect taps in fiber optic cables?

117. In order for a security policy to be effective within an organization, it MUST include

118. How does identity as a service (IDaaS) provide an easy mechanism for integrating identity service into individual applications with minimal development effort?

119. What would be the MOST cost effective solution for a Disaster Recovery (DR) site given that the organization’s systems cannot be unavailable for more than 24 hours?

120. When designing a vulnerability test, which one of the following is likely to give the BEST indication of what components currently operate on the network?

121. Which of the following countermeasures is the MOST effective in defending against a social engineering attack?

122. As a best practice, the Security Assessment Report (SAR) should include which of the following sections?

123. Which of the following actions should be taken by a security professional when a mission critical computer network attack is suspected?

124. Which of the following controls is the most for a system identified as critical in terms of data and function to the organization?

125. Mandatory Access Controls (MAC) are based on:

126. Which of the following is the MOST beneficial to review when performing an IT audit?

127. Due to system constraints, a group of system administrators must share a high-level access set of credentials.

Which of the following would be MOST appropriate to implement?

128. When should an application invoke re-authentication in addition to initial user authentication?

129. Which of the following is the BEST way to protect against structured Query language (SQL) injection?

130. What is the term commonly used to refer to a technique of authenticating one machine to another by forging packets from a trusted source?

131. Which of the following protocols will allow the encrypted transfer of content on the Internet?

132. Which of the following controls is the FIRST step in protecting privacy in an information system?

133. Which of the following is considered best practice for preventing e-mail spoofing?

134. Which of the following is the PRIMARY benefit of a formalized information classification program?

135. Which of the following Disaster Recovery (DR) sites is the MOST difficult to test?

136. Which of the following practices provides the development team with a definition of security and identification of threats in designing software?

137. Which of the following BEST describes botnets?

138. Secure Sockets Layer (SSL) encryption protects

139. When defining a set of security controls to mitigate a risk, which of the following actions MUST occur?

140. Which programming methodology allows a programmer to use pre-determined blocks of code end consequently reducing development time and programming costs?

141. According to best practice, which of the following is required when implementing third party software in a production environment?

142. Which one of the following is the MOST important in designing a biometric access system if it is essential that no one other than authorized individuals are admitted?

143. Which layer of the Open system Interconnect (OSI) model is responsible for secure data transfer between applications, flow control, and error detection and correction?

144. Which of the following is the PRIMARY reason a sniffer operating on a network is collecting packets only from its own host?

145. Which of the following is a peor entity authentication method for Point-to-Point Protocol (PPP)?

146. Which of the following management process allows ONLY those services required for users to accomplish their tasks, change default user passwords, and set servers to retrieve antivirus updates?

147. What protocol is often used between gateway hosts on the Internet?

148. In the Open System Interconnection (OSI) model, which layer is responsible for the transmission of binary data over a communications network?

149. Which type of control recognizes that a transaction amount is excessive in accordance with corporate policy?

150. Which of the following is the PRIMARY security consideration for how an organization should handle Information Technology (IT) assets?

151. A disadvantage of an application filtering firewall is that it can lead to

152. Which of the following are Systems Engineering Life Cycle (SELC) Technical Processes?

153. Which of the following MUST an organization do to effectively communicate is security strategy to all affected parties?

154. Topic 3, . Security Architecture and Engineering



Who in the organization is accountable for classification of data information assets?

155. Which of the following assessment metrics is BEST used to understand a system's vulnerability to potential exploits?

156. Which of the following BEST provides for non-repudiation od user account actions?

157. The use of private and public encryption keys is fundamental in the implementation of which of the following?

158. An organization regularly conducts its own penetration tests.

Which of the following scenarios MUST be covered for the test to be effective?

159. Which of the following is MOST critical in a contract in a contract for data disposal on a hard drive with a third party?

160. Which of the following practices provides the development of security and identification of threats in designing software?

161. While inventorying storage equipment, it is found that there are unlabeled, disconnected, and powered off devices.

Which of the following is the correct procedure for handling such equipment?

162. Which of the following is the BEST approach for a forensic examiner to obtain the greatest amount of relevant information form malicious software?

163. Which of the following entities is ultimately accountable for data remanence vulnerabilities with data replicated by a cloud service provider?

164. What is an advantage of Elliptic Curve Cryptography (ECC)?

165. Which of the following is the MOST important reason for timely installation of software patches?

166. A security professional is asked to provide a solution that restricts a bank teller to only perform a savings deposit transaction but allows a supervisor to perform corrections after the transaction.

Which of the following is the MOST effective solution?

167. Refer to the information below to answer the question.

A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive e-mail, search the web, and use instant messaging. The organization’s Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee's access.

Which of the following methods is the MOST effective way of removing the Peer-to-Peer (P2P) program from the computer?

168. The security team has been tasked with performing an interface test against a frontend external facing application and needs to verify that all input fields protect against invalid input.

Which of the following BEST assists this process?

169. Which of the following is critical for establishing an initial baseline for software components in the operation and maintenance of applications?

170. Which of the following presents the PRIMARY concern to an organization when setting up a federated single sign-on (SSO) solution with another

171. Refer to the information below to answer the question.

A security practitioner detects client-based attacks on the organization’s network. A plan will be necessary to address these concerns.

In addition to web browsers, what PRIMARY areas need to be addressed concerning mobile code used for malicious purposes?

172. An organization is designing a large enterprise-wide document repository system. They plan to have several different classification level areas with increasing levels of controls. The BEST way to ensure document confidentiality in the repository is to

173. A database administrator is asked by a high-ranking member of management to perform specific changes to the accounting system database. The administrator is specifically instructed to not track or evidence the change in a ticket.

Which of the following is the BEST course of action?

174. The application of a security patch to a product previously validate at Common Criteria (CC) Evaluation Assurance Level (EAL) 4 would

175. Which of the following activities is MOST likely to be performed during a vulnerability assessment?

176. Disaster Recovery Plan (DRP) training material should be

177. Which of the following is used by the Point-to-Point Protocol (PPP) to determine packet formats?

178. Application of which of the following Institute of Electrical and Electronics Engineers (IEEE) standards will prevent an unauthorized wireless device from being attached to a network?

179. Which of the following combinations would MOST negatively affect availability?

180. Why is planning the MOST critical phase of a Role Based Access Control (RBAC) implementation?

181. How long should the records on a project be retained?

182. Which of the following methods provides the MOST protection for user credentials?

183. Which of the following is the FIRST step during digital identity provisioning?

184. What is an important characteristic of Role Based Access Control (RBAC)?

185. Which layer of the Open systems Interconnection (OSI) model is being targeted in the event of a Synchronization (SYN) flood attack?

186. Which of the following threats exists with an implementation of digital signatures?

187. Which of the following is a detective access control mechanism?

188. Configuring a Wireless Access Point (WAP) with the same Service Set Identifier (SSID) as another WAP in order to have users unknowingly connect is referred to as which of the following?

189. What is the document that describes the measures that have been implemented or planned to correct any deficiencies noted during the assessment of the security controls?

190. Which of the following is the MOST important action regarding authentication?

191. A security analyst for a large financial institution is reviewing network traffic related to an incident. The analyst determines the traffic is irrelevant to the investigation but in the process of the review, the analyst also finds that an applications data, which included full credit card cardholder data, is transferred in clear text between the server and user’s desktop. The analyst knows this violates the Payment Card Industry Data Security Standard (PCI-DSS).

Which of the following is the analyst’s next step?

192. Why should Open Web Application Security Project (OWASP) Application Security Verification standards (ASVS) Level 1 be considered a MINIMUM level of protection for any web application?

193. Which of the following is the PRIMARY benefit of implementing data-in-use controls?

194. When a system changes significantly, who is PRIMARILY responsible for assessing the security impact?

195. What is a characteristic of Secure Socket Layer (SSL) and Transport Layer Security (TLS)?

196. When can a security program be considered effective?

197. Which of the following access control models is MOST restrictive?

198. Refer to the information below to answer the question.

In a Multilevel Security (MLS) system, the following sensitivity labels are used in increasing levels of sensitivity: restricted, confidential, secret, top secret. Table A lists the clearance levels for four users, while Table B lists the security classes of four different files.





Which of the following is true according to the star property (*property)?

199. Which of the following factors is á PRIMARY reason to drive changes in an Information Security Continuous Monitoring (ISCM) strategy?

200. When building a data center, site location and construction factors that increase the level of vulnerability to physical threats include

201. Which of the following is the PRIMARY risk with using open source software in a commercial software construction?

202. A security consultant has been asked to research an organization's legal obligations to protect privacy-related information.

What kind of reading material is MOST relevant to this project?

203. A vehicle of a private courier company that transports backup data for offsite storage was robbed while in transport backup data for offsite was robbed while in transit. The incident management team is now responsible to estimate the robbery, which of the following would help the incident management team to MOST effectively analyze the business impact of the robbery?

204. While impersonating an Information Security Officer (ISO), an attacker obtains information from company employees about their User IDs and passwords.

Which method of information gathering has the attacker used?

205. What should an auditor do when conducting a periodic audit on media retention?

206. A vulnerability test on an Information System (IS) is conducted to

207. Which security service is served by the process of encryption plaintext with the sender’s private key and decrypting cipher text with the sender’s public key?

208. For a federated identity solution, a third-party Identity Provider (IdP) is PRIMARILY responsible for which of the following?

209. Which of the following is the BEST solution to provide redundancy for telecommunications links?

210. Which of the following types of data would be MOST difficult to detect by a forensic examiner?

211. Which of the following types of business continuity tests includes assessment of resilience to internal and external risks without endangering live operations?

212. How can a forensic specialist exclude from examination a large percentage of operating system files residing on a copy of the target system?

213. What is the purpose of an Internet Protocol (IP) spoofing attack?

214. Which of the following is an accurate statement when an assessment results in the discovery of vulnerabilities in a critical network component?

215. Which of the following is the BEST reason for writing an information security policy?

216. A client has reviewed a vulnerability assessment report and has stated it is Inaccurate. The client states that the vulnerabilities listed are not valid because the host’s Operating System (OS) was not properly detected.

Where in the vulnerability assessment process did the erra MOST likely occur?

217. When network management is outsourced to third parties, which of the following is the MOST effective method of protecting critical data assets?

218. The FIRST step in building a firewall is to

219. In a basic SYN flood attack, what is the attacker attempting to achieve?

220. Which of the following will help prevent improper session handling?

221. A security professional has just completed their organization's Business Impact Analysis (BIA). Following Business Continuity Plan/Disaster Recovery Plan (BCP/DRP) best practices, what would be the professional's NEXT step?

222. The Secure Shell (SSH) version 2 protocol supports.

223. Which methodology is recommended for penetration testing to be effective in the development phase of the life-cycle process?

224. Who is ultimately responsible to ensure that information assets are categorized and adequate measures are taken to protect them?

225. What type of wireless network attack BEST describes an Electromagnetic Pulse (EMP) attack?

226. Which of the following is a benefit in implementing an enterprise Identity and Access Management (IAM) solution?

227. Which of the following is PRIMARILY adopted for ensuring the integrity of information is preserved?

228. An external attacker has compromised an organization's network security perimeter and installed a sniffer onto an inside computer.

Which of the following is the MOST effective layer of security the organization could have implemented to mitigate the attacker's ability to gain further information?

229. Which of the following is used to ensure that data mining activities Will NOT reveal sensitive data?

230. An organization implements a Remote Access Server (RAS). Once users correct to the server, digital certificates are used to authenticate their identity.

What type of Extensible Authentication Protocol (EAP) would the organization use dring this authentication?

231. Which of the following MUST be considered when developing business rules for a data loss prevention (DLP) solution?

232. Which of the following is the BEST method to prevent malware from being introduced into a production environment?

233. Which of the following does Temporal Key Integrity Protocol (TKIP) support?

234. A security professional is assessing the risk in an application and does not take into account any mitigating or compensating controls.

This type of risk rating is an example of which of the following?

235. Which of the following types of security testing is the MOST effective in providing a better indication of the everyday security challenges of an organization when performing a security risk assessment?

236. Refer to the information below to answer the question.

In a Multilevel Security (MLS) system, the following sensitivity labels are used in increasing levels of sensitivity: restricted, confidential, secret, top secret. Table A lists the clearance levels for four users, while Table B lists the security classes of four different files.





In a Bell-LaPadula system, which user cannot write to File 3?

237. Which of the following BEST describes an access control method utilizing cryptographic keys derived from a smart card private key that is embedded within mobile devices?

238. Which of the following is the PRIMARY reason for employing physical security personnel at entry points in facilities where card access is in operation?

239. Which of the following is the BEST way to verify the integrity of a software patch?

240. In an organization where Network Access Control (NAC) has been deployed, a device trying to connect to the network is being placed into an isolated domain.

What could be done on this device in order to obtain proper connectivity?

241. Which Radio Frequency Interference (RFI) phenomenon associated with bundled cable runs can create information leakage?

242. Which of the following MUST be part of a contract to support electronic discovery of data stored in a cloud environment?

243. As part of the security assessment plan, the security professional has been asked to use a negative testing strategy on a new website.

Which of the following actions would be performed?

244. As part of an application penetration testing process, session hijacking can BEST be achieved by which of the following?

245. Which of the following BEST describes a rogue Access Point (AP)?

246. During an audit, the auditor finds evidence of potentially illegal activity.

Which of the following is the MOST appropriate action to take?