Question 1

Which of the following IT security frameworks analyzes business requirements and then creates a "chain of traceability" through the concept, design, implementation, and continual phases of the business life cycle?

Accepted Answer

A)   ISO
B)   NIST
C)   ISACA
D)   SABSA D

Question 2

In which of the following does a threat actor take advantage of web applications that accept user input without validating it before presenting it back to the user?

Accepted Answer

A)   Session hijacking
B)   Man-in-the-middle attack
C)   Cross-site scripting
D)   Privilege escalation C

Question 3

Most U.S. organizations do not use a security framework.

Accepted Answer

A) True 
 B)False  False

Question 4

In social engineering _______________, a threat actor masquerades as a real or fictitious character and then plays out the role on a victim.

Accepted Answer

The answer of In social engineering _______________, a threat actor...

Question 5

Which of the following types of controls includes multifactor authentication, firewalls, and intrusion detection systems?

Accepted Answer

A)   Administrative controls
B)   Logical controls
C)   Physical controls
D)   Online controls

Question 6

Which of the following IT security frameworks is a global non-profit association that develops practices, guidance, and benchmarks, and uses a tool called Control Objectives for Information and Related Technology (COBIT)?

Accepted Answer

A)   ISO
B)   NIST
C)   ISACA
D)   SABSA

Question 7

In which of the following does an attacker secretly relay and possibly alter communications between two parties who believe that they are directly communicating with each other?

Accepted Answer

A)   Session hijacking
B)   Man-in-the-middle attack
C)   Cross-site scripting
D)   Privilege escalation

Question 8

A(n) ________________ defines the actions users may perform while accessing devices and networks that belong to the organization.

Accepted Answer

The answer of A(n) ________________ defines the actions users may...

Question 9

Which of the following does not refer to the process of using a single authentication credential to access multiple accounts, networks, or applications?

Accepted Answer

A)   TACACS+
B)   Identity management
C)   SSO
D)   Federation

Question 10

To address security issues with directory services, many organizations are turning to what framework of business processes, policies, and technologies that facilitates the management of digital identities?

Accepted Answer

The answer of To address security issues with directory services,...

Exam 10: Security Structures and Identity and Access Management