Question 1

You are the security analyst working for a private company out of France. Your current assignment is to obtain credit card information from a Swiss bank owned by that company. After initial reconnaissance, you discover that the bank security defenses are very strong and would take too long to penetrate. You decide to get the information by monitoring the traffic between the bank and one of its subsidiaries in London. After monitoring some of the traffic, you see a lot of FTP packets traveling back and forth. You want to sniff the traffic and extract usernames and passwords. What tool could you use to get this information?

Accepted Answer

A)   Airsnort
B)   Snort
C)   Ettercap
D)   RaidSniff C

Question 2

Which of the following best summarizes the primary goal of a security program?

Accepted Answer

A)   Provide security reporting to all levels of an organization
B)   Create effective security awareness to employees
C)   Manage risk within the organization
D)   Assure regulatory compliance C

Question 3

As a security analyst, you setup a false survey website that will require users to create a username and a strong password. You send the link to all the employees of the company. What information will you be able to gather?

Accepted Answer

A)   The IP address of the employees' computers
B)   Bank account numbers and the corresponding routing numbers
C)   The employees network usernames and passwords
D)   The MAC address of the employees' computers C

Question 4

Which of the following represents the BEST method for obtaining business unit acceptance of security controls within an organization?

Accepted Answer

A)   Allow the business units to decide which controls apply to their systems, such as the encryption of sensitive data
B)   Create separate controls for the business units based on the types of business and functions they perform
C)   Ensure business units are involved in the creation of controls and defining conditions under which they must be applied
D)   Provide the business units with control mandates and schedules of audits for compliance validation

Question 5

What is considered a grant of a property right given to an individual who discovers or invents a new machine, process, useful composition of matter or manufacture?

Accepted Answer

A)   Copyright
B)   Design patent
C)   Trademark
D)   Utility patent

Question 6

Tyler is setting up a wireless network for his business that he runs out of his home. He has followed all the directions from the ISP as well as the wireless router manual. He does not have any encryption set and the SSID is being broadcast. On his laptop, he can pick up the wireless signal for short periods of time, but then the connection drops and the signal goes away. Eventually the wireless signal shows back up, but drops intermittently. What could be Tyler issue with his home wireless network?

Accepted Answer

A)   Computers on his wired network
B)   Satellite television
C)   2.4Ghz Cordless phones
D)   CB radio

Question 7

Preparing an image drive to copy files to is the first step in Linux forensics. For this purpose, what would the following command accomplish? dcfldd if=/dev/zero of=/dev/hda bs=4096 conv=noerror, sync

Accepted Answer

A)   Fill the disk with zeros
B)   Low-level format
C)   Fill the disk with 4096 zeros
D)   Copy files from the master disk to the slave disk on the secondary IDE controller

Question 8

A small law firm located in the Midwest has possibly been breached by a computer hacker looking to obtain information on their clientele. The law firm does not have any on-site IT employees, but wants to search for evidence of the breach themselves to prevent any possible media attention. Why would this not be recommended?

Accepted Answer

A)   Searching for evidence themselves would not have any ill effects
B)   Searching could possibly crash the machine or device
C)   Searching creates cache files, which would hinder the investigation
D)   Searching can change date/time stamps

Question 9

What oversight should the information security team have in the change management process for application security?

Accepted Answer

A)   Information security should be informed of changes to applications only
B)   Development team should tell the information security team about any application security flaws
C)   Information security should be aware of any significant application security changes and work with developer to test for vulnerabilities before changes are deployed in production
D)   Information security should be aware of all application changes and work with developers before changes are deployed in production

Question 10

A newly appointed security officer finds data leakage software licenses that had never been used. The officer decides to implement a project to ensure it gets installed, but the project gets a great deal of resistance across the organization. Which of the following represents the MOST likely reason for this situation?

Accepted Answer

A)   The software license expiration is probably out of synchronization with other software licenses  
B)   The project was initiated without an effort to get support from impacted business units in the organization
C)   The software is out of date and does not provide for a scalable solution across the enterprise
D)   The security officer should allow time for the organization to get accustomed to her presence before initiating security projects

Question 11

How many times can data be written to a DVD+R disk?

Accepted Answer

A)   Twice
B)   Once
C)   Zero
D)   Infinite

Question 12

What feature of Decryption Collection allows an investigator to crack a password as quickly as possible?

Accepted Answer

A)   Cracks every password in 10 minutes
B)   Distribute processing over 16 or fewer computers
C)   Support for Encrypted File System
D)   Support for MD5 hash verification

Question 13

An organization has a stated requirement to block certain traffic on networks. The implementation of controls will disrupt a manufacturing process and cause unacceptable delays, resulting in sever revenue disruptions. Which of the following is MOST likely to be responsible for accepting the risk until mitigating controls can be implemented?

Accepted Answer

A)   The CISO
B)   Audit and Compliance
C)   The CFO
D)   The business owner

Question 14

In order for a CISO to have true situational awareness there is a need to deploy technology that can give a real-time view of security events across the enterprise. Which tool selection represents the BEST choice to achieve situational awareness?

Accepted Answer

A)   Vmware, router, switch, firewall, syslog, vulnerability management system (VMS) 
B)   Intrusion Detection System (IDS) , firewall, switch, syslog
C)   Security Incident Event Management (SIEM) , IDS, router, syslog
D)   SIEM, IDS, firewall, VMS

Question 15

When a router receives an update for its routing table, what is the metric value change to that path?

Accepted Answer

A)   Increased by 2
B)   Decreased by 1
C)   Increased by 1
D)   Decreased by 2

Question 16

What type of equipment would a forensics investigator store in a StrongHold bag?

Accepted Answer

A)   PDAPDA?
B)   Backup tapes
C)   Hard drives
D)   Wireless cards

Question 17

Which of the following will be MOST helpful for getting an Information Security project that is behind schedule back on schedule?

Accepted Answer

A)   Upper management support
B)   More frequent project milestone meetings
C)   More training of staff members
D)   Involve internal audit

Question 18

Which of the following can the company implement in order to avoid this type of security issue in the future?

Accepted Answer

A)   Network based intrusion detection systems
B)   A security training program for developers
C)   A risk management process
D)   A audit management process

Question 19

A department within your company has proposed a third party vendor solution to address an urgent, critical business need. As the CISO you have been asked to accelerate screening of their security control claims. Which of the following vendor provided documents is BEST to make your decision:

Accepted Answer

A)   Vendor's client list of reputable organizations currently using their solution
B)   Vendor provided attestation of the detailed security controls from a reputable accounting firm
C)   Vendor provided reference from an existing reputable client detailing their implementation
D)   Vendor provided internal risk assessment and security control documentation

Question 20

At what layer does a cross site scripting attack occur on?

Accepted Answer

A)   Presentation
B)   Application
C)   Session
D)   Data Link

Exam 3: EC-Council Information Security Manager (E|ISM)