Chapter 1:

Muhammad Rashid Sattar (username:

[email protected])
Attempt 1
Written: Dec 1, 2022 4:36 AM - Dec 1, 2022 4:45 AM
Submission View
Your quiz has been submitted successfully.
1 / 1 point
A chief information security officer (CISO) at a large organization
documented a policy that establishes the acceptable use of cloud
environments for all staff. This is an example of a: (D1, L1.3.1)
Question options:

A) Management/Administrative control
 B) Technical control

C) Physical control

D) Cloud control

View
question
1
feedback
1 / 1 point
Is it possible to avoid risk? (D1, L1.2.1)
Question options:

A) Yes

B) No

C) Sometimes

D) Never

View
question
2
feedback
0 / 1 point
What is meant by non-repudiation?  (D1, L1.1.1)
Question options:

A) If a user does something, they can't later claim that they didn't do it.

B) Controls to protect the organization's reputation from harm due to inappropriate social media postings
time.   

C) It is part of the rules set by administrative controls. 

D) It is a security feature that prevents session replay attacks. 

View
question
3
feedback
1 / 1 point
Which of the following is NOT one of the four typical ways of managing
risk?  (D1, L1.2.1)
Question options:

A) Avoid

B) Accept

C) Mitigate

D) Conflate

View
question
4
feedback
1 / 1 point
Siobhan is deciding whether to make a purchase online; the vendor
wants Siobhan to create a new user account, and is requesting Siobhan's
full name, home address, credit card number, phone number, email
address, the ability to send marketing messages to Siobhan, and
permission to share this data with other vendors. Siobhan decides that
the item for sale is not worth the value of Siobhan's personal
information, and decides to not make the purchase.  

What kind of risk management approach did Siobhan make? (D1, L1.2.2)

Question options:

A) Avoidance

B) Acceptance

C) Mitigation
 D) Transfer

View
question
5
feedback
1 / 1 point
Guillermo is the system administrator for a midsized retail organization.
Guillermo has been tasked with writing a document that describes,
step-by-step, how to securely install the operating system on a
new laptop. This document is an example of a ________. (D1, L1.4.1)
Question options:

A) Policy

B) Standard

C) Procedure

D) Guideline

View
question
6
feedback
1 / 1 point
Lankesh is the security administrator for a small food-distribution
company. A new law is published by the country in which Lankesh's
company operates; the law conflicts with the company's policies. Which
governance element should Lankesh's company follow? (D1, L1.4.2)
Question options:

A) The law

B) The policy

C) Any procedures the company has created for the particular activities affected by the law
 D) Lankesh should be allowed to use personal and professional judgment to make the determination of ho

View
question
7
feedback
0 / 1 point
Kristal is the security administrator for a large online service provider.
Kristal learns that the company is harvesting personal data of its
customers and sharing the data with local governments where the
company operates, without the knowledge of the users, to allow the
governments to persecute users on the basis of their political and
philosophical beliefs. The published user agreement states that the
company will not share personal user data with any entities without the
users' explicit permission. 

According to the (ISC) 2 Code of Ethics, to whom does Kristal ultimately

owe a duty in this situation? (D1, L1.5.1)
Question options:

A) The governments of the countries where the company operates 

B) The company Kristal works for 

C) The users

D) (ISC)2 

View
question
8
feedback
1 / 1 point
While taking the certification exam for this certification, you notice
another candidate for the certification cheating. What should you
do? (D1, L1.5.1)
Question options:
 A) Nothing—each person is responsible for their own actions.

B) Yell at the other candidate for violating test security.

C) Report the candidate to (ISC)2. 

D) Call local law enforcement.

View
question
9
feedback
1 / 1 point
The concept of "secrecy" is most related to which foundational aspect of
security? (D1, L1.1.1)
Question options:

A) Confidentiality

B) Integrity

C) Availability

D) Plausibility

View
question
10
feedback

Congratulations, you passed the quiz!

You've achieved an overall grade of 70% or higher and completed this
activity.

80 %
Chapter 2:
Muhammad Rashid Sattar (username: [email protected]
Attempt 1
Written: Dec 1, 2022 5:21 AM - Dec 1, 2022 5:30 AM
Submission View
Your quiz has been submitted successfully.
Question 1 1 / 1 point
You are working in your organization's security office. You receive a call from
network several times with the correct credentials, with no success. This is an
Question options:

A) Emergency

B) Event

C) Policy

D) Disaster
View
question
1
feedback
Question 2 1 / 1 point
You are working in your organization's security office. You receive a call from
network several times with the correct credentials, with no success. After a br
user's account has been compromised. This is an example of a(n)_______. (D2,
Question options:

A) Risk management

B) Incident detection

C) Malware

D) Disaster

View
question
2
feedback
Question 3 1 / 1 point
An external entity has tried to gain access to your organization's IT environme
example of a(n) _________. (D2, L2.1.1)
Question options:

A) Exploit

B) Intrusion

C) Event

D) Malware

View
question
3
feedback
Question 4 0 / 1 point
When responding to a security incident, your team determines that the vulner
known to the security community, and that there are no currently known defin
databases or collections. This vulnerability and exploit might be called ______
Question options:

A) Malware

B) Critical

C) Fractal

D) Zero-day

View
question
4
feedback
Question 5 1 / 1 point
True or False? The IT department is responsible for creating the organization's
Question options:

True
False
View question 5 feedback
Question 6 0 / 1 point
The Business Continuity effort for an organization is a way to ensure critical _
disaster, emergency, or interruption to the production environment. (D2, L 2.2
Question options:

A) Business

B) Technical

C) IT

D) Financial

View
question
6
feedback
Question 7 1 / 1 point
Which of the following is very likely to be used in a disaster recovery (DR) effo
Question options:

A) Guard dogs

B) Data backups

C) Contract personnel

D) Anti-malware solutions

View
question
7
feedback
Question 8 1 / 1 point
Which of the following is often associated with DR planning? (D2, L 2.3.1)
Question options:

A) Checklists

B) Firewalls

C) Motion detectors

D) Non-repudiation

View
question
8
feedback
Question 9 0 / 1 point
Which of these activities is often associated with DR efforts? (D2, L2.3.1)
Question options:

A) Employees returning to the primary production location

 B) Running anti-malware solutions

C) Scanning the IT environment for vulnerabilities

D) Zero-day exploits

Hide question 9 feedback

Incorrect. Zero-day exploits are a security threat, but not typically associated with DR efforts.

Question 10 1 / 1 point
Which of these components is very likely to be instrumental to any disaster re
Question options:

A) Routers

B) Laptops

C) Firewalls

D) Backups

View
question
10
feedback

Congratulations, you passed the quiz!

You've achieved an overall grade of 70% or higher and completed this activity.

70 %
Chapter 3:
Muhammad Rashid Sattar (username: [email protected]
Attempt 4
Written: Dec 2, 2022 12:25 AM - Dec 2, 2022 12:26 AM
Submission View
Your quiz has been submitted successfully.
Question 1 1 / 1 point
Which of the following is a subject? (D 3, L3.1.1)
Question options:

A) A file

B) A fence

C) A filename

D) A user

View
question
1
feedback
Question 2 1 / 1 point
Lia works in the security office. During research, Lia learns that a configuratio
organization's IT environment. Lia makes a proposal for this change, but the c
approved, tested, and then cleared for deployment by the Change Control Boa
__________. (D3, L3.1.1)
Question options:

A) Defense in depth

B) Holistic security

C) Threat intelligence

D) Segregation of duties

View
question
2
feedback
Question 3 1 / 1 point
Duncan and Mira both work in the data center at Triffid, Inc. There is a policy
present in the data center at the same time; if one of them has to leave for an
until they can both re-enter. This is called ________. (D 3, L3.1.1)
Question options:

A) Blockade

B) Multifactor authentication

C) Two-person integrity

D) Defense in depth

View
question
3
feedback
Question 4 1 / 1 point
Clyde is the security analyst tasked with finding an appropriate physical contr
people will follow badged employees through the entrance of the organization
address this risk? (D3, L3.2.1) 
Question options:

A) Fences

B) Dogs

C) Bollards

D) Turnstiles

View
question
4
feedback
Question 5 1 / 1 point
Sinka is considering a physical deterrent control to dissuade unauthorized peo
property. Which of the following would serve this purpose? (D3, L3.2.1)
Question options:

A) A wall

B) Razor tape

C) A sign

D) A hidden camera

View
question
5
feedback
Question 6 1 / 1 point
Which of these combinations of physical security controls share a single point
Question options:

A) Guards and fences

B) Badge readers and walls

 C) Dogs and bollards

D) High-illumination lighting and cameras

View
question
6
feedback
Question 7 1 / 1 point
Lakshmi presents a userid and a password to a system in order to log on. Whi
the userid  have? (D3, L3.3.1) 
Question options:

A) Confidential

B) Complex

C) Unique

D) Long

View
question
7
feedback
Question 8 1 / 1 point
Lakshmi presents a userid and a password to a system in order to log on. Whi
the password have? (D3, L3.3.1) 
Question options:

A) Confidential

B) Unique

C) Mathematical

D) Shared

View
question
8
feedback
Question 9 1 / 1 point
Derrick logs on to a system in order to read a file. In this example, Derrick is t
Question options:

A) Subject

B) Object

C) Process

D) Predicate

View
question
9
feedback
Question 10 1 / 1 point
Which is a physical control that prevents "piggybacking" or "tailgating"; that is
authorized person into a controlled area? (D3, L3.2.1)
Question options:

A) Bollard

B) Turnstile

C) Fence

D) Wall

View
question
10
feedback

Congratulations, you passed the quiz!

You've achieved an overall grade of 70% or higher and completed this
activity.

100 %

Chapter 4:
Muhammad Rashid Sattar (username:
[email protected])
Attempt 2
Written: Dec 2, 2022 1:34 AM - Dec 2, 2022 1:35 AM

Submission View
Your quiz has been submitted successfully.
1 / 1 point

Common network device used to connect networks. (D4.1 L4.1.1) 

Question options:

A) Server

B) Endpoint

C) Router

D) Switch

View
question
1
feedback

1 / 1 point

A common network device used to filter traffic. (D4.1 L4.1.1) 

Question options:

A) Server

B) Endpoint

C) Ethernet

D) Firewall

View
question
2
feedback

1 / 1 point

endpoint <------> Web server  

 Which port number is associated with the protocol typically used in this
connection?  (D 4.1 L4.1.2)  
Question options:

A) 21

B) 53

C) 80

D) 161

View
question
3
feedback

1 / 1 point

An attack against the availability of a network/system; typically uses

many attacking machines to direct traffic against a given target. (D4.2
L4.2.1)
Question options:

A) Worm

B) Virus

C) Stealth

D) Distributed-denial-of-service (DDOS)

View
question
4
feedback

1 / 1 point

A security solution installed on an endpoint in order to detect potentially

anomalous activity. (D4.2 L4.2.2)
Question options:

A) Router

B) Host-based intrusion prevention system

C) Switch

D) Security incident and event management system (SIEM)

View
question
5
feedback

1 / 1 point

A security solution that detects, identifies and often quarantines

potentially hostile software. (D4.2, L4.2.2)
Question options:

A) Firewall

B) Guard

C) Camera

D) Anti-malware

View
question
6
feedback

1 / 1 point
The common term used to describe the mechanisms that control the
temperature and humidity in a data center. (D4.3 L4.3.1)
Question options:

A) VLAN (virtual local area network)

B) HVAC (heating, ventilation and air conditioning)

C) STAT (system temperature and timing)

D) TAWC (temperature and water control)

View
question
7
feedback

1 / 1 point

A cloud arrangement whereby the provider owns and manages the

hardware, operating system, and applications in the cloud, and the
customer owns the data. (D4.3 L4.3.2)
Question options:

A) Infrastructure as a service (IaaS)

B) Morphing as a service (MaaS)

C) Platform as a service (PaaS)

D) Software as a service (SaaS)

View
question
8
feedback

1 / 1 point

A portion of the organization's network that interfaces directly with the

outside world; typically, this exposed area has more security controls
and restrictions than the rest of the internal IT environment. (D4.3
L4.3.3)
Question options:

A) National Institute of Standards and Technology (NIST)

B) Demilitarized zone (DMZ)

C) Virtual private network (VPN)

D) Virtual local area network (VLAN) 

View
question
9
feedback

1 / 1 point

Which of the following tools can be used to grant remote users access
to the internal IT environment? (D 4.3 L4.3.3)
Question options:

A) VLAN (virtual local area network)

B) VPN (virtual private network)

C) DDOS (distributed denial-of-service)

D) MAC (media access control)

View
question
10
feedback

Congratulations, you passed the quiz!

You've achieved an overall grade of 70% or higher and completed this
activity.

100 %

Chapter 5:
Muhammad Rashid Sattar (username:
[email protected])
Attempt 4
Written: Dec 2, 2022 2:32 AM - Dec 2, 2022 2:33 AM

Submission View
Your quiz has been submitted successfully.
 1 / 1 point

Which of the following can be used to map data flows through an

organization and the relevant security controls used at each point along
the way? (D5.1, L5.1.1)
Question options:

A) Encryption

B) Hashing

C) Hard copy

D) Data life cycle

View
question
1
feedback

1 / 1 point

Why is an asset inventory so important? (D5.2, L5.2.1)

Question options:

A) It tells you what to encrypt

B) You can't protect what you don't know you have

C) The law requires it

D) It contains a price list

View
question
2
feedback

1 / 1 point

Who is responsible for publishing and signing the organization's

policies? (D5.3, L5.3.1)
Question options:
 A) The security office

B) Human Resources

C) Senior management

D) The legal department

View
question
3
feedback

1 / 1 point

Which of the following is always true about logging? (D5.1, L5.1.3)

Question options:

A) Logs should be very detailed

B) Logs should be in English

C) Logs should be concise

D) Logs should be stored separately from the systems they're logging

View
question
4
feedback

1 / 1 point

A mode of encryption for ensuring confidentiality efficiently, with a

minimum amount of processing overhead (D5.1, L5.1.3)
Question options:

A) Asymmetric

B) Symmetric
 C) Hashing

D) Covert

View
question
5
feedback

1 / 1 point

A ready visual cue to let anyone in contact with the data know what the
classification is. (D5.1, L5.1.1)
Question options:

A) Encryption

B) Label

C) Graphics

D) Photos

View
question
6
feedback

1 / 1 point

A set of security controls or system settings used to ensure uniformity

of configuration throughout the IT environment. (D5.2, L5.2.1)
Question options:

A) Patches

B) Inventory

C) Baseline

D) Policy
View
question
7
feedback

1 / 1 point

What is the most important aspect of security awareness/training?

(D5.4, L5.4.1)
Question options:

A) Protecting assets

B) Maximizing business capabilities

C) Ensuring the confidentiality of data

D) Protecting health and human safety

View
question
8
feedback

1 / 1 point

Which entity is most likely to be tasked with monitoring and enforcing

security policy? (D5.3, L5.3.1)
Question options:

A) The Human Resources office

B) The legal department

C) Regulators

D) The security office

View
question
9
feedback

1 / 1 point
Which organizational policy is most likely to indicate which types of
smartphones can be used to connect to the internal IT environment?
(D5.3, L5.3.1)
Question options:

A) The CM policy (change management)

B) The password policy

C) The AUP (acceptable use policy)

D) The BYOD policy (bring your own device)

View
question
10
feedback

Congratulations, you passed the quiz!

You've achieved an overall grade of 70% or higher and completed this

activity.

100 %